Mind the GAP: Security & Privacy Risks of Contact Tracing Apps

Abstract

Contact tracing apps running on mobile devices promise to reduce the manual effort required for identifying infection chains and to increase the tracing accuracy in the presence of COVID-19. Since the beginning of the pandemic, several contract tracing apps have been proposed or deployed in practice by academia or academic-industrial consortia. While some of them rely on centralized approaches and bear high privacy risks, others are based on decentralized approaches aimed at addressing user privacy aspects. Google and Apple announced their joint effort of providing an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy, the so-called "Google/Apple Proposal", which we abbreviate by "GAP". The contact tracing feature seems to become an opt-in feature in mobile devices running iOS or Android. Some countries have already decided or are planning to base their contact tracing apps on GAP 1 .Several researchers have pointed out potential privacy and security risks related to most of the contact tracing approaches proposed until now, including those that claim privacy protection and are based on GAP. However, the question remains as how realistic these risks are. This report makes a first attempt towards providing empirical evidence in real-world scenarios for two such risks discussed in the literature: one concerning privacy, and the other one concerning security. In particular, we focus on a practical analysis of GAP, given that it is the foundation of several tracing apps, including apps such as the Swiss SwissCOVID, the Italian Immuni, and the German Corona-Warn-App. We demonstrate that in real-world scenarios the current GAP design is vulnerable to (i) profiling and possibly de-anonymizing infected persons, and (ii) relay-based wormhole attacks that principally can generate fake contacts with the potential of significantly affecting the accuracy of an app-based contact tracing system. For both types of attack, we have built tools that can be easily used on mobile phones or Raspberry Pis (e.g., Bluetooth sniffers). We hope that our findings provide valuable input in the process of testing and certifying contact tracing apps, e.g., as planned for the German Corona-Warn-App, ultimately guiding improvements for secure and privacypreserving design and implementation of digital contact tracing systems.

Privacy Guarantees of BLE Contact Tracing: A Case Study on COVIDWISE

“…We define and categorize the threat levels based on attackers' privilege levels regarding accessing RPI beacons in different realworld scenarios. These privilege levels are also compatible with the assumptions made in the existing literature [5], [6], [7], [8], [9], [10], [11]. In the walking trail and your neighbor models, an adversary can sniff a very limited amount of beacons for obtaining RPIs.…”

“…As with all security solutions, the privacy guarantees of GAEN are relative. There certainly exist extreme scenarios (e.g., [3], [6], [7], [8], [19], [20]) where attackers may learn additional information. If an adversary has access to RPIs, TEKs, and RPI date-time information read by (say) thousands of users, then the adversary can profile a user's movement [3], [7], [6].…”

“…Hence, user privacy is preserved in the Some attack scenarios in Table 1 have rather strong assumptions regarding the complexity of the attack setup and demand huge resources. For example, attackers in the Organized Crime I model (ID 5) require TEKs and aggregated data in each 10 to 20-minute time window to deanonymize infected users [3], [6], [7]. Aggregated data include public and sensitive information, such as date, time, interaction graph, social graph, address, location type (e.g., residential, workplace, and library), and surveillance cameras.…”

“…In addition, the Organized Crime I model requires access to published TEKs through a jailbroken/rooted device or imitating a contact tracing app [6] (in normal operation, the TEK downloaded are not readily available to the user and the exposure assessment is done away from the user). While obtaining TEKs through a jailbroken/rooted device might be feasible, imitating a contact tracing app is rather difficult.…”

“…Researchers have scrutinized the contact tracing technology and warned that adoption of the technology can have privacy and security issues [5], [6], [7], [8], [9], [10], [11], thus perhaps advocating against its wide adoption. However, these works primarily designed attacks based on abstract protocol design and abstract (theoretically formulated) adversaries (which have access to much more than the actual protocol on actual devices given to users).…”