{"id":834,"date":"2022-01-21T20:29:38","date_gmt":"2022-01-22T03:29:38","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/?p=834"},"modified":"2022-01-21T20:29:41","modified_gmt":"2022-01-22T03:29:41","slug":"the-application-mandate-that-could-have-serious-security-consequences","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/2022\/01\/21\/the-application-mandate-that-could-have-serious-security-consequences\/","title":{"rendered":"The Application Mandate That Could Have Serious Security Consequences"},"content":{"rendered":"\n
\"MY2022
[1]<\/sup><\/figcaption><\/figure><\/div>\n\n\n\n

At the low chance that you were considering attending the Beijing 2022 Olympics, you may want to reconsider. The reason: MY2022.<\/p>\n\n\n\n

What is MY2022?<\/h2>\n\n\n\n

MY2022 is a smartphone application that is mandatory to use for all attendees of the Beijing 2022 Olympics, including press members, government agents, and athletes. While there currently does not exist proof that the application was designed for malicious purposes, it at the very least has major internal security flaws that can easily be exploited by adversaries.<\/p>\n\n\n\n

\"\"
Screenshots of the MY2022 user interface [2]<\/sup><\/figcaption><\/figure><\/div>\n\n\n\n

The research laboratory \u201cCitizen Lab\u201d has done research on this application and, upon multiple discoveries, have pinpointed two major vulnerabilities.[3]<\/sup> This research was published on January 18th 2022. The result of these vulnerabilities could be potential data leakage of users of the app and spoofing of actual data transmitted through the application\u2019s servers. Citizen Lab has even speculated that these vulnerabilities could have been purposely placed, as an act of surveillance by the Chinese government.<\/p>\n\n\n\n

The Vulnerabilities<\/h2>\n\n\n\n

The main vulnerabilities are related to how MY2022 transmits user data. Applications will commonly use SSL, which is used to encrypt and digitally sign data to prevent data from being modified or read when being transmitted between client and server. However, MY2022 does not validate SSL certificates, and thus cannot know if it is sending data to the correct client or server.[3]<\/sup> This is a concern considering such data could include sensitive information which could be read by an attacker, or data sent from the app could be intercepted and modified by an attacker. One way an attacker can exploit this is by \u201cspoofing\u201d a trusted server of the application, which will allow them to be able to send fake information to clients. At the very least, Citizen Lab found five vulnerable SSL connections that could be exploited on the app:<\/p>\n\n\n\n