German Health Insurance Card CA Loses Secret Key

Christiane writes "The SSL Root CA responsible for issuing the German digital health insurance card lost its secret private key during a test enrollment. After their Hardware Security Module (HSM) dutifully deleted its crypto keys during a power outage, it was all 'Oops, why is there no backup?' All issued cards must be replaced: 'Gematik spokesman Daniel Poeschkens poured scorn on the statement that Gematik had insisted on the service provider carrying out a test without backing up the root CA private keys. "We did not decide against a back-up service. The fact of the matter is that the service provider took over the running of the test system, so it also has to warrant its continuous operation. How it fulfills this obligation is its own responsibility."'"

Oh c'mon, be fair!

[Opportunist]

Not even a month ago you chided them because there were too many copies (some of them even offsite, they just didn't know who had them now), now you chew them out for having too few. Make up your effing mind!

NSA/CIA

[Anonymous Coward]

Maybe they should check with the NSA or CIA? They've got a backdoor into EVERY system, and may still have the key saved on a laptop lying around somewhere.

Re:Wrong Title, Wrong summary

[Opportunist]

After all, we all know Germans are exact and punctual, Poles are thieves, Russians are drunk and Fins are even more so. Oh, and Mexicans are lazy and US people are simple minded. Any stereotype missing?

This would never happen in Britain

[Curmudgeonlyoldbloke]

It would easily be found be searching the nearest pub car park for USB keys, or checking the train that the relevant civil servant travelled home on.

Re:Wrong Title, Wrong summary

[Opportunist]

Not only that, they have really weird tastes, too. In food and bed. Sometimes at the same time.

Rootkeylosin!

[192939495969798999]

Q: How do you learn every German swear word in about 20 seconds?
A: Tell the German admin that you lost the root key.

Re:Oh c'mon, be fair!

[MindKata]

"too many copies" ... "having too few"

This kind of organisation usually has a backup somewhere, they just have to find it. Its usually backed up on a post-it note somewhere. Maybe they should ask all of us to look for it, on the sides of our monitors.

Place blame

[ubrgeek]

Poeschkens claimed, "I know nothing! noth-thing!" and proceeded to blame the problem on a man he would only identify as "Hogan."

What is "CA"?

[T Murphy]

For those of you who are wondering what CA is, it stands for Certificate Authority. You see, the Germans have a hard time functioning without a constant stream of praise, so they have this authority in place that prints and sends certificates to people. Every day thousands of Germans get congratualted for crossing the street, for finding their car keys or for eating their 1000th potato of the month. You know you've walked into a German household when you see the wallpaper of framed certificates.

The problem here is that the company deleted the certificate-printing program since they thought someone was trying to hack in and print more certificates for themselves- no one is THAT special so they had to stop him. They forgot to have another program ready to print more certificates, so now Germany is under threat of entering a depression since they no longer get certificates telling them how special they are.

On a serious note: I don't follow this article very well with all the acronyms being spelled out but not explained, and no background knowledge of anything going on here. If someone would care to explain what is going on here to someone that has never heard the term CA, you should get a +5 informative easily.

Re:Oh c'mon, be fair!

[Vu1turEMaN]

My Day 1:

I actually found the administrator password on a post-it note on the back of the server's CRT monitor while cleaning the server room.

"Fucking amazing" I said out loud, and as I pulled it off, on the back was the AmEx credit card number, expiration date, and 3digit pin for our organization to order IT stuff.

Then I noticed on the left underside of the CRT there was another post-it that said Ctrl Shift Alt Num+....so I pressed that and up came a hidden menu of hidden apps running (SysTrayX + a sketchy prog to hide services in TaskManager), 90% of them illegal. Also uTorrent was running, seeding about 50 anime series buried deep within the network and using about half of the T3 connection's throughput.

And to top it all off, I deduced that the server had never had a fresh install of Windows. It used to have NT Server, then they used software to upgrade it to 2000 Server, and software again to upgrade it to Server 2003. ......

Day 7:

I get a call from the old IT guy asking me whats wrong with the connection, and I told him I reinstalled Server 2003, deleted his anime cache, changed the WPA-PSK keys from 1111111111 to something way more secure, reported the AmEx card as stolen to get a new one, changed the admin password and set password age limits on all accounts, and replaced the rootkit infected SCSI drives with new ones that would last longer. Also, I told the managers that his 5000$ quote for network-wide unlimited antivirus was utter bullshit and that he only got a cracked key for Norton 2003 and installed it only on the server, and prolly pocketed the money.

Damn dude was like "BUT I DIDNT BACK UP THE ANIME TO DVD YET!!!". Now I love anime as much as the next person, but I think he has other stuff to worry about at this point.

But you know what got me the most mad and prompted all of this? The server was named Odie, and the computers were all garfield characters.

CALVIN AND HOBBES FTW!!!!

Re:Oh c'mon, be fair!

[Vu1turEMaN]

Oh, and his DAT72 backups had been failing for the last 2 years and he had never checked the logs.

Good thing he left to start his own business! /shudder

Re:Oh c'mon, be fair!

[Hurricane78]

Day 8:
You got fired, and the system got "restored" because your "fixes" halted the whole "business".
It was a sad day.

That's easy.

[Anonymous Coward]

When they kick you out of the pub it's time to be at the curry house.

Re:Oh c'mon, be fair!

[Vu1turEMaN]

Heh...I'm actually just doing a paid internship at a non-profit after their full-time guy left. It was supposed to end on May 1st, but hey I guess they love what I've done.

Got them a cheap dedicated backup system, updated all the systems and reinstalled an NLite-ed XP on every computer, and moved them from Exchange to Google. Oh, and the lab computers run Ubuntu.

They also loved it when I found the IT guy's secret paypal business account with 3000$ sitting in it that was supposed to be used for something else (battery backup replacement batteries). Putting passwords in a file on the administrator's desktop called "passwords for everything.txt" is sooooo helpful for when you're trying to be sneaky.

Seriously, this shit is a soap opera of IT-isms.

Spoonerism

[Curate]

Gematik spokesman Daniel Poeschkens poured scorn

I literally read that as scoured porn...

Does German work like English?

[russotto]

"We did not decide against a back-up service. The fact of the matter is that the service provider took over the running of the test system, so it also has to warrant its continuous operation. How it fulfills this obligation is its own responsibility."' If this were originally in English, it would mean "We knew this would happen and we tried to tell them, but those arrogant SOBs thought they knew it all and didn't want to listen to us. So we shut up, pulled up a chair, got some popcorn, and waited for the fireworks". I'm not sure that translates, though...