Hijacking accounts left and right via Swedish BankID misconfigurations

No ratings

Presented at SEC-T 2024 by

Tobia Righi

Electronic Identification solutions are everywhere, more and more are popping up after the EUs eIDAS regulation that attempts to achieve a secure way to digitally authenticate individuals. Often these systems are implicitly trusted, however time after time vulnerabilities have been discovered in them, making them very valuable targets for threat actors. The Swedish BankID is a popular eID solution, in this talk I will go over a technical and security overview as well as presenting vulnerabilities found in the most common implementations.