Philippines corona tracker android#
Philippines corona tracker mac#

Philippines corona tracker android#

Our analysis focuses on evaluating the permissions declared by the Android version of each app, particularly on what Google calls вЂњ dangerous permissionsвЂќ (or permissions that вЂњaccess private user data, a special type of restricted data that includes potentially sensitive informationвЂќ). We chose to analyze the Android versions of these apps because Android is the predominant mobile operating system used in the Southeast Asian region. In particular, we analyzed Android versions of IndonesiaвЂ™s PeduliLindungi app (version 2.2.2), as well as the PhilippinesвЂ™ StaySafe PH app (version 0.12) and COVID-KAYA app (version 1.4.7). In this report, we analyze IndonesiaвЂ™s PeduliLindungi app, as well as the PhilippinesвЂ™ StaySafe PH and COVID-KAYA apps. Following this publication, we conducted an analysis of COVID-19 apps launched by the governments of Indonesia and the Philippines because of reported concerns over the collection of personal data through the apps (see and for IndonesiaвЂ™s and the PhilippinesвЂ™ apps, respectively), as well as previous incidents of COVID-19-related data breaches in Indonesia and the Philippines. In July 2020, we wrote a short blog post regarding COVID-19вЂ™s impact on marginalised communities in Indonesia, the Philippines, Singapore, and South Korea.

We previously reported that both the Android and web versions of this platform contained vulnerabilities that would have allowed unauthorized users to access private data about the appвЂ™s users and potentially patient data.

COVID-KAYA, a COVID-19 case tracking platform used by healthcare workers in the Philippines, requests access to sensitive private information that does not appear to be necessary for the appвЂ™s principal functions.

We disclosed this vulnerability to Multisys, the developer of StaySafe PH, who released updates for the Android and iOS versions of the app and secured the platformвЂ™s backend database in response.

We are concerned, but did not confirm, that it would be possible to use usersвЂ™ movement patterns to deanonymize them and to discover their health status. Through a vulnerability in the backend database used by this app, we were able to access the geolocation data of hundreds of thousands of users.

StaySafe PH, a COVID-19 contact tracing app launched by the government of the Philippines, collects device geolocation data and stores it in an insecure manner.

Philippines corona tracker mac#

It also collects a userвЂ™s WIFI MAC address and local IP address, which are not necessary for the appвЂ™s main features to function.

PeduliLindungi, a COVID-19 contact tracing app launched by the Indonesian government, collects and associates usersвЂ™ geolocation coordinates with their name, phone number, and device identifiers.

As part of the Citizen LabвЂ™s research into the security and privacy of applications, we report on issues we discovered with three COVID-related applications in Indonesia and the Philippines.

The FAQ and the key findings of this report has been translated to Tagalog and Bahasa Indonesia. To accompany this report, the authors have written an FAQ.