A Bluetooth bug in a popular COVID-19 test at home could falsify the results – TechCrunch

[ad_1]

A security researcher discovered a Bluetooth vulnerability in a popular COVID-19 home test that allowed him to tweak its results.

F-Secure researcher Ken Gannon has identified the defect since resolved in the Illuminated COVID-19 Home Test, a self-administered antigen test that individuals can use to check if they have been infected with the virus. Instead of sending a sample to a testing facility, the sample is tested using a Bluetooth analyzer, which then reports the result to the user and health authorities via the Ellume mobile app.

Gannon found, however, that the built-in Bluetooth analyzer could be tricked into allowing a user to spoof a certifiable result before the Ellume app processes the data.

To perform the hack, Gannon used a rooted Android device to analyze the data the test was sending to the app. He then identified two types of Bluetooth traffic that were most likely tasked with telling the mobile app whether the user was COVID positive or negative, before writing two scripts that were able to successfully change a negative result into a positive one.

The false results of Ellume’s home-based COVID-19 test. (Image credits: F-Secure)

Gannon says that when he received an email with his results from Ellume, he incorrectly showed that he tested positive. To complete the proof of concept, F-Secure also successfully obtained a certified copy of the false COVID-19 test results from Azova, a telemedicine provider with whom Ellume collaborates to certify COVID-19 tests at home for travel or to enter opera.

Although Gannon’s account only includes changing negative results to positive, he says the process “works both ways.” He also said that, before it was patched, “someone with the proper motivation and technical skills could have used these flaws to make sure they, or someone they are working with, get a negative result every time they are tested.” In theory, a fake certification could be presented to meet US re-entry requirements.

In response to F-Secure’s findings, Ellume says it has updated its system to detect and prevent the transmission of falsified results.

“We will also provide a verification portal to allow authorities, including health departments, employers, schools, event organizers and others, to verify the authenticity of the COVID-19 Home Test,” said Alan Fox, head of information systems at Ellume. “Ellume is confident in the reliability of our ECHT test result and we would like to thank F-Secure for bringing this issue to our attention and for the work they do every day to protect consumers, businesses and organizations around the world.” .

[ad_2]