World Cup apps pose a data security and privacy nightmare
- Reference: 1668197171
- News link: https://www.theregister.co.uk/2022/11/11/world_cup_security/
- Source link:
Football fans and others visiting Qatar must download two apps: [1]Ehteraz , a Covid-19 tracker, and [2]Hayya , which allows ticket holders entry into the stadiums and access to free metro and bus transportation services.
Qatar's Ehteraz contact tracking scheme [3]came under scrutiny even before its World Cup use because it allows remote access to users' pictures and videos, and can make unprompted calls.
[4]
Additionally, Ehteraz requires background location services to always be on and it gives the app the ability to read and write to the file system.
[5]
[6]
"Ehteraz is able to install an encrypted file which claims to hold a unique ID, QR code, infection status, configuration parameters and proximity data of other devices using the app," Tom Lysemose Hansen, CTO and co-founder of app security firm Promon told The Register . "Essentially, it is clear that the app is taking data from the end user for more reasons than are expressed by the given consent button."
After reviewing the two apps, France's data protection agency CNIL suggested [7]bringing a burner phone to keep your information safe from prying eyes — and ears. And Norway's head of security offered similar advice, telling the Norwegian Broadcasting Company:
[8]
"I would [9]never bring my mobile phone on a visit to Qatar."
Additionally, some [10]15,000 cameras using facial recognition will monitor the event and attendees, ostensibly to keep footballers and fans safe. But considering the country's dismal [11]human rights' record , it's probably not a bad idea to approach this surveillance with a healthy dose of skepticism.
When asked about security concerns related to the two apps, a spokesperson for Germany's data protection agency BfDI told The Register it is working with the the German Foreign Ministry and the German Federal Office for Information Security to investigate Etheraz and Hayya.
[12]
Additionally, the UK Information Commissioner's Office is "aware of media reports on this matter and we will consider the potential impact on the privacy rights of UK citizens," a spokesperson told The Register , referring travelers to the agency's [13]data rights page . "If anyone is concerned about how their data has been handled, they can make a complaint to the ICO."
The spokesperson declined to comment on the use of burner phones.
[14]Papa John's sued for 'wiretap' spying on website mouse clicks, keystrokes
[15]TikTok accused of covert plot to track specific US citizens' every move
[16]Booting up: Footballers kick off GDPR case for 'misuse' of their performance data
[17]Is it any surprise that 'permacrisis' is the word of the year?
The bottom line, according to Hansen, is that by downloading these apps, which are required to visit Qatar and attend the World Cup, users are forced to "hand over all sensitive IP on a silver platter upon arrival."
"After accepting the terms of these apps, moderators will have complete control of users' devices," he continued. "All personal content, the ability to edit it, share it, extract it as well as data from other apps on your device is in their hands. Moderators will even have the power to unlock users' devices remotely."
And what will state snoops do with this unfettered access? Authoritarian regimes are keen to track who you meet in country, and who you know.
"With this in mind, they'll most likely be using these apps to scrape all your contacts, check your call and SMS history, track your location through GPS and device radio interfaces (bluetooth and wifi) and probably pillage your social media contacts," Hansen said, noting this also puts friends and acquaintances at risk.
Plus, once you accept the terms and conditions, the apps can continue spying on you and your contacts even after you leave Qatar. The only real solution is to get a burner phone, Hansen added, echoing government officials' warning.
Even with a new SIM, don't import any settings or contacts, or log in to your social media accounts, he said. Otherwise, expect to be tracked by Qatar, and possibly other countries' snoops. "The phone's unique IMEI number and SIM's identifier will be tracked by mobile networks in that country and probably shared with other autocratic regimes which means they can continue to track you, in those countries, even after you uninstall the app."
We've asked the app makers and the government for their views. No word yet. ®
Get our [18]Tech Resources
[1] https://play.google.com/store/apps/details?id=com.moi.covid19&hl=en_GB&gl=US&pli=1
[2] https://play.google.com/store/apps/details?id=com.pl.qatar
[3] https://www.wionews.com/world/qatar-coronavirus-contact-tracing-app-ehteraz-stirs-rare-privacy-backlash-300888
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y27UBV80DYqWBF3jmcAcOQAAAQk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y27UBV80DYqWBF3jmcAcOQAAAQk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y27UBV80DYqWBF3jmcAcOQAAAQk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.politico.eu/article/qatar-world-cup-2022-warning-burner-phones-french-agency/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y27UBV80DYqWBF3jmcAcOQAAAQk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.nrk.no/sport/everyone-going-to-the-world-cup-must-have-this-app---experts-are-now-sounding-the-alarm-1.16139267
[10] https://www.france24.com/en/live-news/20220812-qatar-s-ground-control-on-alert-for-world-cup-disasters
[11] https://www.hrw.org/world-report/2022/country-chapters/qatar#eaa21f
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y27UBV80DYqWBF3jmcAcOQAAAQk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://ico.org.uk/your-data-matters/
[14] https://www.theregister.com/2022/10/06/papa_johns_spying_lawsuit/
[15] https://www.theregister.com/2022/10/21/tiktok_spying_allegations_bytedance/
[16] https://www.theregister.com/2021/10/12/footballer_data_trade_case/
[17] https://www.theregister.com/2022/11/01/permacrisis_word_of_the_year/
[18] https://whitepapers.theregister.com/
A government official being careful with government issued phones on an official government visit is one thing.
But having to follow John le'Carre-esq 'Moscow Rules' on a holiday to watch a giant P.E. lesson seems a bit much
To be honest, that's exactly how I would feel about travelling to the Middle East for something like that...
But if you want to watch football you need to go to its traditional home in the Arabian desert - that's the price you pay for sport
In other news
Priti Patel / Suella Braverman / Cthullu (whoever is home sec by the time this is published) backs UK bid for next world cup
Nokia rules!
My dad's phone is an old Nokia, and totally un-smart, no apps, no touch screen, not even colour. So I'm curious as to what the rules state for someone who does not carry a smartphone. (My dad is not going as he is in his 90's now and a bit unsteady on his feet, so all academic to him.)
Re: Nokia rules!
The article says you need the apps to gain entry to the events.
Re: Nokia rules!
It sounds like they would not let him into events without the apps to serve as tickets, but he would probably be freer when traveling around the country in general. However, IMEI and IMSI numbers could still be logged and shared, so freer doesn't mean invulnerable.
App Stores
Has any asked Google and Apple if these apps break any of their store policies ?
Re: App Stores
I think you will find money trumps rights & decency most times for big corporations. After all, that is how they got that way...
I would like to see the not-so-subtle racism in this article applied elsewhere
Actually I would not, but fair is fair. Naughty Qatar. But the UK does just as badly
-> Authoritarian regimes are keen to track who you meet in country, and who you know.
As though there is one country in the world which does not.
How is it going to get your contacts, location, etc.
If you don't give the app permission to do so? That's been necessary on iPhone forever, and I thought Android had added similar stuff a few revs ago? Does the app refuse to operate if it can't grab your contact list? Seems to me they could rely on collecting that info only on those rocking obsolete Androids. Given how much a visit for the World Cup costs, I doubt any of them is carrying a phone that old!
The claim that it will continue to spy on you forever is even more spurious. If you delete the app as your flight back home takes off, how is it going to do that - unless it has a built in 0 day persistent rootkit (i.e. the holy grail of exploits which is worth millions of dollars and used only for very targeted attacks to prevent its discovery that will render it worthless)
While the built in persistent rootkit is theoretically possible, the PR and diplomatic blowback when that was inevitably discovered (perhaps before the World Cup was even over) would greatly outweigh whatever intelligence they were able to collect. Since those with actual secrets worth stealing would use a burner phone to run the app so all it could get is their whereabouts at a given time (and that assumes they don't "accidentally" swap burner phones with someone else who has a similar model just for the heck of it)
Re: How is it going to get your contacts, location, etc.
"Does the app refuse to operate if it can't grab your contact list?"
That'd be an easy way to do it. Anyone who installs this in the first place is willing to accept dodgy software in return for getting into the events, so how many will cheerfully install and activate the app but balk when it demands access and won't work without it? They might not even know about that until they install it in preparation, having already paid for their Qatari lodging and whatever tickets you need to attend.
You're correct about it continuing to spy on you, although I'll point out that you wouldn't need a full rootkit unless the user did a factory reset of their device and a lower-level exploit that doesn't change the system partition would withstand an app uninstall. I don't think they will use either, though. Still, they will be able to collect a significant amount of information while it's running, so even without a beachhead on the device, there's information about you which can be used to drive further attacks if they're motivated to do so. If I scrape your device's common storage and any data I can get by making the user accept permission requests, that's useful in targeting users later or selling to interested parties. I'm not really sure what Qatar would actually do with it, but it's not likely to be good.
I'm dying of suprise right now.
The worlds favorite sport is also it's most corrupt. What about the combination of that and Qatar was going to produce anything else? Until there is house cleaning at FIFA and Bladder is back in the ground with a stake in his heart, we should expect this kind of thing. Same for the IOC. I'm surprised the football fans keep rolling over for this stuff, considering the ultras have overthrown bigger governments and have a penchant for taking out their frustrations by burning things.
Yep a burner phone would be best when visiting certain countries. Years ago at a party in the Westminster area where you would expect to find the odd civil servant I was talking to a bloke for a while. I was talking to him because he was a bit more interesting than anyone else I'd met so far. He was working he said for the FCO and couldn't go into more detail about his role because of the Official Secrets Act. He did say his job just involved doing a lot of things you'd find in a non governmental office. I was trying to tease things out of him but he wasn't budging and he flatly denied being in the "Executive Branch". Anyway after a few more drinks I did get out of him a story about where someone had 'lost' their government issue BlackBerry. This was in an unnamed foreign country and had happened at the airport after landing. The strong suggestion was that the local security service had purloined the device. There had been another almost identical situation before and the FCO were now wise to this. If you flew into that country your BlackBerry was a new issue and therefore wouldn't have anything classified on it or I think be provisioned to access anything yet. There were also rules/guidelines for security in that country that were enhanced compared to the normal rules applied elsewhere.