# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 6 Dynamic Analysis
### App Exploration
Then, user registration required providing personal details, namely email, first and last name, password, and title. Password policy is identical to My Citroen. After email verification, one can log in to the app. We successfully registered one VIN, enabling us to see that vehicle's service maintenance data. **Jaguar InControl**: Connecting the app to the vehicle requires a paid user subscription along with a pre-installed hardware component. Regarding its GUI it is almost identical to the \"Land Rover Incontrol\" one. After opening, the app requested to be granted a location permission. During user registration, which is done externally in an official Jaguar webpage at [[https://incontrol.jaguar.com/jaguar-portal-owner-web/select](https://incontrol.jaguar.com/jaguar-portal-owner-web/select)]([https://incontrol.jaguar.com/jaguar-portal-owner-web/select](https://incontrol.jaguar.com/jaguar-portal-owner-web/select)) (accessed on 20 February 2021), the user needs to provide the country, first and last name, email, and password. The app accepted \"qwertyQ1\" as a password. After email verification, the user is transferred again to the webpage, where they can login. After login, they are presented with another, more detailed registration form, which also asks for a 4-digit PIN, accepting the\"1234\" value. After that, from inside the webpage, the user needs to add a vehicle, namely a VIN. The privacy policy, requires double acceptance, meaning ticking the corresponding boxes and also opening the documents and pressing \"accept\". **Land Rover InControl**: It also requires a paid user subscription. During the user registration phase, the app redirects them to the Land Rover's official webpage at [[https://incontrol.landrover.com/jlr-portal-owner-web/request-account](https://incontrol.landrover.com/jlr-portal-owner-web/request-account)]([https://incontrol.landrover.com/jlr-portal-owner-web/request-account](https://incontrol.landrover.com/jlr-portal-owner-web/request-account)) (accessed on 20 February 2021). The second phase is similar to the \"BMW Connected\" app, namely the app requested only the last eight characters of VIN. After 25 attempts, no randomly generated partial VIN was accepted. User password policy is identical to that of the \"Jaguar Incontrol\". **Tesla**: This app offers only a login option, meaning that the user should have been already registered elsewhere. Tesla provides a registration service at [[https://auth.tesla.com/login](https://auth.tesla.com/login)]([https://auth.tesla.com/login](https://auth.tesla.com/login)) (accessed on 20 February 2021), so we attempted to register through this website. The relevant form accepted the password \"1234567q\". After registering, we were able to login to the app, but no other option, such as registering a VIN, was enabled. It seems that Tesla pre-authenticates the owner, that is, provides each car owner with a specific account upon purchasing the vehicle. **MyT**: User registration is done from inside the app. It requires providing personal information, including email address, first and last name, and a password along with its verification field. The app accepted the string \"111111a@\"as a password. Next, it displayed a T&C and a privacy policy. After email address validation, we were able to log in to the app and successfully entering a VIN. Nevertheless, no information has been made available for the corresponding vehicle. Instead, the app informs the user that such information will be accessible after they verify ownership against a local dealer: \"This vehicle needs to be verified and only after this functionality is available\". Note that when purchasing a Toyota car, typically, the car dealer will register the buyer as the owner of the car, automatically granting them access to the so-called connected services. **myAudi**: It has a similar GUI to that of the MyKODA app. As a first step, the app asks for user's registration in terms of email address (acting as username) and password. This is done from inside the app.