Critical Vulnerabilities in Belgium’s Connective Signing Extension Exposed Millions to Fraud and RCE Security researchers uncovered severe flaws in the Connective Signing Extension, a browser component used by over 2 million people in Belgium for accessing electronic identity (eID) cards and Maestro payment cards. The now-patched vulnerabilities could have enabled attackers to steal eID PINs, harvest card data, forge signing requests, and execute malicious code on Windows devices all with minimal user interaction. ### How the Flaws Worked The extension acts as a bridge between websites, a browser plugin, and a native application that communicates with smart-card readers. However, researchers from Have I Been Pwned identified multiple critical weaknesses: 1. Token Replay Attacks – The extension failed to properly validate the origin of requests, allowing malicious websites to replay tokens issued to legitimate services. This could let attackers interact with the native host and extract data from connected eID or Maestro cards without the user’s knowledge. 2. PIN Phishing via Fake Dialogs – Attackers could display native-looking PIN prompts with custom titles and messages, impersonating trusted banking or government services. The stolen PIN, combined with access to an eID card, could enable unauthorized authentication or document signing. 3. Drive-By Remote Code Execution (RCE) – A command in the native host could load a library from an attacker-controlled path. By tricking users into downloading a malicious file, attackers could execute arbitrary code at the current user’s privilege level, even without an eID card connected. ### Broader Impact Belgium’s eID system is integral to banking, public services, and legally binding electronic signatures under the EU’s eIDAS regulation. A compromised signing capability could facilitate account takeovers, fraudulent identity verification, or large-scale identity theft. Researchers demonstrated an account takeover involving Belgium’s CSAM (Child Abuse Material) reporting system, though impacts on other platforms depended on additional security controls. ### Remediation Timeline Nitro Software Belgium, the company behind Connective and an EU-listed Qualified Trust Service Provider, deployed fixes in stages: - Disabled the risky library-loading feature. - Modified PIN-token handling to prevent decryption by malicious sites. - Enforced origin checks for all requests. The final patch was released 146 days after the initial report, though no CVEs were assigned at the time of disclosure. The vulnerabilities highlight the risks of third-party identity and payment integrations, particularly in high-trust environments like government and financial services.