# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 5 Low-Level Static Analysis
### Outdated Software Components Analysis
\begin{table}
\begin{tabular}{l c c c c c c c c c c c} \hline \hline
**App Name** & **SQLite** & **OpenSSL** & **Python** & **libpng** & **openCV** & **expat** & **jQuery** & **InAppBrowser** & **zlib** & **libcurl** & **libjpeg** & **Total** \\ \hline Volvo On Call & – & – & – & – & – & – & – & – & – & – & – & – & – & 0 \\ BMV Connected & + & ++ & + & + & + & – & – & – & – & – & – & – & 5 \\ My BMW & + & + & + & + & + & – & – & – & – & – & – & 5 \\ MINI Connected & + & ++ & + & + & + & – & – & – & – & – & – & 5 \\ MINI & + & + & + & + & + & – & – & – & – & – & – & 5 \\ Mercedes Me & – & – & – & – & – & – & – & – & – & – & – & 0 \\ My Alta Conact & + & + & – & – & – & – & – & – & – & – & – & 2 \\ Fiat & + & + & - & – & – & – & – & – & – & – & – & 2 \\ My Ucomet & + & ++ & – & + & – & – & – & – & – & + & – & 4 \\ Ucomenet LIVE & + & - & – & – & – & – & – & – & – & – & – & 1 \\ My Ferrari & – & – & – & – & – & – & – & – & – & – & – & 0 \\ FordPass & ++ & ++ & – & – & – & + & – & – & – & – & – & 3 \\ MITSU/BISH RC & – & – & – & – & – & – & – & – & – & – & 0 \\ OUTLANDER PHEV & – & – & – & – & – & – & – & – & – & – & 0 \\ RC & & - & – & – & – & – & – & – & – & – & 0 \\ NissanConnect & – & – & – & – & – & – & – & – & – & – & 0 \\ My Citrogen & + & – & – & – & – & – & + & + & – & – & – & 3 \\ My DS & + & – & – & – & – & – & + & + & – & – & – & 3 \\ My Pepiet & + & – & – & – & – & – & + & + & – & – & 3 \\ Jaguier InControl & + & - & – & – & – & – & – & – & – & – & 2 \\ Land Rover InControl & + & + & – & – & – & – & – & – & – & – & 2 \\ Tesla & – & + & – & – & – & – & – & – & – & + & 2 \\ MyT & + & + & + & ++ & + & – & – & – & + & – & 6 \\ My Audi & – & – & – & – & – & – & – & – & – & – & 0 \\ My Berneley & – & – & – & – & – & – & – & – & – & – & 0 \\ Lamphghnii Unica & – & – & – & – & – & – & – & – & – & – & 0 \\ Forsche Connect & ++ & + & – & – & + & – & – & – & + & – & 4 \\ Sent CONNECT & – & – & – & – & – & – & – & – & – & – & 0 \\ My Skoda & – & ++ & – & – & – & – & – & – & – & – & 1 \\ We Connect & – & – & – & – & – & – & – & – & – & – & 0 \\ \hline Total & 16 & 15 & 5 &6 & 5 &2 &4 &4 &2 &1 &19 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Outdated third-party software components per app. The number of plus (+) signs designates how many obsolete versions of the same library exist in that app. Second, five apps were found to use superannuated versions of the _Python_ library, namely v2.7.10 and v3.4.3. Except from four CVEs that pertain to DoS attacks, say, CVE-2018-1060, CVE-2018-1061, CVE-2017-18207, and CVE-2018-1061, we came across seven other CVEs rated as being of critical (CVE-2017-1000158), high (CVE-2017-17522), and medium (CVE-2016-0772, CVE-2016-5699, CVE-2016-1000110, CVE-2014-4616) severity. In addition, CVE-2007-4559 is not rated yet. Such vulnerabilities may lead to serious attacks, say, a TLS stripping one. Third, six apps were vulnerable to outdated versions of _libpng_[110], which is the official platform-independent Portable Network Graphics (PNG) reference library. The vulnerable versions, i.e., v1.5.27, v1.6.14, v1.6.22 beta03, and v1.6.24 suffer from three disparate CVEs, namely, CVE-2017-12652, CVE-2016-10087, and CVE-2019-7317 being of critical, high, and medium severity, respectively. Such vulnerabilities may be used as vectors to manipulate the data of a PNG image by adding malicious code. On top of that, CVE-2013-6954 can be exploited to mount a DoS attack. Note that v1.6.14 may additionally be exploited by a quartet of DoS-oriented vulnerabilities, namely, CVE-2015-8472, CVE-2015-8126, CVE-2015-0973, and CVE-2014-9495. Five apps employed an outdated version of _openCV_[111], a library of programming functions focusing on real-time computer vision. Notably, these versions, namely v2.4.13 and v.3.3.0 are associated to more than 15 distinct CVEs. All of them are related to vulnerabilities which may cause DoS. It was observed that CVE-2017-12864 and CVE-2017-12862, both being of high severity, could potentially allow an attacker to execute code remotely.