Belgian eID Software Had Holes Big Enough to Sign Away Your Life
Two million Belgians were using browser software riddled with serious security flaws, and nobody knew until a researcher decided to take a proper look.
The software in question is Connective, built by Nitro Software Belgium. It handles digital identity authentication and legally binding electronic signatures. Eight of Belgium's ten largest banks use it. So do more than 60 government agencies. It is, in other words, load-bearing infrastructure for an entire country's digital bureaucracy.
James Arnott, founder of Bay Area Labs, found the problems and presented his findings at DEF CON. The short version: the software had no meaningful checks on which websites were allowed to talk to it.
That single omission opened up a cascade of nasty possibilities. Any website, including something as mundane as a page running third-party ad scripts, could silently interact with the Connective application installed on a visitor's machine. No user action required.
From there it gets worse. A malicious site could quietly read details from any connected eID card or payment card. It could also pop up what looked like a legitimate authentication prompt, with customisable text and no indication of which domain was actually making the request. Users would see an official-looking PIN dialog. They'd have no way to know it was fake.
When a user typed in their PIN, the application sent it straight back to whoever asked for it. Armed with that PIN and a physical eID card plugged into the victim's card reader, an attacker could generate approval tokens and forge legally binding electronic signatures. That's not a theoretical edge case. That's identity fraud with a legal wrapper.
The knock-on effects stretched beyond the Connective software itself. Services like CSAM.be and third-party identity providers such as Itsme rely on eID signatures as part of their trust model. Neither had any vulnerabilities of their own, but they didn't need to. If an attacker had the ability to forge signatures, they could register or take over accounts on those platforms anyway. The foundation was cracked.
Arnott also found a separate remote code execution flaw that had nothing to do with eID cards at all. This one exploited how the application handled local files. The attack path was straightforward: get a user to download a file disguised as something ordinary, then have them visit a webpage. That's it. No elevated permissions needed. The application would execute attacker-controlled code at user level.
It gets more uncomfortable. Because the flaw could be triggered passively and required no special access, Arnott noted it carried worm-like potential, hijacking credentials to push malicious links to other victims and spreading from there.
Nitro fixed everything 146 days after Arnott's initial report. The patch blocked unauthorised origin requests and locked down PIN handling, with full enforcement wrapped up in late July. For their trouble, Arnott received a $200 bug bounty. No CVEs appear to have been assigned.
Nitro hasn't commented publicly. Given the scale of what was sitting in their software, that silence is doing a lot of heavy lifting.