论文标题
对基于美国的联系跟踪应用程序的安全与隐私分析
A Security & Privacy Analysis of US-based Contact Tracing Apps
论文作者
论文摘要
随着COVID-19的发作，全球政府计划开发和部署联系跟踪（CT）应用程序，以帮助加快联系人跟踪过程。但是，专家对使用这些应用程序的长期隐私和安全含义提出了担忧。因此，提出了一些设计保护隐私CT应用程序的建议。为此，Google和Apple开发了Google/Apple曝光通知（GAEN）框架，以帮助公共卫生部门开发保护隐私的CT应用程序。在美国，26个州使用Gaen框架开发其CT应用程序。在本文中，我们通过经验评估了基于美国的Gaen应用程序以确定1）他们拥有的特权，2）如果应用程序符合其确定的隐私政策，以及3）如果它们包含可利用可利用隐私性的已知漏洞。结果表明，所有应用程序都违反了其既定的隐私政策，并包含了几个已知漏洞。
With the onset of COVID-19, governments worldwide planned to develop and deploy contact tracing (CT) apps to help speed up the contact tracing process. However, experts raised concerns about the long-term privacy and security implications of using these apps. Consequently, several proposals were made to design privacy-preserving CT apps. To this end, Google and Apple developed the Google/Apple Exposure Notification (GAEN) framework to help public health authorities develop privacy-preserving CT apps. In the United States, 26 states used the GAEN framework to develop their CT apps. In this paper, we empirically evaluate the US-based GAEN apps to determine 1) the privileges they have, 2) if the apps comply with their defined privacy policies, and 3) if they contain known vulnerabilities that can be exploited to compromise privacy. The results show that all apps violate their stated privacy policy and contain several known vulnerabilities.
