Some keys that allow the generation of the European Green pass would have been stolen and with them programs to create fake certificates would have been published and disseminated online. It is learned from qualified Italian sources according to which it has already been decided to cancel all the passes generated with those keys. In addition, a series of meetings at European level between all the technical stakeholders involved would be scheduled in the morning for an in-depth analysis of the situation. The number of stolen codes is not known at the moment, nor whether the problem also concerns Italy, although investigations are underway.
The theft of the keys would not have occurred in Italy: according to what is learned, from the first investigations carried out, there would be no cyber attacks on Sogei, the Information technology company of the Ministry of Economy that provides the codes to generate the certificates for Italy greens.
The attack could therefore have targeted a counterpart in another European country.
At the moment, however, the keys that have been stolen have been canceled and, consequently, all the green passes generated with those codes have been invalidated.
A pass in the name of Adolf Hitler, born on January 1, 1900: the false certificate, which was valid after a check with the 'Verification C19' app, has been circulating online since late yesterday evening and has been published on Twitter and some specialized sites. According to the site 'Zerozone.it', the story is brought to light by the user '' Reversbrain 'who posted a series of tweets on Twitter around 10.30 pm yesterday: "I think the keys used to sign the Covid digital certificate The EU, at least in Italy, have leaked in some way "he wrote, inviting people to scan a QR code with the official Italian app. Code that was actually valid and, in fact, in the name of Adolf Hitler. "If the loss is confirmed - he added - it means that the fake Covid certificate ofUIe can be forged by anyone. "The user then updated the thread this morning, after the news that actually keys were stolen to generate the passes, claiming that the certificate is no longer valid. According to the Zerozone website, the certificate would have been issued by 'Cnam - Caisse Nationale d'Assurance Maladie', a French organization, on 25 October 2021. Another false but valid QR code, also in the name of Adolf Hitler, born on 1 January 1930, would instead indicate the company 'Janssen - Cilag international' as a producer of the vaccine administered, in Poland, by Centrum and Zdrowia. Everything seems to have been born from a discussion on 'RaidForum', a market on the web that has become a point of exchange of data leaks, writes Zerozone, where isit is also those who hypothesize the possibility that the private key of the Polish government may also have been stolen.
"At a first analysis it seems that the private keys used to sign the green passes have been subtracted, a kind of stamp that is used to validate the documents. The solution would be an inversion of those keys that would invalidate all the passes generated, and their re-stamping" : Stefano Zanero, professor of computer security and computer forensics at the Politecnico di Milano, explains it to ANSA regarding the manipulation of some false green passes disseminated online. The expert adds that the QR Code could be manipulated in various ways, potentially even manually by an "unfaithful employee" during data entry, but in this case it would seem more like an alteration of the private cryptographic keys that allow you to generate green passes. valid. And, adds Zanero, "even if the cases at the moment concern France and Poland we cannot know the extent of the phenomenon because each nation holds its keys, nor the damage account because the keys could also have been stolen a few months ago ". The action finally says l 'expert, it seems of a demonstrative cut since the fake green passes are registered to Adolf Hitler "a character who is no longer alive and makes a fuss".a character who is no longer alive and makes a fuss ".a character who is no longer alive and makes a fuss ".
