French hacker claims Pakistan's COVID-19 contact tracing app reveals patients' locations, govt denies claims

A French ethical hacker has reported privacy flaws in Pakistan's COVID-19 contact tracing app – COVID-19 Gov PK –via a series of tweets. The hacker, Robert Baptiste, who goes by the username Elliot Alderson, pointed out that the app has "hardcoded passwords, insecure connections, privacy issues and...nothing is okay with this app".To recall, the same hacker also spoke to Firstpost about India's Aarogya Setu app. He had said that the Indian government must convince people of the app’s efficacy rather than force them to use it.In a series of tweets, he emphasised that COVID-19 Gov PK is "NOT" a contact tracing app. The hacker added that the app, "gives access to dashboards for each province and state, you can do a self-assessment, get radius alert, get a popup notification reminding the user of their personal hygiene".Basically, it will show you the number of confirmed, critical, recovered, and fatal cases across the country in the past 24 hours.(Also Read: Aarogya Setu, India's contact-tracing app, goes open-source) 

The COVID-19 Gov PK app is developed by the Ministry of IT and Telecom alongwith the National Information Technology Board of Pakistan. It is now available on the Google Play Store and according to the tweet, it has been downloaded more than 5,00,000 times.He also claims that "When you open the app, it asks a token to the pak gov server with hardcoded credentials: CovidAppUser/CovidApi!@#890#".As per a report by Geo TV, a Pakistani news publication, hard-coded credentials — a password embedded into an app’s code for easy access by the developer — are a major security risk, as they are favoured by hackers who target them for access to the app itself, or worse, the device. It further added that ideally, these credentials should be removed before the app's release, but are often left in from the development stage, onto production.Further, Alderson also reveals that the app asks for positions of the infected person on the map, and the request made by the app is "insecure". He added that in the "Radius Alert" tab, "you can get a map of infected people. Ofc, the exact coordinates of infected people are downloaded by the app". Bye, bye privacy?At the end, the hacker tweeted, "Thanks for the good laugh, you are the worst #Covid19 app I analysed."(Also Read: Aarogya Setu: Whether we like it or not, the app is here to stay, but it's still riddled with privacy issues that need strong answers)