BalCCon2k22 - Kirils Solovjovs - Screaming into the void - All e signatures in the world are broken
Discusses balCCon2k22 - Kirils Solovjovs - Screaming into the void - All e signatures in the world are broken and evaluates key implications for security practitioners.
Summary
Overview: E-signatures in your country are insecure. They have been hacked 10 years ago. Everyone knew that but no one wanted to talk about it since there is no easy fix.
We decided to create a PoC and poke the government with it.
This is a story on what happened.
⭐ PoCs included ⭐
Electronically signed documents were a great relief to organizing our daily life during the pandemic. They have actually been helping us for many years (depending on the country).
It's been known for some time that **dynamic content + e-signatures = trouble**, but we were surprised that no one has really done anything ab Details: out it. In 2021 we got tired of explaining the vulnerability each partner that sends in a vulnerable asice for signing, so we created multiple practical PoC that allow you to modify content of e-signed documents post-signing.
Some of these PoC work against many countries. And there is PoC for every single country.
- What is the actual impact? - Why is no-one fixing this? - Can we even fix it? - What are we gonna do about it then?
Related talks
BalCCon - Balkan Computer Congress·1 hr 4 min
Kirils Solovjovs · Amelia Andersdotter
Demonstrates balCCon2k22 - Kirils Solovjovs & Amelia Andersdotter - There once was teams in web and evaluates key implications for security practitioners.
BalCCon - Balkan Computer Congress·37 min
Kirils Solovjovs
Presents balCCon2k23 - Kirils Solovjovs - MITM on PSTN - novel methods for intercepting phone calls and evaluates key implications for security practitioners.
BalCCon - Balkan Computer Congress·56 min
Kirils Solovjovs
Demonstrates balCCon2k19 - Kirils Solovjovs and evaluates key implications for security practitioners.