The International Olympic Committee (IOC) has defender China’s MY2022 app for the Olympic Games in Beijing after researchers found it contained a "devastating" encryption flaw.
Due to the pandemic, China has decided to implement a “closed-loop” management system and daily testing. All international and domestic attendees are mandated to download MY2022 14 days prior to their departure for China and to start monitoring and submitting their health status to the app on a daily basis.
However, the flaw allows encryption protecting users’ voice audio and file transfer to be trivially sidestepped, according to new research from Citizen Lab. The app fails to validate SSL certificates, allowing an attacker to spoof trusted servers by interfering with the communication between the app and servers. This means it can be deceived into connecting to a malicious host, allowing information it transmits to be intercepted and enabling the app to display spoofed content that appears to originate from trusted servers.
The researchers also found that some sensitive data is transmitted without any SSL encryption or any security at all. It transmits non-encrypted data to “tmail.beijing2022.cn” on port 8099 which contain sensitive metadata relating to messages, such as the names of messages’ senders and receivers, and their user account identifiers. This data can be read by any passive eavesdropper, such as someone operating an unsecured WiFi access point or an Internet Service Provider.
The report said the app collects a range of highly sensitive medical information and it is unclear with whom or which organisations it shares this information. It also contains features that allow users to report politically sensitive content, and contains a censorship keyword list which is presently inactive. The keywords target political topics such as Xinjiang and Tibet as well as reference to Chinese government agencies.
Citizen Lab stated that the app’s security deficits may not only violate Google’s Unwanted Software Policy and Apple’s App Store guidelines but also China’s own laws and national standards pertaining to privacy protection, providing potential avenues for future redress.
The IOC told IT Pro that the user is in control over what the app can access on their device, as the settings can be changed to configure access to specific features like Files and Media, Camera, Contacts, Microphone, and more.
RELATED RESOURCE
The top three IT pains of the new reality and how to solve them
Driving more resiliency with unified operations and service management
“The app has received approval of the Google Play store (Android/HarmonyOS) and the App Store (iOS) too and is available for download,” said the spokesperson. “It is not compulsory to install 'My 2022' on cell phones, as accredited personnel can log on to the health monitoring system on the web page instead.”
The IOC added that it has conducted independent third-party assessments on the application from two cyber security testing organisations, with the reports confirming that there are no critical vulnerabilities. It said that many of the app’s features are used for local Beijing 2022 workforce for time-keeping, task management, and instant messaging, as the app is not only for international users.
The IOC has requested the report from Citizen Lab to understand its concerns better. IT Pro has contacted Google and Apple for comment.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Latitude Financial's data policies questioned after more than 14 million records stolenNews Some of the data is from at least 2005 and includes customers’ name, address, and date of birth
-
Latitude hack now under state investigation as customers struggle to protect their accountsNews The cyber attack has affected around 330,000 customers, although the company has said this is likely to increase
-
IDCARE: Meet the cyber security charity shaping Australia and New Zealand's data breach responseCase Studies IDCARE is recruiting a reserve army to turbocharge the fightback against cyber crime not just in the region, but in the interests of victims all over the world
-
Australia commits to establishing second national cyber security agencyNews The country is still aiming to be the most cyber-secure country in the world by 2030
-
Medibank bleeds $26 million in cyber costs following hackNews The company believes this figure could rise to $45 million for the 2023 financial year
-
TikTok's two new European data centres to address data protection concernsNews The company is under pressure to prove its user data isn’t being accessed by the Chinese state
-
Cyber attack on Australia’s TPG Telecom affects 15,000 customersNews It is the third cyber attack on a major Australian telco since October
-
Telstra blames IT blunder for leak of 130,000 customer recordsNews Australia’s biggest telco said that the error was due to a mismanagement of databases and not a cyber attack
