Flaws were discovered in an iOS vaccine passport app after security researchers and hackers showed Quebec’s mobile verification system had multiple security issues.
Quebec has launched its VaxiCode application, a COVID-19 vaccination passport intended to provide a means of proving a person’s vaccination status via their iPhone. Shortly after its release, the security of the system as a whole was already in question.
A computer programmer identified as “Louis” successfully refuted claims made by Quebec Minister of Digital Transformation, Eric Caire, that system-generated QR codes “cannot be tampered with, modified or copied.” In a Radio-Canada report, the man managed to create false proof of vaccination for a person who did not exist.
After storing the evidence in the VaxiCode app, the evidence was then able to trick the VaxiCode Verif companion app, which is intended for businesses to verify documentation.
“Honestly, I am surprised that I was able to get into the system so easily,” the programmer said.
Security concerns are not limited to the creation of false evidence. On Thursday, it was reported that a group of hackers had successfully acquired the QR codes of Premier François Legault, Mayor Valérie Plante, Quebec Health Minister Christian Dubé, as well as evidence from provincial tenants in the opposition and Minister Cairo.
QR codes contain a number of information, including names, dates of birth, dates of vaccination and types of vaccines used. Cairo minimized the problem, maintaining the system is safe to use.
The system was supposed to be as simple as possible to encourage adoption, but Cairo says the province could make the process of obtaining a QR code more complex for improved security.
Cairo also says citizens will also need to show photo ID to go to places requiring vaccination passports. “The heart of the story is to prove your identity,” Cairo said. “I want it to be very clear, the QR code has not been tampered with, it has not been altered, and it remains secure.”
Quebec is making the use of vaccination passports mandatory for a number of activities as of September 1, including sitting in a bar or restaurant, going to a festival or a gymnasium and other high-level situations. risk of transmission.
The problems led to a letter from Quebec Solidare spokesperson Gabriel Nadeau-Dubois to Quebec Premier Legault, calling the situation an “unforgivable mess”. The letter asks the prime minister to make amends for the violation, “otherwise, consideration will have to be given to suspending the vaccination passport until a long-term solution is found.”