A security researcher found a Bluetooth vulnerability in a popular COVID-19 test at home that allowed him to modify the results.
F-Secure researcher Ken Gannon identified the since-fixed bug in the Ellume COVID-19 home test, a self-administered antigen test that individuals can use to check if they are infected with the virus. Instead of sending a sample to a testing facility, the sample is tested with a Bluetooth analyzer, which then reports the result to the user and health authorities via Ellume’s mobile app.
However, Gannon found that the built-in Bluetooth analyzer could be tricked into allowing a user to forge a certifiable result before the Ellume app processes the data.
To perform the hack, Gannon uses a rooted Android device to analyze the data that the test sends to the app. He then identified two types of Bluetooth traffic that were most likely responsible for telling the mobile app whether the user was COVID positive or negative before writing two scripts that could successfully change a negative result to a positive one.
The fake results of Ellume’s Covid-19 test at home. (Image: F-Secure)
Gannon says that when he received an email from Ellume with his results, it falsely indicated that he tested positive. To complete the proof of concept, F-Secure has also successfully obtained a certified copy of the fake COVID-19 test results from Azova, a telemedicine provider that Ellume is working with to certify COVID-19 tests at home for travel or travel .
While Gannon’s report Just converting negative outcomes into positive ones, he says, the process “works both ways.” He also said that, before it was patched, “someone with the right motivation and technical ability could have used these flaws to ensure that he or someone they work with left a negative every time they are tested Result received. ” In theory, a forged certificate could be presented to meet US re-entry requirements.
In response to the results from F-Secure, Ellume says it has updated its system to detect and prevent the transmission of bogus results.
“We will also provide a verification portal that will allow government agencies – including health departments, employers, schools, event organizers, and others – to verify the authenticity of the Ellume COVID-19 home test,” said Alan Fox, Ellume’s Head of Information Systems. “Ellume believes in the reliability of our REAL test results and would like to thank F-Secure for bringing this issue to our attention and for their daily work protecting consumers, businesses and organizations around the world.”
