New Tool Reveals Security and Privacy Issues with Contact Tracing Apps

Researchers have developed a tool to identify security and privacy risks associated with COVID-19 contact tracing apps.

COVIDGuardian, the first automated security and privacy assessment tool, tests contact tracing apps for potential threats such as malware, embedded trackers and private information leakage.

Using the COVIDGuardian tool, cybersecurity experts assessed 40 COVID-19 contact tracing apps that have been employed worldwide for potential privacy and security threats. Their findings include that:

  • 72.5 per cent of the apps use at least one insecure cryptographic algorithm.
  • Three quarters of apps contained at least one tracker that reports information to third parties such as Facebook Analytics or Google Firebase.
  • Whilst most apps were free of malware, the Kyrgyzstan app Stop COVID-19 KG was discovered to have malware.

Following their analysis, the researchers released the results to vendors. Further testing later found that privacy and security weaknesses on four apps had been fixed, and one vulnerable app was found to no longer be available.

Dr Gareth Tyson, Senior Lecturer at Queen Mary University of London, said: "With the pandemic there was a rapid need for contact tracing apps to support efforts to control the spread of COVID-19. Unsurprisingly we found that this had resulted in some relatively mainstream security bugs being introduced worldwide. Some of the most common risks relate to the use of out-of-date cryptographic algorithms and the storage of sensitive information in plain text formats that could be read by potential attackers."

"Our work is helping developers to address these problems. Through COVIDGuardian we've produced a tool that can be used by developers to discover and fix potential weaknesses in their apps and share guidelines that will help to ensure user privacy and security is maintained."

To support this work the researchers also performed a survey involving over 370 individuals to understand the likelihood that they would use a contact tracing app and highlight concerns around their use. The results suggested that the privacy and accuracy of contact tracing apps had the biggest impact on whether individuals would use the app.

As part of the survey, volunteers were also asked about their preferences with regards to decentralised and centralised apps. Dr Tyson, said: "Security and privacy concerns have been a big issue affecting the uptake of these apps. We were surprised that the debate around decentralised vs centralised apps didn't seem so important and, instead, users were more focused on the exact details of what private information is collected. This should encourage developers to offer stronger privacy guarantees for their apps."

Ruoxi Sun, Wei Wang, Minhui Xue, Gareth Tyson, Seyit Camtepez, Damith C. Ranasinghe.
An Empirical Assessment of Global COVID-19 Contact Tracing Applications.

The paper will be presented at the International Conference on Software Engineering on May 23-29 2021. A copy of the paper is available at: https://arxiv.org/abs/2006.10933.

Most Popular Now

FDA Authorizes Software that Can Help Id…

Today, the U.S. Food and Drug Administration authorized marketing of software to assist medical professionals who examine body tissues (pathologists) in the detection of areas that are suspicious for cancer...

Orion Health Supports Professional Recor…

Orion Health is supporting the Professional Record Standards Body's partnership scheme by applying to become a 'quality partner'. The company, which is one of the UK’s leading providers of shared care...

Roche Opens Access to Pathology Imaging …

Roche (SIX: RO, ROG; OTCQX: RHHBY) announced the introduction of the Roche Digital Pathology Open Environment that allows software developers to easily integrate their image analysis tools for tumour tissue...

App Launched in Multiple Languages to He…

An app is being launched to help patients with long term conditions manage their health via care plans accessed on their phone. Unity, by mobile health provider, Health Fabric, will...

Northumbria Healthcare Picks CliniSys to…

Pathologists at one of England's most innovative trusts have chosen the CliniSys laboratory information system (LIMS) as part of a digital strategy to support its drive to continually improve patient...

A Computer Algorithm Called 'Eva' May Ha…

A prescriptive computer program developed by the USC Marshall School of Business and Wharton School of Business of the University of Pennsylvania for Greece to identify asymptomatic, infected travelers...

Contact-Tracing Apps could Improve Vacci…

Mathematical modeling of disease spread suggests that herd immunity could be achieved with fewer vaccine doses by using Bluetooth-based contact-tracing apps to identify people who have more exposure to others...

University of Oxford and Oracle Cloud Sy…

The fast spread of the highly infectious Delta variant underscores the need for faster identification of COVID-19 mutations. Uniting governments and medical communities in this challenge, the University of Oxford...

Study Finds Telemedicine Appointments Re…

Telemedicine appointments combined with in-person visits significantly reduced the risk of further illness for children with medically complex cases, according to results of a new study by researchers with The...

AI Tool Improves Accuracy of Breast Canc…

A computer program trained to see patterns among thousands of breast ultrasound images can aid physicians in accurately diagnosing breast cancer, a new study shows. When tested separately on 44,755 already...

Using Internet in Retirement Boosts Cogn…

Using the internet during your retirement years can boost your cognitive function, a new study has found. Researchers from Lancaster University Management School, the Norwegian University Science and Technology and...

FDA Clears First Major Imaging Device Ad…

Today, the U.S. Food and Drug Administration cleared the first new major technological improvement for Computed Tomography (CT) imaging in nearly a decade. "Computed tomography is an important medical imaging tool...