Live data from Hacker News

I faked tons of Covid passes – “Weak Key Cryptography in real world”

ctrsec.io

21–30 of 222 posts

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#21
Good! Keep it up. Let things be, enough of this vaccine pass comrade BS.

We who are vaccinated should be at peace and trust this vaccine will reduce the likelihood of severe illness. Those who aren’t, I wish them the best, but that’s their choice.

Hopefully this will finally encourage smokers to quit and the obese to cut out a few sodas per day.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#22

Random question, but related: Like this example, I see lots of other applications that require a QR code storing binary data and chose to encoded this data as Base64 (or others) and then add it to a ASCII-only QR code format. Why don't they use a binary-mode QR code? Compatibility?

Perhaps so that generic QR code scanners can parse it and then know to forward it along to the appropriate app?

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#23
post #21

Good! Keep it up. Let things be, enough of this vaccine pass comrade BS. We who are vaccinated should be at peace and trust this vaccine will reduce the likelihood of severe illness. Those who aren’t, I wish them the best, but that’s their choice. Hopefully this will finally encourage smokers to quit and the obese to cut out a few sodas per day.

> Good! Keep it up. Let things be, enough of this vaccine pass comrade BS.

You're going to get heavily downvoted, but I totally agree. The vaccine pass is a complete farce. I even have non-technical friends that have faked vaccine passes. For someone even remotely technical, it's trivial to Photoshop.

If only we had the same fervor when it comes to demonizing weight gain, we could save 10x more lives.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#24
post #21

Good! Keep it up. Let things be, enough of this vaccine pass comrade BS. We who are vaccinated should be at peace and trust this vaccine will reduce the likelihood of severe illness. Those who aren’t, I wish them the best, but that’s their choice. Hopefully this will finally encourage smokers to quit and the obese to cut out a few sodas per day.

While I agree with you in principle, in this specific case smokers have an advantage; it is harder for them to get covid. So here it is not exactly motivating to stop smoking.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#25

Anyone knows if this is applicable to Covid passes used in the European Union as well?

The private keys for the European Green Pass have been leaked and fake passes signed with the keys are being sold on the dark web. https://threatpost.com/eus-green-pass-vaccination-id-private...

Ah yes, repeat the evil dark web narrative. As if a VPS in Russia would get you into trouble. Criminals will be criminals, also if tor etc. wouldn't exist and non-criminals wouldn't get to be anonymous, too.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#26

Random question, but related: Like this example, I see lots of other applications that require a QR code storing binary data and chose to encoded this data as Base64 (or others) and then add it to a ASCII-only QR code format. Why don't they use a binary-mode QR code? Compatibility?

Almost always technical incompetence, I think.

At some level "compatibility" is correct. System 1 outputs binary data, system 2 takes that and turns it into JSON, system 3 encodes that in base64, system 4 turns that into QR codes, and system 4 was what was mandated for producing all of the organisation's QR codes.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#27

Anyone knows if this is applicable to Covid passes used in the European Union as well?

The private keys for the European Green Pass have been leaked and fake passes signed with the keys are being sold on the dark web. https://threatpost.com/eus-green-pass-vaccination-id-private...

The keys were not leaked but the web interfaces that allowed generation of these certificates was left open and accessible.

Passes have been sold (through the clear web and the dark web) but many have also been revoked since. As far as I know, the certificates being sold right now are either someone else's certificate (for places that don't check your ID when you walk in) and certificates generated by people working for places that also give out legitimate certificates, such as some pharmacies and hospitals.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#29

Earlier quoted context omitted.

It seems that actually nothing has had a meaningful impact on coronavirus spread.

> seems…nothing has had a meaningful impact on coronavirus spread Not sure if trolling, but in case not, vaccination has had “a substantial impact on mitigating COVID-19 outbreaks” in America [1]. [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7709178/

The link you provided describes a simulation based on assumed vaccine effectiveness. It's also from 1 year ago. It doesn't seem to reflect any statistically backed insights into what's actually happened over the past year. Or am I missing something?

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#30
post #6

I remember here in Canada there were concerns about this sort of thing when rolling out our proof-of-vaccination system, but practically speaking, the number of people with both the technical understanding and inclination to do this is surely too small to have a meaningful impact on COVID spread.

The problem is that the people that are a) evil enough and b) technical enough to understand this will sell COVID passes for hundreds of dollars each.

Here in the NL there have been tons of people that sold COVID passes, some working at vaccination places, others working at testing places. Instead of hacking anything, they've just been committing regular fraud. The street value of these passes seems to be round €300 to €500. The government has been blacklisting these passes ever since they were first spotted, leaving many of their "customers" angry now that they can no longer fraud their way through the necessary checks.

The problem is not so much a technical one, as modern crypto is quite unbreakable. The pass in the article is based on RSA-512, which has been proven to be breakable all the way back in 1999. With elliptic curve cryptography the system can still remain unbreakable even with shorter keys that can fit into a small QR code, though space is rarely a problem with these codes anyway.

Post reply on HN