EU Age Verification App Hacked in Under 2 Minutes

Description

A dark-mode X post by Paul Moore - Security Consultant (@Paul_Reviews, avatar of a hooded figure with binoculars) describing 'Hacking the #EU #AgeVerification app in under 2 minutes.' He explains that during setup the app creates a PIN, *encrypts* it, and stores it in the Android shared_prefs directory; he criticizes that (1) it shouldn't be a recoverable encrypted PIN at all and (2) it isn't cryptographically tied to the vault holding identity data. An attacker can delete the PinEnc/PinIV values from shared_prefs, restart the app, set a new PIN, and the app presents the old profile's credentials as valid. Other issues: rate limiting is an incrementing counter in the same config file (reset to 0 and keep trying), and 'UseBiometricAuth' is a boolean in the same file (set false and biometrics are skipped). A textbook case of client-side-only security controls in a government identity app

Common Tags

SecurityVulnerabilities InsecureDesign Android Authentication SecurityTheater PenetrationTesting MobileDevelopment DataEncryption SecurityMisconfiguration

Comments

Anonymous ★ Top Pick Storing the PIN, the rate limiter, and the 'UseBiometricAuth' flag in one client-side file isn't defense in depth - it's a settings menu for the attacker

Anonymous ★ Top Pick

Storing the PIN, the rate limiter, and the 'UseBiometricAuth' flag in one client-side file isn't defense in depth - it's a settings menu for the attacker
Anonymous

Nothing says defense in depth like a vault guarded by `UseBiometricAuth=false`.
dev_meme 4mo

*they actually name it to be just a demo and every member state must do their own but cmon
1. @Valithor 4mo
  
  This was my first question when I read this, whether it was just a demo, because if so that makes complete sense to not lock test users into a model that might change before an actual deployment. I'm sure the final version will use a security key or something similar.
2. @Box_of_the_Fox 4mo
  
  Doing it properly would require using Secure Element which would be quite hard and pointless for a demo
@deimossos 4mo

To be fair, its hard to do mass surveillance, without having some security vulnerabilities maybe some information just shouldn't be collected...
@ZmEYkA_3310 4mo

W age verification 🤯🤯
@soreiut 4mo

So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app. You need root to access shared pref
@RiedleroD 4mo

there's an age verification app?
1. @acidbong 4mo
  
  yes, but not enforced and only presented for demo purposes
  
  @mechtaros 4mo
  
  not enforced yet
@akiyiwen 4mo

Nothing is secure if others can have your device physically...
@SamsonovAnton 4mo

If an attacker is that smart, he surely passes the age verification.
1. @azizhakberdiev 4mo
  
  doesn't matter, attackers can make rogue clients or 3rd party software that will help bypass these checks
2. @deadgnom32 4mo
  
  don't underestimate kids. back in my days hacking starforce was a part of daily life.
@azizhakberdiev 4mo

cmon, didn't lucky patcher teach us not to trust edge device side data?
1. @TheFloofyFloof 4mo
  
  can't use lucky patcher once sideloading is deemed illegal
@azizhakberdiev 4mo

also while we are at it, kids are very smart
@azizhakberdiev 4mo

even if it gets them +0.001 robux they will hack it
@Sun_Serega 4mo

I'm actually excited for more ability to verify the age, especially from EU side it can't possibly be worse than for-profit american options like persona and being able to exclude kids from my vrchat lobbies is a big + not excited for it being mandated in basic communication apps tho...
1. @TheFloofyFloof 4mo
  
  VRChat uses persona and has doesn't appear to have plans to change vendors
  
  @Sun_Serega 4mo
  
  yeah, but I have plans to change the platform to Resonite its better in almost every way for me, but when they support questies - its gonna be flooded with kids, just like vrc has been
@Sun_Serega 4mo

and yeah, there is no age verification, but there are all the tools to implement your own for your own lobbies
@nyxiereal 4mo

What the fuck shared_preferences sure is easier to use than secure_storage, but it's not that hard
@YaroST12 4mo

Is the CN still not up on that post? He's showing off the vulnerability with a rooted device, you cant "simply remove" something from shared_prefs. If you can do that - you've blown open most, if not all, of Android's security measures.
1. @death_by_oom 4mo
  
  The main problem of the post is that the app is actually a demo. But I would expect the actual age verification app that stores my official documents and can be used to prove my age and identity to be zero trust
  
  @YaroST12 4mo
  
  If the Baltics were able to develop a government level 2FA system (Smart ID) then I think the EU can do the same, especially if it's gonna be open source.
@NaNmber 4mo

A post from Durov on the matter 🙂 https://t.me/durov/491
1. @RiedleroD 4mo
  
  mhm. sure
  
  @death_by_oom 4mo
  
  He's not wrong though, ID and Age verification apps should be in the same category as passwords manager. They should be zero knowledge based, otherwise that's asking for trouble
  
  @RiedleroD 4mo
  
  well duh. but his conclusion about it being on purpose is straight up a conspiracy theory
  
  @death_by_oom 4mo
  
  True, but what I don't understand is why even show this unfinished Swiss cheese security demo app
  
  @RiedleroD 4mo
  
  I'm guessing that it was less work for the contractor this way. get overpaid and then underdeliver, is the motto of any and all government contractors
  
  @death_by_oom 4mo
  
  Maybe
@sandor73 4mo

ok but you still need physical access to the device

Use J and K for navigation

EU Age Verification App Hacked in Under 2 Minutes

Description

Categories

Common Tags

Comments

More like this

Bug Bounties Then Paid XSS; Now AI Says Duplicate

Why Would I Ever Use a Different DSA k

Trust Me, Claude, It’s My WordPress Route