2021年3月19日

一组IT专家周四表示，德国和奥地利的一次安全漏洞导致13.6万多份COVID-19检测结果没有受到保护。他们说，考试中心软件的入侵使8万多人的姓名、地址和其他个人信息不受保护。这个名为Zerforschung的专家小组和德国出版物混乱计算机俱乐部(CCC)在一份报告中透露，两国100多个考试中心使用的软件存在差距。这包括设在公司、学校和日托中心的考点。据气候中心报道，德国和奥地利有超过8万人受到影响。泽福schung发现，不仅可以查看COVID-19检测结果，还可以查看检测证书上的姓名、出生日期、地址、公民身份和身份证号码。仅仅因为数据是可访问的并不意味着它全部都被访问了。IT专家表示，他们在参观了慕尼黑公司21Dx运营的柏林新冠病毒检测中心后发现了这一安全漏洞，该公司称其是德国最大的新冠病毒检测和疫苗接种中心运营商，21Dx使用Medicus AI的SafePlay软件，这一安全漏洞正是源自该公司。奥地利数字健康科技公司Medicus AI对德国报纸Süddeutsche Zeitung表示，此次安全漏洞是由“2月中旬软件更新中的一个漏洞”引起的。Medicus AI表示，只有“在技术上非常有经验、拥有适当技术工具的人”才能访问这些信息。 The company didn't deny to the Süddeutsche Zeitung that 136,000 test results were accessible online. But the CCC said in its report that you only had to create an account for a COVID-19 test to access the personal data stored in PDF documents. Thanks to a separate loophole in the software, unauthorized users could also access a employee portal through the account they made for their COVID-19 test, see when a test was carried out at each center, and whether the test was positive or negative, the experts found. Through the portal, it was easy to access photos of the test results, which featured the names of patients, the CCC said in the report. Baher Al Hakim, CEO of Medicus AI, told Insider the breach was fixed within a few hours of being reported. He also said that the company conducted an investigation into the breach and only six people were affected. Insider reached out to 21Dx for comment, but didn't immediately receive a response.