Update 2019-04-04: The use of not encrypted connections to retrieve directions was first reported in 2014 by researchers of the STIC Program of Fundación Sadosky. Source: https://github.com/programa-stic/security-advisories/blob/master/BAComoLLego/README.md

Update 2019-04-10: The Android version of the “BA Como Llego” application was updated on April 5, 2019. The main issues addressed in our blog were solved, however location about the destination searched by the user is still leaked. Moreover, not all communication of the application is encrypted, basic information about phone model, OS, language, and in some cases what topic is searched. The Apple iOS version of “BA Como Llego” has not been updated yet. We have not received any response from the developers to our email in which we detailed the issues reported here.

Update 2019-06-03: On April 23, 2019 Dirección General de Ciencias de la Información responded to our email addressing the issues and said the issues will be fixed. The Android version of the “BA Como Llego” application was updated on April 5, 2019. All of the issues addressed in our blog regarding the Android version were resolved. However, all of the issues in the Apple iOS version of “BA Como Llego” remain.

SUMMARY

In this blog post we report important issues found on the public transport application “BA Cómo Llego” developed by Argentinean Government. A summary of the issues found is:

The application sends the exact location of the users in clear text over the network. Anyone with access to the traffic can know where you are.

Every search done in the app by the user is sent in clear text, leaking the content of the search. Anyone with access to the traffic can know what you type in real time.

Every character typed generates a new request, leaking not only what you type but how you type it. Anyone with access to the traffic may analyze who you are.

This affects iOS application version 5.6.0, and current Android application.

ABOUT THE APPLICATION

“BA Cómo Llego” is an application developed by the Government of Buenos Aires City (“Gobierno de la Ciudad Autónoma de Buenos Aires“). With more than 1,000,000 reported installations. This application helps individuals move around Buenos Aires city by finding public transport. It provides directions and transportation options including bus, subway, train, car, bike, or foot.