Hacker News Reader

Comment by smorgusofborg | Hacker News Reader

I'm curious as to why the assumption is that the keys were compromised rather than that ability to submit false patient data to be signed in the real system? Can anyone who looked at the fake certificates comment on whether anything about format or metadata indicates they weren't from the normal system?

View on HN

My understanding is that health care professionals do not directly interact with the system generating certificates. Instead, they simply enter patient vaccination records in e-health system (or whatever it is called in each country). And then the certificate systems query patient's records and if appropriate information is found, generates a certificate. Clearly, there is no patient with such a name and date of birth which means that someone has tampered with the certificate generation system directly. Even if the keys are not stolen, someone might have an unauthorized access to the system at high level.

Germany, at least, doesn't have a central database on vaccinations and just relies on pharmacy staff to validate the yellow paper Vaccination Pass and government IDs.

In such a case any pharmacist can generate a factious certificate. I don't expect them to risk their licence with false data entry but given a big country and a sufficient number of disgruntled, nearly retired professionals...

Doesn't have to be retired professionals. There have been cases in Germany where employees of pharmacies fake these certificates [0]. The link talks about hundreds of faked certificates from a single pharmacy.

[0] https://www.br.de/nachrichten/bayern/hunderte-digitale-impfp... (German)

You'd be surprised what people can do. Not in Germany, but in Cyprus which is issuing EU certificates with the same as well there is an active case of a doctor who allegedly was adding people to the system without actually vaccinating them because they were against vaccination but wanted to get a pass issued. He would then throw away the dose after entering the batch number in the system. The case broke out when one of the fake pass holders got sick and had to be intubated, at which point he told the doctors about the scum he was involved in.

https://cyprus-mail.com/2021/08/14/coronavirus-new-remand-fo...

This is really dependent on each country. For The Netherlands, I know there is a system healthcare professionals can use to manually generate DCCs: in case of problems with the link, patients not giving permission to share PHI to a central registry or in exceptional cases like (partly) vaccinated outside of the EU and such. Just the matter of entering all details and it'll spit out a valid DCC.

Source: had to use this procedure myself.

And what enables this is that there are people who will pay for the certificate instead of taking a free vaccine. Dumbest black market I've seen.

It's right up there with auto seatbeat alarm stoppers?

Forgot those were a thing. Can't agree more, since the real seat belt is free too.

To my understanding, the input of the patient data is tied to scanning a vaccine dose after use. That's a bit harder or riskier to do than randomly inputing someone's name in the system.

Manual input certainly exists. My own EU Covid pass is showing "US" as the member state, as I got my vaccines in the US and the data got transcribed by the French foreign affairs into the EU system.

Reply on news.ycombinator.com