[ad_1]
A safety researcher discovered a Bluetooth vulnerability in a well-liked at-home COVID-19 take a look at permitting him to change its outcomes.
F-Safe researcher Ken Gannon recognized the since-fixed flaw within the Ellume COVID-19 Dwelling Take a look at, a self-administered antigen take a look at that people can use to verify to see if they’ve been contaminated with the virus. Relatively than submitting a pattern to a testing facility, the pattern is examined utilizing a Bluetooth analyzer, which then studies the consequence to the consumer and well being authorities by way of Ellume’s cell app.
Gannon discovered, nevertheless, that the built-in Bluetooth analyzer might be tricked to permit a consumer to falsify a certifiable consequence earlier than the Ellume app processes the info.
To hold out the hack, Gannon used a rooted Android system to investigate the info the take a look at was sending to the app. He then recognized two kinds of Bluetooth site visitors that had been almost definitely accountable for telling the cell app if the consumer was COVID constructive or adverse, earlier than writing two scripts that had been in a position to efficiently change a adverse consequence right into a constructive one.
The faked outcomes from the Ellume at-home COVID-19 take a look at. (Picture: F-Safe)
Gannon says that when he acquired an electronic mail along with his outcomes from Ellume, it incorrectly confirmed he had examined constructive. To finish the proof-of-concept, F-Safe additionally efficiently obtained a licensed copy of the faked COVID-19 take a look at outcomes from Azova, a telehealth supplier that Ellume companions with for certifying at-home COVID-19 assessments for journey or going into work.
Whereas Gannon’s writeup solely consists of altering adverse outcomes to constructive ones, he says that the method “works each methods.” He additionally stated that, earlier than it was patched, “somebody with the correct motivation and technical abilities may’ve used these flaws to make sure they, or somebody they’re working with, will get a adverse consequence each time they’re examined.” In concept, a pretend certification might be submitted to fulfill U.S. re-entry necessities.
In response to F-Safe’s findings, Ellume says it has up to date its system to detect and forestall the transmission of falsified outcomes.
“We may even ship a verification portal to permit authorities – together with well being departments, employers, faculties, occasion organizers and others – to confirm the authenticity of the Ellume COVID-19 Dwelling Take a look at,” stated Alan Fox, Ellume’s head of Info Programs. “Ellume is assured within the reliability of our ECHT take a look at consequence, and we wish to thank F-Safe for bringing this challenge to our consideration and for the work they do daily to guard customers, companies and organizations across the globe.”
[ad_2]
