#Report: Security concerns over compulsory app launched by Hong Kong government
This is part of a report published by #TechOpenFund on July 27, 2022. The investigation was conducted by #7ASecurity and #OTFRedTeamLab in 2022:
//...This exercise involved both a privacy audit and a security audit of the #LeaveHomeSafe #Android and #iOS apps.
The privacy audit could not conclusively prove malicious intent or unauthorized tracking of Hong Kong citizens. However, the security audit demonstrated that these applications have not been professionally audited by any competent security firm before, and that significant flaws exist in the current software security development lifecycle.
This is particularly concerning given that the app was originally introduced more than a year and a half ago, was made mandatory in some fashion for 9 months and recently began requesting real name registration and tracking user’s movements.
While no clear privacy violation could be conclusively proven during the audit at runtime, a number of application artifacts, likely inherited from underlying dependencies or simply security vulnerabilities introduced by mistake, were found during this exercise.//
Read the full article:
https://www.opentech.fund/news/7asecurity-otf-red-team-lab-partner-completes-blackbox-pentest-and-privacy-audit-of-leavehomesafe-app/
Source: Open Tech Fund #Jul27
#MassSurveillance #Track #Privacy #App #PoliceState #Pandemic
This is part of a report published by #TechOpenFund on July 27, 2022. The investigation was conducted by #7ASecurity and #OTFRedTeamLab in 2022:
//...This exercise involved both a privacy audit and a security audit of the #LeaveHomeSafe #Android and #iOS apps.
The privacy audit could not conclusively prove malicious intent or unauthorized tracking of Hong Kong citizens. However, the security audit demonstrated that these applications have not been professionally audited by any competent security firm before, and that significant flaws exist in the current software security development lifecycle.
This is particularly concerning given that the app was originally introduced more than a year and a half ago, was made mandatory in some fashion for 9 months and recently began requesting real name registration and tracking user’s movements.
While no clear privacy violation could be conclusively proven during the audit at runtime, a number of application artifacts, likely inherited from underlying dependencies or simply security vulnerabilities introduced by mistake, were found during this exercise.//
Read the full article:
https://www.opentech.fund/news/7asecurity-otf-red-team-lab-partner-completes-blackbox-pentest-and-privacy-audit-of-leavehomesafe-app/
Source: Open Tech Fund #Jul27
#MassSurveillance #Track #Privacy #App #PoliceState #Pandemic