# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 4 High-Level Static Analysis
This includes the current cellular network information, the status of any ongoing calls, and a list of any _PhoneAccounts_, i.e., apps which can place or receive a phone call, registered on the device. * P10: CALL_PHONE allows an app to initiate a phone call without going through the dialer user interface for the user to confirm the call. * P11: READ_EXTERNAL_STORAGE allows an app to read from external storage, such as an SD card. * P12: WRITE_EXTERNAL_STORAGE permits an app to write to external storage. As seen from Table 2, all apps requested at least two dangerous permissions. Specifically, a total of 10, 9, 8, and 7 such permissions were asked by 3, 5, 6, and 5 apps, respectively, while only one app requested the least number of two permissions of this kind. Not less important, all apps requested the ACCESS_FINE_LOCATION permission (P7), and the vast majority of them permission to read and write the external storage (P11 and P12). Moreover, from the same table, it can be inferred that apps of the same automotive group may present an identical or nearly identical distribution of permissions. For instance, this observation stands true for the PSA, and partially for the Mitsubishi and Tata groups. Furthermore, the same allocation of permissions may be perceived for certain apps within a group, e.g., the two \"connected\" apps in the BMW group. Finally yet importantly, some of these permissions, namely P2, P3, P4, P5, P6, P7, P10, and even P11 and P12 do not seem necessary for a connected cars app of this kind to possess. For instance, after interacting with the apps, we realised that several of them asked for the CAMERA permission just for scanning the Vehicle Identification Number (VIN). While this may come in handy while entering the VIN in the app, it is only to be used once or, at best, a limited number of times. Furthermore, as mentioned in the introduction, some apps may enable the user to schedule a service appointment. In this case, granting, say, P2, P5, and P10 may seem reasonable, although this utility will be used a few times per year. At the same time, however, this also magnifies the app's attack surface, so a careful balance between functionality and usability should be maintained. Moreover, some apps may offer the possibility to view past routes on to a map or locate a parked vehicle. However, at least for the first case, choosing to grant the app with only P8, which caters for an accuracy of approximately equivalent to a city block, is way more privacy-preserving. P11 and P12 on the other hand seem justifiable if the user wishes to store historical vehicle data to a SD card. However, is this something the average user would likely do? Overall, as a rule of thumb, the number of permissions that an app requests should be minimised. This is because curtailing access to sensitive permissions diminishes the risk of unintentionally misusing some of them, and also significantly contributes in reducing the app's attack surface. So, while such a permission may be deemed necessary for introducing a new functionality, it may compromise user adoption and render the app vulnerable for attackers. As already pointed out, API calls per app have been also extracted with the aim of identifying certain call to methods which may pose a threat to the user's privacy. Specifically, the following potentially privacy-invasive (sensitive) API calls were discovered in apps' smali code:  
* _android/telephony/TelephonyManager; \(\rightarrow\) getNetworkOperator()_ returns the mobile country code (MCC) and mobile network code (MNC) of the current registered operator. * _android/telephony/TelephonyManager; \(\rightarrow\) getNetworkOperatorName()_ returns the alphabetic name of the current registered operator. * _[-15]Landroid/telephony/TelephonyManager; \(\rightarrow\) getLine1 Number() returns the phone number string for line 1, e.g., the Mobile Station International Subscriber Directory Number (MSISDN) for a GSM phone for a specific subscription.