Dissecting contact tracing apps in the Android platform

Abstract

Contact tracing has historically been used to retard the spread of infectious diseases, but if it is exercised by hand in large-scale, it is known to be a resource-intensive and quite deficient process. Nowadays, digital contact tracing has promptly emerged as an indispensable asset in the global fight against the coronavirus pandemic. The work at hand offers a meticulous study of all the official Android contact tracing apps deployed hitherto by European countries. Each app is closely scrutinized both statically and dynamically by means of dynamic instrumentation. Depending on the level of examination, static analysis results are grouped in two axes. The first encompasses permissions, API calls, and possible connections to external URLs, while the second concentrates on potential security weaknesses and vulnerabilities, including the use of trackers, in-depth manifest analysis, shared software analysis, and taint analysis. Dynamic analysis on the other hand collects data pertaining to Java classes and network traffic. The results demonstrate that while overall these apps are well-engineered, they are not free of weaknesses, vulnerabilities, and misconfigurations that may ultimately put the user security and privacy at risk.

Let the Cat out of the Bag: Popular Android IoT Apps under Security Scrutiny

“…For ensuring the reproducibility of the results, we used the free-to-use "community" edition of the tool. It is to be noted that Ostorlab has been utilized in the context of analogous vulnerability analysis researches, including the ones in [7,8,13,14].…”

“…For both the analysis phases, when searching for weaknesses and vulnerabilities, we followed the methodology set out in the OWASP mobile security testing guide [3]. Actually, more or less the same methodology have been followed by [4] regarding static analysis, [5,6] regarding dynamic analysis, and [7,8] for both types of analysis.…”

Designing evaluation framework for the empirical assessment of COVID-19 mobile apps in Pakistan

“…Main features included in their analysis were usability, functionality, design, user perception, information and content and ethical issues. The work presented by Kouliaridis et al [4] is focused on twenty six (26) mobile apps collected from different European countries from Google play store. They performed both static and dynamic analyses of mobile apps by studying the permission, access level, weakness, misconfiguration, vulnerabilities and privacy issues.…”

A Survey on Digital Certificates Approaches for the COVID-19 Pandemic

“…With reference to the previous section and Table 3, eighteen countries are omitted because they currently do not offer such apps. For the interested reader, an analogous analysis but for official contact tracing apps available in European countries has been contributed by [9].…”

“…Moreover, the authors in [8] examined COVID-19 entirely from the Internet of Things (IoT) prism. On the other hand, the work in [9] provided a holistic security and privacy assessment of the official Android contact tracing apps supported by European countries, leaving out apps destined for COVID-19 digital certificates. To our knowledge, the most relevant work to ours is that in [10].…”