COVID vaccine certificates can be forged in 10 minutes due to ‘obvious’ security flaw

Near-perfect counterfeits of the federal government’s COVID-19 vaccine digital certificate can be made in 10 minutes using free software, a member of the public has discovered.

Richard Nelson, a software engineer in Sydney, discovered an “obvious” security flaw in the Express Plus Medicare app allowing him to create vaccination certificates with any name and date of birth and featuring the back animations. plan to prevent tampering.

Loading

The prime minister has previously said certificates are a “credible and effective” way for states to administer exemptions to certain aspects of the lockdowns.

The discovery of the flaw could put the brakes on state and federal governments, allowing vaccinees more freedoms.

Mr Nelson discovered the security flaw in the current system (which was launched over two months ago) while searching one evening last week with the Express Plus Medicare app.

Other security experts have confirmed that this is the kind of obvious vulnerability that would have been found during a basic security audit of the app.

To show how easy it is to forge certificates, Mr. Nelson took 10 minutes to make a fake certificate with the name of this journalist (who has not yet taken all his pictures).

Loading

“I don’t think it’s a good idea to broadcast it among the anti-vax crowd,” he said.

“People who do not have a valid certificate can present one quite easily – the implications are left to the imagination.”

Will it be corrected?

After discovering the flaw, Nelson sent detailed instructions to the government, but has yet to receive a response.

Responding to questions from the CBA, a spokesperson for Employment Minister Stuart Robert, who has ministerial responsibility for data and digital policy, said the government had “iteratively updated the evidence vaccination certificates “.

“The government will continue to iteratively update proof of vaccination certificates … including by strengthening security measures,” he said.

From the response, it was not clear whether the government would fix the vulnerability (which would require an update to the Medicare app).

A basic security audit would have found a loophole

Security vulnerability is different from that identified by Senator Rex Patrick earlier this month.

The senator used “some graphic tools” to forge the PDF export of the vaccination certificate.

This only works on PDF, as the certificate in the app itself is protected against counterfeiting by an animated tick, a live clock, and a glittering coat of arms (similar to the type used for digital driver’s licenses).

As can be seen in the video above, Mr. Nelson’s more sophisticated counterfeit includes these anti-fraud features.

Mr Nelson said the flaw was “absolutely” found during a security audit.

This is not the first time that an experienced software developer has made holes in government computer systems.

He was part of the tech community that discovered significant vulnerabilities in the COVIDSafe app last year, including the tracking app not working properly on a locked iPhone.

Privacy expert Vanessa Teague, another prominent member of the tech community, said the Medicare app flaw was “not surprising after experiencing COVIDSafe.”

“Oh yeah, wow,” she said.

“Certificates require digital signatures with a QR code”

Certificates also have a bigger security issue, she said.

Other models, such as the one used by the EU, have a digital signature in the form of a QR code that can be verified as a defense against fraud.

Such a system would be much more difficult to cheat.

“They still have to do something a bit like what the EU has done,” said Ms Teague.

The PM reported that the vaccine certificate will be revised in October, although it is not clear whether the new version will only be used for international travel and will work with existing vaccine certificates.

In early July, the Australian Digital Health Agency, a statutory body responsible for implementing various digital health initiatives, has issued a call for tenders for a smartphone app to store digital vaccination certificates, as well as COVID-19 test results.

The proposed mobile application will be ready “before December 2021” and will include “multiple authenticity and anti-fraud measures”.

Mr Robert’s spokesperson did not answer questions about whether the government was working on a new type of vaccine certificate.