# A Security and Privacy Scoring System for Contact Tracing Apps
## Appendix A App Attack Analysis Example, Canada Covid Alert  
We performed the vulnerability analysis for the 18 attacks against each of the 5 representative applications. Below is an example of the reasoning for the score given. This is the analysis of the first attack against the Canadian Covid Alert application. Due to length limitations, the entire scoring procedure for all of the apps could not be included in this paper. The analysis of each attack against each app can be found in [17]. * **Access: 2/10**. There is nothing in the protocol to prevent someone from building a tool to collect GPS location data when the phone makes a BLE connection. The attack requires either circumventing the app to log the contact information outside of it or rooting the attackers device to access the logged contact information. The bottleneck of attack 1 is obtaining the temporary IDs of the victim to trace through the system. In the Covid Alert documentation, all it says is that the temporary IDs are \"securely stored\" without a clear definition of what that means [22]. It is assumed that to see the temporary IDs, the attacker would need to root the victims device. Thus, this attack should be marked as a 1. However, because the IDs of positive users are made available through the server, an attacker could collect all of this information, and then recreate the list of IDs of positive users, find matches and follow them. This possibility is why the score is a 2. * **Knowledge: 3/10**. The attack would require being able to make the GPS logging code, detect that the device has logged the Bluetooth information, root the attacker's own device and potentially the victims, or pull the list from the server and recreate the IDs of positive users. * **Complexity: 6/10**. * **Technology: 7/10**. The tools required for the exploit would require a standard computer to create. The analysis can be done on a consumer computer. * **Build: 5**. The attack requires one or two tools, the GPS logger, the access to the contact list, and the method of collecting the IDs to track. Then, the program matches the ID and every GPS coordinate and maps them together. One person could do this in more than a month, or a few could do this in about a month. All of these components were created before for GPS-based data attacks and would need to be put together for this. * **Effort: 1.5/10**. * **Planning: 1/10**. This is high effort because the code has to be placed on many phones to collect all of the required information. Then, the data have to be compiled. * **Human: 2**. To effectively cover an area, quite a few people would need to be involved. Once the software is on their phone, they would not have to necessarily do anything out of the ordinary however, just go through their usual routine. * **Scope: 4/10**. This would affect the group that the IDs could be identified for. People close to any of those involved whose devices could be accessed to obtain the IDs or people who test positive in the community. This is smaller than everyone that an attacker knows and is not every positive individual, as it is relegated to the area covered. * **Impact: 4/10**. * **Data: 4/10**. The contact log information itself is not easy to use, but the GPS data allow the creation of a map of where someone has been and could then determine where they live, work, or other personal information. * **Trust: 4/10**. This would damage trust in the system. There is the potential that a politically motivated group could use this to single out certain people, especially if they can target those that have the virus. * **Detection: 8/10**. It is possible that this would not be noticed. The code that collects the information does not need to interfere with the app, just monitor it; however, the amount of people involved would require quite the vow of secrecy. It could involve access to someone's phone to retrieve the IDs, which would increase the risk of detection. * **Repairability: 2.5/10**. * **System: 1/10**.