A taxonomy of attacks on the exposure notification system used by contact tracing applications

To enhance pandemic response in COVID-19, Google and Apple introduced the Exposure Notification (EN) system - a decentralized, Bluetooth-based framework enabling contact tracing applications to evaluate and mitigate exposure risks. As the EN system is expected to evolve in upcoming versions to address future pandemic scenarios, characterizing and addressing its current attack vectors and vulnerabilities is critical to ensuring its effectiveness and robustness in future public health responses. Existing literature studies have revealed vulnerabilities, assessed their impact, and, in some cases, proposed countermeasures to improve the EN’s resilience. However, the current state of the art still lacks a general taxonomy with adequate granularity that includes the most recently disclosed attacks. This paper presents a comprehensive taxonomy of attacks targeting the EN system. Building on existing categorizations, the proposed taxonomy refines and expands previous frameworks to systematically classify 47 known attacks. It adopts a granular, multilevel structure organized into three core categories – Denial of Service, False Alert Injection, and Information Disclosure – based on attack characteristics, objectives, and outcomes. This taxonomy details current EN attack vectors and procedures, highlighting areas and vulnerabilities that warrant further exploration, analysis, and revision. By systematically mapping these threats, this research aims to advance the design of resilient and secure contact tracing frameworks–a basis for strengthening future contact tracing applications.