Europe's Electronic ID System Fixed Against Impersonation Risk

guest · Oct 29, 2019

Europe's Electronic ID System Fixed Against Impersonation Risk
October 29, 2019
https://www.bleepingcomputer.com/ne...c-id-system-fixed-against-impersonation-risk/

Researchers analyzing the electronic system for transactions and signatures used by the European Union member states found flaws that allowed impersonating any EU citizen.
Insufficient checks
Vulnerability researchers from SEC Consult found two vulnerabilities in the eIDAS-Node Integration Package that facilitates communication with eIDAS nodes (Connector and Service) in each country.

One of the weaknesses discovered allowed an attacker to avoid verification of the digital certificate signing the SAML message. Thus, threat actors could "send a manipulated SAML response to an eIDAS-Connector to authenticate as anybody."

"Therefore, the entity certificate signature is not verified against the public key in the issuer certificate. An attacker can create a certificate with an arbitrary public key whose Issuer DN matches one of the Subject DN’s of the trusted certificates," SEC Consult writes in a report today.
This is not the first time SEC Consult researchers impersonated Goethe. Almost a year ago, they used it to demonstrate a flaw in the authentication process via German ID cards with RFID chips.
Click to expand...

SEC Consult: Authentication Bypass in eIDAS-Node

Log in or Sign up

Europe's Electronic ID System Fixed Against Impersonation Risk

guest Guest

Log in or Sign up

Europe's Electronic ID System Fixed Against Impersonation Risk

guest Guest

Useful Searches