CVE-2020-24722

An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping to amplify a contamination attack. This can cause metadata deanonymization and risk-score inflation. NOTE: the vendor's position is "We do not believe that TX power authentication would be a useful defense against relay attacks.

An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping to amplify a contamination attack. This can cause metadata deanonymization and risk-score inflation. NOTE: the vendor's position is "We do not believe that TX power authentication would be a useful defense against relay attacks.

**EN DISPUTA** Se detectó un problema en el protocolo GAEN (también se conoce como Google/Apple Exposure Notifications) hasta el 05/10/2020, tal como es usado en las aplicaciones COVID-19 en Android e iOS. El bloque de metadatos cifrados con un valor TX carece de un checksum, permitiendo a bitflipping amplificar un ataque de contaminación. Esto puede causar una desanonimización de los metadatos y la inflación de la puntuación de riesgo. NOTA: la posición del proveedor es "No creemos que la autenticación de energía TX sea una defensa útil contra los ataques de retransmisión"