  Ahead of the rollout of the SwissCovid contact tracing app, an official
public security test was performed. During this audit, Prof. Serge Vaudenay and
Dr. Martin Vuagnoux described a large set of problems with the app, including a
new variation of a known false-positive attack, leveraging a cryptographic
weakness in the Google and Apple Exposure Notification framework to tamper with
the emitted Bluetooth beacons. Separately, the first author described a
re-identification attack leveraging rogue apps or SDKs. The response from the
Swiss cybersecurity agency and the Swiss public health authority was to claim
these various attacks were unlikely as they required physical proximity of the
attacker with the target (although it was admitted the attacker could be
further than two meters). The physical presence of the attacker in Switzerland
was deemed significant as it would imply such attackers would fall under the
Swiss Criminal Code. We show through one example that a much larger variety of
adversaries must be considered in the scenarios originally described and that
these attacks can be done by adversaries without any physical presence in
Switzerland. This goes directly against official findings of Swiss public
authorities evaluating the risks associated with SwissCovid. To move the
discussion further along, we briefly discuss the growth of the attack surface
and harms with COVID-19 and SwissCovid prevalence in the population. While the
focus of this article is on Switzerland, we emphasize the core technical
findings and cybersecurity concerns are of relevance to many contact tracing
efforts.
