BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Khoury College of Computer Sciences - ECPv6.17.4//NONSGML v1.0//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Khoury College of Computer Sciences
X-ORIGINAL-URL:https://www.khoury.northeastern.edu
X-WR-CALDESC:Events for Khoury College of Computer Sciences
REFRESH-INTERVAL;VALUE=DURATION:PT1H
X-Robots-Tag:noindex
X-PUBLISHED-TTL:PT1H
BEGIN:VTIMEZONE
TZID:America/New_York
BEGIN:DAYLIGHT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
TZNAME:EDT
DTSTART:20250309T070000
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
TZNAME:EST
DTSTART:20251102T060000
END:STANDARD
BEGIN:DAYLIGHT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
TZNAME:EDT
DTSTART:20260308T070000
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
TZNAME:EST
DTSTART:20261101T060000
END:STANDARD
BEGIN:DAYLIGHT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
TZNAME:EDT
DTSTART:20270314T070000
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
TZNAME:EST
DTSTART:20271107T060000
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
DTSTART;TZID=America/New_York:20260917T140000
DTEND;TZID=America/New_York:20260917T160000
DTSTAMP:20260901T193230Z
CREATED:20260831T195111Z
LAST-MODIFIED:20260901T193230Z
UID:10006672-1789653600-1789660800@www.khoury.northeastern.edu
SUMMARY:Talk: Wand Protocol — A Full-Chain Security Assessment of an FDA-Listed Fertility Hormone Analyzer (hybrid/Boston)
DESCRIPTION:Join over Microsoft Teams\n\n\n\n\n \n\n\n\nThis hybrid talk (via Teams and on the Boston campus) will present a coordinated vulnerability disclosure involving an FDA-listed fertility hormone analyzer\, its mobile app\, and its cloud infrastructure. The assessment identified vulnerabilities across three attack surfaces: an unauthenticated Bluetooth Low Energy connection enabling device impersonation and the injection of fabricated hormone readings; publicly accessible production firmware; and a hardcoded third-party API key that could expose sensitive health-profile data associated with approximately 659\,000 accounts. \n\n\n\nThe researchers also observed health-related data being transmitted to analytics and advertising SDKs\, although this represents an identified data flow rather than a confirmed breach. The seminar will include a live demonstration of the device-impersonation attack\, examine the gap between FDA listing and cybersecurity assurance\, and present recommended mitigations. \n\n\n\nAll research was conducted using researcher-owned devices and accounts. The findings were disclosed to the manufacturer\, the FDA Center for Devices and Radiological Health\, and CISA before this presentation. \n\n\n\nSpeakers\n\n\n\nGigi Xiaoqing Liu is a Northeastern graduate researcher specializing in embedded systems\, medical-device security\, and AI security. Her experience includes wireless and mobile reverse engineering\, binary exploitation\, and cloud security. \n\n\n\nEn Mong (Lucas) is an MS Cybersecurity student and medical-device security researcher at Northeastern. His work spans BLE analysis\, firmware reverse engineering\, endpoint security\, and vulnerability management. He contributed to research resulting in eight CVEs and a CISA medical advisory. \n\n\n\nMuzzammil Mohammed is a Northeastern MS Cybersecurity graduate\, offensive security researcher\, and penetration tester. A core developer of the WandKit BLE auditing toolkit\, he specializes in cloud API exploitation\, authentication bypasses\, and AI-assisted security auditing. \n\n\n\nNarmina Karimova is a Northeastern cybersecurity graduate researcher with experience in enterprise technology at financial institutions and the United Nations. She developed the project’s Python-based BLE attack suite\, reverse-engineered the Android application\, uncovered hardcoded credentials\, and confirmed a critical authorization vulnerability involving sensitive health data.
URL:https://www.khoury.northeastern.edu/event/talk-wand-protocol-a-full-chain-security-assessment-of-an-fda-listed-fertility-hormone-analyzer-hybrid-boston/
LOCATION:366 West Village H\, 440 Huntington Avenue\, Boston\, MA\, 02115\, United States
GEO:42.3386529;-71.0921979
X-APPLE-STRUCTURED-LOCATION;VALUE=URI;X-ADDRESS=366 West Village H 440 Huntington Avenue Boston MA 02115 United States;X-APPLE-RADIUS=500;X-TITLE=440 Huntington Avenue:geo:-71.0921979,42.3386529
END:VEVENT
END:VCALENDAR