Ontario should prevent the 'hack' that hit Quebec's vaccine passport app, expert warns
Ontario’s vaccine passport app should learn from an episode in Quebec where some people created their own QR codes and spoofed the identity of several Quebec politicians, says a Toronto cybersecurity expert.
Quebec’s government has complained to police about so-called hackers who were able to appear to obtain the QR codes of Quebec leaders -- including Premier Francois Legault -- something that should be avoided here, says Claudiu Popa.
“I like QR codes as much as anybody else. You can flash them and scan them on the fly. But they should be only used to transfer and communicate secure information and the best way to protect confidentiality is to use encryption,” he said.
Quebec has defended its system, saying the alleged breach exploited a small vulnerability that is being fixed.
“It’s a really precise loophole that is being corrected right away,” Eric Caire, Quebec’s minister for government digital transformation, told CTV Montreal last week.
“We will think about it if it’s a good idea to put more obstacles in the system, more constraints,” he said.
QR codes are short for “quick response” codes and are often used to store a string of characters such as a website or some names and dates in a speedy, machine-readable format.
In Quebec, the QR codes contain a person’s name, date of birth, and information about the vaccinations they have received.
Those codes are a central feature of the Quebec government’s vaccine passport system, which launched on Wednesday.
It appears the so-called hackers were able to obtain publicly available information such as the name and the birthdate, and used whether the politician had already disclosed his or her vaccination status.
Then it appears the person made their own QR code, which could be read by the vaccine passport app.
In Ontario, the vaccine passport will first be a printed or shown vaccine receipt, and an app is scheduled to come in only on October 22.
Ontario’s Associate Minister of Digital Government Kaleed Rasheed told a news conference that the government is aware of the issue in Quebec.
“The provincially designed app is going to be very secure and privacy protected,” he said.
If the QR code displayed by a customer contains an encrypted code which only the QR reader can decode, the app would be more secure, Popa said.
He also advised that people should not flash around their QR codes, and keep them private as they would with a credit card or a drivers’ licence.
“We have so many tools that could scan QR codes from a distance,” he said.
CTVNews.ca Top Stories
'I just can't believe that it took so long': Body found in wreckage 3 months after deadly fire
A man accused of arson in a January Old Strathcona apartment fire is expected to be charged with manslaughter after a body was discovered in the burned building late last month.
No proof man lied to brother about number of kittens born in litter, B.C. tribunal rules
A man was denied a $5,000 payout from his brother after a B.C. tribunal dismissed his claim disputing how many kittens were born in a litter.
Quebec police hand out hundreds of tickets to Hells Angels and other bikers before 'first run' meeting
Quebec provincial police handed out hundreds of fines to Hells Angels members and other supporting motorcycle clubs who met for their 'first run' in a small town near Sherbrooke, Que.
Explosion at train station leads to discovery of stolen car on Montreal's South Shore: police
Police are investigating after a BMW exploded in the St-Lambert Exo train station parking lot on Montreal's South Shore.
A Chinese driver is praised for helping reduce casualties in a highway collapse that killed 48
A Chinese truck driver was praised in local media Saturday for parking his vehicle across a highway and preventing more cars from tumbling down a slope after a section of the road in the country's mountainous south collapsed and killed at least 48 people.
Snakes almost on a plane: U.S. TSA discovers a bag with small snakes in passenger's pants
According to an X post by the Transportation Security Administration, officers at the Miami International Airport found the small bag of snakes hidden in a passenger's trousers on April 26 at a checkpoint.
Russia puts Ukrainian President Zelenskyy on its wanted list
Russia has put Ukrainian President Volodymyr Zelenskyy on its wanted list, Russian state media reported Saturday, citing the interior ministry’s database.
A candidate for Germany's key party was beaten up while campaigning for European elections
A candidate for Chancellor Olaf Scholz's center-left party in next month's election for the European Parliament was beaten up and seriously injured while campaigning in an eastern city, the party said Saturday.
Grandparents killed in wrong-way crash on Hwy. 401 identified
A 60-year-old man and a 55-year-old woman killed in a wrong-way crash on Highway 401 earlier this week have been identified by the Consulate General of India in Toronto.