Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

11:10 AM

Most Contact-Tracing Apps Fail Basic Security

A survey of 17 Android applications for informing citizens if they had potential contact with a COVD-19-infected individual finds few have adopted code-hardening techniques.

Government agencies and private organizations that are developing contact-tracing applications to help citizens keep informed about their potential risk of infection have failed to provide adequate protections against compromise and hacking, mobile-application security firm Guardsquare stated in a report published on Thursday.

The company analyzed 17 Android applications, looking for six different types of security countermeasures that the company deems necessary to protect user privacy and prevent the data collected by the contact app from being used for unforeseen purposes. Only one of the applications included full encryption and obfuscation of sensitive data, according to the report.

Despite the need to quickly get contract-tracing capabilities into the hands of citizens, countries need to get privacy right, says Grant Goodes, chief scientist with Guardsquare.

"In the current day and age, with people's somewhat understandable mistrust of government, if you try to roll out something — for a legitimate purpose and a well-intentioned purpose — but you make a giant security mistake, as North Dakota's app did, you will destroy public trust," he says. "And you really only get one shot at these things."

Contact tracing is widely considered to be a necessary step for countries to take to continue to open up their economies while reducing the transmission of infectious diseases. Manual contact tracing — the only effective method in the past — requires a massive workforce. Before the epidemic, state, and local health departments employed fewer than 2,000 contact tracers, but anywhere between 100,000 and 300,000 may be necessary.

"Prompt identification, voluntary isolation or quarantine, and monitoring of a person diagnosed with COVID-19 and their contacts can effectively break the chain of disease transmission and prevent further spread of the virus," the US Center for Disease Control said in a policy statement. "Case investigation and contact tracing are core disease control measures that have been used by state and local health departments for decades to slow or stop the spread of infectious diseases."

Contact-tracing applications make the process more accurate and less labor-intensive but raise significant privacy concerns. One early adopter of contract tracing, China, uses a centralized system that has no significant protections for citizens' privacy, allowing police to check the status of people as they commute between various locations. The United Kingdom and France are also pursuing a centralized model, raising the specter of large databases of geolocation data on their citizens stored on government-owned servers.

Privacy advocates have argued that decentralized contact tracing is the only way to proceed. In May, Apple and Google launched a joint initiative to create a framework for opt-in privacy-preserving contact tracing that only stored location data on the device. Such distributed contact tracing is the preferred way among technologists to implement the technology, but people have not adopted such optional technology very quickly. In Germany, which launched its app this week, only 41% of people are likely to adopt the app, while 46% are not willing to use contact tracing, one survey found, according to the Wall Street Journal.

People are even less likely to adopt applications if security issues are found, says Guardsquare's Goodes. In May, Amnesty International found significant security weaknesses in the mandatory contact-tracing application in Qatar, issues that exposed more than 1 million people. Pro-privacy configuration service Jumbo analyzed the Care19 contact-tracing app developed by North Dakota and found that it fails to abide by its own privacy policy, sharing information on the user's location with geolocation-based advertising service FourSquare. In June, FourSquare allowed developers to disable the advertising ID that could be used to track users.

In its analysis, Guardsquare deemed six different forms of data protection to be necessary to protect a user's privacy on the applications. The code should have obfuscation to make reverse engineering more difficult, string encryption to protect sensitive code variables and names, asset encryption to prevent attackers from accessing parts of the program, and additional obfuscation to harden the software. In addition, the program should have checks to prevent running on a compromised device or in an emulator.

These measures do not even take into account how the application and the government behind the application handles the data. Yet, only a single application — of 17 — managed to have all the application-hardening measures in place, Guardsquare stated in its analysis. The five applications tested from the Americas all adopted three of the techniques, but none adopted the other three security measures. The applications created for the Middle Eastern market had the least amount of security measures, with only two of four applications even adopting a method of encryption or obfuscation.

"This form of voluntary contact tracing could be a far more gentle form of lockdown, if people trust it and it works right," says Goodes. "The problem is that we are just starting to get these apps out there and they are being rushed, without the proper security."

Making the applications private from the get-go is critical, adds Guardsquare's Goodes. "There are so many ways that this can go wrong," he says. "We have seen that every technology has a dark side, and the police have shown a willingness to use any technology to their benefit."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "What's Anonymous Up to Now?"

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
PUBLISHED: 2021-02-27
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__M...