A Multi-Tier Security Analysis of Official Car Management Apps for Android

Abstract

Using automotive smartphone applications (apps) provided by car manufacturers may offer numerous advantages to the vehicle owner, including improved safety, fuel efficiency, anytime monitoring of vehicle data, and timely over-the-air delivery of software updates. On the other hand, the continuous tracking of the vehicle data by such apps may also pose a risk to the car owner, if, say, sensitive pieces of information are leaked to third parties or the app is vulnerable to attacks. This work contributes the first to our knowledge full-fledged security assessment of all the official single-vehicle management apps offered by major car manufacturers who operate in Europe. The apps are scrutinised statically with the purpose of not only identifying surfeits, say, in terms of the permissions requested, but also from a vulnerability assessment viewpoint. On top of that, we run each app to identify possible weak security practices in the owner-to-app registration process. The results reveal a multitude of issues, ranging from an over-claim of sensitive permissions and the use of possibly privacy-invasive API calls, to numerous potentially exploitable CWE and CVE-identified weaknesses and vulnerabilities, the, in some cases, excessive employment of third-party trackers, and a number of other flaws related to the use of third-party software libraries, unsanitised input, and weak user password policies, to mention just a few.

Dissecting contact tracing apps in the Android platform

“…Note that for the sake of the reproducibility of the results, we employed the free-to-use "community" edition of the tool. To our knowledge, the same tool has been exploited in the context of similar researches [59][60][61].…”

Emerging Cybersecurity and Privacy Threats to Electric Vehicles and Their Impact on Human and Environmental Sustainability

“…Some of these applications are provided by EV manufacturers and large companies, but many are thirdparty applications which are built and distributed by independent developers [109]. Poorly developed applications contain security flaws, backdoors, and privacy loopholes [110]. In 2016, the Nissan connect app was hacked to gain control of the EV functions including the vehicle sensors, air conditioning, and heating [111].…”

Let the Cat out of the Bag: Popular Android IoT Apps under Security Scrutiny

“…For ensuring the reproducibility of the results, we used the free-to-use "community" edition of the tool. It is to be noted that Ostorlab has been utilized in the context of analogous vulnerability analysis researches, including the ones in [7,8,13,14].…”

“…For both the analysis phases, when searching for weaknesses and vulnerabilities, we followed the methodology set out in the OWASP mobile security testing guide [3]. Actually, more or less the same methodology have been followed by [4] regarding static analysis, [5,6] regarding dynamic analysis, and [7,8] for both types of analysis.…”