{"id":2886,"date":"2018-11-25T23:21:33","date_gmt":"2018-11-25T22:21:33","guid":{"rendered":"http:\/\/mouillere.com\/universconvergents\/?p=2886"},"modified":"2018-11-26T10:59:37","modified_gmt":"2018-11-26T09:59:37","slug":"vulnerabilitie-des-cartes-didentite-electroniques","status":"publish","type":"post","link":"https:\/\/mouillere.com\/universconvergents\/2018\/11\/25\/vulnerabilitie-des-cartes-didentite-electroniques\/","title":{"rendered":"Vuln\u00e9rabiliti\u00e9 des cartes d&#8217;identit\u00e9 \u00e9lectroniques"},"content":{"rendered":"<p>ZDNet consacre un article relatif \u00e0 la vuln\u00e9rabilit\u00e9 du syst\u00e8me de cartes \u00e0 identit\u00e9 \u00e9lectronique (eID) utilis\u00e9 par l\u2019\u00c9tat allemand permettant d&#8217;usurper l&#8217;identit\u00e9 d&#8217;un autre citoyen lors de l&#8217;authentification eID.<\/p>\n<p><!--more--><\/p>\n<p>La vuln\u00e9rabilit\u00e9 ne r\u00e9side pas dans la puce d&#8217;identification par radiofr\u00e9quence (RFID) int\u00e9gr\u00e9e dans les cartes eID mais dans le SDK utilis\u00e9 par les \u00e9diteurs de sites Internet souhaitant prendre en charge l&#8217;authentification eID. Governikus Autent SDK est l&#8217;un des SDK utilis\u00e9s par les sites Internet et portails gouvernementaux pour prendre en charge les proc\u00e9dures de connexion et d&#8217;enregistrement bas\u00e9es sur l&#8217;eID.<\/p>\n<p>&nbsp;<\/p>\n<p>La proc\u00e9dure d&#8217;authentification consiste \u00e0:<\/p>\n<ol>\n<li>ins\u00e8rer sa carte eID dans un lecteur de carte ou utiliser son smartphone puis entrer son code PIN\u00a0;<\/li>\n<li>v\u00e9rifier la demande de connexion via l&#8217;application client eID et produire une signature de v\u00e9rification cryptographique renvoy\u00e9e vers le service en ligne. La r\u00e9ponse eID (signature et donn\u00e9es personnelles de l&#8217;utilisateur) envoy\u00e9e au service en ligne permet de finaliser la proc\u00e9dure d&#8217;authentification bas\u00e9e sur l&#8217;eID.<\/li>\n<\/ol>\n<p>La faille de s\u00e9curit\u00e9 se trouverait au niveau de la transmission des donn\u00e9es personnelles de l&#8217;utilisateur.<\/p>\n<p>Cependant, la vuln\u00e9rabilit\u00e9 ne concerne pas tous les services prenant en charge l&#8217;authentification eID, notamment les services en ligne ayant mis en en \u0153uvre la pseudonymisation (au lieu d&#8217;envoyer les donn\u00e9es de l&#8217;utilisateur avec chaque demande d&#8217;authentification). En outre, toutes les r\u00e9ponses d&#8217;authentification eID \u00e9tant journalis\u00e9es, les attaques peuvent \u00eatre d\u00e9tect\u00e9es en temps r\u00e9el, bloquant ainsi les attaquants qui tentent de falsifier leur identit\u00e9 avant de se connecter.<\/p>\n<p>&nbsp;<\/p>\n<p>Il s\u2019agit donc d\u2019une faille diff\u00e9rente du probl\u00e8me cryptographique d\u00e9couvert dans plus de 750.000 cartes d&#8217;identit\u00e9 estoniennes en 2017 ayant contraint le gouvernement estonien de remplacer toutes les cartes concern\u00e9es pour emp\u00eacher les op\u00e9rations frauduleuses sur les portails gouvernementaux.<\/p>\n<p>&nbsp;<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe loading=\"lazy\" class=\"youtube-player\" width=\"1110\" height=\"625\" src=\"https:\/\/www.youtube.com\/embed\/kaATyYmpiIE?version=3&#038;rel=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;fs=1&#038;hl=fr-FR&#038;autohide=2&#038;wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\"><\/iframe><\/span><\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/www.zdnet.fr\/actualites\/le-systeme-allemand-de-carte-d-identite-electronique-vulnerable-a-l-usurpation-d-identite-en-ligne-39876925.htm\" target=\"_blank\" rel=\"noopener\">https:\/\/www.zdnet.fr\/actualites\/le-systeme-allemand-de-carte-d-identite-electronique-vulnerable-a-l-usurpation-d-identite-en-ligne-39876925.htm<\/a><\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/www.bsi.bund.de\/EN\/Topics\/ElectrIDDocuments\/EID_node.html\" target=\"_blank\" rel=\"noopener\">https:\/\/www.bsi.bund.de\/EN\/Topics\/ElectrIDDocuments\/EID_node.html<\/a><\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/sec-consult.com\/en\/blog\/2018\/11\/my-name-is-johann-wolfgang-von-goethe-i-can-prove-it\/\" target=\"_blank\" rel=\"noopener\">https:\/\/sec-consult.com\/en\/blog\/2018\/11\/my-name-is-johann-wolfgang-von-goethe-i-can-prove-it\/<\/a><\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/edri.org\/estonian-eid-cryptography-mess-750000-cards-compromised\/\" target=\"_blank\" rel=\"noopener\">https:\/\/edri.org\/estonian-eid-cryptography-mess-750000-cards-compromised\/<\/a><\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/www.reuters.com\/article\/estonia-gemalto\/estonia-sues-gemalto-for-152-mln-euros-over-id-card-flaws-idUSL8N1WD5JZ\" target=\"_blank\" rel=\"noopener\">https:\/\/www.reuters.com\/article\/estonia-gemalto\/estonia-sues-gemalto-for-152-mln-euros-over-id-card-flaws-idUSL8N1WD5JZ<\/a><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>ZDNet consacre un article relatif \u00e0 la vuln\u00e9rabilit\u00e9 du syst\u00e8me de cartes \u00e0 identit\u00e9 \u00e9lectronique (eID) utilis\u00e9 par l\u2019\u00c9tat allemand permettant d&#8217;usurper l&#8217;identit\u00e9 d&#8217;un autre citoyen lors de l&#8217;authentification eID.<\/p>\n","protected":false},"author":1,"featured_media":2887,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[87,20,16],"tags":[],"class_list":["post-2886","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-banking-payment","category-cybersecurite","category-donnees-personnelles"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2018\/11\/german-eid-auth-process.png?fit=600%2C301&ssl=1","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p6jw1p-Ky","jetpack-related-posts":[{"id":2965,"url":"https:\/\/mouillere.com\/universconvergents\/2019\/05\/14\/kit-de-bonnes-pratiques-de-la-cnil-a-destination-des-developpeurs\/","url_meta":{"origin":2886,"position":0},"title":"Kit de bonnes pratiques de la CNIL \u00e0 destination des d\u00e9veloppeurs","author":"Fred","date":"14 mai 2019","format":false,"excerpt":"La CNIL vient de publier un kit des bonnes pratiques \u00e0 appliquer d\u00e8s la conception d\u2019une solution IT (Code, SDK, biblioth\u00e8ques, etc.) selon le principe GDPR de Privacy by Design afin d\u2019am\u00e9liorer la gestion des donn\u00e9es et s\u00e9curiser les projets. https:\/\/www.cnil.fr\/fr\/kit-developpeur Les premi\u00e8res recommandations visent le choix des outils de\u2026","rel":"","context":"Dans &quot;Donn\u00e9es personnelles&quot;","block_context":{"text":"Donn\u00e9es personnelles","link":"https:\/\/mouillere.com\/universconvergents\/category\/it\/donnees-personnelles\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2015\/06\/6640564215_b3dc3f033d.jpg?fit=450%2C287&ssl=1&resize=350%2C200","width":350,"height":200},"classes":[]},{"id":2850,"url":"https:\/\/mouillere.com\/universconvergents\/2018\/10\/15\/tokenisation-paiement-et-authentification\/","url_meta":{"origin":2886,"position":1},"title":"Tokenisation, Paiement et Authentification","author":"Fred","date":"15 octobre 2018","format":false,"excerpt":"En mati\u00e8re de paiement, la tokenisation est le remplacement d\u2019\u00e9l\u00e9ments sensibles comme le PAN (Primary Account Number ou num\u00e9ro figurant au recto de votre carte bancaire) par des \u00e9l\u00e9ments moins sensibles appel\u00e9s tokens (ou jetons) li\u00e9s \u00e0 des appareils (mobiles, tablettes, IoT). L\u2019enr\u00f4lement (ou la demande d\u2019\u00e9mission d\u2019un jeton associ\u00e9\u2026","rel":"","context":"Dans &quot;Banking &amp; Payment&quot;","block_context":{"text":"Banking &amp; Payment","link":"https:\/\/mouillere.com\/universconvergents\/category\/it\/banking-payment\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2018\/10\/tokenization.png?fit=765%2C430&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2018\/10\/tokenization.png?fit=765%2C430&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2018\/10\/tokenization.png?fit=765%2C430&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2018\/10\/tokenization.png?fit=765%2C430&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":2878,"url":"https:\/\/mouillere.com\/universconvergents\/2018\/11\/07\/vers-la-fin-annoncee-des-sms-dauthentification-des-paiements\/","url_meta":{"origin":2886,"position":2},"title":"Vers la fin annonc\u00e9e des SMS d\u2019authentification des paiements","author":"Fred","date":"7 novembre 2018","format":false,"excerpt":"Le SMS (SMS-OTP pour \u00abOne Time Password\u00bb) qui permet de valider la plupart des achats sur Internet devra \u00eatre remplac\u00e9 d\u00e8s septembre 2019 par des syst\u00e8mes d'identification plus performants. Une authentification forte est traditionnellement d\u00e9finie comme l\u2019utilisation de plusieurs facteurs pour authentifier l\u2019utilisateur d\u2019un moyen de paiement : la connaissance,\u2026","rel":"","context":"Dans &quot;Banking &amp; Payment&quot;","block_context":{"text":"Banking &amp; Payment","link":"https:\/\/mouillere.com\/universconvergents\/category\/it\/banking-payment\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2018\/11\/digital-payment.jpg?fit=1170%2C480&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2018\/11\/digital-payment.jpg?fit=1170%2C480&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2018\/11\/digital-payment.jpg?fit=1170%2C480&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2018\/11\/digital-payment.jpg?fit=1170%2C480&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2018\/11\/digital-payment.jpg?fit=1170%2C480&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":2754,"url":"https:\/\/mouillere.com\/universconvergents\/2018\/03\/22\/la-directive-europeenne-sur-les-services-de-paiement-dsp2\/","url_meta":{"origin":2886,"position":3},"title":"La Directive europ\u00e9enne sur les Services de Paiement (DSP2)","author":"Fred","date":"22 mars 2018","format":false,"excerpt":"La Directive europ\u00e9enne sur les Services de Paiement (DSP2) qui r\u00e9forme la premi\u00e8re directive adopt\u00e9e en 2009 et d\u00e9finissant un cadre juridique pour la mise en place d'un march\u00e9 europ\u00e9en unique des paiements, est entr\u00e9e en vigueur le 13 janvier 2018. La DSP2 a pour objectif de cr\u00e9er un march\u00e9\u2026","rel":"","context":"Dans &quot;Donn\u00e9es personnelles&quot;","block_context":{"text":"Donn\u00e9es personnelles","link":"https:\/\/mouillere.com\/universconvergents\/category\/it\/donnees-personnelles\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2018\/03\/CBqt6UsSSPQ-ckxEyiUJkjl72eJkfbmt4t8yenImKBVvK0kTmF0xjctABnaLJIm9.jpg?fit=467%2C226&ssl=1&resize=350%2C200","width":350,"height":200},"classes":[]},{"id":6231,"url":"https:\/\/mouillere.com\/universconvergents\/2024\/09\/10\/bonnes-et-mauvaises-pratiques-des-parcours-digitaux-et-de-consentement\/","url_meta":{"origin":2886,"position":4},"title":"Bonnes et mauvaises pratiques des parcours digitaux et de consentement","author":"Fred","date":"10 septembre 2024","format":false,"excerpt":"Face aux Dark patterns, Consent or Pay et autres pratiques n'ayant pour seule finalit\u00e9 que de vicier le consentement, la F\u00e9d\u00e9ration des Tiers de Confiance du Num\u00e9rique (FnTC) publie un guide sur les bonnes pratiques des parcours digitaux et de consentement. \u00a0 Bonnes pratiques https:\/\/youtu.be\/e961QKnKxYI Le Guide de bonnes pratiques\u2026","rel":"","context":"Dans &quot;Donn\u00e9es personnelles&quot;","block_context":{"text":"Donn\u00e9es personnelles","link":"https:\/\/mouillere.com\/universconvergents\/category\/it\/donnees-personnelles\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2024\/09\/DarkPatterns.png?fit=1200%2C803&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2024\/09\/DarkPatterns.png?fit=1200%2C803&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2024\/09\/DarkPatterns.png?fit=1200%2C803&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2024\/09\/DarkPatterns.png?fit=1200%2C803&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2024\/09\/DarkPatterns.png?fit=1200%2C803&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3260,"url":"https:\/\/mouillere.com\/universconvergents\/2019\/11\/02\/cybersecurite-et-vulnerabilite-humaine\/","url_meta":{"origin":2886,"position":5},"title":"Cybers\u00e9curit\u00e9 et vuln\u00e9rabilit\u00e9 humaine","author":"Fred","date":"2 novembre 2019","format":false,"excerpt":"Maddyness publie un int\u00e9ressant article sur une r\u00e9cente \u00e9tude de l'entreprise de cybers\u00e9curit\u00e9 Proofpoint qui met en avant le facteur humain \u00e0 l\u2019origine des cyber-attaques. Sur les 300 cadres interrog\u00e9s, 86% indiquent avoir subi une cyber-attaque au cours des 3 derni\u00e8res ann\u00e9es. Pour 48% des cadres interrog\u00e9s, les failles humaines\u2026","rel":"","context":"Dans &quot;Cybers\u00e9curit\u00e9&quot;","block_context":{"text":"Cybers\u00e9curit\u00e9","link":"https:\/\/mouillere.com\/universconvergents\/category\/it\/cybersecurite\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2015\/07\/Cyber-Security.jpg?fit=1200%2C829&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2015\/07\/Cyber-Security.jpg?fit=1200%2C829&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2015\/07\/Cyber-Security.jpg?fit=1200%2C829&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2015\/07\/Cyber-Security.jpg?fit=1200%2C829&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/mouillere.com\/universconvergents\/wp-content\/uploads\/2015\/07\/Cyber-Security.jpg?fit=1200%2C829&ssl=1&resize=1050%2C600 3x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/mouillere.com\/universconvergents\/wp-json\/wp\/v2\/posts\/2886","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mouillere.com\/universconvergents\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mouillere.com\/universconvergents\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mouillere.com\/universconvergents\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mouillere.com\/universconvergents\/wp-json\/wp\/v2\/comments?post=2886"}],"version-history":[{"count":1,"href":"https:\/\/mouillere.com\/universconvergents\/wp-json\/wp\/v2\/posts\/2886\/revisions"}],"predecessor-version":[{"id":2888,"href":"https:\/\/mouillere.com\/universconvergents\/wp-json\/wp\/v2\/posts\/2886\/revisions\/2888"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mouillere.com\/universconvergents\/wp-json\/wp\/v2\/media\/2887"}],"wp:attachment":[{"href":"https:\/\/mouillere.com\/universconvergents\/wp-json\/wp\/v2\/media?parent=2886"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mouillere.com\/universconvergents\/wp-json\/wp\/v2\/categories?post=2886"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mouillere.com\/universconvergents\/wp-json\/wp\/v2\/tags?post=2886"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}