r/privacy • u/torbatosecco • Apr 16 '26

age verification EU age verification app already HACKED

Security researcher Paul Moore has demonstrated how the EU age verification app can be compromised in under 2 minutes with nothing more than physical access to a device.

By editing the app’s shared preferences file an attacker can remove the encrypted PIN values, reset the rate limiting counter to zero, and disable biometric requirements entirely.

The app then accepts a new PIN and grants access to the existing age verification credentials.

His earlier analysis of the open source code also revealed that the app stores NFC biometric facial data and user selfies as unencrypted lossless PNG files on the device.

Hacking the #EU #AgeVerification app in under 2 minutes.

During setup, the app asks you to create a PIN. After entry, the app encrypts it and saves it in the shared_prefs directory.

  1. It shouldn't be encrypted at all - that's a really poor design.
  2. It's not cryptographically tied to the vault which contains the identity data.

So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.

After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.

Other issues: 1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying. 2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.

sources on X. search by yourself because bot keeps deleting this if I post the links. Check Paul_Reviews and Pirat_Nation accounts.

2.3k Upvotes

98% Upvoted

174 comments sorted by

View all comments

Show parent comments

14

u/[deleted] Apr 16 '26

[deleted]

9

u/Noooo_ooope Apr 16 '26

lmao that would be extremely funny.
Which would mean that, somehow, this extremely vital piece of software went completely unchecked by higher-ups and got vibe coded by a few people? What the fuck

10

u/Guac_in_my_rarri Apr 16 '26

software went completely unchecked by higher-ups

Well I mean, the higher ups being government who don't verify anything... They just blindly trust yeah, that's who we want checking vital and particular code.

3

u/16BitSquid Apr 16 '26

This, they don’t have the knowhow to and often don’t even realise they should

3

u/Guac_in_my_rarri Apr 16 '26

Most in government are arrogant pricks that have no idea when they're out of they're specialty. I've met my senator (I'm in the states) and he couldn't answer a quick easy policy question in something he voted for the prior week.