Most Contact-Tracing Apps Fail Basic Security

A survey of 17 Android applications for informing citizens if they had potential contact with a COVD-19-infected individual finds few have adopted code-hardening techniques.

Government agencies and private organizations that are developing contact-tracing applications to help citizens keep informed about their potential risk of infection have failed to provide adequate protections against compromise and hacking, mobile-application security firm Guardsquare stated in a report published on Thursday.
The company analyzed 17 Android applications, looking for six different types of security countermeasures that the company deems necessary to protect user privacy and prevent the data collected by the contact app from being used for unforeseen purposes. Only one of the applications included full encryption and obfuscation of sensitive data, according to the report.
Despite the need to quickly get contract-tracing capabilities into the hands of citizens, countries need to get privacy right, says Grant Goodes, chief scientist with Guardsquare.
In the current day and age, with peoples somewhat understandable mistrust of government, if you try to roll out something — for a legitimate purpose and a well-intentioned purpose — but you make a giant security mistake, as North Dakotas app did, you will destroy public trust, he says. And you really only get one shot at these things.
Contact tracing is widely considered to be a necessary step for countries to take to continue to open up their economies while reducing the transmission of infectious diseases. Manual contact tracing — the only effective method in the past — requires a massive workforce. Before the epidemic, state, and local health departments employed fewer than 2,000 contact tracers, but
anywhere between 100,000 and 300,000 may be necessary
.
Prompt identification, voluntary isolation or quarantine, and monitoring of a person diagnosed with COVID-19 and their contacts can effectively break the chain of disease transmission and prevent further spread of the virus, the US Center for Disease Control said in
a policy statement
. Case investigation and contact tracing are core disease control measures that have been used by state and local health departments for decades to slow or stop the spread of infectious diseases.
Contact-tracing applications make the process more accurate and less labor-intensive but raise significant privacy concerns. One early adopter of contract tracing, China, uses a centralized system that has no significant protections for citizens privacy, allowing police to check the status of people as they commute between various locations. The United Kingdom and France are also pursuing a centralized model, raising the specter of large databases of geolocation data on their citizens stored on government-owned servers.
Privacy advocates have argued that decentralized contact tracing is the only way to proceed. In May, Apple and Google
launched a joint initiative
to create a framework for opt-in privacy-preserving contact tracing that only stored location data on the device. Such distributed contact tracing is the preferred way among technologists to implement the technology, but people have not adopted such optional technology very quickly. In Germany, which launched its app this week, only 41% of people are likely to adopt the app, while 46% are not willing to use contact tracing,
one survey found, according to the Wall Street Journal
.
People are even less likely to adopt applications if security issues are found, says Guardsquares Goodes. In May, Amnesty International
found significant security weaknesses
in the mandatory contact-tracing application in Qatar, issues that exposed more than 1 million people. Pro-privacy configuration service Jumbo
analyzed the Care19 contact-tracing app
developed by North Dakota and found that it fails to abide by its own privacy policy, sharing information on the users location with geolocation-based advertising service FourSquare. In June, FourSquare allowed developers to disable the advertising ID that
could be used to track users
.
In
its analysis
, Guardsquare deemed six different forms of data protection to be necessary to protect a users privacy on the applications. The code should have obfuscation to make reverse engineering more difficult, string encryption to protect sensitive code variables and names, asset encryption to prevent attackers from accessing parts of the program, and additional obfuscation to harden the software. In addition, the program should have checks to prevent running on a compromised device or in an emulator.
These measures do not even take into account how the application and the government behind the application handles the data. Yet, only a single application — of 17 — managed to have all the application-hardening measures in place, Guardsquare stated in its analysis. The five applications tested from the Americas all adopted three of the techniques, but none adopted the other three security measures. The applications created for the Middle Eastern market had the least amount of security measures, with only two of four applications even adopting a method of encryption or obfuscation.
This form of voluntary contact tracing could be a far more gentle form of lockdown, if people trust it and it works right, says Goodes. The problem is that we are just starting to get these apps out there and they are being rushed, without the proper security.
Making the applications private from the get-go is critical, adds Guardsquares Goodes. There are so many ways that this can go wrong, he says. We have seen that every technology has a dark side, and the police have shown a willingness to use any technology to their benefit.
Related Content:
Centralized Contact Tracing Raises Concerns Among Privacy-Conscious Citizens
Coronavirus, Data Privacy & the New Online Social Contract
Fake COVID-19 Contact-Tracing Apps Infect Android Phones
Microsoft Proposes Privacy Controls for COVID-19 Contact Tracking, Tracing
How Data Breaches Affect the Enterprise
Privacy & Digital-Rights Experts Worry Contact-Tracing Apps Lack Limits
Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays featured story:
Whats Anonymous Up to Now?

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Most Contact-Tracing Apps Fail Basic Security