Wand Protocol - Full Chain Attack on an FDA Listed Fertility Analyzer

The Northeastern University researchers examine a consumer fertility hormone analyzer that is FDA listed and used at home to track LH, FSH, estrogen and progesterone. They argue that these readings guide real decisions, such as IVF timing, so forged or leaked numbers carry physical and legal consequences. They map the data path across Bluetooth Low Energy, the companion phone app and the vendor cloud, noting that results pass through three trust boundaries where they could be altered.

The team reported about 20 separate weaknesses across those layers. The headline problem is a rogue peripheral attack. The app matches the device by a substring of its advertised Bluetooth name, so an attacker advertising a matching name receives the user's session token during the normal handshake. In a live demo, they spoofed the analyzer, got the app to connect to a laptop, and injected fake results. Other findings included a login endpoint that issued sessions without checking passwords, a hardcoded API key in the app that allowed reads and writes across many profiles, firmware reachable through an unauthenticated storage bucket, and health data sent to third-party analytics on every session open. All testing used researcher-owned hardware and accounts.

The proposed fixes are encrypted BLE with authenticated pairing, mutual authentication between app and device, integrity protection on health payloads, removal of embedded secrets, minimizing third-party telemetry, and a published disclosure policy with a software bill of materials. The vendor said it had shipped device and app updates after two patch cycles. For practitioners, the lesson is that connected medical devices need authenticated links, server-side object authorization and scrutiny of bundled tracker SDKs.