Things must have been heating up in the offices of the Ministère de la Santé et des Services sociaux (MSSS, Québec’s health and social services ministry) on Friday morning.
After hammering home that using the QR code as proof of vaccination was 100% secure, two flaws were reported in the media.
First, hackers demonstrated that it was possible to download proofs of vaccination that were not intended for them.
Second, another individual demonstrated that it was possible to create fake QR codes from scratch.
In less than 24 hours.
The MSSS’s initial reaction was to issue a press release stating that “formal complaints have already been filed with the police. The competent authorities will investigate and determine whether criminal charges should be laid.”
We understand their embarrassment. For weeks, the Ministry has been telling us that the chosen solution is secure. In its press release, it doubles down. “The MSSS reiterates that the QR code is secure,” it reads.
And yet, the proof of vaccination was easy to download. All you needed was the person’s name and date of birth. With this information and a few lines of code, you can deduce the health insurance number. Knowing the date and manufacturer of the first vaccine dose speeds up the process. This information is often easy to find on social media.
According to an anonymous source, some of the responses returned by the site made the task easier. “If you have the right health insurance [ number ], it tells you if the date is wrong,” he explained to us. In addition, another message lets you know if you provided the wrong manufacturer name.
According to this person, you are “able to make a lot of requests and nothing stops [ you ].”
Returning error messages this useful to a hacker is a practice to avoid. It gives clues, and it is the first thing a security researcher will look at.
Another security practice is to put measures in place to prevent “brute force”, that is, to prevent someone from trying every possible combination of a health insurance number until they find the right one.
This does not seem to have been done adequately.
Fortunately, these two flaws were found by people who had the common good in mind. An unscrupulous person could have sold their services creating fake QR codes. A malicious person could have publicly released the proofs of vaccination. That is not what happened. The hackers who found these flaws contacted journalists. They wanted these risks to be known and taken seriously.
Instead of calling the police, perhaps we should consider thanking them.
There is currently no official mechanism for a hacker who has found a vulnerability to report it to the government.
It would be a good idea to set one up.
It would be more useful than repeating that everything is fine.
Photo credit: EFF - CC BY license
