Toronto lab finds security vulnerabilities, censorship framework in Olympic app - CBC Sports | Canada News Media
Connect with us

Sports

Toronto lab finds security vulnerabilities, censorship framework in Olympic app – CBC Sports

Published

 on


Researchers at a Toronto-based tech laboratory have uncovered security vulnerabilities and censorship frameworks in an app all 2022 Beijing Olympics attendees must use.

The Citizen Lab, a research institute at the University of Toronto’s Munk School of Global Affairs and Public Policy that studies spyware, found a “simple but devastating” flaw in the MY2022 app that makes audio files, health and customs forms transmitting passport details, and medical and travel history vulnerable to hackers.

Researcher Jeffrey Knockel found MY2022 does not validate some SSL certificates, digital infrastructure that uses encryption to secure apps and ensures no unauthorized people can access information as it is transmitted.

This failure to validate means the app can be deceived into connecting with malicious hosts it mistakes as being trusted, allowing information the app transmits to servers to be intercepted and attackers to display fake instructions to users.

“The worst-case scenario is that someone is intercepting all the traffic and recording all the passport details, all the medical details,” said Knockel, a research associate, who investigated the app after a journalist curious about its security functions approached him.

WATCH | Explaining security flaws in the Beijing Olympics app:

Explaining the security flaw & censorship framework found in ‘My2022’ Beijing Olympic app

12 hours ago

Duration 4:45

The Citizen Lab, a socio-political research group from the University of Toronto’s Munk School of Global Affairs & Public Policy, found the Beijing 2022 companion app, to be used by Olympians and other attendees of the Games, has a security flaw that opens up any user’s personal data to hackers. David Masson, chair of enterprise security at Darktrace, joined to explain the potential dangers of the app to its users. 4:45

Olympic organizers have required all games attendees, including athletes, spectators and media members, to download and start using the MY2022 app for submitting health and customs information like COVID-19 test results and vaccination status at least 14 days ahead of their arrival in China.

The app from a state-owned company called Beijing Financial Holdings Group also offers GPS navigation and text, video and audio chat functions and the ability to transfer files and provide news and weather updates.

Knockel found it’s unclear with whom the app shares highly sensitive medical information.

Censorship keyword list

The Olympic playbook outlines personal data such as biographical information and health-related data may be processed by Beijing 2022, International Olympic and Paralympic committees, Chinese authorities and “others involved in the implementation of the [COVID-19] countermeasures.”

Knockel said MY2022 outlines several scenarios where it will disclose personal information without user consent, which include but are not limited to national security matters, public health incidents, and criminal investigations.

However, the app does not specify whether court orders will be required to gain access to this information and who will be eligible to receive data.

WATCH | Cybersecurity experts at UofT voice concerns about Beijing Olympics app:

Cybersecurity experts concerned about 2022 Beijing Olympics app

19 hours ago
Duration 3:44

Cybersecurity experts at the University of Toronto are voicing concerns about the My2022 app, which is required for all participants in the Beijing Winter Olympics. 3:44

The final concern Knockel uncovered was that the app allows users to report “politically sensitive” content and found it has a censorship keyword list.

The list includes 2,442 political terms, including some linked to tensions in Xinjiang and Tibet, as well as references to Chinese government agencies. On the list are Chinese phrases translating to “Jews are pigs” and “Chinese are all dogs,” Uyghur terms for “the Holy Quran” and Tibetan words referring to the Dalai Lama.

Knockel couldn’t find evidence the list was being used by the app.

“We don’t know whether they intended for it to be inactive or whether they intended for it to be active, but either way, it’s something that … can be enabled at the flick of a switch,” said Knockel.

The Citizen Lab disclosed the concerns it found with MY2022 to organizing committees on Dec. 3, giving them 15 days to respond and 45 days to fix the issues, before it publicly disclosed the problems.

IOC requests copy of lab report

A new version of MY2022 for iOS users was released on Jan. 6, but Citizen Lab said no issues were resolved with the update. In fact, Citizen Lab said the update introduced a new “Green Health Code” feature that collects more medical data and is vulnerable to attacks because of its lack of SSL certificate validation.

The Beijing Organizing Committee did not respond to a request for comment.

The International Olympic Committee said in a statement that it has requested a copy of the Citizen Lab’s report to better understand its concerns.

The IOC noted it has conducted independent third-party assessments on MY2022 with two cyber-security testing organizations and found there are no critical vulnerabilities in the app.

Meanwhile, the Canadian Olympic Committee did not address the report specifically, but said it has reminded all members of Team Canada that the Games present a unique opportunity for cybercrime and they should be extra diligent about these risks.

It said in a statement it has recommended Team Canada members leave personal devices at home, limit personal information stored on electronics brought to the Games, only connect to official Wi-Fi, turn off transmitting functions when not in use and remove any Games related apps when they’re no longer necessary.

Knockel recommends anyone headed to the Olympics only use the app when connected to networks they trust, like a virtual private network.

Olympic participants should also consider taking conversations and other actions that are not mandatory to complete in MY2022 to other apps with better security, he said.

“But it’s tricky,” he said. “Even if they are aware of the security vulnerabilities in the app, they might not have a choice.”

Adblock test (Why?)



Source link

Continue Reading

Sports

After 20 years at the top of chess, Magnus Carlsen is making his next move

Published

 on

 

STAVANGER, Norway (AP) — Few chess players enjoy Magnus Carlsen‘s celebrity status.

A grand master at 13, refusing to play an American dogged by allegations of cheating, and venturing into the world of online chess gaming all made Norway’s Carlsen a household name.

Few chess players have produced the magical commodity that separates Norway’s Magnus Carlsen from any of his peers: celebrity.

Only legends like Russia’s Garry Kasparov and American Bobby Fischer can match his name recognition and Carlsen is arguably an even more dominant player. Last month, he beat both men to be named the International Chess Federation’s greatest ever.

But his motivation to rack up professional titles is on the wane. Carlsen, 33, now wants to leverage his fame to help turn the game he loves into a spectator sport.

“I am in a different stage in my career,” he told The Associated Press. “I am not as ambitious when it comes to professional chess. I still want to play, but I don’t necessarily have that hunger. I play for the love of the game.”

Offering a new way to interact with the game, Carlsen on Friday launched his application, Take Take Take, which will follow live games and players, explaining matches in an accessible way that, Carlsen says, is sometimes missing from streaming platforms like YouTube and Twitch. “It will be a chiller vibe,” he says.

Carlsen intends to use his experience to provide recaps and analysis on his new app, starting with November’s World Chess Championship tournament between China’s Ding Liren and India’s Gukesh Dommaraju. He won’t be competing himself because he voluntarily ceded the title in 2023.

Carlsen is no novice when it comes to chess apps. The Play Magnus game, which he started in 2014, gave online users the chance to play against a chess engine modeled against his own gameplay. The company ballooned into a suite of applications and was bought for around $80 million in 2022 by Chess.com, the world’s largest chess website.

Carlsen and Mats Andre Kristiansen, the chief executive of his company, Fantasy Chess, are betting that a chess game where users can follow individual players and pieces, filters for explaining different elements of each game, and light touch analysis will scoop up causal viewers put off by chess’s sometimes rarefied air. The free app was launched in a bid to build the user base ahead of trying to monetizing it. “That will come later, maybe with advertisements or deeper analysis,” says Kristiansen.

While Take Take Take offers a different prospect with its streaming services, it is still being launched into a crowded market with Chess.com, which has more than 100 million users, YouTube, Twitch, and the website of FIDE the International Chess Federation. World Chess was worth around $54 million when it got listed on the London Stock Exchange.

The accessibility of chess engines that can beat any human means cheating has never been easier. However, they can still be used to shortcut thousands of hours of book-bound research, and hone skills that would be impossible against human opponents.

“I think the games today are of higher quality because preparation is becoming deeper and deeper and artificial intelligence is helping us play. It is reshaping the way we evaluate the games,” especially for the new generation of players, says Carlsen.

At the same time, he admits that two decades after becoming a grand master, his mind doesn’t quite compute at the tornado speed it once did. “Most people have less energy when they get older. The brain gets slower. I have already felt that for a few years. The younger players’ processing power is just faster.”

Even so, he intends to be the world’s best for many years to come.

“My mind is a bit slower, and I maybe don’t have as much energy. But chess is about the coming together of energy, computing power and experience. I am still closer to my peak than decline,” he said.

Chess has been cresting a popularity wave begun by Carlsen himself.

He became the world’s top-ranked player in 2011. In 2013, he won the first of his five World Championships. In 2014, he achieved the highest-ever chess rating of 2882, and he has remained the undisputed world number one for the last 13 years.

Off the table, chess influencers, like the world No. 2, Hikaru Nakamura, are using social media to bring the game to a wider audience. The Netflix series “The Queen’s Gambit” burnished chess’ unlikely cerebral sex appeal when it became one of the streamer’s biggest hits in 2020.

And in 2022 Carlsen’s refusal to play against Hans Niemann, an American grand master, who admitted to using technology to cheat in online games in the past, created a rare edge in the usually sedate world of chess. There is no evidence Niemann ever cheated in live games but the feud between the pair propelled the game even further into public consciousness.

Whether chess can continue to grow without the full professional participation of its biggest celebrity remains to be seen.

Source link

Continue Reading

Sports

Top figure skaters ready to hit the ice at Skate Canada International

Published

 on

 

Canadian pairs team Deanna Stellato-Dudek and Maxime Deschamps along with ice dancers Piper Gilles and Paul Poirier headline a strong field at Skate Canada International. The Canadians say they’re excited to perform in front of a home crowd as the world’s best figure skaters arrive in Halifax. (Oct. 24, 2024)

Source link

Continue Reading

Sports

Nico Echavarria shoots another 64 to lead the Zozo Championship by 2 shots after the second round

Published

 on

 

INZAI CITY, Japan (AP) — Nico Echavarria shot a 6-under 64 on Friday — matching his 64 on Thursday — to lead by two shots over Taylor Moore and Justin Thomas after the second round of the Zozo Championship in Japan.

Thomas shot 64 and Moore carded 67 with three others just three shots off the lead including Seamus Power, who had the day’s low round of 62 at the Narashino Country Club.

Thomas has twice won the PGA Championship but is winless in two years on the PGA Tour.

Eric Cole (67) and C.T. Pan (66) were also three behind heading to Saturday.

Nick Taylor, of Abbotsford, B.C., is the top Canadian at 5-under and tied for 16th.

Ben Silverman, of Thornhill, Ont., is two shots back of Taylor and tied for 31st.

“I’ve never had a lead after 36 holes,” said Echavarria, a Colombian who played at the University of Arkansas. His lone PGA win was last year in Puerto Rico.

He had a two-round total of 12-under 128.

“I’ve had it after 54, but never after 36, so it’s good to be in this position. There’s got to be some pressure,” he added. “Hopefully a good round tomorrow can keep me in the lead or around the lead. And how I said yesterday — the goal is to be close with nine holes to go.”

Rickie Fowler, a crowd favorite in Japan because of his connections to the country, shot 64 to go with an opening 68 and was four shots back going into the weekend. Max Greyserman was also four behind after a 68.

“It would be amazing to win here,” said Fowler, whose mother has Japanese roots. “Came close a few years ago.”

Fowler tied for second in 2022

Fowler described his roots as “pretty far removed for Japan, but I’m sure I have relatives here, but I don’t know anyone. Japanese culture’s always been a fairly big part of life growing up. I always love being over here.”

Japanese star Hideki Matsuyama shot his second 71 and was 14 shots off the lead.

Defending champion Collin Morikawa shot 67 and pulled within eight shot of the lead, and Xander Schauffele — British Open and PGA winner this season — shot 65 and was 10 behind after a 73 on Thursday.

“I feel like I’ve got a good game plan out here,” Morikawa said, another player with Japanese connections. “I just have to execute shots a little better.”

“I am the defending champ, but that doesn’t mean I’m immediately going to play better just because I won here,” he added. “It’s a brand new week, it’s a year later. I feel like my golf game is still in a good spot. I just haven’t executed my shots. When that doesn’t happen it makes golf a little tougher.”

Schauffele turned 31 on Friday and said he was serenaded before his opening tee shot. He also has ties to Japan. His mother grew up in Japan and his grandparents live in the Tokyo area.

“Nice way to spend my 31st birthday,” he said.

___

AP golf:

The Canadian Press. All rights reserved.

Source link

Continue Reading

Trending

Exit mobile version