Vulnerability

AliveCor KardiaMobile sends ECG data over sound without encryption

MedDevice Cyber Staff · Oct 25 · 3 min read · Via CISA ICSMA-22-298-01

CISA published advisory ICSMA-22-298-01 on October 25, 2022, covering two vulnerabilities in AliveCor KardiaMobile: the Kardia App for Android, versions 5.17.1-754993421 and earlier, and all versions of the KardiaMobile device. Carlos Cilleruelo Rodríguez and Javier Junquera Sánchez of the University of Alcalá reported them.

CVE-2022-41627 (CWE-311, CVSS v3 4.8) is the design issue. The KardiaMobile device sends its readings to the phone as sound, and that data-over-sound protocol has no encryption. An attacker within 5 feet could read patient EKG results or disrupt the reading by emitting sounds at similar frequencies.

CVE-2022-40703 (CWE-302, CVSS 5.2) is in the Android app, which is open to the publicly known Intent Manipulation exploit. It lets an attacker bypass app authentication and view or alter information in the app.

AliveCor acknowledged the missing encryption but called the circumstances needed to exploit it unlikely. For the app, it points to its usage instructions, which recommend a phone passcode or biometric lock to reduce Intent Manipulation risk.

Proximity requirements lower the odds, and they do nothing about integrity: a faked cardiogram is a clinical problem no matter how close the attacker had to stand.

Are you a representative of AliveCor? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

No fix is listed for the unencrypted data-over-sound protocol, which AliveCor says is unlikely to be exploited. Users should protect their phones with a passcode or biometric lock, keep the Kardia App current, and take readings away from people who could be within 5 feet.

Lock the phone. Use a passcode or biometric identification, which AliveCor says reduces Intent Manipulation risk.
Update the Kardia App. Move past version 5.17.1-754993421 on Android.
Record in private. Take readings where no unknown person is within 5 feet.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Physiological waveform processing Mobile app

Contributing

Home use Handles patient data

KardiaMobile

PID-4112 Physiological waveform processing Handles patient data

Kardia App

Mobile app

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2022-41627 in AliveCor KardiaMobile?

CVE-2022-41627 (CWE-311, CVSS v3 4.8) is the lack of encryption in the AliveCor KardiaMobile data-over-sound protocol. An attacker within 5 feet could read EKG results or cause a denial of service by emitting similar frequencies. CISA published it in ICSMA-22-298-01 on October 25, 2022.

How does CVE-2022-40703 affect the Kardia App for Android?

CVE-2022-40703 (CWE-302, CVSS 5.2) lets an attacker bypass authentication in the AliveCor Kardia App for Android 5.17.1-754993421 and earlier through the Intent Manipulation exploit and view or alter app data, per CISA advisory ICSMA-22-298-01 from October 25, 2022. AliveCor recommends a phone PIN or biometric lock.

← Back to Vulnerabilities

Key Facts

Product 1: KardiaMobile All versions (AliveCor)
Device Type: Personal ECG recorder
Product 2: Kardia App Android 5.17.1-754993421 and earlier (AliveCor)
Device Type: ECG companion mobile app
Materials: Kardia App ≤ 5.17.1-754993421; Data-over-sound protocol all versions
Components: Mobile Application, Generic Hardware
Interfaces: Wireless, Virtual
Dataflow: KardiaMobile to Kardia App (phone) over unencrypted data-over-sound, carrying ECG/EKG readings
Assets: Patient EKG results (Patient Data); KardiaMobile ECG readings sent to the phone (Sensor Data); Information held in the Kardia App (viewable/alterable after authentication bypass) (User Data)
Advisory: ICSMA-22-298-01
CVEs: CVE-2022-41627, CVE-2022-40703
CVSS: 4.8
Severity: Medium
Disclosed: Oct 25, 2022
Source: CISA ICSMA-22-298-01

Sources

AliveCor: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: AliveCor