20 Vulnerabilities in Mira Fertility Tracker Could Compromise Health Data
Researchers found 20 flaws in the Mira Ultra 4 fertility tracker, enabling potential data manipulation, impersonation, and firmware reverse engineering.
Northeastern University researchers have uncovered a significant security lapse in the Mira Ultra 4, a popular at-home fertility tracking device. A total of 20 vulnerabilities were identified across the device's Bluetooth communications, companion mobile application, and cloud infrastructure. These flaws could allow attackers to impersonate the device, alter crucial hormone readings, access sensitive user health data, and even reverse-engineer the device's firmware.
The findings, presented at DEF CON's Biohacking Village, were the result of a comprehensive security assessment funded in part by the U.S. Department of Health and Human Services' Advanced Research Projects Agency for Health (ARPA-H). The research team, composed of students from Northeastern's Archimedes Center for Healthcare & Medical Device Cybersecurity, highlighted the broader implications for the security of connected consumer health devices.
According to the researchers, the vulnerabilities span three primary attack surfaces. Firstly, the Bluetooth connection between the Mira analyzer and the mobile app lacked proper authentication, allowing nearby attackers to impersonate the device and inject falsified hormone readings. Secondly, the device's production firmware was found in a publicly accessible cloud storage bucket, enabling unauthorized reverse engineering. Lastly, flaws in authorization mechanisms and insecure object references within the mobile app's cloud APIs could grant read and write access to user health profiles.
One of the most concerning aspects is the potential for data integrity compromise. The researchers demonstrated the ability to inject manipulated hormone data into the application. This could lead to critical misjudgments in fertility planning, potentially resulting in mistimed IVF treatments, failed fertility cycles, or unintended pregnancies if users rely on inaccurate readings.
While the researchers found no evidence of actual data exfiltration or exploitation against real users, the potential impact is substantial. Based on user ID analysis, an estimated 650,000 to 659,000 user accounts could have been affected by the authorization flaws. The team also observed health-related data, including cycle and medical condition information, being transmitted to third-party analytics and advertising SDKs, though this was noted as observed data flow rather than a confirmed breach.
Following the discovery, the vulnerabilities were reported through a coordinated disclosure process involving the device manufacturer, Quanovate Tech, the U.S. Food and Drug Administration (FDA), and the Cybersecurity and Infrastructure Security Agency (CISA). Quanovate has acknowledged the findings and has reportedly completed two rounds of remediation, issuing updates to address the identified security gaps.
This case study underscores the growing need for robust security reviews in the rapidly expanding market of connected medical and health devices. As more personal health data is collected and transmitted wirelessly, ensuring the privacy and integrity of this sensitive information becomes paramount.