Belgium's Connective eID Extension Used by 8 of 10 Major Banks, 60+ Government Agencies Had Critical Flaws; Any Website Could Steal eID Data, PINs, Execute Remote Code via Drive-By Attack

Belgium's Connective eID Extension Used by 8 of 10 Major Banks, 60+ Government Agencies Had Critical Flaws; Any Website Could Steal eID Data, PINs, Execute Remote Code via Drive-By Attack—Fixed 146 Days After Report

8 out of 10 Banks in Belgium HATE This One Weird eID RCE

TL;DR. The Connective signing extension has over 2 million users, primarily in Belgium, and lets websites talk to electronic ID (eID) and Maestro payment cards. It was used by "8 of the 10 largest banks in Belgium and 60+ Belgian government agencies and departments"1, and it underpins eIDAS qualified signatures, a signature format legally trusted by governments and organisations. We found multiple major issues. Any site or iframe could read the user's eID and Maestro card data, and recover their...