Publication: Análisis de Vulnerabilidades en Aplicaciones de Rastreo de Covid-19 basadas en el Protocolo DP3T
Loading...
Official URL
Full text at PDC
Publication Date
2021-06
Advisors (or tutors)
Editors
Journal Title
Journal ISSN
Volume Title
Publisher
Citations
Exportar
Abstract
Debido a la pandemia mundial provocada por el COVID-19 a principios de 2020, vimos como el número de personas contagiadas por este virus crecía a una velocidad muy alta, causando la saturación de los hospitales, muchos fallecimientos y llevando a muchos países a imponer un confinamiento domiciliario durante meses. Para controlar los contagios y actuar de manera rápida ante un caso de una persona contagiada por el virus y evitar su expansión, surge un trabajo clave que es el rastreador, que es una persona que se dedica a investigar los contactos cercanos que ha tenido una persona que ha dado positivo en COVID-19 para avisarles que hagan una cuarentena domiciliaria y se realicen las pruebas correspondientes. Este rastreo manual se vuelve un trabajo muy arduo debido a la rápida expansión del virus dejando de ser efectivo. Por este motivo surge la idea de crear una aplicación móvil para hacer un rastreo digital de contacto más efectivo. Sin embargo, el rastreo mediante una aplicación móvil, despierta en los usuarios la preocupación y el temor de que con este sistema se violen su privacidad e intimidad y que sus datos queden expuestos a posibles hackers, provocando que los usuarios no usen el sistema y con ello se pierda la efectividad del rastreo de contactos. En este trabajo se realiza un analisis de las vulnerabilidades presentes en las aplicaciones móviles de rastreo de contactos que se basan en el protocolo DP-3T utilizando una herramienta de análisis automático de vulnerabilidades para aplicaciones móviles. Específicamente, se realiza una serie de análisis (estático y dinámico) a las aplicaciones basadas en el protocolo DP-3T desarrolladas en la UE. En total se han seleccionado un total de 18 aplicaciones según su disponibilidad y posibilidad de instalación. El resultado de los análisis ha sido bastante mejorable en la mayoría de las aplicaciones con una media de puntuación de 47.7 donde más del 90 % han resultado ser inseguras en la versión con la que se ha realizado este trabajo. Todo esto puede venir a raíz del escaso tiempo de desarrollo que puede haber llevado a la toma de decisiones que no hayan sido las más adecuadas a la hora de preservar la seguridad tanto como de hacer una aplicación funcional.
Due to the global pandemic caused at the beginning of 2020 by the Corona Virus Disease (COVID-19), we have seen the raise of the number of people infected by the virus growing at a very high speed, provoking multiple saturations in hospitals, many deaths and leading many countries to impose home confinement for months. To control the infections and act quickly in case of infections by the virus and prevent its spread, a key job arised, the tracker, which is a person who is dedicated to investigating the close contacts a person who has been tested positive for COVID-19 so they can be warned to do a home quarantine and carry out the corresponding tests. This manual scan becomes very ardous work due to the rapid spread os the virus, becoming ineffective. For this reason, the idea of creating a mobile application to make more effiecient digital contact tracing arosed. However, tracking through a mobile application arouses in users concern and fear that with this system their privacy an intimacy wil be violated and so their data will be exposed to potencial hackers, causing users not to use this system and so this will make a loose of effectiveness of contact tracing. In this work, an analysis of vulnerabilities present in mobile contract tracing applications based on the Decentralized Privacy-Preserving Proximity Tracing (DP-3T) protocol is carried out using an automatic vulnerability analysis tool for mobile applications. Specifically, a series of analyzes (static and dymamic) are carried out on the applications based on DP-3T protocol developed in the Unión Europea (UE). A total of 18 applications have been selected according to their availability and possibility of instalation. The results of the analysis had been quite improvable in most of applications with a 47.7 of average score where more than 90 % have turned out to be insecure in the version this analysis has been done. All of this can be as a result of the short development time developers may have had leading to some decisions not have been the most appropiate when it comes to preserving security but as making it functional applications.
Due to the global pandemic caused at the beginning of 2020 by the Corona Virus Disease (COVID-19), we have seen the raise of the number of people infected by the virus growing at a very high speed, provoking multiple saturations in hospitals, many deaths and leading many countries to impose home confinement for months. To control the infections and act quickly in case of infections by the virus and prevent its spread, a key job arised, the tracker, which is a person who is dedicated to investigating the close contacts a person who has been tested positive for COVID-19 so they can be warned to do a home quarantine and carry out the corresponding tests. This manual scan becomes very ardous work due to the rapid spread os the virus, becoming ineffective. For this reason, the idea of creating a mobile application to make more effiecient digital contact tracing arosed. However, tracking through a mobile application arouses in users concern and fear that with this system their privacy an intimacy wil be violated and so their data will be exposed to potencial hackers, causing users not to use this system and so this will make a loose of effectiveness of contact tracing. In this work, an analysis of vulnerabilities present in mobile contract tracing applications based on the Decentralized Privacy-Preserving Proximity Tracing (DP-3T) protocol is carried out using an automatic vulnerability analysis tool for mobile applications. Specifically, a series of analyzes (static and dymamic) are carried out on the applications based on DP-3T protocol developed in the Unión Europea (UE). A total of 18 applications have been selected according to their availability and possibility of instalation. The results of the analysis had been quite improvable in most of applications with a 47.7 of average score where more than 90 % have turned out to be insecure in the version this analysis has been done. All of this can be as a result of the short development time developers may have had leading to some decisions not have been the most appropiate when it comes to preserving security but as making it functional applications.
Description
Trabajo de Fin de Grado en Ingeniería de Computadores, Facultad de Informática UCM, Departamento de Sistemas Informáticos y Computación, Curso 2022-21.