Exploiting a Contact Tracing App to Attack Neighboring Devices

Abstract

The recent pandemic fosters an increasing dependency on various forms of digital communications that support social distancing. To mitigate widespread exposure to COVID, the Louisiana Department of Health's COVID Defense contact tracing application helps users learn about potential exposures to infected individuals. This research investigates the viability of using the Louisiana Department of Health's COVID Defense application symptoms share feature as an attack vector. The primary contribution of this research is an initial assessment of the effective modification and distribution of a packaged JSON file that contains a malicious link. Secondly, it highlights the effectiveness of this attack through email, WIFI direct, and nearby share.