- [2020-03-10] The company Unicount has developed an e-service which allows companies to be registered in Estonia using Smart-ID. Companies in the Estonian Business Register can only be directly registered using an ID card or Mobile-ID. The Smart-ID company registration service provided by Unicount is using the company registration API that has been offered since 2017 by the Estonian Business Register.
https://www.ituudised.ee/uudised/2020/03/10/tanasest-saab-ettevotteid-asutada-smart-idga
https://news.err.ee/1061645/estonian-companies-can-now-be-established-using-only-smart-id
https://www.baltictimes.com/estonia__1st_company_founded_with_use_of_smart-id_registered_on_tuesday/ - [2020-03-06] A large-scale cyber attack simulation exercise developed by CybExer Technologies was conducted bringing together 12 Estonian companies and institutions.
https://news.err.ee/1060615/cyber-exercise-brings-together-defense-league-public-and-private-sector - [2020-03-03] Yet another cybersecurity index has placed Estonia in the 58th position. According to the study, 1.59% of mobiles and 13.2% of computers in Estonia are infected with malware.
https://www.comparitech.com/blog/vpn-privacy/cybersecurity-by-country/ - [2020-02-26] For several years, the Estonian ID card software recognized digital signatures created with revoked certificates as valid signatures. Software libraries used by Estonian e-service providers are likely still affected. The EU-developed eSignature DSS library and libraries used in other EU countries are also affected.
https://www.delfi.ee/news/paevauudised/eesti/tartu-ulikooli-turvaspetsi-jarjekordne-avastus-id-kaardi-tarkvaras-oli-aastaid-kriitiline-auk?id=89080065
https://www.youtube.com/watch?v=eYG17IGOCi0 - [2020-02-26] A Smart-ID account can now be created using biometrics. In the enrollment process the Smart-ID app over NFC retrieves person’s photo from their biometrical passport and uses phone’s camera to perform face recognition. For biometrical passport reading Smart-ID uses Dutch company’s InnoValor NFC-based ReadID software, but for face recognision a cloud service provided by UK company iProov. Contrary to the claims, the security guarantees provided by this technology are quite weak, since the facial verification technology at best can verify only the presence of the person and not their intent to create a Smart-ID account. Fortunately, the person is required to confirm their intent either using previous Smart-ID account (including non-qualified) or a security code sent over email or SMS.
https://digi.geenius.ee/rubriik/uudis/riik-vottis-biomeetriliste-passide-toega-smart-id-labivaatamiseks-ajapikendust/
https://tehnika.postimees.ee/6884293/smart-id-kasutajad-peavad-olema-valmis-uuenduseks
https://digi.geenius.ee/rubriik/uudis/smart-id-kasutajaks-saab-nuud-biomeetriaga-kuidas-see-kaib/
https://news.err.ee/1056955/biometric-registration-made-available-to-users-of-smart-id
https://www.iproov.com/newsroom/blog/estonian-digital-identity-with-iproov - [2020-02-26] Self-censorship at UT. The university decided not to publish an article in the University of Tartu magazine, Universitas Tartuensis, about a cooperation agreement between the university and Huawei. Since the Chinese company Huawei is perceived as a potential threat to national security, the Huawei topic has become sensitive.
https://ekspress.delfi.ee/kuum/tartu-ulikool-keelas-ajakirjanikul-huawei-teemalise-artikli-avaldamise?id=89042773
https://www.err.ee/1058339/tartu-ulikool-lubab-huaweiga-koostood-tehes-jargida-eesti-julgeolekuhuve
https://news.err.ee/1056839/paper-university-of-tartu-refused-to-publish-article-on-huawei - [2020-02-25] Teachers and system owners of e-school environments are discussing the acceptable duration of an authenticated session after which the user is automatically logged out. According to RIA, session length is not specified in the ISKE implementation guide and it is up to the system owner.
https://digi.geenius.ee/rubriik/uudis/opetajate-protest-e-opilaspaevikiku-kasutusmugavuse-osas-toi-kaasa-turvariski/ - [2020-02-20] The e-shop reset.ee closed its doors leaving at least 275 customers without money. The police do not consider it a scam but a a civil offense, inviting victims to file a claim in the bankruptcy proceedings.
https://digi.geenius.ee/rubriik/uudis/tarbijakaitse-saatis-politseisse-reseti-asjus-kuriteoteate-aga-politsei-ei-alusta-uurimist/ - [2020-02-12] The state pays for Smart-ID on a per use basis – the more users use Smart-ID, the more the state will have to pay (SK offers volume discounts). Smart-ID users outnumber Mobile-ID users two-to-one today. At the end of 2019, there were 230,000 Mobile-ID users and 430,000 Smart-ID users.
https://news.postimees.ee/6898254/estonia-to-create-new-digital-identification-tool - [2020-02-12] The state’s Mobile-ID contract will expire in 2022. RIA and PPA will announce the procurement for a new eID solution this year. The state does not want to copy Smart-ID, but instead use something else possibly based on biometrics.
https://news.postimees.ee/6898254/estonia-to-create-new-digital-identification-tool
https://tehnika.postimees.ee/6897706/eesti-asub-looma-uut-inimeste-tuvastamise-vahendit - [2020-02-12] The Estonian Foreign Intelligence Service has published their 2020 report. It contains a section on Russian cyber operations in 2019 and mentions potential Chinese threats including Huawei.
https://www.valisluureamet.ee/pdf/raport-2020-en.pdf - [2020-02-12] A ridiculous incident was reported which highlighted the core weakness in Mobile-ID (and Smart-ID). A customer of Luminor Bank unexpectedly logged into a stranger’s bank account. The customer accidentally entered the wrong username and the correct owner of the username confirmed the login with his Mobile-ID. The bank acknowledged that similar incidents have happened before. SEB bank also confirmed similar incidents.
https://epl.delfi.ee/uudised/kogemata-voorale-kontole-turvarisk-toob-netipanka-uue-lahtri?id=88906895 - [2020-02-12] RIA is analyzing the risks of enabling i-voting on iOS and Android mobile devices. It will also have to be decided whether to allow voting using Smart-ID in the next elections. The final decision will rest with the National Electoral Committee.
https://news.postimees.ee/6898254/estonia-to-create-new-digital-identification-tool
https://digi.geenius.ee/rubriik/uudis/riik-otsustab-juba-jargmisel-kuul-kas-valimistel-saab-e-haalt-anda-smart-id-ga/ - [2020-02-11] RIA and PPA launched a cybercrime information website (cyber.politsei.ee) where people are asked to report suspicious emails, account hijacking, money stolen from accounts, etc. The data will be used to inform the public about new crime schemes and to help investigate cases.
https://news.err.ee/1033928/police-launch-cybercrime-information-website - [2020-02-10] After the Tartu Smart Bike Share website had a security flaw which gave access to personal data of registered users, the Data Protection Inspectorate conducted a proceeding on the activities of the Tartu City Government over a longer period of time and concluded that the data leak did not pose a risk to users.
https://digi.geenius.ee/rubriik/uudis/tartu-rattaringluse-andmeleke-ei-kujutanud-kasutajatele-ohtu/ - [2020-02-05] The Estonian ID software introduced an option to sign documents with Smart-ID. Smart-ID signing in DigiDoc4 client uses the additional security measure of the Smart-ID app – the users have to choose the right verification code out of three (similar to LHV bank). Smart-ID support is also planned for Android and iOS DigiDoc apps.
https://digi.geenius.ee/rubriik/uudis/riik-lisab-digiallkirjastamise-tarkvarale-smart-id-toe-soov-on-see-lisada-ka-mobiiliappidele/
https://www.id.ee/index.php?id=39777
https://www.ria.ee/et/uudised/ria-id-tarkvara-voimaldab-nuudsest-smart-idga-digiallkirjastada.html - [2020-02-04] Remote verification will be launched in the e-Notary self-service portal enabling notarial acts to be carried out at Estonia’s foreign representations without physically visiting a notary’s office. In order to perform remote verification, the customer will need an Estonian ID-card, digital ID, Mobile-ID or an e-resident’s digital ID. The personal identification system of the participants will use Veriff’s biometric face recognition technology.
https://news.err.ee/1031373/notary-acts-can-be-carried-out-in-foreign-embassies-from-february
https://www.err.ee/1034421/eesti-notarite-koda-loi-voimaluse-sooritada-toiminguid-interneti-kaudu
https://news.err.ee/1063131/estonian-embassies-join-e-notar-distant-authentication-pilot-project - [2020-01-30] RIA introduced a state signing service (SiGa) to replace DigiDocService. The service allows the creation of documents digitally signed with ID card and Mobile-ID and the validation of signatures. The service is provided to all persons performing public tasks. The software used by the service is public and allows anyone to run a similar service themselves.
https://www.ria.ee/et/uudised/ria-vastvalminud-riigi-allkirjastamisteenus-hoiab-asutuse-kulusid-kokku.html - [2020-01-17] UT, CybExer Technologies, NATO CCDCOE, Thinnect and Elisa Eesti will create a cyber defense environment in the simulation of critical information infrastructure protection on a cyber training ground (whatever it is).
https://news.err.ee/1025354/project-started-to-make-cyberdefense-for-public-and-private-infrastructure - [2020-01-16] A draft bill initiated by MKM would require telecoms to seek state permission when introducing new hardware and software. The security of any new tech will additionally be monitored by RIA, the Internal Security Service (ISS) and the state’s foreign intelligence agency. The restrictions are likely motivated to keep 5G networks away from the Chinese company Huawei, which is suspected of being controlled by the communist Chinese government.
https://tehnika.postimees.ee/6826879/eesti-sidetehnika-hakkab-labima-julgeolekukontrolli
https://tehnika.postimees.ee/6859100/it-minister-karu-esimene-tagasilook-oluline-eelnou-tunnistati-pohiseaduse-vastaseks
https://www.ituudised.ee/uudised/2020/01/28/valitsus-tahab-oigust-lubada-ning-keelata-eesti-sidevorkudes-kasutatavat-tehnoloogiat
https://tehnika.postimees.ee/6873351/minister-karu-noudis-huaweilt-aru
https://tehnika.postimees.ee/6871738/eesti-hakkab-tehnikat-politiseerima
https://www.ituudised.ee/uudised/2020/03/16/sidevorkude-turvalisust-puudutav-eelnou-sai-taiendust-ja-saadeti-teisele-lugemisele
https://news.err.ee/1020859/telecoms-security-bill-may-exclude-huawei-from-estonian-market-firm-says - [2020-01-15] Estonian-based web security company WebARX found a critical vulnerability in the popular WordPress plugin InfiniteWP Client and WP Time Capsule.
https://digi.geenius.ee/rubriik/uudis/eesti-veebiturbe-ettevote-leidis-kriitilise-haavatavuse-mis-mojutab-poolt-miljonit-veebilehte/ - [2020-01-14] Cybernetica will create an automated threat information system between the US Air Force and the Estonian Defense Forces. The US-Estonian cyber-security alert information exchange system will cost €3.54 million. The contract was granted to Cybernetica without competition.
https://tehnika.postimees.ee/6873957/cybernetica-sai-riigilt-magusa-miljonilepingu-ilma-konkurentsita
https://www.err.ee/1023814/eesti-ja-usa-alustasid-kuberkaitsealast-koostood-ohuteabe-vahetamiseks
https://news.err.ee/1023833/estonia-and-the-us-to-build-joint-cyber-threat-intelligence-platform - [2020-01-14] In 2019, PPA instituted 12 disciplinary proceedings due to police officers making non-work related inquiries to the police information system. The police officer who made 35 queries was fired.
https://digi.geenius.ee/rubriik/uudis/politsei-karistas-uheksat-ametnikku-andmebaaside-vaarkasutamise-eest-uks-kaotas-too/ - [2020-01-10] Due to technical issues at RIA, the notification service using @eesti.ee email address was disrupted between December 19 and January 7. In total 85,000 emails were not delivered in this period.
https://tehnika.postimees.ee/6869462/rikke-tottu-ei-joudnud-85-000-riigi-ametlikku-teadet-inimesteni - [2020-01-10] Geenius has contacted the biggest banks in Estonia, asking whether they have enabled security features to prevent criminals using their domain names in e-mail spoofing attacks. Danske Bank, Svenska Handelsbanken, Citadele, SEB and Bigbank has introduced DMARC to prevent e-mail spoofing attacks. Swedbank is still (already for a half a year) considering implementing DMARC. In LHV’s opinion, DMARC implementation is too complicated.
https://digi.geenius.ee/rubriik/uudis/eesti-pangad-on-hakanud-agaramalt-kasutama-tehnoloogiat-millega-e-kirja-pettuseid-valtida/ - [2020-01-08] A family doctor helpline service has been opened offering personalized advice. The hotline staff will have access to a patient’s medical records if the caller grants consent authenticating with Mobile-ID or Smart-ID.
https://news.err.ee/1021433/family-doctors-advice-helpline-cannot-issue-repeat-prescriptions - [2020-01-07] The court denied the early release of Aleksei Vasilev, a 20-year-old student from Kingisepp convicted for finding flaws in the computer networks of Estonian state agencies on the orders of FSB. His 4-year sentence will end on November 4, 2021.
https://news.err.ee/1021428/court-denies-early-release-to-russian-man-convicted-of-working-for-fsb
https://news.err.ee/1010629/court-to-discuss-releasing-juvenile-convicted-of-spying-for-fsb-early - [2020-01-04] The Minister of the Interior was asked how many cases of illegal surveillance have been investigated by authorities. According to the response, 17 cases of private surveillance were registered in 2016, 71 cases in 2017, 22 cases in 2018 and 24 cases in 2019. There was one confirmed case of illegal surveillance and covert listening in 2017.
https://news.err.ee/1020497/authorities-not-interested-in-former-minister-s-bugged-office-claims - [2020-01-03] The database leakage of e-shop charlot.ee will be investigated by Latvian Data Protection Inspectorate, as the leaked database contained more data about clients in Latvia.
https://digi.geenius.ee/rubriik/uudis/eesti-ajaloo-suurimat-e-poe-andmeleket-uurivad-edasi-latlased/ - [2020-01-03] SK ID Solutions has paid a contractual penalty to AS LHV Pank for disruptions in the functioning of the Mobile-ID service, as the maximum permitted downtime of 45 minutes was exceeded in 2019. SEB, Swedbank and Luminor refused to disclose whether they have sought contractual penalties from SK ID Solutions.
https://news.err.ee/1020240/sk-id-solutions-pays-penalty-to-lhv-for-disruptions-in-mobile-id-service - [2020-01-01] Personnel rotation in RIA. In December, Andrus Kaarelson, Deputy Director General of the State Information System Branch at the RIA has left RIA returning to work in the private sector. Margus Arm, previously the head of the Electronic Identity Department has been appointed Deputy Director General of the State Information System Branch. The new head of RIA’s Electronic Identification Department is now Mark Erlich. In December, Lauri Aasmann took over as the new RIA Deputy Director General for Cybersecurity. Aasmann came to RIA from the NATO CCD COE, where he led a team of lawyers. Previously, he worked as a lawyer at Swedbank AS and as a prosecutor at the Northern District Prosecutor’s Office and Tallinn Prosecutor’s Office, where he dealt with white-collar crime and cybercrime.
https://www.err.ee/1010537/ria-kuberturvalisuse-teenistuse-juhiks-sai-lauri-aasmann
https://news.err.ee/1020294/margus-arm-appointed-state-information-system-chief-at-ria
https://www.ria.ee/et/uudised/ria-peadirektori-asetaitjaks-sai-margus-arm.html
https://digi.geenius.ee/rubriik/uudis/riigi-infosusteemi-ameti-uks-tippjuhte-suundub-toole-erasektorisse/
https://www.ria.ee/et/uudised/olukord-kuberruumis-detsember-2019.html - [2019-12-31] A software engineer found a flaw in the Elisa home router which gives access to the management password and access to the router over SSH. Elisa claims that this flaw can only be used by clients themselves, but cannot be used to access other client’s devices.
https://digi.geenius.ee/rubriik/uudis/elisa-koduinterneti-ruuterist-avastati-turvaauk-mis-voimaldab-saada-ligipaasu-tehnilise-kasutaja-paroolile/ - [2019-12-28] Märt Põder gave the presentation “DEBRIEF ON E-VOTING IN ESTONIA” at the 36th Chaos Communication Congress (36C3), explaining his view on the i-voting in Estonia.
https://events.ccc.de/congress/2019/wiki/index.php/Projects:Netizen_index_of_e-voting_requirements
https://docs.google.com/presentation/d/1ON01Fej5w7cnBmTsTIxnaoWFIh_LhuuaoAGkKFAZ0EE/edit?folder=0AKv1cHIDbJwmUk9PVA
https://twitter.com/trtram/status/1211007098194219009 - [2019-12-23] A fraud case involving fake tara deposit checks caused €12,925 in damages. The fake checks were printed with a cashier printer on the same paper as the real checks. The criminals understood the composition of the bar code and configured the printer so that the printout would deceive the Maxima checkout system that prevents the use of a copy of a check receipt. It turned out that the checks were printed by IT specialist from the company that serviced tara vending machines at Maxima stores. The criminals were tracked down using CCTV footage that is stored by the store for 30 days.
https://ekspress.delfi.ee/kuum/aasta-krimiullatus-voltsitud-taaratsekkidega-raha-kokku-ajanud-kelmid-tootasid-nagu-mafioosod?id=88435809 - [2019-12-23] The Supreme Court expressed its position in the case where a woman gave her ID card and PIN codes voluntarily to a man who ordered some merchandise in her name from Telia e-shop using ID card authentication. The case has been sent back to district court. According to the Supreme Court, in case the owner voluntarily gives his ID card with PIN codes to another person who uses the ID card to enter into a transaction, the transaction (or digital signature) may be valid based on the provisions of “entry into transaction through representative” (General Part of the Civil Code Act – GPoCCA – Chapter 8). As the court referenced GPoCCA § 131, this construction can still be attacked and the signed contract later annulled.
https://ekspress.delfi.ee/sisuturundus/e-identimise-vahendite-turvalisest-hoidmisest-ja-tehingutest?id=88465617
https://www.riigikohus.ee/et/lahendid?asjaNr=2-16-124450/77 - [2019-12-21] MyHits radio uploaded, on Google Docs, a publicly available document containing names, phone numbers and email addresses of all participants in their prize game. The link was embedded in the source code of the prize game website. The subjects and Data Protection Inspectorate have been informed.
https://digi.geenius.ee/rubriik/uudis/myhitsi-auhinnamangu-osalejate-andmed-olid-koigile-huvilistele-kattesaadavad/ - [2019-12-20] A group of Estonians used blank chip and PIN cards containing stolen credit card data to empty bank accounts of Indian, Bangladeshi and Pakistani victims. The criminals also attempted to order 17 phones in total from Klick using a Japanese credit card, but were reported to the police.
https://news.postimees.ee/6855114/estonian-gang-emptied-indian-bank-accounts - [2019-12-19] The Supreme Court of Estonia ruled that the bill expanding EDF surveillance rights is unconstitutional. The court said that the covert collection and processing of personal data may be necessary for the effective defense of domestic and external peace, however, legislation should establish efficient procedural guarantees similar to those set out in the Code of Criminal Procedure, in order to eliminate the possibility of the person against whom surveillance is conducted not being informed of the EDF having processed their data.
https://news.err.ee/1015626/top-court-bill-seeking-to-expand-edf-surveillance-rights-unconstitutional - [2019-12-18] A secret camera was found at a metal company AKG Loots. The high-tech camera was installed under the ceiling of the production workshop and was in constant communication. Industrial espionage is suspected, as the company has several international clients with classified contracts.
https://ekspress.delfi.ee/teateid-elust/metallifirmas-leiti-salajane-jalgimisseade?id=88407489 - [2019-12-17] From 2020 PPA will introduce a 5 EUR fee for obtaining a new ID card PIN envelope.
https://raha.geenius.ee/rubriik/uudis/uuest-aastast-saab-id-kaardi-ja-passi-soodsamalt-tellida/ - [2019-12-16] Mobile-ID was down for two hours.
https://digi.geenius.ee/rubriik/uudis/selgus-eilse-mobiil-id-kahetunnise-katkestuse-pohjus/
https://news.err.ee/1014529/mobile-id-service-in-estonia-disrupted-now-back-online - [2019-12-14] A Viljandi hospital patient learned that a hospital nurse had viewed her health information and shared it in Facebook messages with her friend. The nurse has been fined for data breach.
https://leht.postimees.ee/6849818/medode-nuhkis-sobranna-mahitusel-voora-inimese-terviseinfo-jarele - [2019-12-12] The i-voting workgroup published the full report with 25 proposals to improve the i-voting system enhancing credibility and managing risks. In the IT Minister’s opinion, several important directions have been outlined and following working groups should be set up to go deeper into the more specific topics. In Märt Põder’s opinion, the report is a failure as the verifiability(?) issue has not been addressed.
https://www.mkm.ee/sites/default/files/content-editors/e-valimiste_tooruhma_koondaruanne_12.12.2019_0.pdf
https://digi.geenius.ee/rubriik/uudis/e-valimiste-tooruhma-liige-loppraport-on-minu-jaoks-labikukkumine/
https://digi.geenius.ee/rubriik/uudis/it-minister-karu-moodustab-e-valimiste-tooruhma-osas-uued-toogrupid/
https://digi.geenius.ee/rubriik/uudis/e-valimiste-tooruhm-ei-soovi-e-valimisi-ara-lopetada-hoopis-voimalusi-juurde-lisada/
https://tehnika.postimees.ee/6844891/kingo-tooruhm-annab-aru-kas-e-valimised-on-eesti-habiplekk
https://news.postimees.ee/6849632/e-voting-task-force-finishes-report-including-25-proposals-for-improving-system
https://news.err.ee/1013585/e-election-taskforce-report-complete-includes-25-improvement-proposals
https://www.err.ee/1013627/tooruhm-tegi-25-ettepanekut-e-valimiste-parendamiseks
https://news.err.ee/1015470/ria-does-not-have-funds-to-implement-e-election-workgroup-s-proposal - [2019-12-12] Florian Hartleb wrote an article “e-Estonia. Europe´s Silicon Valley or a new 1984?”. The article mentions X-Road, personal ID code, DDoS attacks in 2007, Infineon ID card crisis in 2017 and data embassy project. Contrary to the title, the privacy aspects are not discussed in depth.
https://link.springer.com/chapter/10.1007/978-3-030-27957-8_16 - [2019-12-06] Former Minister of Rural Affairs Mart Järvik claimed that he had detected “bugs” in his office in one section of the ceiling. He tried two eavesdropping detection devices borrowed from his friends. Later, according to an unnamed source, the detected device turned out to be a device for amplifying Wi-Fi signals.
https://news.err.ee/1010579/prosecution-we-do-not-know-what-jarvik-is-talking-about
https://news.err.ee/1011075/mart-jarvik-s-letter-to-helme-about-alleged-eavesdropping
https://news.err.ee/1010506/former-minister-says-he-found-listening-device-in-ministry-of-rural-affairs
https://news.err.ee/1011048/rural-affairs-ministry-no-bugging-device-found-in-former-minister-s-office
https://news.err.ee/1012483/reform-mp-asks-mart-helme-about-alleged-illegal-surveillance-of-jarvik
https://news.err.ee/1011441/jarvik-i-haven-t-seen-a-bug-but-the-equipment-detected-it
https://news.err.ee/1011608/paper-jarvik-bugging-device-a-simple-wifi-signal-amplifier - [2019-12-05] A cryptographer from the Republic of Senegal published a subtle attack against the Smart-ID clone detection mechanism described in the original Smart-ID paper. The flaw allows an attacker who has cloned a victim’s Smart-ID app instance to forge signatures before the victim has used his instance, such that when the victim uses his Smart-ID instance, the attacker’s clone which was used to forge signatures is not detected by the server. The flaw lies in the fact that according to the protocol description, the next expected request ID is set by the client and not the server, which means that after the attack the attacker can reset the next request ID to match the request ID stored in the victims Smart-ID instance, thereby leading to the victim’s next request to be accepted by the Smart-ID server. SK has responded that the actual Smart-ID implementation uses an updated clone detection mechanism which is not affected by this flaw.
https://eprint.iacr.org/2019/1412
https://twitter.com/doomsdaysoup/status/1204399972231331846
https://www.skidsolutions.eu/en/News/iacr-published-smart-ids-cryptanalysis/ - [2019-12-03] Toomas Vaks, former RIA Deputy Director General for Cybersecurity, wrote an opinion piece about cyber risks.
https://leht.postimees.ee/6840530/toomas-vaks-kas-ja-kes-peaks-kartma-kuberohtu - [2019-12-02] Agu Kivimägi wrote his thoughts about the recently highlighted issue that the time of signing of a digitally signed file can be changed.
https://digi.geenius.ee/rubriik/uudis/agu-kivimagi-kas-digiallkirja-aega-saab-usaldada/ - [2019-12-02] SEB has made an update to its Android mobile app, which now allows SEB customers to make payments by touching a payment terminal with their mobile phone. The app can be used to pay for mobile purchases up to €150 if NFC has been enabled on the phone.
https://tehnika.postimees.ee/6839851/seb-apiga-saab-ka-nuud-poes-maksta - [2019-11-29] Phishing attacks against Smart-ID users have advanced. Now attackers are performing active attacks and displaying to victims the correct Smart-ID verification code. The usual defense of comparing verification codes does not work anymore. Now the only defense is to verify that the authentication is performed in the expected web site.
https://www.ria.ee/et/uudised/petturite-ongitsuslehed-muutumas-inimeste-jaoks-usutavamaks.html - [2019-11-29] CERT-EE warned about scam emails sent in the name of SEB bank. A victim from Tartu lost €4,777 in the scam. Security specialists have pointed out that SEB is endangering their clients by not configuring SPF+DMARC to prevent email spoofing using seb.ee domain.
https://kasulik.delfi.ee/news/uudised/hoiatus-tartlane-langes-ohtliku-seb-nimel-leviva-kelmuse-ohvriks-ja-kaotas-pangakontolt-ligi-5000-eurot?id=88072693
https://twitter.com/SadEstonianIT/status/1200422642639130625
https://twitter.com/SadEstonianIT/status/1195009181826404358 - [2019-11-27] Registration of marriage is one of the few things that cannot be concluded digitally. The state is now analyzing the possibility of making marriage registration easier and partly accessible through the state portal eesti.ee.
https://news.err.ee/1007521/state-analyzing-online-marriage-registration - [2019-11-26] People sent letters to the Ministry of Justice and the Chancellor of Justice expressing their dissatisfaction with the fact that the real estate owned by them can be searched in the electronic land register by anyone. The land register has now been modified such that only an authenticated user would be able to search for real estate by name or personal identification code leaving an audit trail.
https://tehnika.postimees.ee/6835333/riik-asus-piirama-kinnistusraamatus-tuhnimist - [2019-11-20] A communication channel has been set up between the police and Facebook, allowing police officers to access Facebook account holders’ information in minutes if police the estimates that there is a real risk to human life. If there is no immediate threat, the request will take longer, sometimes a couple of days. In 2019, PPA asked Facebook about 88 accounts, requiring quick response nine times. Account freezes have been requested for 14 accounts.
https://digi.geenius.ee/rubriik/uudis/kuidas-ja-kui-kiiresti-saab-politsei-facebookist-katte-kaja-kallase-ahvardajate-ja-teiste-kahtlusaluste-andmed/ - [2019-11-20] Using a fake Facebook account, death threats were made towards Reform Party leader Kaja Kallas. According to PPA, the perpetrators are based in Sweden and therefore Kallas’ life was in no immediate danger.
https://news.err.ee/1006702/paper-estonian-and-swedish-police-to-cooperate-over-kaja-kallas-threat
https://news.err.ee/1005823/police-not-opening-criminal-proceedings-into-kaja-kallas-online-threats
https://news.err.ee/1004931/paper-death-threats-against-reform-party-leader-made-in-sweden - [2019-11-20] Rats seriously damaged RIA’s underground optical cable affecting the operation of eesti.ee and the services of the Health Insurance Fund. Although physical network connections are duplicated, these e-services failed to automatically move to another channel.
https://www.ria.ee/et/uudised/olukord-kuberruumis-november-2019.html
https://www.ria.ee/et/uudised/rotid-pohjustasid-riigivorgu-osalise-katkestuse.html
https://www.ria.ee/et/uudised/riigivorgu-oine-kaablivahetus-sujus-torgeteta.html
https://m.arileht.delfi.ee/article.php?id=88126529
https://news.err.ee/1005397/ria-hopes-to-remedy-cable-disruptions-with-automatic-devices-in-future
https://news.err.ee/1005241/e-services-inaccessible-after-rats-chew-through-wires - [2019-10-30] The Estonian Research Council has financed the creation of a programmable USB device with a RGB LED and button, which can be programmed, for example, to emulate a keyboard and send key strokes after it is plugged into the computer. The device was given out to high school students in the Robotex event.
https://hackest.org/usb/ - [2019-09-25] The requirement for an age check when ordering alcohol online is not enforced by all e-shops. Some parcel terminals require the ID card of an adult to be inserted, but the terminal does not ask for a PIN code (which means that the process does not involve any cryptography).
https://epl.delfi.ee/uudised/e-poest-alkoholi-tellides-piisab-taisealise-id-kaardist?id=87524573 - [2019-04-26] TalTech in cooperation with others have created a High School Cyber Security Selection Course Digital Textbook. The textbook contains material on various topics and includes a lot of unseen video materials.
https://web.htk.tlu.ee/digitaru/kyberkaitse/ - [2017-01-27] In Tallinn Circuit Court, defendants contested the integrity of an electronic evidence (a virtual machine image containing Skype logs), based on the fact that the integrity of the disk image was provided by calculating the hash using the outdated MD5 hash function. The defendants demonstrated a practical MD5 collision attack by showing that when opening two visually different image files the calculated MD5 hash value of the files was the same. The court correctly noted that while the MD5 function is not collision resistant, it is still second pre-image resistant guaranteeing the integrity of the collected evidence.
https://journals.sas.ac.uk/deeslr/article/view/5081