Security issues with electronic invoices
invoice.secvuln.info
Security issues with electronic invoices
1–10 of 67 posts
Re: Security issues with electronic invoices
#2Any reason why they wouldn’t use EDIFACT instead?
Re: Security issues with electronic invoices
#3Any reason why they wouldn’t use EDIFACT instead?
OK, it’s been a long time since I worked in this space. Seems like it’s an XML version of the INVOIC message, but is it required to support the XML syntax, or does the plain old EDI format suffice?
Re: Security issues with electronic invoices
#4Another project by Hanno Böck: https://youtube.com/@decarbonizeeverything?si=q6yczy30SZx_sA...
Re: Security issues with electronic invoices
#5How can there be security issues with a public document? Can't you just sign it with a cert like any other piece of data that needs a proven source?
But also let me get this straight, there is an actual EU standard for invoices? Why the does nobody follow this and I have to keep asking people to put the fucking VAT ID onto it like I'm a broken record?
Re: Security issues with electronic invoices
#6How can there be security issues with a public document? Can't you just sign it with a cert like any other piece of data that needs a proven source? But also let me get this straight, there is an actual EU standard for invoices? Why the does nobody follow this and I have to keep asking people to put the fucking VAT ID onto it like I'm a broken record?
States have not starting to enforce them until recently. As I understand it the goal is to have all members using them in a couple of years time
Re: Security issues with electronic invoices
#7How can there be security issues with a public document? Can't you just sign it with a cert like any other piece of data that needs a proven source? But also let me get this straight, there is an actual EU standard for invoices? Why the does nobody follow this and I have to keep asking people to put the fucking VAT ID onto it like I'm a broken record?
Because when some things parse the document they do things like read files from the OS as specified in the document
Re: Security issues with electronic invoices
#8A standard for invoices seems like something that an accounting body should create that is optional for businesses, not something mandatory created by the government. People will generally follow an optional standard to make their own lives easier, but a mandatory one introduces a compliance middleman into the invoicing process.
Re: Security issues with electronic invoices
#9How can there be security issues with a public document? Can't you just sign it with a cert like any other piece of data that needs a proven source? But also let me get this straight, there is an actual EU standard for invoices? Why the does nobody follow this and I have to keep asking people to put the fucking VAT ID onto it like I'm a broken record?
The concern is that a malicious vendor could send you an evil invoice where the XML either references external entities that get downloaded and allow potential RCE, or where the document contains references to the local execution environment which allow data exfiltration (or both). In theory a properly-secured XML parser shouldn't allow this, but history has shown that's harder than you might think.
Re: Security issues with electronic invoices
#10A standard for invoices seems like something that an accounting body should create that is optional for businesses, not something mandatory created by the government. People will generally follow an optional standard to make their own lives easier, but a mandatory one introduces a compliance middleman into the invoicing process.
That's just not how the EU functions.