Two Million Belgians Exposed by Flaws in the Software They Use to Sign Legal Documents Online
Security researcher James Arnott found that Belgium's most-used digital identity tool could let any malicious website steal a user's PIN, forge their electronic signature, or quietly run attack code on their computer, all without the victim clicking anything suspicious.
Key points
- Researcher James Arnott found multiple severe security flaws in the Connective browser extension, used by over 2 million people in Belgium for government and banking authentication.
- Any malicious website or embedded online ad could silently access a user's electronic identity card data and trick them into revealing their PIN.
- A separate flaw allowed attackers to run malicious code on a victim's computer without needing any special permissions.
- Nitro Software Belgium fully fixed the issues 146 days after Arnott's initial report and paid him a $200 bug bounty.
- Eight of Belgium's ten largest banks and over 60 government agencies relied on the affected software.
Belgium runs a national electronic identity system that lets citizens log into government websites, sign contracts, and authenticate with banks using a physical ID card and a browser extension called Connective. Think of it like a digital version of signing your name in front of a notary, except it all happens through software on your computer. Over 2 million people use it.
At the DEF CON security conference last week, James Arnott, founder of cybersecurity firm Bay Area Labs, explained how that software had a set of serious, now-fixed flaws that could have let criminals do a lot of damage.
How did the attack actually work?
The software never checked which website was talking to it. That single missing check is where everything fell apart.
When you install Connective, it runs quietly in the background, ready to help any website that needs to confirm your identity or collect your signature. The problem: it would respond to any website, not just legitimate ones. A criminal could build a fake page, or even hide malicious code inside an online advertisement on an otherwise normal site, and that code could silently read the details from your ID card or payment card the moment you plugged it in.
Worse, the software let websites display official-looking pop-up boxes asking for your PIN, which is the four-digit code that protects your electronic signature. Those pop-ups showed whatever text the requesting website chose. Nothing on screen told you which site was actually asking. So a fake banking page could show a pop-up that looked completely genuine, you'd type your PIN, and the attacker's server would receive it.
| What was at risk | Detail |
|---|---|
| Electronic ID card data | Silently readable by any site while card was inserted |
| Payment card details | Also exposed via the same missing check |
| PIN code | Could be harvested through fake-but-convincing pop-ups |
| Electronic signatures | Attackers could forge legally binding signatures using a stolen PIN |
| Computer itself | Remote code execution flaw worked even without a card present |
With a stolen PIN, an attacker could generate what are called approval tokens, which are digital proofs used to create a legally binding electronic signature, without the card owner knowing. That meant forged contracts, forged government filings, or hijacked accounts on services like the national identity platform CSAM.be and the widely used Itsme identity app. Neither of those services had flaws of their own; they simply trusted the signature, and the signature had been faked.
Could your computer be taken over too?
Yes, and this part did not even require an ID card. Arnott also found a remote code execution vulnerability, meaning a way to force the software to run attacker-controlled instructions on your machine. A criminal could pull it off by getting you to download a file that looked like an ordinary document and then visit a webpage. No admin password required. The flaw also had worm-like potential: it could hijack your credentials to forward malicious links to your contacts, spreading itself.
In practice, the failure mode here is a drive-by attack. You open what looks like a PDF, visit a page, and the attacker is already running code under your account.
What has been fixed, and what should you do?
Nitro Software Belgium patched everything. The fix took 146 days from Arnott's first report and was fully enforced in late July 2025. The company blocked requests from unauthorised sources and secured how PINs are handled. No CVE identifiers, the standard reference numbers used to track publicly known software vulnerabilities, appear to have been assigned to these flaws. Nitro did not respond to a request for comment first reported by SecurityWeek.
If you are a Connective user in Belgium, make sure the extension is updated to its latest version in your browser. Check your browser's extension list and look for any pending updates.
Keep an eye on any accounts tied to your national ID, including government portals and banking apps, for unexpected login activity or documents you do not recognise.
One operational takeaway: a $200 bounty for flaws that touched the signing infrastructure of an entire country's digital economy is an awkward number to defend in a post-mortem.
