# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 6 Dynamic Analysis
### App Exploration
In this stage, the app mandated an 8-character password and accepted \"11111112\"; no password confirmation field were present in the form. After, the user can log in and enter their personal details, i.e., first and last name and accept the displayed marketing policy, which however is not a requirement. Next, the app asks for a VIN. After some tries, we succeeded pre-registering a couple of VINs with the app. However, to complete registration, the app requires the user to bring all the necessary documents to a local Audi dealership, who is responsible to confirm the ownership of the specific vehicle and provide them with access to the app. **My Bentley**: First, the app informs the user regarding the related vehicle models it supports. Then, the user registration phase initiates from inside the app. After providing all the personal data, i.e., user location, car vendor, first and last name, email, phone number, and address, the app requested a VIN. From the 25 inputted VINs no one was accepted, probably because the supported by the app models are new. The app presents the user with a T&C and a privacy policy. **Lamborghini Unica**: A user invitation code is required for them to be able to create an account and log in against the app. This code can be obtained upon user request through the app to Lamborghini. The request mandates filling in several fields, namely local dealer, VIN, and ownership documents. The app presents the user with a T&C and a privacy policy. **Porsche Connect**: At start, it requires an online registration and verification phase, which is done against a website at [[https://login.porsche.com/auth/gb/en_GB/registration](https://login.porsche.com/auth/gb/en_GB/registration)]([https://login.porsche.com/auth/gb/en_GB/registration](https://login.porsche.com/auth/gb/en_GB/registration)) (accessed on 20 February 2021). In the relevant web form, the owner must upload all the vehicle ownership documents along with personal information, including an email address along with the corresponding verification field, first and last name, and address. The string \"1111 wW@\" was accepted as a password. After that, the app notifies the user that they will be informed by email about the outcome. User login is not done via the app, but through the same website. After trying to log in, we redirected back to the app getting the error \"There is no vehicle stored for your Porsche ID. Please register your Connect-enabled vehicle at My Porsche. (error: 9_MP_EL).\". The app provides the user with a T&C and a privacy policy. **SEAT CONNECT**: The app first asks for an email address. After validation, user registration is required. The app accepted \"12345671\" or \"11111112\" as a user password, but not the \"12345678\" one. Then a 4-digit user PIN was required; as with all other similar apps the \"1234\" value was accepted. We were able to pre-register one VIN with this app. Nevertheless, the app requires physical access to the vehicle for completing the user registration phase. That is, the user must possess a device named _Dataping_[119], which is connected to the OBD port of the vehicle. The app displayed a T&C and a privacy policy. **MySKODA**: For initiating the user registration phase, the app requested for an email address. Then, from inside the app, the user needs to enter a password; no confirmation field was present, and the app accepted \"11111112\". Next, the user is presented with a T&C and a privacy policy, and also needs to validate their email address. After login, the user has to accept or deny a marketing policy, which however its acceptance was mandatory for the app to proceed. Afterwards, the app displayed the error message \"Your connection is not secure! Personal information may be leaked!\", with error code \"ERROR_CONNECTION_NOT_SECURED\". After manually checking the code of this app, we realised that it creates several http connections, i.e., new _HttpURLConnection_ object instances are obtained by invoking the _openConnection()_ method on a _URL_ object.