Australia’s vaccine certificates easy to fake due to “obvious” security flaw, says software engineer

Human hand holding smart phone with Digital International Certificate of Covid-19 Vaccination in Time Square, New York City.  The certificate indicates that the holder has been vaccinated against Coronavirus Covid-19. French version.

A Sydney-based software engineer has worked out a way to create a passable forgery of Australia’s digital COVID-19 vaccine certificates.

And he reckons it can be done in just 10 minutes using free software.

Richard Nelson told ABC News an “obvious” security flaw allowed him to make a copy of the proof-of-jab feature in the Medicare app with anyone’s details on it – no vaccine required.

His version even contains the anti-forgery animation used in the background of the certificates.

Nelson said he found the security flaw while playing around on the Medicare app one night.

“It’s a very basic flaw. I thought surely there would be some kind of mitigation to stop this kind of attack, but there wasn’t,” he told the national broadcaster.

“I don’t think it’s a good idea to get it out there among the anti-vax crowd.

“People who don’t have a valid certificate can fairly easily present one — the implications of that are left up to the imagination.”

Just in case our imagination isn’t vivid enough, this means unvaccinated people could use the app to travel internationally when the time comes, chucking a huge spanner in the works for the rest of us by potentially prolonging travel restrictions.

Not to mention risking lives.

Once he realised how easy it was to trick the app, he notified the government with detailed instructions, but told ABC News he has not heard back.

Travel Weekly has reached out to the Department of Health and the office of Employment Minister Stuart Robert, who is responsible for data and digital policy, but is yet to receive a response.

However, a spokesman for Robert told ABC News the government is continuously updating the proof of vaccine certificates.

“The government will continue to iteratively update the proof of vaccination certificates … including bolstering security measures,” the spokesman said.

According to ABC News, other security experts confirmed the flaw should have been picked up in a basic security audit.

Latest News

  • Products

Embrace the journey: Traversing the world with the Shokz OpenRun

If you’ve been on the wrong side of a final call in the airport, or missed the stop on rail journey, it might be time to invest in a pair of Shokz OpenRun headphones. Originally marketed as headphones for fitness fanatics, runners or cyclists with a keen to steer clear of a prang with a car, […]

  • Tour Operators
  • Tourism

TTC: Deals are driving up demand for September trips

The latest market research from TTC Tour Brands shows interest in international leisure travel remains high for 2024, with 77 per cent of Australians over 18 still planning trips this year. Notably, 28 per cent of those travellers are eyeing September for their journeys. Europe continues to be the most popular destination, with 68 per […]

  • Aviation

Qantas ‘working urgently’ to fix app data leak

Qantas is looking into customer reports that passengers have this morning been able to access other passengers’ personal information on the airlines app. X user Lachlan posted that he was able log into different accounts every time he opened the app. My @Qantas app logs me in to a different person each time I open […]

  • Hotels

Revamped Wailoaloa Beach hotel opens as Crowne Plaza Fiji Nadi Bay Resort & Spa

Crowne Plaza Fiji Nadi Bay Resort & Spa is open and ready for bookings after the first phase of a multi-million-dollar transformation. Part of IHG Hotels & Resorts’ premium collection, the transformation has seen the completion of 106 guestrooms showcasing contemporary interiors reflective of the premium Crowne Plaza brand and is a first for the […]

  • Luxury
  • News

Kamalaya Koh Samui clinches clutch of wellness awards

Kamalaya Wellness Sanctuary & Holistic Spa has so far clinched five prestigious awards in 2024, including being inducted into the ‘Hall of Fame’ at the World Spa & Wellness Awards in London. Founders of the Koh Samui sanctuary and spa John and Karina Stewart expressed their heartfelt gratitude for the awards. “We are profoundly honoured […]