8 Out of 10 Banks in Belgium HATE This One Weird eID RCE

The talk examines Connective's signing browser extension, used by many Belgian banks and government bodies, and the native host it relays to. The speaker explains the trust chain: a web page messages the extension, which forwards the request to the native host without recording where it came from. The only gate is an activation token, and because that token carries no origin binding, it can be replayed by any site.

Using a virtual eID and a virtual Maestro card built on an ESP32 board, the researcher showed that any page or iframe could read the full contents of a card. The host also returned a PIN token that held the PIN encrypted with a key included in the same token and an IV hardcoded in the binary. That allowed decryption and reuse for about five minutes, so an attacker could phish a PIN once and then authenticate or sign as the victim. The native host also validated library paths by searching for "DLL" as a substring, so a file with a double extension passed the check and could be downloaded and loaded as a polyglot, giving code execution from an ordinary-looking download.

The vendor first rated the problems medium severity and fixed them months later, after follow-up and a national agency's involvement. The practical takeaways are that extension store reviews focus on malware rather than vulnerabilities, native hosts should be treated as untrusted attack surface, and extension developers must validate input that arrives from web content.