Taking apart the Sarawak Covid Trace app for Android

Source: https://www.newsarawaktribune.com.my/download-covidtrace-app-for-contact-tracing/

On 15 May 2020, Local Government and Housing Minister Dato Sri Dr Sim Kui Hian announced that Sarawak has decided to release their own contact tracing app, imaginatively called COVID Trace.

My interest was piqued by this line in an article on the Borneo Post:



Surely they can't be broadcasting mobile phone numbers in the clear?!

So I decided to have a look.

Foreword:

This is a very rough first cut of taking apart the Sarawak Covid Trace app to see what it does (and doesn't) do. I am no Android developer, and by no means is this complete or comprehensive.

Also, this post does not seek to:

• Discover bugs in the app, be they functional or technical
• Attempt to find security vulnerabilities

This is purely to see if the app actually does what it claims to do based on public pronouncements, and what it actually does.

Also this only covers the Android version of the app. I have not looked at the iOS version.

It would be very helpful if SAINS and SMA actually published the source of the COVID Trace app, similar to what Australia has done with their COVIDSafe contact tracing app.

Version:

The version that I grabbed off the Google Play Store was marked version 1.0.0, uploaded on 12 May 2020. The hash of the APK that I pulled aprt is as follows:

covidtrace_1.0.0.apk

SHA-256: 931876caf1e61707ba8fdb0b67a2ddf5b432bf5e173d29f49640558f8c426209

SHA-384: 704e92143362ad205cea6f2358ed3d0cd0d2be3bbea02accfca001f970113637514102d05665ee94da13ad6f58a8cdad

SHA-512: e12fd9786ce4ee5dbb5ce89309cd49a76b65fcb212a6f30ef81d7a5976568695a9d21778f7a785861a016ac2003bf0404156827462f4ff9304a75e921ccad1f5

I used JADX v1.1.0 to decompile it, and started poking around.

What does it transmit?

A cursory glance of the code confirms my suspicions: Sarawak COVIDTrace is based off the Singaporean OpenTrace code base, which is the basis of their Trace Together app.

This is no bad thing: reusing good{ish}/better code is better than creating bad code from scratch

I am pleased to say that Dr Sim is incorrect when he says: "this app can automatically detect and get the phone numbers of people within three metres around the handphone user."


Note the code has references to Open Trace

The only thing that the Sarawak COVID Trace app transmits is the power level of the Bluetooth probe (setIncludeTxPowerLevel), the random(ish) identifier that is generated (pUuid), a field that says it is the COVID Trace app, and the phone model (addManufacturerData)

It explicitly exudes the phone name, by setIncludeDeviceName(false), so it wouldn't record "Fatimah's phone", "Tan Ah Beng OnePlus" etc

In laymen's terms, what the probe sends out is:

- The phone model (eg. Iphone 7, Xperia XZ1)
- A randomly generated ID for the user (eg. fn67345443)
- A field that says it is the COVID Trace app (to distinguish it from other Bluetooth devices like bluetooth headphones, your Google Speaker etc)
- The transmit power level of the Bluetooth radio

That is it.

AFAIK the Sarawak COVID Trace app doesn't use the phone telco metadata. On the server side it might, but deassembling the app isn't going to show us or otherwise.

What does it receive?

It has a filter that only receives probes from the Sarawak COVID Trace app. So if there is another person using the Singaporean Trace Together app, it wouldn't record the intreaction with the person only using the Singaporean Trace Together app.



On the receiving side, this is what is stored on the phone:

• The date (in unix time)
• The version of the Tracing protocol (v1 in this case)
• The UUID (generated by the phone)
• A "message" field (which is to announce that it is the Sarawak app)
• The model of the phone sending the probe
• The model of the phone receiving the probe (in this case I've been in contact with an iPhone user)
• And the signal strength of the Blutetooth broadcast (RSSI, txpower)

And this is what the government will receive from the uploaded data.

The data is stored in a SQLite database it seems. 

How does it submit the data?

Similar to the Singapore Open Trace source code, the user needs to actually tap something to upload the data. There is no continous stream of data calling back to SAINS/SMA.



When the upload is triggered by the user, it is sent to https://firebasestorage.googleapis.com. So that's where it is being sent to.

The Australian COVIDSafe app had controversy, as it sends the data to device-api.prod.lp.aws.covidsafe.gov.au, aka AWS (Amazon Web Services). There was (and still is, if I may add) concern about data sovereignty.


Source: https://covidtrace.sarawak.com.my/faq.html

One thing that I found interesting, and that is not in the code but in the official FAQ, is that to upload the close contact data, is that the code to upload is not provided to the user over SMS to their number, but provided by the Department of Health officer.

A bit of an out of band verification.

An improvement, security wise, from the Australian version, where the person taps to upload their close contact data, they get sent a SMS, enter the code, and if it matches, then the upload task starts.

I suppose the problem is how do you verify that the person is actually a Department of Health officer.......?

Security of collected data

One thing I will say is that the  Sarawak COVID Trace app doesn't allow other applications to access its store, so unless the phone is jailbroken, other apps can't access the tracing data stored in the Sarawak COVID Trace app.



In laymans terms this means WhatsApp, Facebook etc, installed on your phone, cannot access the data in SarawakCOVID Trace.

At least they did get this right.

Identifying

Unlike the Australian COVIDSafe app, the Sarawak COVID Trace app doesn't seem to cycle the UUID in intervals. (Every 2 hours in COVIDSafe, albeit imperfectly) The UUID is initialised at install, and the same UUID seems to be used as long as the app is installed.

The thing is that the UUID is initialised at install, so uninstalling the Sarawak COVID Trace app and reinsalling it will generate a new and different UUID. So the UUID is not fixed to the phone (ie. getting the same UUID inspite of uninstalling and reinstalling the app, resetting the phone etc)

When a person signs up with the COVID Trace app, their phone number is required to be entered. A SMS is sent to the number and as a one-time code sent.

Once the verification is complete, that is when the app matches a phone generated UUID to a phone number.

Only when a a person is:

1) Confirm to be infected; and
2) Consents to the data in the COVID Trace app being uploaded; then
3) The process is to match the UUID (A randomly generated ID for the user) with a mobile phone number, and start picking up the phone and calling people

Historical data, and not actually deleting after 21 days

Another part of the article caught my eye:


Source: https://www.theborneopost.com/2020/05/15/swak-comes-up-with-covid-trace-app-public-urged-to-utilise-it-dr-sim/

That's may be what Dr Sim says. However I can't find anything in the code that actually deletes the contact probe details after any timeframe, let alone 21 days.

One concern I have of the Sarawak COVID Trace app is that it doesn't delete the contact data. The Australian one deletes contact data after 21 days, so the phone doesn't store data that can be used to generate a historical running record of who you met with.

While not a smoking gun, if I can't find anything in the code where there is a job to delete data after twenty-one days after looking for 20 mins, I'm going to say that more likely than not that Sim's statement, that "information gathered will be stored on your handphone for 21 days", may not be technically accurate.

I don't want to be harsh on Dr Sim: he is not a tech person, no one is expecting him to vet the code, and he relies on what he is told.

But I think it is fair to call out when the app doesn't do what the public pronouncements say it does.

If anyone can find a regular process that deletes data older than 21 days I would be very much interested. 

Calling back to Google Analytics?

Another concern I have is that the Sarawak COVID Trace app calls back to Google (Advertisment) Analytics, without a clear indication on why it does so.

I get that SAINS/SMA may want to get analytics on how many people who downloaded it are actually using it, how often, how long, do they kill the background process or not, but this data, and call back to Google, can be linked with the phone and used for custom ad targeting.

IMO, this should NEVER be in a contact tracing app. Any contact tracing app should not be calling back to Google, much less Google Analytics.

Claims vs code

Source: https://covidtrace.sarawak.com.my/

From what I see in the code vs what they claim on their official site:

1) Yes, encounter history is stored locally, and not a ongoing stream to a remote server.

2) It doesn't write GPS coordinates to the database; however it has code to get (but not store) GPS coordinates. No clear reason why it is there: if it is for future use this should be mentioned.



3) The only PII collected is the mobile number: largely true. It doesn't ask for name or postcode or age range, which the Australian app does (albeit there is no obligation to provide correct information; my name is now Yui, I'm aged 18 - 25, and my postcode is 6969 #totallyMature)

4) As mentioned above, the only thing that it broadcasts is a randomly generated UUID, phone model, and characteristics of the broadcast power

There is debate whether a phone model with a static UUID can be considered unique and identifiable, but overall point 4 holds true

5) As mentioned, subject to the phone not being jailbroken, other 3rd party apps are not allowed to access the data in Sarawak COVID Trace. However, there is the concern of the code for Google Analytics; and can be used to profile who has and who hasn't installed the app.

6) We can only trust that they delete the data from their systems on their end once it is used. As for deleting the data on the phone, once the app is uninstalled the tracing data will be deleted.

The issue of data only being kept on the phone for 21 days is still very much unresolved, and I really can't find any code that actually does it!

Few concerns specific to Sarawak COVID Trace off the top of my head:

1) The "data is only kept for only 21 days" claim: is not reflected in the code. Long term, it can be used to make a social network graph of who you met in person, assuming all parties are using the app. Privacy considerations.

2) Use of Google Analytics: still unexplained, and should NOT be used (potentially Google can profile who is using contact tracing apps even if their other services in the phone can't access the app data)

3) Data sovereignty: how happy (or otherwise) are people sending their data to Google (Firebase)? Probably an academic question for people using an Android phone without a custom de-googled ROM, but Apple and custom ROM users may have other thoughts

4) How long will the uploaded data be stored? Who can access and use it? Are there limits on who can it be shared with?

In Australia they rammed through legislation in Parliament to say that it can only be accessed by the (Australian) Department of Health, can't be used by police and security agencies, can't be use in court for criminal matters, data to be deleted "When the pandemic ends" (so, never), having an independent auditor for data access oversight, and making it an offence to force people to install COVIDSafe.

5) The (reverse engineered) code is not obfuscated, so that is a good one in my books. However the objects and classes are all over the place, and not necessarily intuitively named.

It works, but the code readability is not as easy as the Australian version.

6) Somewhat related to my 2nd point above, no clear reason in the code why the app asks for Google Play Store Install Referrer API permissions.  Any app IMO should only require the bare minimum permissions. The Australian version works without asking for Google Play Store Install Referrer API permission.

7) It does actually hijack any battery optimisation rules, prevents the phone from sleeping. While not a criticism per se, (it needs that to do its job) something to keep in mind.

The Australian version of the app at least tries to adhere to the battery optimisation rules.

8) In 2020, certificate pinning should be used, with the certificates on what it can connect to, put in the app. The Australian COVIDSafe app actually comes with certificate ke pinning, so it can only communicate with the server that it should only be communicating to. So hijacking DNS and a LetsEncrypt certificate MITM attack shouldn't be successful.

9) The number of ciphersuites that it can use is IMO unnecessarily large. It is 2020: TLS 1.0 and 1.1 should not be used. I would enforce it to use TLS 1.3 only if I had my way; but acknowledge that TLS 1.2 is required for backwards compatibility.

But even in TLS 1.2, the ciphersuite list should be trimmed: no 3DES, no SHA-1, GCM mode over CBC mode, with Forward Secrecy.


(If anyone needs guidance on ciphersuites I'm more than happy to provide~!)

Omake

There is a little regional flavour in the io.bluetrace.opentrace.streetpass.StreetPassWorker object 😅😄

Final words

After all this, I think it is important to not miss the bigger picture: no app, no technology, is going to be the silver bullet.

The app is only a aid for contact tracing: it is not the authoritative source of everyone that the person has had contact to.

Nothing beats picking up phones, walking pavements (well, not that we have any in Malaysia), physically meeting people, to do contact tracing, to find people who may have been infected, and isolate them.