Some falsified EU DCC are still not rejected by CoronaCheck _scanner_

[HenkPoley]

For which there is no issue tracker.. Neither for the DCC Scanner, for border patrol.

Example leaked EU DCC QR code: https://github.com/ehn-dcc-development/hcert-spec/discussions/105#discussioncomment-1591595

Already reported it here about a week ago: https://twitter.com/henkpoley/status/1457713831514451972?s=21

Since the list is dynamically downloaded, I suppose that report never really went anywhere (going back to, no public issue tracker).

[HenkPoley]

Some more from here: https://github.com/denysvitali/covid-cert-analysis/blob/master/LEAKED.md

CoronaCheck Scanner still scans:

• samples/leaked/043.txt
• samples/leaked/040.txt
• samples/leaked/033.txt
• samples/leaked/014.txt
• samples/leaked/009.txt

Additionally the 'DCC Scanner' for border patrol also accepts the following. But would of course not pass the passport check.

• samples/leaked/042.txt - but only 1 vaccin
• samples/leaked/041.txt
• samples/leaked/040.txt
• samples/leaked/039.txt
• samples/leaked/038.txt
• samples/leaked/037.txt
• samples/leaked/036.txt
• samples/leaked/035.txt
• samples/leaked/034.txt
• samples/leaked/033.txt
• samples/leaked/030.txt
• samples/leaked/029.txt
• samples/leaked/028.txt
• samples/leaked/027.txt
• samples/leaked/026.txt
• samples/leaked/025.txt
• ..
• ..

[Rool]

Thanks, I have forwarded this to our security team, will keep you posted.

[HenkPoley]

I'll close this as "works as intended".

Meaning, the receiving end is supposed to check the passport matches the EU DCC QR-code.