Critical Flaws in Belgian eID Software Expose Millions to Identity Theft and Forgery
Severe vulnerabilities in Belgium's Connective digital identity software, used by millions and critical to banking and government, could allow attackers to steal sensitive data and forge legally binding signatures.
A security researcher has uncovered critical vulnerabilities in the Connective digital identity system, a browser extension utilized by over two million people in Belgium. Developed by Nitro Software Belgium, this system is integral to the operations of eight of Belgium's ten largest banks and more than 60 government agencies, handling digital identity authentication and legally binding electronic signatures.
James Arnott, founder of cybersecurity firm Bay Area Labs, discovered that the Connective software failed to adequately verify the websites interacting with a user's computer. This oversight meant that any website, or even an embedded online advertisement, could communicate directly with the Connective application on a victim's machine without their knowledge or consent. This lack of verification is a fundamental breach of trust in digital identity systems.
According to Arnott's findings, a malicious website could silently access connected electronic ID (eID) and payment card details. More alarmingly, attackers could trick users into divulging their eID PIN by presenting official-looking authentication pop-ups. Because the software allowed web pages to customize the text within these dialog boxes without displaying the originating domain, users were left unable to discern legitimate prompts from sophisticated phishing attempts.
Once a user entered their PIN into a fraudulent prompt, the Connective application transmitted it directly to the requesting webpage. An attacker could then leverage this stolen PIN to generate unauthorized approval tokens, effectively forging legally binding electronic signatures whenever the victim's physical eID card was inserted into a card reader. This capability poses a severe risk for identity theft and fraudulent transactions.
The compromise of the eID system has significant implications for Belgium's broader digital trust infrastructure, impacting government portals like CSAM.be and third-party identity providers such as Itsme. While these services themselves were not flawed, their reliance on the eID signature mechanism meant that an attacker gaining control of signing capabilities could potentially register or hijack digital identity accounts, leading to widespread account takeovers.
Beyond identity theft, Arnott also identified a remote code execution (RCE) vulnerability that could be exploited independently of whether an eID card was present. By exploiting a flaw in how the Connective application processed local files, a malicious website could compel the software to execute attacker-controlled code at the user level. This type of vulnerability could be delivered through a drive-by attack, requiring only a user to download a disguised file and visit a compromised webpage.
This RCE flaw carried the potential for self-propagation, as it did not require special permissions and could potentially hijack user credentials to send malicious links to other potential victims, acting like a worm. Nitro Software Belgium was notified of these issues and has since remediated them, deploying updates to block unauthorized origin requests and secure PIN handling. The company awarded a $200 bug bounty for the findings, and the final security enforcement was completed in late July, approximately 146 days after the initial report. No CVEs have been assigned to these vulnerabilities.
Arnott publicly disclosed these findings at the DEF CON conference and released a detailed blog post outlining the technical aspects of the vulnerabilities. The widespread use of the Connective system by major financial institutions and government bodies underscores the critical importance of robust security in digital identity solutions.