Two Software Issues In The Swiss COVID-19 Contact Tracing App Identified by DeepCode.ai
Contact tracing apps, which alert users when they have been in contact with infected people, are being touted as crucial aids to control the spread of Covid-19. The Swiss proximity tracking system is currently being tested in a final live phase by selected groups as reported by swissinfo.ch.
The National Cybersecurity Centre (NCSC) received the report about the 2 issues found by DeepCode.ai in the source code of the app through their official portal and within days the 2 issues have been already fixed. DeepCode.ai is an ETH Zurich Spin-off utilizing cutting-edge Symbolic AI to learn from the billions of lines of code and fixes the global development-community generated since the 1950’s when modern software development started. DeepCode took less than 0.5 seconds to identify those two problems and to produce all the details and descriptions needed for the developers to fix them: this included the semantic description of the problems and precise examples of how similar problems were fixed in the development community in a totally different context.
The decentralized contact tracing app called “DP-3T” is the concept of EPFL and is co-developed by Switzerland’s two Federal Institutes of Technology (ETHZ and EPFL). It “ will leverage the new Google and Apple Contact Tracing APIs as soon as they are available,” Pascal Strupler, Director-General of the Swiss Federal Office of Public Health, is quoted as saying in a press release.
“The app, which people can voluntarily download and use, employs Bluetooth technology to allow smartphones to communicate with each other anonymously. If a person tests positive for coronavirus, all the people with whom that person was in contact in previous days — less than two meters proximity for more than 15 minutes — are alerted via the app to isolate themselves and get tested. The DP-3T system is decentralized with contacts and data stored on devices rather than on an external server. “
An EPFL staff displays the tracing application “SwissCovid” on his mobile device on the second day of the pilot for the app at the Swiss Federal Institute of Technology Lausanne in Lausanne, Switzerland May 26, 2020. REUTERS/Denis Balibouse”
The DP-3T project is part of the Swiss National Covid-19 Science Task Force, a national scientific advisory board set up to tackle the pandemic.
Most content and text in this article is based on a compilation and quotes from articles published in SWI swissinfo.ch on the topic unless otherwise stated.
Here are the links to the originally identified reports (GitHub Log-in Required):
- Missing close on java.io.FileInputStream [:82] leads to a resource leak.
- To provide truly random values, the java.util.Random [:64] object must be reused and not created for every call.
Sources:
- https://www.swissinfo.ch/eng/covid-19_coronavirus-contact-tracing-app--friend-or-foe-/45746418
- https://www.swissinfo.ch/eng/digital-solution_contact-tracing-app-could-be-launched-in-switzerland-within-weeks/45706296
- https://www.swissinfo.ch/eng/public-scrutiny_swiss-covid-19-contact-tracing-app-ready-for-privacy-testing/45792632
- https://www.melani.admin.ch/melani/en/home/public-security-test/current_findings.html
- https://github.com/DP-3T/dp3t-sdk-backend/blob/develop/dpppt-backend-sdk/dpppt-backend-sdk-ws/src/main/java/org/dpppt/backend/sdk/ws/config/MultipleJWTConfig.java
- https://github.com/admin-ch/CovidCode-Service/blob/develop/src/main/java/ch/admin/bag/covidcode/authcodegeneration/service/AuthCodeVerificationService.java
- https://www.reuters.com/article/us-health-coronavirus-swiss-apps/swiss-parliament-paves-way-for-coronavirus-tracing-app-rollout-this-month-idUSKBN23F2E9
Anyone can use DeepCode.ai for free with just 3 clicks: https://www.deepcode.ai/cloud-login
