Quebec vaccine passport app hacked within days after launch

Quebec’s digital vaccination passport system is under fire as computer programmers are demonstrating how easy it is to hack the province’s new VaxiCode app.

In just two days since launching on the App Store, where it quickly become one of the most downloaded apps in Canada, multiple accounts have surfaced of tech-savvy individuals being able to exploit weaknesses in the app’s design.

The app works as a digital wallet for the unique quick response (QR) codes given to Quebec residents as proof of vaccination. The QR codes contain personal information including names, birthdates, vaccination dates, and vaccination types. After registering their QR code in the app, Quebecers can then use their smartphones — along with a government-issued photo ID — to access spaces where vaccinations will be made mandatory.

However, a computer programmer, who spoke anonymously to Radio-Canada under a pseudonym, was able to successfully generate false proof of vaccination for non-existent citizens and register them in the app within six hours.

Around the same time, a hacker group used the newly released app to access the personal QR codes of several notable Quebec politicians, including Premier François Legault, Health Minister Christian Dubé, and Deputy Minister for Government Digital Transformation Éric Caire.

For his part, Caire — who is officially charged with ensuring Quebec’s vaccination passport system is secure — has downplayed the severity of the app’s weaknesses. In an interview with Radio-Canada, he argued that his personal information is already publicly available and his vaccine appointments well-documented on social media, suggesting that the hackers may not have needed to break into the app to gain that information. Nonetheless, CBC News reported that Quebec’s Health Ministry has filed formal complaints with the police regarding the QR code leaks.

Caire also suggested that improving the app’s security — specifically, making obtaining and registering QR codes a more complex process — would detract from the province’s goal of making vaccination passports as easy and user-friendly as possible.

Vaccination passports will be officially required to access certain public spaces and events in Quebec as of September 1st, 2021.

Source: CBC News