# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 6 Dynamic Analysis  
### App Exploration  
This section details on the obtained results after dynamically testing the different apps from the perspective of the end-user, typically the car owner. Given that it is practically unworkable for one to possess or control even in the short-term so many different vehicles, this scrutiny is confined to the owner-to-app and/or owner-to-car registration (or pairing) phases and not to the app functionality in general. Namely, this phase has been carried out manually and involves the creation of a new user account, typically from inside the app or through redirection to a website. This normally requires the user to accept terms and conditions (T&C) along with other policies, if any, and enter basic identification information, including their name and surname, country, city, email address, a username and password, etc. Where applicable, it can also include registration of the vehicle against the owner, i.e., the owner is required to provide some kind of ownership-proof. For this purpose, a Xiaomi Redmi Note 8 Pro smartphone, running on Android 10 has been employed. For the apps that required, typically after the user registration phase, a VIN as input, we tested specific vendor VINs that we either generated using a custom-made Python script or acquired from the internet by searching relevant websites [118]. In their majority, these apps requested a full 17- character VIN, except a limited number of cases where a partial VIN was needed. Where applicable, a maximum number of 25 VINs have been tested against the app. All in all, as shown in Tables 10 and 9, this subsection compares the apps based on 20 criteria split into two categories, namely security issues and VIN authentication methods. The specific results per app are given in the following. **Volvo On Call**: User registration is done through a website at [[https://volvoid.eu](https://volvoid.eu)]([https://volvoid.eu](https://volvoid.eu)). volvocars.com/Account/initaccount?market=GB&language=en (accessed on 20 February 2021). The user has to enter an email address, password, along with a confirmation field, first and last name, country, and language. Regarding the password, the app accepted \"111111w\". After registering, we managed to successfully add a vehicle with a VIN obtained from the internet. Then, the app informs the user to wait for a PIN to be sent to the email address provided. No such email was received though. The app provides a T&C and a privacy policy. **BMW Connected**: It uses a distinct authentication method to connect the app with the vehicle. Specifically, after user registration, performed from inside the app, it requests the last seven characters of VIN. Then, the app informs the user that the car dashboard shows a 6-number PIN, which needs to be entered in the app. It was observed that with every wrong answer, the app directs the user back to entering the VIN; no upper bound to the number of wrong answers seems to apply. User registration requires entering the country, email, password, confirm password, first and last name, title, and a 4-digit PIN, where it accepted \"1234\". An 8-character password policy is enforced, but it is rather weak as the app accepted the \"111111 QQ\" one. After user registration, the app presents the user with a privacy policy. It was noticed that the app keeps the previous session alive, so subsequent user logins are done by means of the 4-digit PIN. Another interesting point is that after entering a VIN that was already paired with another user account, the app asks the current user if they wish to change region; however, by accepting it, the app asks for vehicle 6-number PIN verification. **My BMW**: First, the user is required to accept T&C. Before registering a newly created user account, the app informs the user that an account should have been already created on their behalf by their local car dealer. In the relevant registration form, the app provides a password confirmation field and accepted \"1111111a\" as a password. Next, an email