Digital identity software is supposed to be the one component in a bank’s stack that verifies who it is talking to. For over two years, the most widely deployed one in Belgium never bothered to check.
No origin check, no problem for an attacker
Connective is a browser extension built by Nitro Software Belgium that bridges web pages to a locally installed application used for electronic ID authentication and legally binding electronic signatures. It is embedded in the login and signing flows of eight of Belgium’s ten largest banks and more than 60 government agencies, reaching upwards of two million users. Security researcher James Arnott, founder of Bay Area Labs, found that the local Connective application had no mechanism to verify which website was sending it requests. Any site a victim happened to have open, including a malicious advertisement loaded inside an otherwise legitimate page, could talk to the extension exactly as if it were the bank or government portal it was built for.
From silent card reads to a remote shell
With origin checks absent, Arnott demonstrated that a malicious page could silently read connected eID and payment card details without the user noticing anything. Separately, he found a remote code execution path that did not require an ID card to be inserted at all: getting the native application to load and run an attacker-supplied library was enough. Combined, the two flaws meant a single drive-by ad impression could move from reading identity data to arbitrary code execution on the victim’s machine, no phishing click, no malicious download, no card ever physically compromised.
A 146-day fix, and no CVE yet
Nitro Software’s eventual remediation disabled the risky library-loading capability, changed how PIN tokens are handled so a requesting website only ever receives a reference value rather than the token itself, and added the origin verification that should have existed from the start. That fix landed 146 days after the initial report, and as of disclosure at DEF CON on August 10 no CVE identifier had been assigned to either flaw, which will make it harder for downstream banks and agencies to track exposure through standard vulnerability management tooling.
Why this matters beyond Belgium
Every EU member state runs some equivalent of Connective in its national eID or e-signature infrastructure, and the pattern here, a client-side bridge trusted implicitly by every website on the machine, is common to most of them. For any organisation relying on third-party identity or signing software to satisfy KYC, eIDAS or NIS2 obligations, the open question is not whether your vendor has ever had a flaw like this, but whether you would know if they did, and how long they would take to fix it.
If you need an independent security review of the identity, signing or authentication software your organisation depends on, or help building a vendor risk process that catches this class of issue before a researcher does, contact Excello Digital. We help European banks, public bodies and enterprises hold their identity infrastructure suppliers to the standard their compliance obligations actually require.