Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Forged Certificate gets validated

See original GitHub issue

Due to a bug in the QR decoder, forged QR Certificates get validated.

This bug is similar (if not equal) to ministero-salute/it-dgc-verificaC19-android#185 and it can be reproduced as follows.

Valid Certificate

QR Valid

This QR code has the same data as the one below. Sadly it gets validated in the Swiss Covid Checker app.

Invalid Certificate

Invalid QR

Note that, when decoded with zbar, both QR codes have the same data contained.

Hypothesis

This feels like a QR Decoding issue. We’re discussing it at denysvitali/covid-cert-analysis#9 and at ministero-salute/it-dgc-verificaC19-android#185

Issue Analytics

State:
Created 2 years ago
Comments:5 (3 by maintainers)

Top GitHub Comments

2reactions

denysvitalicommented, Nov 5, 2021

Maybe this is a wrong report. I just realized this QR is supposed to be valid and it’s part of eu-digital-green-certificates/dcc-quality-assurance and it’s thus supposed to be valid. It’s just a weird certificate.

I guess we can close this issue, sorry!

https://github.com/eu-digital-green-certificates/dcc-quality-assurance/blob/main/AD/1.0.0/VAC-1-Pauta_Completa.png

1reaction

ubamreincommented, Nov 5, 2021

No worries and thanks for your efforts!

Top Results From Across the Web

Dangers of Domain-Validated SSL/TLS Certificates

In the fight against fake sites, phishing and fraud, trustworthy SSL certificates are essential. This is why domain-validated certificates can be dangerous.

Fake SSL Certificates: How Can They Be a Problem?

A hacker can issue a fake certificate by getting the username and password of the CA and then accepting the certificate signing request....

Can't I forge an SSL certificate? [duplicate]

The verification is on the client side. The attacker can't provide a valid signature for the real server without its private key. –...

Forged SSL Certificates Pervasive on the Internet

About 0.2% of all SSL certificates are forged. ... “It's a lot harder to get an EV [extended validation] certificate issued by a...

How SSL Certificate Validation Works

SSLs are digital certificates that use encryption security for the ... Getting the right type of SSL validation is essential since your site ......