Skip to main content

French hacker claims Pakistan's COVID-19 contact tracing app reveals patients' locations, govt denies claims

A French ethical hacker has reported privacy flaws in Pakistan's COVID-19 contact tracing app – COVID-19 Gov PK –via a series of tweets. The hacker, Robert Baptiste, who goes by the username Elliot Alderson, pointed out that the app has "hardcoded passwords, insecure connections, privacy issues and...nothing is okay with this app".

To recall, the same hacker also spoke to Firstpost about India's Aarogya Setu app. He had said that the Indian government must convince people of the app’s efficacy rather than force them to use it.

In a series of tweets, he emphasised that COVID-19 Gov PK is "NOT" a contact tracing app. The hacker added that the app, "gives access to dashboards for each province and state, you can do a self-assessment, get radius alert, get a popup notification reminding the user of their personal hygiene".

Basically, it will show you the number of confirmed, critical, recovered, and fatal cases across the country in the past 24 hours.

(Also Read: Aarogya Setu, India's contact-tracing app, goes open-source) 

Representational image. PTI

The COVID-19 Gov PK is developed by the Ministry of IT and Telecom with the National Information Technology Board of Pakistan. It is now available on Play Store and according to the tweet, it has been downloaded more than 5,00,000 times.

He also claims that "When you open the app, it asks a token to the pak gov server with hardcoded credentials: CovidAppUser/CovidApi!@#890#".

As per a report by Geo TV, a Pakistani news publication, hardcore credentials – a password embedded into the code for easy access by the developer – are a major security risk as they are favoured by hackers who target them for access to the app itself, or worse, the device. It further added that ideally these codes should be removed before the app's release but are often left in the developing stage.

Further, Alderson also reveals that the app asks for positions of the infected person on the map, and the request made by the app is "insecure". He added that in the "Radius Alert" tab, "you can get a map of infected people. Ofc, the exact coordinates of infected people are downloaded by the app". Bye, bye privacy?

At the end, the hacker tweeted, "Thanks for the good laugh, you are the worst #Covid19 app I analysed."

(Also Read: Aarogya Setu: Whether we like it or not, the app is here to stay, but it's still riddled with privacy issues that need strong answers) 

Government's take

Meanwhile, per the report by Geo TV, National  Information Technology Board (NITB) has refuted the claims by the French researcher, saying they were "incorrect".

As per the report, the press release said, “The purpose of the app is to stop the epidemic spread. A very limited personal information of the user is collected. The app does not show the exact coordinates of the infected people, instead, it shows the radius parameter that is fixed by default at 10 meters for self-declared patients and 300 meters at a quarantine location. Hence, self-declared patients have to give their consent to reveal their coordinates for the safety of other citizens. Moreover, they have accepted our app privacy policy/terms and conditions,”.

It added, “No user login mechanism is present in the app. Therefore, the use of login and passwords are not part of app workflow. The screenshot mentioning the hardcoded password is the defined keyword to give more security to auto-token endpoint, so that endpoint can only be used from mobile apps.”

“All our API's communicate using HTTPS. Hence, security and protection of data of users as per international standards is of prime importance and implemented at the core,” it added.

(Also read: 'Indian govt should convince public on Aarogya Setu's efficacy rather than forcing it on them': Cybersecurity expert Elliot Alderson tells Firstpost) 



Udimi - Buy Solo Ads from Firstpost Tech Latest News https://ift.tt/3dNWF1G
via IFTTT
Labels:

Comments

Post a Comment

Popular posts from this blog

9 VCs in Madrid and Barcelona discuss the COVID-19 era and look to the future

Spain’s startup ecosystem has two main hubs: Madrid and Barcelona. Most observers place Barcelona first and Madrid second, but the gap appears to close every year. Barcelona has benefitted from attracting expats in search of sun, beach and lifestyle who tend to produce more internationally minded startups. Madrid’s startups have predominantly been Spain or Latin America-focused, but have become increasingly international in nature. Although not part of this survey, we expect Valencia to join next year, as city authorities have been going all-out to attract entrepreneurs and investors. The overall Spanish ecosystem is generally less mature than those in the U.K., France, Sweden and Germany, but it has been improving at a fast clip. More recently, entrepreneurs in Spain have moved away from emulating success in pursuit of innovative technologies. Following the financial crisis, the Spanish government supported the creation of startups with the launch of FOND-ICO GLOBAL, a €1.5 billi
Post a Comment
Read more

How to Stay Creative and Keep SEO in Mind

Information Technology Blog - - How to Stay Creative and Keep SEO in Mind - Information Technology Blog Search engine optimization (SEO) refers to customizing your website’s content to ensure that web browsers give your website a high SEO score. The sites with the highest SEO scores are featured on the search engine’s first page of search results for relevant searches.  71%  of the click-throughs happen with articles listed on the first page of results on the search engine. This means that if your website’s article is the second (or third, or fourth page), it’s less likely the search user will even see your article. You want your article to be ranking as close to the top of the first page of results as possible. In order to have a good SEO score your site’s content needs to feature keywords and relevant phrases. It must be optimized for easy navigation between pages. It also needs to be referenced via external links that drive traffic to your site. Incorporating all of these elem
Post a Comment
Read more

Everything we know about HHS Protect, a secretive government project with Peter Thiel's Palantir that helps brief Trump's coronavirus task force

A secretive project at the US Department of Health and Human Services is working with technology companies to collect and analyze data related to the novel coronavirus .  Dubbed "HHS Protect," the effort tracks information from around the country about coronavirus case numbers, hospital capacity, and even supply chain issues.  HHS uses Palantir Technologies , a data firm cofounded by Peter Thiel, to distill that information for the White House coronavirus task force. Visit Business Insider's homepage for more stories . A secretive project at the US Department of Health and Human Services is working with technology companies to collect and analyze data related to the novel coronavirus.  Dubbed "HHS Protect," the effort includes roughly 2.5 billion pieces of data from healthcare providers, government officials, and labs around the country about coronavirus case numbers, hospital capacity, and even supply chain issues.  The goal is learn about the progress
Post a Comment
Read more