The Patching Friars' AlmanacA calendar of CVE saints

Patron of February 15

sPACEHoly card for space-attack, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 PIN **** sPACE PERSONA FICTA
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Blessed sPACE, Who Posed as the Card

Patron of electronic ID cards, card readers without a keypad, and official apps that are not official.

Life

In February 2024 CVE-2024-23674 was published on the online identification function of the German ID card. According to the researchers, with a card reader lacking a secure PIN pad and a counterfeit app installed by the victim, an attacker in the middle could impersonate them and read their data off the card. Germany's federal IT security office replied that securing the client side is the cardholder's job.

Prayer

O Blessed sPACE, who recites the PIN on our behalf, let our reader have a keypad and our app an honest origin. Amen.

How to celebrate

Celebrated by installing the ID app only from the official source and using a reader that takes the PIN on the device.

Type your PIN just anywhere, and you lend your face to anyone.

Technical record

Disclosed on
February 15 2024
CVE
CVE-2024-23674
CVSS
9.6

The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A man-in-the-middle attacker can assume a victim's identify for access to government, medical, and financial resources, and can also extract personal data from the card, aka the "sPACE (Spoofing Password Authenticated Connection Establishment)" issue. This occurs because of a combination of factors, such as insecure PIN entry (for basic readers) and eid:// deeplinking. The victim must be using a modified eID kernel, which may occur if the victim is tricked into installing a fake version of an official app. NOTE: the BSI position is "ensuring a secure operational environment at the client side is an obligation of the ID card owner."

Sources: ctrlalt.medium.com · dropbox.com

Canonized by Pope Xzorcist I

Related saints

Sharing the feast day

Same year: 2024

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.