Checking Contact Tracing App Implementations

Robert Flood, Sheung Chan, Wei Chen, David Aspinall, David Aspinall

2021

Abstract

In the wake of the COVID-19 pandemic, contact tracing apps have been developed based on digital contact tracing frameworks. These allow developers to build privacy-conscious apps that detect whether an infected individual is in close-proximity with others. Given the urgency of the problem, these apps have been developed at an accelerated rate with a brief testing period. Such quick development may have led to mistakes in the apps’ implementations, resulting in problems with their functionality, privacy and security. To mitigate these concerns, we develop and apply a methodology for evaluating the functionality, privacy and security of Android apps using the Google/Apple Exposure Notification API. This is a three-pronged approach consisting of a manual analysis, general static analysis and a bespoke static analysis, using a tool we’ve developed, dubbed MonSTER. As a result, we have found that, although most apps met the basic standards outlined by Google/Apple, there are issues with the functionality of some of these apps that could impact user safety.

Paper Citation

in Harvard Style

Flood R., Chan S., Chen W. and Aspinall D. (2021). Checking Contact Tracing App Implementations.In Proceedings of the 7th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-491-6, pages 133-144. DOI: 10.5220/0010237201330144

in Bibtex Style

@conference{icissp21,
author={Robert Flood and Sheung Chan and Wei Chen and David Aspinall},
title={Checking Contact Tracing App Implementations},
booktitle={Proceedings of the 7th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2021},
pages={133-144},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0010237201330144},
isbn={978-989-758-491-6},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 7th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Checking Contact Tracing App Implementations
SN - 978-989-758-491-6
AU - Flood R.
AU - Chan S.
AU - Chen W.
AU - Aspinall D.
PY - 2021
SP - 133
EP - 144
DO - 10.5220/0010237201330144