A highly anticipated European Union Age Verification application has come under heavy scrutiny after a security researcher demonstrated how to bypass its core protections in less than two minutes.
The application, recently praised by EU officials for its robust privacy standards, contains severe cryptographic and design flaws that allow attackers to easily hijack user identity credentials.
Critical PIN Bypass Discovered
Security consultant Paul Moore analyzed the open-source code of the EU Age Verification app and quickly discovered fundamental vulnerabilities in how it handles sensitive user data.
The primary issue stems from the application’s PIN creation and storage process. During setup, the app encrypts the user’s PIN and saves it locally in a configuration directory known as shared preferences.
Moore noted that encrypting the PIN locally is a poor architectural choice, but the more critical failure is that the PIN is not cryptographically tied to the secure vault holding the identity data.
Because of this disconnect, an attacker with local access to the device’s file system can manipulate the configuration file to take over the account.
By simply deleting the specific PinEnc and PinIV encryption values from the shared preferences directory and restarting the application, the attacker forces the app to request a new PIN.
Once a new PIN is created, the application grants the attacker full access to the original user’s identity credentials, allowing them to present the stolen identity as valid.
Additional Authentication Flaws
Beyond the critical PIN bypass vulnerability, Moore discovered two additional security flaws located within the exact same local configuration file.
These poor design choices allow attackers to bypass other fundamental security controls with trivial text edits:
- Rate limiting protections can be completely defeated by changing an incrementing number in the configuration file back to zero, allowing an attacker to guess PINs infinitely without being locked out.
- Biometric authentication checks can be entirely disabled by locating a basic true or falseÂ
UseBiometricAuth value in the settings file and changing it to false.
These security discoveries directly contradict recent statements made by European Commission President Ursula von der Leyen.
She recently claimed the application was technically ready for deployment and respected the highest privacy standards in the world, specifically highlighting that its open-source nature allowed anyone to verify its security.
Moore warned that releasing the application in its current state will inevitably serve as the catalyst for an enormous data breach.
Relying on local shared preference files for critical security checks like biometrics and rate limiting is a well-known anti-pattern in mobile application development.
The fundamental flaws in local data storage and authentication suggest that the application requires a complete architectural overhaul before it can be safely deployed to European citizens.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
