Jump to content

Albion College Forces Students to Install 24/7 Tracking App that Readily Leaks Personal Health Data

Skipple

Summary

 

Albion College, a private liberal arts college in Michigan, is forcing students to install a contact tracing app, called Aura. The app collects students' names, location, and COVID-19 status, then generates a QR code containing that information. Students can't opt-out. If students refuse, they face suspension. Also, students also aren't allowed to leave campus at all. 

 

That application had some massive security flaws that allowed full access to the database exposing every student's name, address, DOB, and COVID-19 test status. The vulnerability has sense been patched. 

 

Quotes

 

The App & School Policy:

Quote

Albion College,  a small liberal arts school in Michigan, said in June it would allow its nearly 1,500 students to return to campus for the new academic year starting in August. But less than two weeks before students began arriving on campus, the school announced it would require them to download and install a contact-tracing app called Aura, which it says will help it tackle any coronavirus outbreak on campus. There’s a catch. The app is designed to track students’ real-time locations around the clock, and there is no way to opt out.

 

The Aura app lets the school know when a student tests positive for COVID-19. It also comes with a contact-tracing feature that alerts students when they have come into close proximity with a person who tested positive for the virus.

In addition to having to install the app, students were told they are not allowed to leave campus for the duration of the semester without permission over fears that contact with the wider community might bring the virus back to campus.

 

If a student leaves campus without permission, the app will alert the school, and the student’s ID card will be locked and access to campus buildings will be revoked, according to an email to students, seen by TechCrunch.

Students are not allowed to turn off their location and can be suspended and “removed from campus” if they violate the policy, the email read.

Security:

 

Quote

TechCrunch used a network analysis tool to discover that the code was not generated on a device but rather on a hidden Aura website—and that TechCrunch could then easily change the account number in the URL to generate new QR codes for other accounts and receive access to other individuals' personal data.

 

A student at Albion, looking into the app's source code, also found hard-coded security keys for the app's backend servers. A researcher took a look and verified that those keys gave access to "patient data, including COVID-19 test results with names, addresses, and dates of birth," TechCrunch reports. “The keys were practically ‘full access’,” Gilda told TechCrunch. She said the keys — since changed — gave her access to the app’s databases and cloud storage in which she found patient data.

 

Nucleus pushed out an updated version of the app on the same day with the keys removed, but did not acknowledge the vulnerability.

 

 

My thoughts

Holy god the ACLU better be all over this one. I cannot imagine being forced to install a 24/7 tracing tool from my school, let alone that app having massive vulnerabilities.

 

Oh, and you aren't allowed to leave. 

Sounds like a good time for a school transfer. 

 

Sources

https://techcrunch.com/2020/08/19/coronavirus-albion-security-flaws-app/

https://arstechnica.com/tech-policy/2020/08/college-contact-tracing-app-readily-leaked-personal-data-report-finds/

ask me about my homelab

on a personal quest convincing the general public to return to the glory that is 12" laptops.

cheap and easy cable management is my fetish.

Link to comment
Share on other sites

Link to post
Share on other sites

I sense a class-action lawsuit... Also, students could just install the app on a burner phone ( @Arika S ), leaving it running 24/7 within the boundaries of the school. Still wrong to force the students to go through such measures, but, it is an option until the University realizes it will be facing some serious legal action. 

GPU: XFX RX 7900 XTX

CPU: Ryzen 7 7800X3D

Link to comment
Share on other sites

Link to post
Share on other sites

Who the hell thought this was a good idea

Bethesda PC:   R7 3700X  -  Asrock B550 Extreme 4  -  Corsair Dominator Platinum RGB 16GB@3.6GHz -  Zotac AMP Extreme 1080TI -  Samsung 860 Evo 256GB  -  WD Blue 2TB SSD -  500DX  -  Stock cooling lul  -  Rm650x

CrumpleBox V3:  Xeon X5680  -  Asus X58 Sabertooth  -  DDr3 16GB@1.33Ghz  -  Gigabyte 1660s -  TT smart RGB 700W  -  

Cooler Master Storm Trooper  -  120GB Samsung 850 Pro   -  LTT Edition Chromax NH-D15 ?

 

CrumpleBox 3 ROTF: I5-6400  -  MSI B150m Mortar  -  16GB 2133Mhz Vengeance Pro RGB  -  Strix 1070Ti - GTX 1070 FE  -  Adata 128GB SSD  -  Fractal Design Define C  -  Gammaxx 400V2  -  Cooler Master silent pro gold 1000W

CrumpleBox 2: i7-7820x - MSI X299 Raider - 32GB Thermaltake Toughram 3.6Ghz - 2x Sapphire Nitro Fury - 128GB PCie Adata SSD - O11 Dynamic - EVGA CLC 360 - Corsair RM1000X

 

Perhiperals:  Gateway 900p60 monitor  -  Dell 1024x768@75  -  Logi. G403 Carbon  -  Logi. G502  -  SteSer. Arctis 5  -  SteSer. Rival 110 - Corsair Strafe RGB MK.2

 

 

Link to comment
Share on other sites

Link to post
Share on other sites

Quote

In addition to having to install the app, students were told they are not allowed to leave campus for the duration of the semester without permission over fears that contact with the wider community might bring the virus back to campus.

 

If a student leaves campus without permission, the app will alert the school, and the student’s ID card will be locked and access to campus buildings will be revoked, according to an email to students, seen by TechCrunch.

So people with jobs are pretty much SOL?

 

Quote

a small liberal arts school

Oh, I guess they don't need to worry about people with jobs then.

CPU: Intel i7 6700k  | Motherboard: Gigabyte Z170x Gaming 5 | RAM: 2x16GB 3000MHz Corsair Vengeance LPX | GPU: Gigabyte Aorus GTX 1080ti | PSU: Corsair RM750x (2018) | Case: BeQuiet SilentBase 800 | Cooler: Arctic Freezer 34 eSports | SSD: Samsung 970 Evo 500GB + Samsung 840 500GB + Crucial MX500 2TB | Monitor: Acer Predator XB271HU + Samsung BX2450

Link to comment
Share on other sites

Link to post
Share on other sites

Why?

is the University at least cheap so you „pay „ with your data? ;)

Hi

 

Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler

hi

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Link to comment
Share on other sites

Link to post
Share on other sites

1 minute ago, Drama Lama said:

is the University at least cheap so you „pay „ with your data?

You're funny.

 

image.png.6919ff55a1d62bd32ad9a690f00a057e.png

ask me about my homelab

on a personal quest convincing the general public to return to the glory that is 12" laptops.

cheap and easy cable management is my fetish.

Link to comment
Share on other sites

Link to post
Share on other sites

Just now, Skipple said:

You're funny.

So for five years?

Hi

 

Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler

hi

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Link to comment
Share on other sites

Link to post
Share on other sites

34 minutes ago, Spotty said:

 

Oh, I guess they don't need to worry about people with jobs then.

The smart ones are working part time at mcdonalds so when they leave they have experience in the field.

Grammar and spelling is not indicative of intelligence/knowledge.  Not having the same opinion does not always mean lack of understanding.  

Link to comment
Share on other sites

Link to post
Share on other sites

Sometimes I feel like somebody needs to remind these colleges that you’re one the paying to go there and that they’re not the ones paying you to go there.

Judge a product on its own merits AND the company that made it.

How to setup MSI Afterburner OSD | How to make your AMD Radeon GPU more efficient with Radeon Chill | (Probably) Why LMG Merch shipping to the EU is expensive

Oneplus 6 (Early 2023 to present) | HP Envy 15" x360 R7 5700U (Mid 2021 to present) | Steam Deck (Late 2022 to present)

 

Mid 2023 AlTech Desktop Refresh - AMD R7 5800X (Mid 2023), XFX Radeon RX 6700XT MBA (Mid 2021), MSI X370 Gaming Pro Carbon (Early 2018), 32GB DDR4-3200 (16GB x2) (Mid 2022

Noctua NH-D15 (Early 2021), Corsair MP510 1.92TB NVMe SSD (Mid 2020), beQuiet Pure Wings 2 140mm x2 & 120mm x1 (Mid 2023),

Link to comment
Share on other sites

Link to post
Share on other sites

3 hours ago, Drama Lama said:

So for five years?

No, I think that's per year 😆.

Judge a product on its own merits AND the company that made it.

How to setup MSI Afterburner OSD | How to make your AMD Radeon GPU more efficient with Radeon Chill | (Probably) Why LMG Merch shipping to the EU is expensive

Oneplus 6 (Early 2023 to present) | HP Envy 15" x360 R7 5700U (Mid 2021 to present) | Steam Deck (Late 2022 to present)

 

Mid 2023 AlTech Desktop Refresh - AMD R7 5800X (Mid 2023), XFX Radeon RX 6700XT MBA (Mid 2021), MSI X370 Gaming Pro Carbon (Early 2018), 32GB DDR4-3200 (16GB x2) (Mid 2022

Noctua NH-D15 (Early 2021), Corsair MP510 1.92TB NVMe SSD (Mid 2020), beQuiet Pure Wings 2 140mm x2 & 120mm x1 (Mid 2023),

Link to comment
Share on other sites

Link to post
Share on other sites

17 minutes ago, Tech_Dreamer said:

it's good for you & everyone around you. do it. DO IT NOW. DO IT. DO IT NOW.DO IT. DO IT.

Install tracker, for your safety.

c3c.jpg

CPU: Intel Core i7-5820K | Motherboard: AsRock X99 Extreme4 | Graphics Card: Gigabyte GTX 1080 G1 Gaming | RAM: 16GB G.Skill Ripjaws4 2133MHz | Storage: 1 x Samsung 860 EVO 1TB | 1 x WD Green 2TB | 1 x WD Blue 500GB | PSU: Corsair RM750x | Case: Phanteks Enthoo Pro (White) | Cooling: Arctic Freezer i32

 

Mice: Logitech G Pro X Superlight (main), Logitech G Pro Wireless, Razer Viper Ultimate, Zowie S1 Divina Blue, Zowie FK1-B Divina Blue, Logitech G Pro (3366 sensor), Glorious Model O, Razer Viper Mini, Logitech G305, Logitech G502, Logitech G402

Link to comment
Share on other sites

Link to post
Share on other sites

5 minutes ago, PCGuy_5960 said:

Install tracker, for your safety.

c3c.jpg

wait till they get a hold of half tested Russian vaccines & start to enforce that one as well.

Details separate people.

Link to comment
Share on other sites

Link to post
Share on other sites

Just now, Tech_Dreamer said:

wait till they get a hold of half tested Russian vaccines & start to enforce that one as well.

Then one night they'll wake up to the sound of hardbass and find the students slav squatting and drinking vodka while hunting bears with AK-47s.

Spoiler

But in all seriousness isn't what they are doing completely illegal? There is no way they can actually force students to be tracked 24/7.

 

CPU: Intel Core i7-5820K | Motherboard: AsRock X99 Extreme4 | Graphics Card: Gigabyte GTX 1080 G1 Gaming | RAM: 16GB G.Skill Ripjaws4 2133MHz | Storage: 1 x Samsung 860 EVO 1TB | 1 x WD Green 2TB | 1 x WD Blue 500GB | PSU: Corsair RM750x | Case: Phanteks Enthoo Pro (White) | Cooling: Arctic Freezer i32

 

Mice: Logitech G Pro X Superlight (main), Logitech G Pro Wireless, Razer Viper Ultimate, Zowie S1 Divina Blue, Zowie FK1-B Divina Blue, Logitech G Pro (3366 sensor), Glorious Model O, Razer Viper Mini, Logitech G305, Logitech G502, Logitech G402

Link to comment
Share on other sites

Link to post
Share on other sites

Just now, PCGuy_5960 said:

 

  Hide contents

But in all seriousness isn't what they are doing completely illegal? There is no way they can actually force students to be tracked 24/7.

 

technically they probably signed a waiver to "abide by the rules" of the institution when they joined & they can deem if something is right or wrong, they are pretty much contractually bound to the terms & conditions legally. being a private entity/institution they probably have exclusive privilege/status if it becomes a legal matter. just like clicking "accept terms of agreement & continue" .

Details separate people.

Link to comment
Share on other sites

Link to post
Share on other sites

If the security vulnerabilities were fixed then I wouldn’t really see an issue. Contact tracing is a good thing and would prevent serious illness and death. It doesn’t work without location history, that’s the whole point.

 

If people don’t like it they don’t have to attend, it’s a private school on private property. They can require whatever they want. The school could also offer remote classes and or refunds of course to prevent drama, but that information isn’t disclosed in your post.

MacBook Pro 16 i9-9980HK - Radeon Pro 5500m 8GB - 32GB DDR4 - 2TB NVME

iPhone 12 Mini / Sony WH-1000XM4 / Bose Companion 20

Link to comment
Share on other sites

Link to post
Share on other sites

Just now, Tech_Dreamer said:

technically they probably signed a waiver to "abide by the rules" of the institution when they joined & they can deem if something is right or wrong, they are pretty much contractually bound to the terms & conditions legally. being a private entity/institution they probably have exclusive privilege/status if it becomes a legal matter. just like clicking "accept terms of agreement & continue" .

Yeah, but there are limitations on what they can force you to do, right? Especially if you signed the contract before they added this rule.

CPU: Intel Core i7-5820K | Motherboard: AsRock X99 Extreme4 | Graphics Card: Gigabyte GTX 1080 G1 Gaming | RAM: 16GB G.Skill Ripjaws4 2133MHz | Storage: 1 x Samsung 860 EVO 1TB | 1 x WD Green 2TB | 1 x WD Blue 500GB | PSU: Corsair RM750x | Case: Phanteks Enthoo Pro (White) | Cooling: Arctic Freezer i32

 

Mice: Logitech G Pro X Superlight (main), Logitech G Pro Wireless, Razer Viper Ultimate, Zowie S1 Divina Blue, Zowie FK1-B Divina Blue, Logitech G Pro (3366 sensor), Glorious Model O, Razer Viper Mini, Logitech G305, Logitech G502, Logitech G402

Link to comment
Share on other sites

Link to post
Share on other sites

Just now, PCGuy_5960 said:

Yeah, but there are limitations on what they can force you to do, right? Especially if you signed the contract before they added this rule.

unless it includes conditions & clause that the collage can change & determine what the parameters are. usually you see the similar toned approach in products pricing with MSRP values & discount/offer deals to foresee lawsuits & avoid it. it's always drowned in the fine print, but it's usually there.

Details separate people.

Link to comment
Share on other sites

Link to post
Share on other sites

1 minute ago, PCGuy_5960 said:

Yeah, but there are limitations on what they can force you to do, right? Especially if you signed the contract before they added this rule.

Sometimes I don;t understand us law, in Australia regardless if the student signed a contract or not and regardless of it being a private institution, contracts in Australia are void if they contain unfair or one sided conditions.  Being tracked and imprisoned fits both of those descriptors so the uni would have its arse handed to it by several legal institutions.  not the least of which is the HRC which has a very nasty bite (so bad it's almost a dictatorial entity). 

Grammar and spelling is not indicative of intelligence/knowledge.  Not having the same opinion does not always mean lack of understanding.  

Link to comment
Share on other sites

Link to post
Share on other sites

4 hours ago, Shammikit said:

I would buy an old Nokia 3310 and tell them this is the only phone I use :D

Nokia 3310 will protect you better against COVID-19 and you don't even need to wait for vaccin :D

DAC/AMPs:

Klipsch Heritage Headphone Amplifier

Headphones: Klipsch Heritage HP-3 Walnut, Meze 109 Pro, Beyerdynamic Amiron Home, Amiron Wireless Copper, Tygr 300R, DT880 600ohm Manufaktur, T90, Fidelio X2HR

CPU: Intel 4770, GPU: Asus RTX3080 TUF Gaming OC, Mobo: MSI Z87-G45, RAM: DDR3 16GB G.Skill, PC Case: Fractal Design R4 Black non-iglass, Monitor: BenQ GW2280

Link to comment
Share on other sites

Link to post
Share on other sites

5 hours ago, GrockleTD said:

Who the hell thought this was a good idea

The usual idiotic fanboys of centralized authority, facebook karens, etc. The usual people who think government or other institutions should have any authority to track and control every moment of your life for "health and safety".

 

I wonder how long before contact tracing is horribly misused, which is the only possibly outcome for such a stupid concept.

Ketchup is better than mustard.

GUI is better than Command Line Interface.

Dubs are better than subs

Link to comment
Share on other sites

Link to post
Share on other sites

2 hours ago, AluminiumTech said:

No, I think that's per year 😆.

Seems a bit high to me for an art school 

 

but that would kinda explain the low number of students 

Hi

 

Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler
Spoiler

hi

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Link to comment
Share on other sites

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×