#ageverification
Hacking the #EU #AgeVerification app in under 2 minutes. During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory. 1. It shouldn't be encrypted at all - that's a really poor design. 2. It's not cryptographically tied to the vault which contains the identity data. So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app. After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid. Other issues: 1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying. 2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step. Seriously Ursula von der Leyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.
Paul Moore - Security Consultant 3,388,460 views • 1 month ago
Bypassing #EU #AgeVerification using their own infrastructure. I've ported the Android app logic to a Chrome extension - stripping out the pesky step of handing over biometric data which they can leak... and pass verification instantly. Step 1: Install the extension Step 2: Register an identity (just once) Step 3: Continue using the web as normal The extension detects the QR code, generates a cryptographically identical payload and tells the verifier I'm over 18, which it "fully trusts". This isn't a bug... it's a fundamental design flaw they can't solve without irrevocably tying a key to you personally; which then allows tracking/monitoring. Of course, I could skip the enrolment process entirely and hard-code the credentials into the extension... and the verifier would never know.
Paul Moore - Security Consultant 1,174,777 views • 1 month ago
Bypassing the #EU #ageVerification app - part 2. This time, it's v2026.04-2 - which won't run on rooted devices & has encrypted shared preferences. If we ignore the fact they've used a 6 year old deprecated library, they haven't actually solved the problem at all. An attacker can just as easily delete ciphertext as plain text. Ironically, they've tried to solve a problem they don't truly understand... much like the concept itself.
Paul Moore - Security Consultant 70,022 views • 1 month ago
The biometric authentication of the #EU #AgeVerification app can be easily bypass too...
Baptiste Robert31,255 views • 1 month ago
Online gaming platform, Roblox has introduced a new age-verification safety feature, rolling out from December that will prevent children from playing with others outside of their age group and messaging adults they don't know. #Roblox #ageverification #safety #children #facialrecognition
7NEWS Australia45,881 views • 6 months ago
0:43
Sensitive content
This media may contain sensitive content.
No more content to load