Nothing Fixed This CMF Watch App Security Flaw That Could Expose User Data

Nothing — the UK startup led by OnePlus Co-Founder Cal Pei — just lately rolled out a partial repair for a safety vulnerability that affected the companion app for the CMF Watch Pro, in response to a report. The encryption-related flaw was able to exposing electronic mail addresses and passwords used to enroll in an account. The points have come to mild weeks after Nothing’s iMessage-on-Android app was shut down amid allegations that the service didn’t encrypt messages and media as marketed by Nothing and its accomplice Sunbird.

9to5Google contributor Dylan Roussel, in a latest a thread on X (previously Twitter), defined that the CMF Watch app was encrypting each the e-mail deal with and password offered by customers when signing up for an account — whereas permitting decryption of each the e-mail and password with the identical keys. The publication reviews that the means to decrypt person info was additionally discovered within the Android app, which allowed anybody to view these particulars.

Back in September, Roussel had identified that the CMF Watch app was developed by Chinese agency Jingxun, and references to the agency have been seen within the app. At the time, he identified that the corporate’s web site additionally lists OnePlus as certainly one of its companions, alongside Sony, Philips, and Toshiba.

Months after the vulnerabilities have been reported, CMF by Nothing instructed the publication that it’s working to repair the safety flaws identified by Roussel — the encryption technique for a person’s password has reportedly been resolved, whereas the e-mail deal with remains to be impacted by the flaw. The firm instructed 9to5Google that an OTA replace might be rolled out to CMF Watch Pro customers to resolve excellent points.

According to the 9to5Google report, the corporate just lately opened up totally different factors of contact for vulnerabilities with each Nothing and CMF by Nothing merchandise — these weren’t accessible again in September when the failings have been being reported.

It is value noting that Nothing was just lately entangled in a privateness controversy when the corporate launched its Nothing Chats app in beta, promising Nothing Phone 2 customers entry to Apple’s proprietary iMessage service. After a number of points with the privateness and safety of the service have been raised on-line — together with dealing with of unencrypted messages and media by Nothing’s accomplice Sunbird — the corporate pulled its app from the Play Store, whereas Sunbird additionally knowledgeable customers it was pausing entry to its personal service.