Security Flaws Seen in China’s Mandatory Olympics App for Athletes
The New York Times
Researchers said the app, which will store sensitive health data on participants at the Winter Games, has serious encryption vulnerabilities.
The mandatory smartphone app that athletes will use to report health and travel data when they are in China for the Olympics next month has serious encryption flaws, according to a new report, raising security questions about the systems that Beijing plans to use to track Covid-19 outbreaks.
Portions of the app that will transmit coronavirus test results, travel information and other personal data failed to verify the signature used in encrypted transfers, or didn’t encrypt the data at all, according to the report by Citizen Lab, a University of Toronto cybersecurity watchdog. The group also found that the app includes a series of political terms marked for censorship in its code, though it does not appear to actively use the list to filter communications.
China has entered the final planning stages for a Winter Olympics that will seek to control the spread of Covid-19 by keeping athletes and other participants separate from the greater Chinese population. The app, called MY2022, was designed to bolster those precautions, enabling electronic links between the government and participants to contact trace in the event of any outbreaks. It resembles a broader system of app-based health codes used to control population movements in the event of outbreaks.
