# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 7 Conclusions  
The connected vehicle app development is a relatively new field, and the demand for such apps is expected to mushroom in the next few years. Furthermore, as the connected car landscape is still at a nascent stage, developers may be tempted toward adaptingalready existing apps to connected vehicles, instead of designing and engineering new ones. On top of that, the reality has proven that security and privacy aspects are often not properly prioritised by software developers and vendors who rather concentrate on the functional ones. However, as a guidepost, security must not be left anymore as an afterthought. Instead, one must proactively secure software--think for instance about security and privacy by design--while they are building it. Especially, focusing on the Android ecosystem, there are already several noteworthy standards and best practices for developing secure software, including the Android developer website, the OWASP mobile top 10 project, the CERT Android secure coding standard, and the JSSEC Android application secure design/secure coding guidebook. In this context, the results of this work, which stem from the whole population of official single-vehicle management apps offered currently in Europe, can be used as a basis and reference for not only alerting and motivating the involved parties to proactively improve the security robustness of their products and conduct frequent vulnerability assessments, but also to raise the security awareness of end-users. From a security viewpoint, it was demonstrated that a significant number of apps remain susceptible to several high or even critical severity weakness and vulnerabilities, which are due to sundry reasons, including misconfigurations, secure coding negligence, and latent or overt security flaws that relate to the use of third-party software. Overall, at least 87% of the apps were found to be potentially exposed to six out of the total 11 CWEs, with about 80% of them to utilise a couple of obsolete cryptographic hash algorithms. Moreover, roughly 93% and 87% of apps exhibited more than one issue in their manifest file and shared libraries, respectively. At the same time, outdated software component exploration and taint analysis revealed that almost two-thirds of the apps have at least one issue. Furthermore, from a privacy standpoint, there exist several hiccups that emanate from the over-claim of sensitive permissions and API calls, the inclusion of trackers, and frail user- or vehicle-to-app registration practices. While apparently all these aspects target on increasing app's functionality and improve user experience on the app as a whole, they are potentially rendering it more privacy-intrusive at the same time; approximately 42% of apps incorporate at least two third-party trackers. On the positive side, a critical mass of apps demonstrated well-architected security practices, especially in relation to the VIN-to-owner registration process, which is a sensitive and essential matter; namely, only 18% of the apps indicated a potential issue in regard to the VIN authentication method. Future work can concentrate on other types of either official or third-party automotive smartphone apps, say, infotainment, and possibly embrace more criteria and angles of examination, say, usability, a full-scale dynamic analysis, general data protection regulation (GDPR) level of compliance, and so forth. Conceptualization, G.K. and E.C. ; methodology, G.K., V.K. ; validation, E.C., G.K., and V.K. ; investigation, E.C., G.K., and V.K. ; writing-original draft preparation, E.C., G.K., and V.K. ; writing-review and editing, E.C., G.K., and V.K. ; supervision, G.K. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not Applicable, the study does not report any data. The authors declare no conflict of interest.