The Quebec Ministry of Health and Social Services (MSSS) calls on citizens to be vigilant after being made aware of the creation of fake applications on Google Play copying the visual of the VaxiCode application, which serves as a vaccine passport in Province.
“According to the information received, people would have copied the visual developed for the VaxiCode application and would have succeeded in having these fake applications approved for download on Google Play”, indicates a press release issued late Friday evening by the MSSS, which recalls other share that its own applications “are secure” and ensure “the protection of personal information” of Quebecers.
The MSSS also indicates that it quickly took steps with Google to remove these fraudulent applications. These seem to have already been deleted, noted The duty Saturday.
“This type of copy of popular applications is an increasingly frequent problem. Thus, citizens must ensure vigilance to ensure that they download the legitimate official application, ”adds the ministry. To do this, it recommends that citizens ensure that the application they download bears the exact name of the one developed by Quebec, without any other word before or after. The VaxiCode app allows citizens to access several non-essential businesses and public events, while the VaxiCode Check app is used by merchants who need to validate their customers’ QR code.
The co-founder of Hackfest, Patrick Mathieu, also recommends that users of these applications ensure that the author of them is indeed the MSSS. Otherwise, “there is the risk that people download it and that it is a virus,” said the cybersecurity expert. As for the theft of personal data taken from the QR code, which includes the name, date of birth and the list of vaccines received from the persons concerned, the risk is particularly important if a business or the manager of an event accidentally downloads a fake version of the application VaxiCode Verified, estimates Mr. Mathieu.
“If there are merchants who install a Check application that is malicious, they could pass the information of all the customers they scan” to a malicious person, he raises. The MSSS also notes in its press release that merchants who use fake applications to scan the QR code of their customers and keep their personal information “will be subject to sanctions”.
Fight against the pandemic
Cybersecurity expert Steve Waterhouse, for his part, fears that these bogus applications allow unvaccinated people to access public events or certain businesses, as hospitalizations start to rise again in the province.
“Unvaccinated people could end up in events with vaccinated people, which could hamper efforts to fight the pandemic,” he fears. These bogus applications could also contribute to identity theft by malicious people who can supplement their collection of personal data on the web for this purpose, he adds.
In the past few weeks, many flaws have been raised regarding the VaxiCode app. QR codes of several elected members of the National Assembly, including Prime Minister François Legault, had in particular been compromised, leading to threats of prosecution from the Quebec government against the offenders. A computer scientist met by Radio-Canada last month He also said he was amazed at the ease with which he was able to create false vaccine evidence for fictitious people.
“Anyone can modify the application, anyone can upload the data to the scan; we can make fake applications to steal information […] It is the method in place that ultimately allows fraud, ”says Patrick Mathieu.
The latter “blames” the government for “the absence of an official and secure digital identity card” accessible to all Quebecers. In Estonia, such a smart card with a unique identification number allows access to many online services, without compromising the personal data of its users. However, despite the data theft scandal at Desjardins in 2019, Quebec continues to “pull out” in terms of protecting the personal information of its residents, said Mathieu.
Watch video
Reference-feedproxy.google.com