On the Privacy and Integrity Risks of Contact-Tracing Applications
This research reveals significant privacy and integrity vulnerabilities in contact-tracing applications, posing risks for individuals relying on these tools for public health, and for public health agencies deploying them.
This paper identifies two critical attacks on smartphone-based contact-tracing applications: a contact-isolation attack that identifies infected users and a contact-pollution attack that generates false-positive alerts. Evaluating these on the DP-3T framework, the authors found that with approximately 10,000 monitoring points, 5-40% of infected users in a major city like Houston could be de-cloaked.
Smartphone-based contact-tracing applications are at the epicenter of the global fight against the Covid-19 pandemic. While governments and healthcare agencies are eager to mandate the deployment of such applications en-masse, they face increasing scrutiny from the popular press, security companies, and human rights watch agencies that fear the exploitation of these technologies as surveillance tools. Finding the optimal balance between community safety and privacy has been a challenge, and strategies to address these concerns have varied among countries. This paper describes two important attacks that affect a broad swath of contact-tracing applications. The first, referred to as contact-isolation attack, is a user-privacy attack that can be used to identify potentially infected patients in your neighborhood. The second is a contact-pollution attack that affects the integrity of contact tracing applications by causing them to produce a high volume of false-positive alerts. We developed prototype implementations and evaluated both attacks in the context of the DP-3T application framework, but these vulnerabilities affect a much broader class of applications. We found that both attacks are feasible and realizable with a minimal attacker work factor. We further conducted an impact assessment of these attacks by using a simulation study and measurements from the SafeGraph database. Our results indicate that attacks launched from a modest number (on the order of 10,000) of monitoring points can effectively decloak between 5-40\% of infected users in a major metropolis, such as Houston.