German COVID-19 Contact-Tracing Vulnerability Allowed RCE

A security vulnerability in the infrastructure underlying Germany’s official COVID-19 contact-tracing app, called the Corona-Warn-App CWA, would have allowed pre-authenticated remote code execution RCE. Researcher Alvaro Muñoz wrote in a report this week that he and his team at GitHub Security La...

CVE-2020-26230

CVE-2020-26230 affects Radar COVID (Spain) where positives uploading TEKs to the backend can be identified/de-anonymized by an on-path observer. Root cause: backend communication is made only by COVID-19 positives, enabling traffic correlation across networks (MNOs/ISPs/VPNs or on-path attackers)...

PT-2020-15832 · Google · Gaen Protocol

Name of the Vulnerable Software and Affected Versions: GAEN protocol affected versions not specified Description: An issue was discovered in the GAEN protocol, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping ...

CVE-2020-24721

An issue was discovered in the GAEN aka Google/Apple Exposure Notifications protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the...

Code injection

An issue was discovered in the GAEN aka Google/Apple Exposure Notifications protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the...

Govt.-Backed Contact-Tracing Apps Raise Privacy Hackles

The Electronic Frontier Foundation is echoing lawmaker concerns that California is not taking privacy seriously enough, as state legislators mull launching a COVID-19 exposure-notification app based on Apple and Google’s smartphone technology. The U.S. nonprofit, which is aimed at protecting...

Apple/Google Exposure Notification API Information Disclosure Vulnerability

The Apple/Google Exposure Notification API is a contact tracking survey application for pandemic diseases. An information disclosure vulnerability exists in the Apple/Google Exposure Notification API beta 2020-05-29 and earlier versions, which can be exploited by an attacker to bypass Bluetooth...

CVE-2020-13702

The CVE-2020-13702 entry concerns the Rolling Proximity Identifier used by the Apple/Google Exposure Notification API (beta through 2020-05-29). A secondary temporary UID enables attackers within Beacon/IoT networks to track an individual device’s movements via Bluetooth LE discovery, compromisin...

CVE-2020-13702: Exposure of Sensitive Information to an Unauthorized Actor

The Rolling Proximity Identifier used in the Apple/Google Exposure Notification API beta through 2020-05-29 enables attackers to circumvent Bluetooth Smart Privacy because there is a secondary temporary UID. An attacker with access to Beacon or IoT networks can seamlessly track individual device...

PT-2020-13655

Name of the Vulnerable Software and Affected Versions Apple/Google Exposure Notification API beta through 2020-05-29 Description The issue enables attackers to circumvent Bluetooth Smart Privacy due to a secondary temporary UID in the Rolling Proximity Identifier. This allows an attacker with...

Google and Apple Plan to Turn Phones into COVID-19 Contact-Tracking Devices

Tech giants Apple and Google have joined forces to develop an interoperable contact-tracing tool that will help individuals determine if they have come in contact with someone infected with COVID-19. As part of this new initiative, the companies are expected to release an API that public agencies...