Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor
The Qardio Arm iOS application exposes sensitive data such as usernames
and passwords in a plist file. This allows an attacker to log in to
production-level development accounts and access an engineering backdoor
in the application. The engineering backdoor allows the attacker to
send hex-based commands over a UI-based terminal.
Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor
The Qardio Arm iOS application exposes sensitive data such as usernames
and passwords in a plist file. This allows an attacker to log in to
production-level development accounts and access an engineering backdoor
in the application. The engineering backdoor allows the attacker to
send hex-based commands over a UI-based terminal.
Qardio has not responded to requests to work with CISA to mitigate these
vulnerabilities. Users of these affected products are invited to
contact Qardio customer support https://www.qardio.com/about-us/#contact for additional information.
Users should do the following to help mitigate the risk:
* Disable Bluetooth when not in use.
* Don't use this device in public or within Bluetooth range of malicious actors.
* Only use trusted mobile apps from trusted providers.
Exploits
Credits
finder
Bryan Riggins of Insulet Corporation reported these vulnerabilities to CISA.
The Qardio Arm iOS application exposes sensitive data such as usernames
and passwords in a plist file. This allows an attacker to log in to
production-level development accounts and access an engineering backdoor
in the application. The engineering backdoor allows the attacker to
send hex-based commands over a UI-based terminal.