{"id":31796,"date":"2019-11-14T13:07:42","date_gmt":"2019-11-14T13:07:42","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/infosec-boffins-pour-cold-water-on-claims-home-office-brexit-app-can-be-easily-hacked\/"},"modified":"2019-11-14T13:07:42","modified_gmt":"2019-11-14T13:07:42","slug":"infosec-boffins-pour-cold-water-on-claims-home-office-brexit-app-can-be-easily-hacked","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/infosec-boffins-pour-cold-water-on-claims-home-office-brexit-app-can-be-easily-hacked\/","title":{"rendered":"Infosec boffins pour cold water on claims Home Office Brexit app can be easily hacked"},"content":{"rendered":"
<\/div>\n

Reports that the Home Office’s Brexit app contains “serious vulnerabilities” that could expose the phone numbers, addresses and passport details of EU citizens are overblown, say security experts.<\/p>\n

To date, one million EU nationals have downloaded the Android settled status app, which asks users to take a selfie and scans the chip in their passports in order to verify their identity.<\/p>\n

The Financial Times<\/em> today splashed with the headline “Home Office app for EU citizens easy to hack” based on a report by Norwegian security firm Promon<\/a>. The company’s researchers found the app contains loopholes allowing them to access any information that was entered into it, including the facial scans and images of passport pages.<\/p>\n

However, the Promon team did not reveal a specific vulnerability. Instead they tested the app’s resilience against basic and commonly used attack methods and tools, and themselves noted these “often require very limited technical skills to use”.<\/p>\n

David Lodge, from Pen Test Partners, said of the research: “All their findings are what we would recommend for a mobile app to have to follow best practices. That is security measures that could be applied to improve the security of the app. These are controls like the app detecting whether the phone has been rooted.<\/p>\n

“To exploit anything with what they’ve listed would require a complicated setup or a device that has already been compromised.”<\/p>\n

Promon found the “ID Document Check Android” app lacked functionality to “prevent” malware from reading and stealing sensitive information provided by users, including passport details and photo IDs. They also noted that “attackers may modify or add malicious elements to the app, repackage and re-distribute the app, without the app noticing such changes or foreign elements”.<\/p>\n

The firm added the app is not:<\/p>\n