# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 6 Dynamic Analysis
### App Exploration
\begin{table}
\begin{tabular}{l c c c c c c c c c} \hline \hline
**App Name** & **V1** & **V2** & **V3** & **V4** & **V5** & **V6** & **V7** & **Vs** & **V9** & **V10** \\ \hline Volvo On Call & – & – & – & – & – & – & – & – & N/A & + & N/A \\ BMW Connected & – & – & – & + & + & + & – & + & – & + \\ My BMW & – & – & – & – & – & – & – & – & – & – \\ MNI Connected & – & – & – & + & N/A & N/A & – & N/A & – & N/A \\ MNI & – & – & – & – & – & – & – & – & – & – \\ Mercedes me & – & + & – & – & – & – & – & + & – & – \\ My Alfa Connect & + & + & – & – & N/A & N/A & N/A & N/A & – & N/A \\ FIAT & + & + & – & – & N/A & + & N/A & N/A & – & N/A \\ My Uconnect & + & + & N/A & N/A & N/A & + & N/A & N/A & N/A & N/A \\ UConnect IVE & – & – & – & – & – & + & N/A & N/A & – & N/A \\ MyFerrari & – & – & + & N/A & N/A & N/A & + & N/A & – & N/A \\ FordPass & + & – & – & – & – & – & – & + & – & + \\ MITSUBISH RC & – & + & – & – & – & + & – & – & – & – \\ OUTLANDER PREY HC & + & + & – & – & – & + & – & – & – & – \\ NissenConnect & – & + & N/A & – & N/A & N/A & N/A & – & – & – & N/A \\ My Citron & – & – & – & – & – & – & – & + & – & + \\ My Citron & – & – & – & – & – & – & – & + & – & + \\ My Citron & – & – & – & – & – & – & – & + & – & + \\ MyCip & – & – & – & – & – & – & – & + & – & + \\ MYPECIoT & – & – & – & – & – & – & – & + & – & + \\ Jaguar InControl & + & + & N/A & – & N/A & N/A & N/A & N/A & – & N/A \\ Land Rover InControl & + & + & N/A & + & N/A & N/A & N/A & N/A & – & N/A \\ Tesla & – & – & + & N/A & N/A & N/A & N/A & N/A & N/A & N/A \\ MyT & – & + & – & – & – & N/A & – & – & – & – & N/A \\ myAndi & – & + & + & – & – & – & – & + & + & + \\ My Bentley & – & + & N/A & – & N/A & N/A & N/A & N/A & – & N/A \\ Lamborghnii Unica & + & – & N/A & – & N/A & N/A & + & N/A & – & N/A \\ Persche Connect & – & – & N/A & – & N/A & N/A & + & N/A & – & N/A \\ SETA CONNECT & – & – & – & – & – & + & – & N/A & – & N/A \\ MySKODA & – & – & – & – & – & + & – & – & – & N/A \\ SKODA Connect LITE & – & – & – & N/A & N/A & + & – & – & – & N/A \\ We Connect & – & – & – & – & – & + & – & N/A & – & N/A \\ \hline Total & 7 & 10 & 4 & 3 & 1 & 10 & 3 & 8 & 1 & 7 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Different VIN registration/authentication methods. V1: Paid subscription, V2: Limited model support, V3: Face-to-face proof of ownership, V4: Partial VIN, V5: PIN in vehicle, V6: Physical access, V7: Online proof of ownership, V8: Acceptance of unsupported model VINs, V9: Email address verification with PIN, V10: Acceptance of the same VIN with multiple accounts without verification. address validation step is required. After login, the user is prompted to enter a 4-digit PIN; the app accepted the \"1234\" value. Next, the app requested accepting two diverse T&C and two different privacy policies and granting specific permissions, namely calendar, camera/photos, location, and notifications. We tried more than 20 VINs, but no one of them was accepted. After reopening the app, it requested either for fingerprint access or the 4-digit PIN, meaning that no password was required. This functionality applies to the \"MINI Connected\" app as well. **MINI Connected**: User registration is performed from inside the app. Regarding password policy, it required at least a combination of eight letters, numbers, and/or symbols, accepting the \"123456 ab\" one. Furthermore, it did not offer any option for language, automatically providing the language pertinent to the user's location. While the registration process was successful, user login failed after displaying the message \"An error occurred while authenticating. Please try again.\" In a subsequent attempt to log in, the app requested accepting T&C and a privacy policy. After that, we were requested to provide a 4-digit PIN and validate it; the \"1234\" was accepted. Then, the app asked for several permissions, as given in Table 2. We tried to login/logout many times to the app. The result was to be asked every time to accept T&C and provide a PIN.