Flaw in COVID-19 Testing Gadget Could’ve Been Exploited to Change Results

A now-set Bluetooth vulnerability in a residence COVID-19 tests gadget could have been exploited to pretend examination final results.

Security investigate agency WithSecure introduced the news Thursday early morning with Cue Wellness, the machine vendor that patched the flaw. Ken Gannon, a researcher with the company-infosec arm of WithSecure, located that by eavesdropping on Bluetooth transmissions from Cue’s handheld reader unit to its Android app, he could determine hexadecimal sequences that corresponded by examination information, then rewrite them in a way the app acknowledged as legit. 

“I was capable to alter my destructive take a look at end result to a constructive by intercepting and shifting the info as it was transmitted from Cue’s reader to the cellular app on my phone,” Gannon suggests. “The process is generally the exact same for altering a good consequence to adverse, which could induce challenges if anyone who understands how to do what I did decides to start off falsifying benefits.”

WithSecure states Cue “responded promptly” to near the vulnerability and did not know of any faked test results exterior these Gannon reported.

“The reliability and safety of our technological know-how is of the utmost worth to our corporation and we appreciate the WithSecure team’s collaboration,” claims Vimal Subramanian, VP of information protection and privacy at Cue Health and fitness, in a assertion.

A second complex doc shared in progress by WithSecure (with documentation posted on GitHub) says Cue’s take care of requires server-side checks but also advises that Cue buyers update their mobile applications to the present version—1.7.2 for Android and 1.7.1 for iOS—which will then prompt them to update the Cue device’s firmware.

San Diego-primarily based Cue’s system—promoted in a Tremendous Bowl advert this March—consists of a $249 handheld reader that with a COVID-19 check cartridge (a 3-pack sells for for $195) performs molecular nucleic acid amplification tests, a much more sensitive check out than the reagent immediate tests the authorities started providing away this winter season.

Cue states a “NAAT” check like people in its package “combines the diagnostic precision of a central lab with the pace and usefulness of an at-dwelling exam.” 

Researchers have discovered that for checking somebody’s infectiousness, regular reagent tests will work much better. But low-priced at-dwelling assessments never qualify beneath the Centers for Condition Control’s prerequisite that Us residents test destructive before traveling house from exterior the US only skillfully-operate assessments or app-assisted check kits will do.

This most up-to-date episode of problematic IoT security would have been a single way to evade that prerequisite. But as I have recognized above 3 transatlantic visits considering the fact that very last summer season, most not too long ago returning in early March from MWC Barcelona, examine-in counter brokers may perhaps not inspect PDFs of negative test success all that intently.