Skip to content
This repository has been archived by the owner on Sep 15, 2023. It is now read-only.

Forged Certificate gets validated #306

Closed
denysvitali opened this issue Nov 4, 2021 · 5 comments
Closed

Forged Certificate gets validated #306

denysvitali opened this issue Nov 4, 2021 · 5 comments

Comments

@denysvitali
Copy link

denysvitali commented Nov 4, 2021 •
edited

Due to a bug in the QR decoder, forged QR Certificates get validated.

This bug is similar (if not equal) to ministero-salute/it-dgc-verificaC19-android#185 and it can be reproduced as follows.

Valid Certificate

QR Valid

IMG_20211104_201430_883.jpg

This QR code has the same data as the one below. Sadly it gets validated in the Swiss Covid Checker app.

Invalid Certificate

Invalid QR

Note that, when decoded with zbar, both QR codes have the same data contained.

Hypothesis

This feels like a QR Decoding issue. We're discussing it at denysvitali/covid-cert-analysis#9 and at ministero-salute/it-dgc-verificaC19-android#185
@goebelUB
Copy link
Contributor

goebelUB commented Nov 4, 2021

Thanks for reporting, we'll look into it!

@ubamrein
Copy link
Contributor

ubamrein commented Nov 5, 2021

About the first QR code passing:
It looks like this QR code has indeed a valid signature and might be maliciously issued, was a mistake during issuance or maybe was a test-case for the production system. In any case, I think we are safe to assume that this QR code should not be valid and so like Micky Mouse & Co this should be revoked in Switzerland soon. Thanks for collecting all of those!

About the encoding issue in the second QR code:
I'm using this tool here to debug certificates (based on the Rust implementation found here ). As far as I can see the invalid QR-Code has a newline at the very end. Hence the two codes do not contain exactly the same data!

This is probably also why decoding (and hence verification) of the second QR code fails with the "D|B45" error -- '\n' is not a valid base45 character.

@denysvitali
Copy link
Author

Oh, you're right, that could very much be the case since I strip newlines in my reader. Duh!

@denysvitali
Copy link
Author

Maybe this is a wrong report. I just realized this QR is supposed to be valid and it's part of eu-digital-green-certificates/dcc-quality-assurance and it's thus supposed to be valid. It's just a weird certificate.

I guess we can close this issue, sorry!

https://github.com/eu-digital-green-certificates/dcc-quality-assurance/blob/main/AD/1.0.0/VAC-1-Pauta_Completa.png

@ubamrein
Copy link
Contributor

ubamrein commented Nov 5, 2021

No worries and thanks for your efforts!

@ubamrein ubamrein closed this as completed Nov 5, 2021
denysvitali added a commit to denysvitali/covid-cert-analysis that referenced this issue Nov 5, 2021
@denysvitali
feat(samples/saaanchez): remove certificate
414fcfe 
This certificate, despite being weird and being
signed by a production key of AD, is in fact
genuine and used as part of the EU DGC Quality Assurance tests.

This is very unfortunate as these certificates
should have never been signed with a productive key
to begin with.

For this reason, this certificate isn't forged and
thus it is now removed with this commit.

References:
- #9
- ministero-salute/it-dgc-verificaC19-android#185
- admin-ch/CovidCertificate-App-Android#306
- eu-digital-green-certificates/dcc-quality-assurance#183
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@denysvitali @ubamrein @goebelUB