PT-2020-16359 · Apple+2 · Ios+3

Carmela Troncoso + 4 · Published 2020-11-13 · Updated 2021-02-04 · CVE-2020-26230

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Radar COVID versions prior to 1.0.8 (uniform distribution) and 1.1.0 (exponential distribution) on iOS Radar COVID versions prior to 1.0.7 (uniform distribution) and 1.1.0 (exponential distribution) on Android Radar COVID Backend versions prior to 1.1.2-RELEASE

Description The issue allows identification and de-anonymization of COVID-19 positive users when using Radar COVID. This is caused by the fact that connections to the server are only made by COVID-19 positives, enabling any on-path observer to identify which users had a positive test. The attacker may also de-anonymize the user by correlating Radar COVID traffic to other identifiable information from the victim, such as contract information or user-generated flows containing identifiers in the clear. The vulnerability has been mitigated with the injection of dummy traffic from the application to the backend.

Recommendations Update iOS Radar COVID to version 1.0.8 (uniform distribution) or 1.1.0 (exponential distribution) to fix the issue. Update Android Radar COVID to version 1.0.7 (uniform distribution) or 1.1.0 (exponential distribution) to fix the issue. Update Radar COVID Backend to version 1.1.2-RELEASE to fix the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-26230

GHSA-W7JX-37X3-W2JX

Affected Products

Android

Radar Covid

Radar Covid Backend

Ios

References · 17

• 🔥 https://github.com/DP-3T/documents/blob/master/DP3T%20-%20Best%20Practices%20for%20Operation%20Security%20in%20Proximity%20Tracing.pdf · Exploit
• https://github.com/RadarCOVID/radar-covid-android/commit/91dcfff6252055637bc9ee0c46b8f003d64a16b9 · Patch
• https://github.com/RadarCOVID/radar-covid-android/commit/8e5d14ec60e0c1847a4733556cf34d232c27102c · Patch
• https://github.com/RadarCOVID/radar-covid-android/commit/9627f4d69705bca68e550eefd3df1b9abe90b215 · Patch
• https://github.com/RadarCOVID/radar-covid-android/commit/7fdc7debeb8a37faa77b53d9f9a1b4bbcff445ce · Patch
• https://github.com/RadarCOVID/radar-covid-android/commit/09d00e5ede801ca400d45c7feda5a99c34e4176c · Patch
• https://github.com/RadarCOVID/radar-covid-android/commit/53252773ffa81e116deabcbbea3bac96872b9888 · Patch
• https://github.com/RadarCOVID/radar-covid-android/commit/ea0c4cc837f72f58e2b5df1ecf0899743ec3cdf8 · Patch
• https://github.com/RadarCOVID/radar-covid-ios/commit/2d1505d4858642995ea09f02f23c953acaa65195 · Patch
• https://github.com/RadarCOVID/radar-covid-backend-dp3t-server/commit/c37f81636250892670750e3989139fd76d4beffe · Patch
• https://github.com/RadarCOVID/radar-covid-backend-dp3t-server/commit/6d30c92cc8fcbde3ded7e9518853ef278080344d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26230 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26230 · Vendor Advisory
• https://github.com/RadarCOVID/radar-covid-backend-dp3t-server/security/advisories/GHSA-w7jx-37x3-w2jx · Note
• https://t.me/cvenotify/9414 · Telegram Post