Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
The Internet Medicine

Fake Covid-19 Vaccine Certificates Are Being Advertised On the Dark Web (bankinfosecurity.com) 207

Criminals have been selling fake vaccine certificates online and may be able to fool an EU system designed to verify the certificates' validity, researchers warn. BankInfoSecurity reports: [A] report released last week, "COVID-19 Vaccination Certificates in the Dark Web," which has not yet been peer-reviewed, notes that some darknet markets continue to sell supposed vaccine certificates for use in multiple countries. Four researchers - Dimitrios Georgoulias, Jens Myrup Pedersen, Morten Falch, Emmanouil Vasilomanolakis - who are all part of the Cyber Security Group at Aalborg University in Copenhagen, Denmark, reviewed vaccination certificate offerings from 17 marketplaces and 10 vendor shops. The researchers found that at least one vendor appears to be selling digital certificates, registered in Italy, that are being read as valid by mobile COVID-19 certificate-checking apps developed by both France and Denmark.

The Aalborg University researchers, however, note that many darknet markets forbid any listing containing any items related to COVID-19. But others, they say, do allow both physical and digital vaccine certificates to be offered for sale, and in some cases also "yellow vaccination cards" or other vaccination record cards that can be used as proof of vaccination, albeit only inside the country in which they were supposedly issued. "The listings are heavily focused on European countries and the United States, but there are also listings from other continents and countries, such as Brazil, Canada, Mexico and Australia," as well as Russia, the researchers write. "The pricing differs greatly between the different listings, with the cheapest certificate starting at $39 and the highest price reaching almost $2,800, which included both a physical and a digital certificate, registered in the United Kingdom," they write. Most markets accept bitcoin and monero cryptocurrencies as payment, they add, while a smaller number also take such digital coins as ethereum, cardano, litecoin and zcash. [...] The Aalborg University researchers note that buying a fake digital certificate gives the seller ample opportunity to scam a buyer.

If these fake COVID-19 certificates can indeed pass for valid ones, then one unanswered question remains: How? Many of the sites claim to have access to the systems used to issue certificates, either by hacking into them remotely, or having insiders who work at a healthcare or other health organization, the researchers say. "In the specific case of a listing on the Russian marketplace Hydra, the description even mentioned the exact location and hospital that the system was accessed from," they say. Another possibility, however, is that criminals have somehow stolen one or more private keys for the European system, which were issued to participating health organizations. If so, it would be difficult to revoke these keys, the researchers say, since doing so would invalidate what might be a large quantity of legitimate certificates too.

This discussion has been archived. No new comments can be posted.

Fake Covid-19 Vaccine Certificates Are Being Advertised On the Dark Web

Comments Filter:
  • by Anonymous Coward on Saturday December 04, 2021 @03:09AM (#62045753)

    This is insane. Just take the free shot instead, you fucking retards.

    • It would be really interesting to see how anti-vax propaganda in America differs from anti-vax propaganda in the US.

      In America, we have anti-vax propaganda that says, "carrying a card is a sign of an authoritarian government, stay away from it." Whereas I doubt that's a common line of reasoning in, for example, Belarus.

      • Re: (Score:3, Interesting)

        by Lisandro ( 799651 )

        In most of Western Europe the main objections right now are regarding mandatory certificates and government tracking.

        Actual vaccine hesitancy is way lower than in the US, in my experience.

      • by Freischutz ( 4776131 ) on Saturday December 04, 2021 @03:48AM (#62045823)

        It would be really interesting to see how anti-vax propaganda in America differs from anti-vax propaganda in the US.

        In America, we have anti-vax propaganda that says, "carrying a card is a sign of an authoritarian government, stay away from it." Whereas I doubt that's a common line of reasoning in, for example, Belarus.

        So they don't want authoritarian government yet these same people are also busy trying to set up a one party state under God Emperor Donald Trump. How delightfully contradictory. Prey tell us more amusing stories of the behaviour of American wildlife.

      • In Europe, a large part of anti-vaxers refuse on religious grounds. A fair number refuses because they mistrust "big pharma" and believe in natural or spiritual healing. The number of people with concerns about safety of the vaccine are dwindling fast. And only a small group still believe that the vaccin is a way to inject us with a 5G chip so Bill Gates can control our minds.

        The anti-vax propaganda in the EU doesn't reflect that distribution though (at least here in the Netherlands). There is almost
        • Fascinating, I didn't know anthroposophism was a thing.

          • Supposedly a lot of people who use some of the same drugs report similar experiences during their trip state, to the point where they "go" to the same "places" and "meet" the same "entities". I haven't tried most of these compounds so I can't speak to this phenomenon personally. Maybe it will turn out that it activates the brain in the same way and therefore people have similar experiences based on where/how certain things are stored/performed in the brain, but it is one of the phenomena that tends to incre

        • On social media the most common messages are: "It doesn't work", "There are unknown long-term consequences in using it", or there are horror stories about serious side effects. Not much propaganda from anthroposophists; they aren't openly promoting their alternatives, though a few prominent ones have been helping spreading disinformation.

          Yeah I barely use FB to keep track of some events but a former classmate of mine constantly posts memes like that.

          "The government is in a difficult position. It has to convince the unvaccinated that the vaccines work, and at the same time convince the vaccinated that they don't work and they need one more shot"

          or

          *Picture of a dog being bitten by another dog, that is in turn being humped by a third dog*
          Labeled "the unvaccinated", "the vaccinated", "the government"

          whaaat?? Then there's shit like my generally

        • by redback ( 15527 )

          you know what has unknown long term consequences?

          Getting COVID.

      • Due to lack of proper healthcare systems, about 30% of the EU population relies on homeopathy. They are notorious anti-vax. Also, the vaccine and testing isnâ(TM)t free in EU, my mother is paying EUR 40 per mandatory test and the good vaccines (Moderna, J&J, â¦) are EUR 120, while the only free or low cost ones are Sinovac and other ineffective ones.

        • Which country are you talking about specifically? EU citizen here and the vaccines are completely free here. Testing is also free, and homoeapathy is not some 30%, I would believe that it's below 3% but then we also have a 69.3% vaccination rate of the whole population (vs 59.7% for the US).
    • It is ridiculous, just take a free screenshot of someone elses covid app. Nobody ever verifies your ID, they just glance at the screen.
      • I've had a couple of clients recently require either a glance at a screen or me to fill out a form attesting to vaccination status. But I did some on site work at an FDA facility, and they required a scannable, verifiable QR code to let me through the gate.

        Some friends of mine who got vaccinations early were given only a paper card and have no idea how they'd come up with a QR. Once inside the FDA building people would sit right next to me in meetings, so it seems the rank and file weren't too worried abo
        • by jhecht ( 143058 )
          I did not even get a paper card when I was vaccinated in early March. I tried repeatedly to get a certificate without success; finally got a printout stuck on the back of my primary physician's business card.
        • Wife and I are both doctors. Forget QR codes; when we got our first vax doses they didn’t even have a website to track them. Still have no QR codes, but at least we got our initial doses registered with the state system when we got boosters. The unvaxed can die if they want to. Your FDA attendees are doing what pretty much everyone in medicine does - we’re over it.
    • Not to mention the fact that it seems somewhat ill-advised to hand over your name, date of birth, social security nr and passport / driver's license numbers (which they need to generate the certificate) to unknown criminals on the dark web.
    • Clyde: I can’t get vaccinated because I’m allergic to shellfish.
      Wendy: Clyde, there’s no shellfish in the vaccine!
      Clyde: I know, but I read that sometimes in the lab where the vaccine is made, if someone ate shellfish, that it can get cross-contaminated, and have left over residual shellfishness.
      Jimmy: So you’re saying you won’t take the Covid vaccinated out of shellfishness?
      Clyde: Yes, that is correct, just a general sense of Shellfishness.

      Credit to South Park.

  • Amazing (Score:5, Funny)

    by thadtheman ( 4911885 ) on Saturday December 04, 2021 @03:39AM (#62045805)

    I am shocked, shocked to find illict vax documents sold on the dark web.
    "Here are your illicit drugs ordered on the dark web sir"

    • Yeah exactly.
      Why the fuck would they be shocked by this low consequence BS when you can buy drugs, guns, and fake IDs since forever?
      I even remember people on clearnet sites like 4chan discussing how to forget vaccination cards
  • by 93 Escort Wagon ( 326346 ) on Saturday December 04, 2021 @03:44AM (#62045815)

    They're priced in dollars - not bitcoin?

  • by thegarbz ( 1787294 ) on Saturday December 04, 2021 @04:37AM (#62045907)

    This has been going on all year. And what's with the summary "which has not been peer reviewed yet"? You don't need to wait for peer review for validity on an article which tells people that something which has been documented in multiple countries and has already had many arrests associated with it.

    Adolf Hitler got a vaccination certificate: https://www.schengenvisainfo.c... [schengenvisainfo.com]
    12 people arrested in Germany: https://www.dw.com/en/germany-... [dw.com]
    2 people arrested in The Netherlands: https://apnews.com/article/cor... [apnews.com]
    On sale in Ireland for 350EUR: https://www.irishtimes.com/new... [irishtimes.com]
    Which shows the cost of living in Ireland since they are only 150EUR in Italy: https://www.euronews.com/2021/... [euronews.com]
    Oh and this has been going on since March: https://www.bbc.com/news/techn... [bbc.com]

    I know Slashdot is late to the party

    • British law places fraud, as more serious than simple stealing or shoplifting. Get caught doing this in Australia, expect a criminal record, which will disqualify you from many jobs. The people paying high amounts, could later be blackmailed. Lets hope the police catch some, and prosecute fully.
  • I'm curious. AFAIK, the EU COVID vaccine certificates are a serial number & a QR code of it for quick & easy scanning & verification. All the verification apps do is scan the QR code & check it against a database of govt ID numbers, e.g. national ID card or passport. You need to show your valid govt ID with the number on it when someone checks your COVID certificate. If they don't match &/or the photo on the ID doesn't match your face, then you've failed the verification. The certificate

    • by djinn6 ( 1868030 )

      Not sure about the EU, but here in California, I've been to many places that supposedly requires vaccination. I offer them the official, government-issued digital QR code, but they all told me they can't check it. So what do they check instead? A screenshot I took while using the verification app on my own QR code. It shows my name and vaccination dates. It's also a .png file that I can photoshop a new name onto in 3 minutes (2 of which is waiting for PS to start).

      • Since the US govt appears to use people's social security numbers as passwords, granting access to all kinds of information & services & identity theft seems to be rampant, I don't hold out much confidence in US authorities being able to do a great deal about widespread identity fraud with the resources they're allocated.
    • Could be that the criminals have an inside man that can create entries in the governmental database, looks from TFA that the persons have to give away their personal info, id etc to the criminals in order to get their fake certificate.
  • by quonset ( 4839537 ) on Saturday December 04, 2021 @07:57AM (#62046095)

    The nice thing is, when these people get caught [cnn.com] they face both hefty fines [cnn.com] and jail time [mashable.com]. Meaning they have a criminal record [cbslocal.com]. Meaning, in many states, they can't vote [go.com].

    Who knew forging a government document [nbc4i.com] could be illegal?

    • Interesting thing is the COVID-19 virus isn't fooled by these "fake" certificates either. Self-correcting problem.

  • by Black Parrot ( 19622 ) on Saturday December 04, 2021 @08:00AM (#62046097)

    It would be easier and more reliable to just scan you for the cpuid on the chip inserted by the vaccine.

    • Poe's Law means that I don't know what to make of your comment. I'm going to assume intelligence so you're joking, right?
  • So called "COVID exemption lanyards" can be bought on ebay for about a £5 in the UK even though there is no such thing. Images/PDF to print yourself are also circulating on FB/Twitter etc.

  • Even for those who like the protection against symptomatic disease that vaccines offer, and who therefore own a "real" certificate, there is good reason to also own a fake one: Presenting the "fake" one (issued to some arbitrary common name) keeps you from leaking personal data in many locations that are mandated to check those certificates. There are lots of people who do not like to leave a data trail in every bar or brothel they visit.
    • In in the 7 months I've had my card filled out, I've had to show it exactly once - and that was just to show that I had one. No one actually looked at the details on the card. I have not been avoiding public spaces excessively, and it is possible that some places actually check more closely. But to spend money on a fake card when it seems like no one cares about a real one is a bit of a waste.
    • Presenting the "fake" one (issued to some arbitrary common name) keeps you from leaking personal data in many locations that are mandated to check those certificates.

      Or you could simply implement the system in a way that doesn't leak personal data, e.g. the Netherlands where the barcode has the day of the month of your birth and your first initial in it. Woop de fucking do. "9 C" There you go, public now for all to see.

  • Looking at my own card and the paper mail-in ballots, both are stupid easy to copy. Neither has a GUID associated with it. Neither has a cryptographic hash function associated with it. Two points: 1) faking either is easy and 2) if you're motivated enough it's easy. Just sayin'.

    • Oh, there is voter fraud: It's just not committed by the people "they" think it is. Ie. Projection.
    • Oh there is voter fraud.

      https://www.thedailybeast.com/... [thedailybeast.com]

      https://www.azmirror.com/2021/... [azmirror.com]

    • Card? It sounds like you're not talking about the EU certificate which is what TFA is about given that a) it's not a card, and b) it is cryptographically signed.

    • by xalqor ( 6762950 ) on Saturday December 04, 2021 @02:06PM (#62046831)

      Election officials check the submitted ballots against the voter registration roster.. it's easy to identify multiple ballots submitted for the same voter, ballots submitted for a non-registered voter, and invalid ballots (e.g. vote is for president but you changed the question to be what is your favorite food, so that the answer is not a valid vote for president).

      The election officials already check if any registered voters moved out of the district or registered somewhere else, or died, or for some other reason become ineligible to vote there, and they remove them from the roster. This can also happen after the election, and in that case the count is adjusted to discount invalid votes.

      You don't need any hashes for the above to work, and the combination of your name, birthday, and registered address are already a unique identifier within a voting district. It would be extremely rare for twins to be given the same birth name, but even in that situation you just need another state id to distinguish them.

      Seems that many people confuse "it's easy to attempt voter fraud" with "it's easy to commit voter fraud without detection". If the attempted fraud is detected and handled, then it doesn't affect the election results.

      There might be a use for cryptography in improving elections even more, but today the voter registration rosters are plaintext and you don't need cryptography to ensure you have at most one vote per eligible voter.

    • Of course there are no personally identifying marks on the ballot itself, what part of 'secret ballot' were you unsure on?

      There is however a globally unique ID on the return envelope you have to use to submit that secret ballot that can be verified and recorded before they pass it to the folks actually responsible for opening the thing. It is part of how they can tell you your ballot is in the mail and that it has been received back and the signature accepted. Copied or faked an ID on the envelope? Congr
  • by bugs2squash ( 1132591 ) on Saturday December 04, 2021 @12:51PM (#62046645)

    many darknet markets forbid any listing containing any items related to COVID-19

    How bad does your culture have to be for the darknet to cancel it ?

  • A person who cannot receive a vaccination because it would be demonstrably more dangerous to their health and safety than their likelihood of catchiing COVID developing severe COVID symptoms could have a somewhat legal use case for this sort of thing, as it would get them a pass at a locale that is demanding proof of vaccination without having to disclose that they had any kind of medical condition which made vaccination impractical for them. Unfortunately, this is far more likely to be used by people who
    • demonstrably more dangerous to their health and safety than their likelihood of catchiing COVID developing severe COVID symptoms

      That person only exists in the fantasy of Covid deniers.

    • by Kernel Kurtz ( 182424 ) on Saturday December 04, 2021 @02:18PM (#62046875)

      A person who cannot receive a vaccination because it would be demonstrably more dangerous to their health and safety than their likelihood of catchiing COVID developing severe COVID symptoms could have a somewhat legal use case for this sort of thing, as it would get them a pass at a locale that is demanding proof of vaccination without having to disclose that they had any kind of medical condition which made vaccination impractical for them. Unfortunately, this is far more likely to be used by people who simply don't want to be vaccinated without a justifiable health recommendation. .

      Here in my Canadian province, if you have a legitimate medical exemption for not getting vaccinated (which is approved by a purpose created panel of specialist doctors and is not easy to get, because indeed very few people have legitimate medical reasons for not being vaccinated), they will issue you a card with a QR code that will validate just like all the rest, with no indication you are "special". There is not much risk to this, as people who actually qualify for this are one in many thousands.

  • New fad: buying one's own death sentence.

The Tao is like a glob pattern: used but never used up. It is like the extern void: filled with infinite possibilities.

Working...