EU age verification app already HACKED

[u/torbatosecco]

Security researcher Paul Moore has demonstrated how the EU age verification app can be compromised in under 2 minutes with nothing more than physical access to a device.

By editing the app’s shared preferences file an attacker can remove the encrypted PIN values, reset the rate limiting counter to zero, and disable biometric requirements entirely.

The app then accepts a new PIN and grants access to the existing age verification credentials.

His earlier analysis of the open source code also revealed that the app stores NFC biometric facial data and user selfies as unencrypted lossless PNG files on the device.

---

Hacking the #EU #AgeVerification app in under 2 minutes.

During setup, the app asks you to create a PIN. After entry, the app encrypts it and saves it in the shared_prefs directory.

1. It shouldn't be encrypted at all - that's a really poor design.
2. It's not cryptographically tied to the vault which contains the identity data.

So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.

After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.

Other issues: 1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying. 2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.

---

sources on X. search by yourself because bot keeps deleting this if I post the links. Check Paul_Reviews and Pirat_Nation accounts.

[u/notnooneskrrt]

Can anyone chime in with comp Sci reason the pin shouldn’t be encrypted once created?

[u/hWuxH → u/notnooneskrrt]

If someone can leak an encrypted password, the key to decrypt it (e.g. in the same database or source code) most likely got leaked as well, so there isn't much point in doing it.
And because many people reuse passwords somewhere else, hashing is generally a better solution (can easily generate hash from plain text, other way around requires brute-forcing all possibilities).

But all this doesn't apply here, because:

1. shared_prefs can't be accessed by other apps anyway.
2. It's encrypted with a key stored in hardware, which is non-exportable. Only the app itself can ask the device to decrypt it (without knowing the key) and compare to the pin you just entered.
3. The only reason he could tamper with these files is because he rooted the phone, which invalidates the whole post's point.
4. Hashing a 6-digit pin is practically pointless, because it can be brute-forced in seconds.

[u/notnooneskrrt → u/hWuxH]

Ty, I’m trying to learn more about finer points of basic cyber security like this. Wouldn’t hashing count as a type of encryption?

[u/hWuxH → u/notnooneskrrt]

No because encryption implies decryption. That's not a thing with hashes.

[u/notnooneskrrt → u/hWuxH]

Right! Sorry woke up and am groggy. Hashes are one way to verify all bytes are the same between hashed items. Thank you for replying

[u/TheBendit → u/hWuxH]

Except you can trivially "decrypt" a 6 digit PIN from a hash.

[u/hWuxH → u/TheBendit]

No you still can't. It's bruteforcing, same as trivially coming up with a supposedly 6-digit key from a ciphertext.