Serious Vulnerability Discovered in Beijing Olympics App

The official mobile application of the winter Olympic Games in Beijing was picked apart by security researchers and the discoveries were troubling.

A research team with Canadian Citizen Lab published a post on the MY2022 app and discovered a "devastating" vulnerability. According to the research, the application has a flaw that renders the encryption of data transferred over the app practically null and void.

MY2022 is the official app that has been made obligatory for all participants in the Beijing Olympics, including athletes and accompanying teams and entourage. The app is going to be used by members of the press covering the event as well.

SSL Encryption Flaws

The research team discovered a very significant vulnerability in the method that the application uses to transmit data across devices. The communication itself is encrypted, but the vulnerability allows a potential malicious actor to circumvent that encryption and execute man-in-the-middle attacks, as well as access sensitive information.

The app was found unable to validate SSL certificates. This allows a potential attacker to spoof trusted server communication and make the app connect to a malicious node.

In addition to the poor SSL implementation, researchers discovered that the app was transmitting bits of "sensitive" data without any encryption. This means that any "passive" eavesdropper could tap into this transmission through a wi-fi access point and see the names of message senders and recipients, as well as user account IDs.

No Response from Dev

The team over at Citizen Lab disclosed their findings to the Beijing Organising Committee first, as is customary, with 15 days for a response and 45 days provided for a fix. In late January the app was updated but the research team found the reported issues were still in the latest build and Citizen Lab received no response to their original query.

The research document published by Citizen Lab concludes with strong hints that the MY2022 app doesn't meet the security requirements of either the Google Play Store or the Apple App Store, due to the poor handling of sensitive data and bad security implementation, and as such may be delisted from those app marketplaces.