# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 6 Dynamic Analysis
### App Exploration
**FordPass**: At start, the app asks for country information, and whether the user permits the use of cookies. However, even if the latter option is denied, the app proceeds and allows them to create an account. In this step, the user has to accept the T&C and a privacy policy. It was observed that the app accepted \"12345678\" as a password. Next, the user has to provide a 4-digit PIN, and as with other similar apps, the \"1234\" value was accepted. Note that the app does not require the user to validate their email address. After that, the user is presented with various marketing options, but the app let them to refuse all. As a safety measurement, the app also required the user to confirm that they are not driving at that moment. After completing the above mentioned steps, we were able to provide a VIN. From a total of 10 VINs, seven were accepted. For vehicle models prior to 2012, the app only displayed service maintenance data. However, for newer vehicle models, an additional authorisation step popped up. That is, the user has to self \"authorise\", the specific vehicle (to be controlled by her), except the vehicle is already authorised by another user. In the latter case, the user can either send a request to the already authorised user to grant her an additional authorization or deauthorise all users who have previously gain authorization to the same vehicle; we however did not try the latter option for avoiding causing any problem to legitimate users. Lastly, we noticed that a paid subscription to specific services, including traffic avoidance information can be performed from inside the app. **MISUBISHI RC**: At start, the app requires accepting T&C and a privacy policy. It also asks to be granted a couple of permissions, namely Location and Bluetooth. Then, the user needs to connect the app to the vehicle, i.e., turn on the engine and select to register from the dashboard via Bluetooth. Given the requirement of having physical access to the vehicle, we could not test the app any further. Currently, the app supports only two vehicle models. **OUTLANDER PHEV RC**: It is similar to the \"MITSUBISHI RC\" one. The only differences are that this app is compatible with another Mitsubishi model, and the pairing process with the vehicle is done over WiFi. **NissanConnect**: User registration is done from inside the app. The relevant form requires an 8-character password and includes a password confirmation field. The password \"eE#11111\" has been accepted. Next, the app required the user to accept T&C and validate their email address. After login, the user can register a VIN. The app itself does not inform the user about the supported models. However, according to information in Google Play, it is currently compatible with only three models manufactured from 2019 onward. Although we entered 25 VINs, no one has been accepted by the app. **My Citroen**: User registration is performed from inside the app. The displayed form contains fields for entering email, password, confirm password, title, first and last name. A password of at least eight characters is required, and the app accepted the \"11111114\" one. After creating a user account, the app asks for a VIN. The app did accept a VIN, and we were able to learn the periodic car maintenance data for that vehicle. **MyDS**: It is very similar to the \"My Citroen\" one. We were able to be registered as users using the password \"1234567a\". The registration process also requires a VIN, but after 25 attempts, no VIN was accepted. **myOpel**: It has the same graphical user interface (GUI) as that of the \"My Citroen\" app, and user registration is performed the same way too. After some tries, the app accepted two VINs, and we were able to see the corresponding vehicle's maintenance data,both for already completed services and future ones. The app provides the user with a T&C and a privacy policy. **MYPEUGEOT**: It offers a similar GUI as with the My Citroen app. First, the app requested to accept the T&C and a privacy policy.