Northeastern students found security vulnerabilities with popular fertility tracker
The Northeastern graduate students said the maker of the device has updated their service to account for their security issues.
Female fertility trackers have exploded in popularity in the past decade. In fact, the global feminine technology market is expected to reach a valuation of $255 billion by 2035, according to Research and Markets, a market research firm.
One of the main draws of these trackers is that they give users access to high quality health data that is easily accessible from their smartphones or computers. But they don’t come without risk.
Students working in Northeastern University’s Archimedes Center for Healthcare & Medical Device Cybersecurity recently uncovered 20 security vulnerabilities with the Mira Ultra 4, a popular at-home fertility tracker used to track hormones and ovulation cycles.
The weaknesses were found both with the device and its mobile application. With these security lapses, hackers could connect to the device using a Bluetooth connection, access unencrypted information, and inject the device with incorrect health data, the students found.
But the students didn’t just have the ability to share false data with the device, they could also completely impersonate users, said Narmina Karimova, a graduate researcher at the center who worked on the study.
“We could do a full takeover of the device and the companion app,” she said, noting that at the time they were testing, over 600,000 Mira accounts could have been exposed to the vulnerabilities.
That could directly impact people who rely on the device for appointments with their medical providers. People’s sensitive health information could have also potentially been exposed to bad actors, added Muzzammil Mohammed, also a graduate researcher at the center.
Led by Northeastern Professor Kevin Fu, the Archimedes Center tests and analyzes medical devices for cybersecurity risks.
It works with the U.S. Department of Health and Human Services, which funded a portion of the students’ cybersecurity investigation through its Advanced Research Projects Agency for Health, which supports “high-risk” biomedical research not traditionally done by commercial or government entities, according to its website.
The students reported their findings to the U.S. Food and Drug Administration and the Cybersecurity and Infrastructure Security Agency, a federal agency focused on securing digital technologies.
Editor’s Picks
Editor’s Picks
Editor’s Picks
As part of this process, they also disclosed their findings to Quanovate Tech Inc., the maker of the Mira device. In an August media statement, the company said that it had identified the root cause of the security lapses and had issued a fix through software updates.
Quanovate Tech Inc. did not respond to a request from Northeastern Global News seeking further clarification on the fix.
The students presented their findings this summer at DefCon in Las Vegas, an annual hacking conference attended by thousands of cybersecurity professionals, academics and hobbyists.
Matthew Braun, an electrical and computer engineering program manager in the College of Engineering, assisted the students in finalizing their report.
That the students were able to identify the vulnerabilities and understand their significance showed a high level of technical knowledge, he said.
“They had to figure out what other engineers were thinking,” he said. “It required them to think, ‘What are they doing here, and how could that be misused.’”
The investigation started as a class project for a graduate level medical device cybersecurity class at Northeastern. The students’ assignment was to analyze the device with no expectation that they needed to uncover security issues, Karimova said.
When the students started uncovering specific gaps in the Mira device, they started investigating more closely. Over the course of two months, the students read up on the space as they uncovered vulnerability after vulnerability, she said.
“This was a new world for all of us,” she said. “This just started as a class. We never expected to be presenting at DefCon.”
Most junior employees working in cybersecurity don’t get a project like this in the first five years they are on the job, Braun highlighted.
“Every one of these students is going to be exceptional on day one with their employers,” he said. “Being able to produce folks that have this experience prior to getting their degree, really gives them a leg up and helps the industry.”
