Flaw in COVID-19 Testing Gadget Could’ve Been Exploited to Change Results

A now-preset Bluetooth vulnerability in a household COVID-19 tests unit could have been exploited to phony take a look at results.

Protection research company WithSecure introduced the information Thursday early morning with Cue Overall health, the device seller that patched the flaw. Ken Gannon, a researcher with the corporate-infosec arm of WithSecure, uncovered that by eavesdropping on Bluetooth transmissions from Cue’s handheld reader device to its Android app, he could identify hexadecimal sequences that corresponded by check details, then rewrite them in a way the app acknowledged as legit. 

“I was ready to improve my unfavorable take a look at consequence to a optimistic by intercepting and switching the info as it was transmitted from Cue’s reader to the cell application on my cell phone,” Gannon says. “The method is essentially the similar for transforming a favourable result to unfavorable, which could result in complications if somebody who appreciates how to do what I did decides to start off falsifying outcomes.”

WithSecure claims Cue “responded promptly” to shut the vulnerability and did not know of any faked test results exterior people Gannon reported.

“The dependability and protection of our technology is of the utmost value to our corporation and we enjoy the WithSecure team’s collaboration,” states Vimal Subramanian, VP of info safety and privateness at Cue Wellbeing, in a statement.

A next technological document shared in advance by WithSecure (with documentation posted on GitHub) says Cue’s fix entails server-facet checks but also advises that Cue people update their mobile applications to the current version—1.7.2 for Android and 1.7.1 for iOS—which will then prompt them to update the Cue device’s firmware.

San Diego-centered Cue’s system—promoted in a Super Bowl advertisement this March—consists of a $249 handheld reader that with a COVID-19 check cartridge (a a few-pack sells for for $195) performs molecular nucleic acid amplification exams, a far more delicate check out than the reagent fast exams the governing administration started supplying away this wintertime.

Cue suggests a “NAAT” exam like those people in its kit “combines the diagnostic precision of a central lab with the speed and usefulness of an at-property take a look at.” 

Scientists have identified that for checking somebody’s infectiousness, typical reagent screening will work better. But low cost at-household tests do not qualify under the Facilities for Condition Control’s requirement that People in america test negative in advance of traveling property from outside the house the US only professionally-operate exams or application-assisted take a look at kits will do.

This hottest episode of problematic IoT security would have been a single way to evade that necessity. But as I’ve understood over a few transatlantic visits since last summertime, most not long ago returning in early March from MWC Barcelona, check out-in counter brokers may well not inspect PDFs of detrimental examination results all that carefully.