Throwing even more doubt on the security of the vaccine passport, hackers easily downloaded yesterday the vaccine evidence of the Premier of Quebec, Franois Legault, and members of his cabinet.
• Read also - The vaccination passport at work raises many legal questions
• Read also - Hacked vaccine proof: Gabriel Nadeau-Dubois asks for a quick plan
"Child's play" summed up to our Bureau of Investigation a source very close to this file.
With simple information lying around the internet and encryption software to find the health insurance number, hackers were able to get their hands on the precious QR codes and related information.
- Listen to the latest news from Mario Dumont and Vincent Dessureault on QUB radio:
This is personal information that is usually protected by access to information law.
Several people targeted had also posted on social networks the place where they were vaccinated as well as the date.
Thus, the vaccine evidence of Prime Minister Franois Legault, his Minister of Health Christian Dub and that of the Minister for Digital Transformation Eric Caire were easily downloaded.
The latter had however assured Tuesday that the QR code could not be falsified or copied.
The leaders of the oppositions in Quebec, star columnists as well as personalities from the municipal scene are also among the people targeted by way of example by the pirates.
- Listen to Philippe-Vincent Foisy's interview with Steve Waterhouse, cybersecurity expert, on QUB radio:
Badly secured information
“The last name, first name, date of birth, place of vaccination… It's easy to obtain. This is poorly secured information. You can download anyone's QR code, ”explained our source, adding that the website configuration facilitates the theft of vaccine evidence.
"If we have the right health insurance [number], that tells us if the date is not right," he continued. This person also stressed that he could multiply the requests without the slightest hitch.
According to computer security experts, this gesture shows that a person who has not received his vaccines could easily create a false identity for him to enter non-essential businesses from the 1 st of September.
- Listen to La Rencontre Lise-Mulcair at the microphone of Richard Martineau on QUB radio:
Complain to the police
It's easy to use a stranger's vaccine proof and create a fake ID card, especially since the QR codes aren't associated with a photograph, they noted.
“The system will not prevent anyone from stealing someone else's identity if they really want to. It is simply a question of downloading the code of someone that we know - that we have enough information - and make a false student card or other ”, affirmed Patrick Mathieu, co-founder of Hackfest and security expert of information.
“The most incredible thing about this flaw is that it allows you to download someone else's code and steal their identity. "
Informed by our Bureau of Investigation, the Prime Minister's office said it takes this threat very seriously and intends to file a "formal" complaint to the police.
"The competent authorities will investigate and determine whether criminal charges will be brought against the people behind this initiative," Prime Minister spokesman Ewan Sauves said in the evening.
- Listen to Vincent Dessureault's column at the microphone of Genevive Pettersen on QUB radio
Lack of verification
For his part, expert Steve Waterhouse believes that the government should however have consulted information security specialists before distributing QR codes to the population.
"It's a deployment that lacked basic cybersecurity verification, from the design of the solution to its commissioning," he said.
- With Sam Harper, Agence QMI
♦ Last week, our Bureau of Investigation revealed that hackers easily created an application that allows you to copy the personal information included in the vaccination passport.
SEE ALSO ...