Flaw in COVID-19 Testing Gadget Could’ve Been Exploited to Change Results

A now-preset Bluetooth vulnerability in a property COVID-19 testing machine could have been exploited to pretend check outcomes.

Stability research business WithSecure declared the news Thursday early morning with Cue Overall health, the unit seller that patched the flaw. Ken Gannon, a researcher with the corporate-infosec arm of WithSecure, observed that by eavesdropping on Bluetooth transmissions from Cue’s handheld reader unit to its Android application, he could establish hexadecimal sequences that corresponded by exam knowledge, then rewrite them in a way the application acknowledged as legit. 

“I was in a position to adjust my unfavorable examination outcome to a good by intercepting and changing the data as it was transmitted from Cue’s reader to the cell app on my cell phone,” Gannon suggests. “The method is generally the exact for switching a good outcome to unfavorable, which could induce troubles if somebody who appreciates how to do what I did decides to get started falsifying success.”

WithSecure states Cue “responded promptly” to shut the vulnerability and did not know of any faked take a look at results exterior all those Gannon claimed.

“The dependability and stability of our engineering is of the utmost value to our company and we enjoy the WithSecure team’s collaboration,” says Vimal Subramanian, VP of facts stability and privacy at Cue Wellness, in a statement.

A next technological document shared in advance by WithSecure (with documentation published on GitHub) states Cue’s fix involves server-aspect checks but also advises that Cue users update their cell applications to the existing version—1.7.2 for Android and 1.7.1 for iOS—which will then prompt them to update the Cue device’s firmware.

San Diego-centered Cue’s system—promoted in a Tremendous Bowl ad this March—consists of a $249 handheld reader that with a COVID-19 exam cartridge (a three-pack sells for for $195) performs molecular nucleic acid amplification tests, a additional delicate check out than the reagent speedy checks the governing administration began supplying away this winter.

Cue claims a “NAAT” test like individuals in its kit “combines the diagnostic precision of a central lab with the speed and usefulness of an at-property examination.” 

Scientists have observed that for examining somebody’s infectiousness, regular reagent tests will work greater. But low-cost at-property exams really do not qualify underneath the Facilities for Illness Control’s prerequisite that Americans take a look at unfavorable right before flying household from outdoors the US only skillfully-run tests or app-assisted exam kits will do.

This latest episode of problematic IoT safety would have been one way to evade that need. But as I’ve recognized around three transatlantic trips due to the fact past summer months, most lately returning in early March from MWC Barcelona, look at-in counter brokers may well not inspect PDFs of detrimental check final results all that carefully.