# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 6 Dynamic Analysis
### App Exploration
To register a vehicle, the app required the last seven characters of VIN. Based on the vendor, we tried 25 different combinations, but no one of them was accepted. **MINI**: It is identical to the \"My BMW\" one. In fact, we logged in using the BMW account credentials. Moreover, the user is required to enter a 4-digit PIN and accept T&C. **Mercedes me**: User registration is performed from inside the app. First, the user needs to enter an email address, which is verified by means of a 6-digit code. Next, they have to choose a country, and provide their title, first and last name, and date of birth, but not a password. We managed to pre-register two VINs with this app. For one of them, as a next step, the app required the owner to get authorised at the premises of a local Mercedes car dealer. For the other, probably because the respective VIN corresponded to an unsupported model, the app did not request for car dealer authentication, but it did not let the user to proceed with any other operation. The app provides a T&C and a privacy policy. Given that user registration is password-less, for them to reconnect to the app, they need to provide their email, get a 6-digit code, and enter it into the app; this means that the app enforces a kind of one-time password policy. **My Alfa Connect**: It requires a paid user subscription for letting them to further interact with it. That is, the owner needs to first perform an activation step at an Alfa Romeo dealership. Then, the user receives an email which contains a hyperlink, enabling them to finish registering the account and activating the relevant services on both the app and the [[https://www.alfaromeoconnect.eu/](https://www.alfaromeoconnect.eu/)]([https://www.alfaromeoconnect.eu/](https://www.alfaromeoconnect.eu/)) (accessed on 20 February 2021) website. Given that the registration procedure requires personal interaction, it was infeasible to analyse this app further. Currently, the app supports only two 2020 models. Neither a T&C nor a privacy policy statement is provided by the app at startup. **FIT**: It is very similar to the \"My Alfa Connect\" one. In the app's description in Google Play, it is mentioned that \"FIAT mobile app and Uconnect Services are available for FIAT vehicles equipped with the new Uconnect Box\". So, as with the My Alfa Connect case, it was unattainable to proceed any further with this app. **My Uconnect**: After starting the app, the user is informed that it currently supports specific models, which are equipped with the \"Uconnect infotainment system\". Lastly, similar to the \"Uconnect LIVE\" one, this app required a paid subscription. **Uconnect LIVE**: This app supports FCA vehicles, including those from Abarth and Lancia. The app does not have a strong password policy; simple passwords like \"12345678\" are accepted. On the plus side, the app needed physical access to the vehicle for being fully enabled. Physical access can be achieved by means of USB or Bluetooth, with the preferred one being over Bluetooth. On top of that, this app requires a paid subscription. **MyFerrari**: It requires a validation directly from Ferrari for authenticating the owner and connecting the app to the vehicle. Specifically, for registering, the app redirects the user to a Ferrari webpage at [[https://www.ferrari.com/en-US/auto/owner-reg](https://www.ferrari.com/en-US/auto/owner-reg)]([https://www.ferrari.com/en-US/auto/owner-reg](https://www.ferrari.com/en-US/auto/owner-reg)) (accessed on 20 February 2021). There, we did provide all the necessary (fake) personal information, but as a further step, the owner is required to get in contact with a local Ferrari dealer. In the user registration form, the password policy was at least 8-characters, one uppercase, one lowercase, one digit, and one special character. Another observation is that upon starting the app it asks the user to accept granting a location permission. The app provides the user with a T&C and a privacy policy.