hello my name is moritz gruber and i'm
here to present to you our latest
research we may share the number of
diaper changes a privacy and security
evaluation of mobile child care
applications
this work was a cooperation of the
institute of internet security in
gaelsen creation
the aware 7
secunet
and the max planck institute in bochum
our research team
includes a few young fathers
and therefore calls our whatsapp
messengers with information from child
care our our normal everyday life
but besides messages via whatsapp there
are also apps for communication with
child care
therefore we decided to evaluate
childcare apps in more detail
first of all we were surprised by the
wide range of functions these apps offer
if you take a closer look
at our example screenshots you get an
impression of those
they allow the employees of a daycare
center to manage the data of children or
to communicate with the parents
furthermore many of those apps allow
parents to share data about their
children or to get in touch with other
parents
the functionality of some of those apps
is quite familiar to that of a social
network like for example facebook
our goal in this work was to evaluate
how the security of our children's data
is handled in such apps
we wanted to look at the whole project
from a privacy point of view and from a
security point of view
in total we looked at 42 apps for
android
those apps are identified by searching
the google play store for terms like
child care app or preschool management
apps as well as many others
we then manually evaluated all these
apps we found according to the following
criteria to determine if they fit in our
scope
the first criteria was
the app is intended for the child care
sector
the second was
the app should be used for the
communications between parents and child
care workers
and lastly the app provides a management
interface for storing data of children
and processing and managing it
in the end 42 apps remained
these apps together have over 3 million
users according to the google play store
the largest market share
are held by blooms and brightwheel with
over a million users each
all these apps process highly sensitive
data such as
names addresses behavior of children
photos videos their current location and
even health data
all this data is considered to be highly
highly sensitive
to ensure the privacy of minorities the
regulations of gdpr and copper surf
we use those regulations to evaluate the
privacy policies of the 42 apps
since we wanted to analyze the apps from
a security and privacy
point of view
this was our analysis pipeline as shown
in this image
each of the examined apps was decompiled
and statically analyzed
after awards we performed the dynamic
analysis of the apps to capture their
behavior and communication life
we finally took a closer look at the
privacy policies of each of those apps
in a static analysis we used a wide
variety of tools to identify for example
misconfigured firebase database used by
those apps
furthermore we took a closer look at the
permissions set by those apps and
evaluated which dangerous permissions
are used
we took the definition of dangerous
permissions from google's android
documentation
lastly
we looked at the libraries which are
used by the app and whether they are
outdated or are built insecurely
the dynamic analysis we examined the
apps with an interception proxy in order
to be able to read and evaluate the
external communication of those apps
so we could evaluate the communication
to the backend and how
tls is handled by those apps and
backends
another important point was to evaluate
how the data of the app is stored
and therefore we looked at the data of
the apps locally on the android
smartphone and we also tried to find
insecure cloud storages used by those
apps externally
furthermore we looked at the backends
for common vulnerabilities in such apps
such as insecure direct object
referencing short idol or
outdated software components or other
vulnerabilities
we also looked at the privacy policies
of those apps
manually since almost a third were not
written in english language
we took the privacy policy from the link
in the google play store
among other things we evaluated whether
the privacy policy
mentions the processing of data of
miners it was
also interesting to us whether the
privacy policy lists which data is
stored
and which data is processed
we also wanted to evaluate whether it is
possible to read out one's own data
11 of the privacy policies examined did
not describe the app in the first place
but a website of the provider or the
whole privacy policy of the provider but
they didn't mention the app at all
one third of the apps did not list
any data they store or process at all
we found it particularly surprising
that only 96
of the privacy policies mention that
they process or stay our data from
children at all
but this is their only purpose these are
apps for processing and storing data of
children and communication with those
parents
in the table shown here we see a section
from a table from our paper
this clearly shows how diversified the
results of our privacy analysis were
a good example for a poorly maintained
privacy policy would be the app hokita
which does not mention processing of
data from children in its privacy policy
also this is obviously its purpose
furthermore no no information about the
track has used or the data stored or
processed is described in this policy
the situation is similar to the app's
parent zone or strampla bundle
on the other side a positive example is
the app daily connect or live kit
which met all our requirements and list
their privacy policy he that they
process data from miners
furthermore they list which data this is
they process and store and which
trackers they use
besides these there are also many apps
like hi mama or kaimbu that only lists
part of the required data
which only shows how to how to device
the results of in the sectora
and this only shows how many work there
is to do for those
those companies to fix their privacy
policies
the majority of apps examine support
security doesn't support security
features such as certificate pinning
this is a feature which would it may
make much more difficult for a man in
the middle attacker to read and listen
to the communication or to manu
manipulate it
89 of all apps we examine still support
outdated android versions like android
2.1
these are versions that are no longer
supported by google
and doesn't get any updates from google
at all
we also found that 30 percent of the
libraries we stacked statically analyzed
were either outdated or compiled with
the necessary security flags
functions such as address relocation or
stack canary or
non-executable stacks were missing on
those libraries
we also found that 70 percent of the
dynamically analyzed back ends we
examined used outdated components with
noun vulnerabilities
this means that vulnerabilities with
cves are known for a large part of the
back ends analyzed
in the dynamic analysis we also looked
whether the backends are suspectable to
common vulnerabilities
this was the case for 10 of the back-end
servers we found sql injections graphql
injections and also insecure direct
object referencing vulnerabilities and
many others
all these apps
allow an attacker to access data of
other users through such vulnerabilities
we also identify cloud storage in 12 of
the apps
this was particularly alarming as the
most sensitive data could be accessed
unencrypted and unsecured on the
internet there were amazon aws buckets
and firebase databases which contained
chat messengers pictures of children
videos
and user data such as email
addresses and clear names
overall it should be noted the large
proportion of the apps studied use
insecure and incomplete privacy policies
this is especially a problem as more and
more child care institutions will rely
on digital communication challenge
channels and applications and use
services like whatsapp if there are no
simple but secure solutions
to improve the situations guidelines and
checks for the evaluation of child care
software and its development should be
written in the near future
these guidelines can then be used by
political actors to make manufacturer us
change their way of building
applications
finally a dialogue with the
manufacturers and developers of such
apps should be initiated this should
then this should enable them to
understand the responsibility of the
data they process and how it can be
protected
in our opinion these are the most
important takeaways from our analysis of
child care apps thank you very much for
your attention and we look forward to
answering your questions