Chinese language Olympic App Has Critical Safety Flaws: Report

A smartphone app that is anticipated to be broadly utilized by athletes and others attending subsequent month’s Winter Video games in Beijing has obvious safety issues that might expose delicate information to interception, in line with a report revealed Tuesday.

Citizen Lab, an Web watchdog group, mentioned in its report the MY2022 app has severely flawed encryption that will make customers’ delicate information — and another information communicated via it — susceptible to being hacked. Different vital person information on the app wasn’t encrypted in any respect, the report discovered.

Which means the info might be learn by Chinese language Web service suppliers or telecommunications corporations via Wi-Fi hotspots at motels, airports and Olympic venues.

The Citizen Lab report mentioned the app was obligatory for attendees of the video games, and the Worldwide Olympic Committee’s official steerage instructs attendees to obtain the app earlier than they arrive to China. However the IOC issued an announcement Tuesday saying the smartphone app was not obligatory.

The IOC additionally pushed again towards Citizen Lab’s report, saying two unbiased cybersecurity testing organisations had discovered no vital vulnerabilities with the app.

China is requiring all worldwide Olympic attendees — together with coaches and journalists — to log right into a well being monitoring system no less than 14 days earlier than their departure. They will use the app to take action, or can log in via a Net browser on a PC. The app permits customers to submit required well being info every day and is a part of China’s aggressive effort to handle the coronavirus pandemic whereas internet hosting the video games, which start February 4. The multipurpose app additionally contains chat options, file transfers, climate updates, tourism suggestions and GPS navigation.

Citizen Lab’s report comes amid heightened issues over athletes’ information and privateness. Many nations are advising their athletes to not take their regular smartphones to China, however as a substitute to deliver short-term — or burner — telephones that don’t retailer any delicate private information, in line with information stories.

The US Olympic & Paralympic Committee issued an advisory to athletes telling them to “assume that each system and each communication, transaction, and on-line exercise will probably be monitored.”

“There ought to be no expectation of information safety or privateness whereas working in China,” the advisory mentioned.

China has a well-documented historical past of conducting muscular surveillance of its residents and aggressive cyber-spying on others. However Citizen Lab mentioned there was no proof that the simply discoverable safety flaws within the MY2022 app have been positioned deliberately by the Chinese language authorities. For one, a lot of the delicate well being info held on the app is required to be submitted on to authorities on well being customs varieties, the report mentioned.

Citizen Lab mentioned the safety vulnerabilities present in MY2022 app are much like these present in in style Chinese language Net browsers and famous that “inadequate safety of person information is endemic to the Chinese language app ecosystem.”

“In mild of earlier work analysing in style Chinese language apps, our findings regarding MY2022 are, whereas regarding, not stunning,” the report mentioned.

Citizen Lab mentioned it reported the safety points to the Beijing Organizing Committee final month however didn’t obtain a response. The report additionally mentioned the app’s safety flaws may run afoul of Apple’s and Google’s insurance policies for software program used on iPhone handsets and Android gadgets. The 2 corporations didn’t instantly return a request for remark.

The Android model of the MY2022 app included a listing named “illegalwords.txt” that included 2,442 key phrases, together with some that might be politically delicate and relate to China’s actions towards Tibet and the Uyghur ethnic group.

The report mentioned regardless of having the listing bundled with the app, it doesn’t seem to perform. The Chinese language authorities has lengthy required tech corporations to censor content material and key phrases deemed politically delicate or inappropriate.