Cracking open the COVIDSafe
summary
COVIDSafe’s claims meet code and evidence not slogans: Android and iOS builds reuse OpenTrace but fail to rotate temp ids reliably so temp id rotation is broken, a pairing/GATT flow enables silent bonding on Android and yields CVE-2020-12856 exploitable for permanent tracking, and one exploit scores 9.8 CVE score. Analysis shows phone model leakage, inconsistent background behaviour, and that the Apple/Google exposure notification decentralized API would avoid most of these problems.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:56Contact Tracing
- 3:20Privacy
- 5:52Bluetooth
- 9:25How it works
- 14:31Problems
- 16:19The big problem
- 19:14Exposure Notification
- 21:56Conclusion
related talks
29mCOVID-19 Apps: Public Health or Hype?
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
25mBetter safe than sorry
07m"The significance of mobile exploit applications"
40mSecurity: The Hidden Cost of Android Stalkerware
36mRevisiting Stealthy Sensitive Information Collection from Android Apps
32mAndroid iPhone Risks and Solutions
41mFive Years of Android Security Research: the Good, the Bad...