Coronavirus: UK considers virus-tracing app to ease lockdown

A coronavirus app that alerts people if they have recently been in contact with someone testing positive for the virus “could play a critical role” in limiting lockdowns, scientists advising the government have said.

The location-tracking tech would enable a week’s worth of manual detective work to be done in an instant, they say.

But the academics say no-one should be forced to enrol – at least initially.

UK health chiefs have confirmed they are exploring the idea.

“NHSX is looking at whether app-based solutions might be helpful in tracking and managing coronavirus, and we have assembled expertise from inside and outside the organisation to do this as rapidly as possible,” said the tech-focused division’s chief Matthew Gould.

Instant alerts

The study by the team at the University of Oxford’s Big Data Institute and Nuffield Department of Medicine was published in the journal Science.

It proposes that an app would record people’s GPS location data as they move about their daily lives. This would be supplemented by users scanning QR (quick response) codes posted to public amenities in places where a GPS signal is inadequate, as well as Bluetooth signals.

If a person starts feeling ill, it is suggested they use the app to request a home test. And if it comes back positive for Covid-19, then an instant signal would be sent to everyone they had been in close contact with over recent days.

Those people would be advised to self-isolate for a fortnight, but would not be told who had triggered the warning.

Infographic shows how app would trace contacts using location and QR barcode scans and send them a notification when they'd been close to someone diagnosed with Covid-19

In addition, the test subject’s workplace and their transport providers could be told to carry out a decontamination clean-up.

“The constrictions that we’re currently under place [many people] under severe strain,” said the paper’s co-lead Prof Christophe Fraser.

“Therefore if you have the ability with a bit more information and the use of an app to relax a lockdown, that could provide very substantial and direct benefits.

“Also I think a substantial number of lives can be saved.”

To encourage take-up, it is suggested the app also acts as a hub for coronavirus-related health services and serves as a means to request food and medicine deliveries.

The academics note that similar smartphone software has already been deployed in China. It was also voluntary there, but users were allowed to go into public spaces or on public transport only if they had installed it.

BBC

Chinese hacking group has found new way to bypass two-factor authentication

A group with alleged links to the Chinese government has been accused of hacking networks worldwide, but in a rare twist, it’s said to be bypassing two-factor authentication in the process.

The hack was detailed late last week by security researchers from Fox-IT Holding B.V. APT20, the group behind the campaign, targets web servers as the first point of entry with a particular focus on Jboss.

Once through the door, the group installs web shells then spreads throughout the network. Showing fairly typical behavior, the group seeks out passwords and administrator accounts to obtain more information from their targets utilizing virtual network credentials for more secure access.

Where it gets interesting is that the researchers claim they found evidence that APT20 was gaining access to VPN accounts that were protected by 2FA. Hacking 2FA isn’t new, and the process involved is somewhat complicated, but APT20 is said to have found a new way to bypass the process.

The hackers are believed to have stolen an RSA SecurID software token from a hacked system, then modified the key to work on different systems.

“The software token is generated for a specific system, but of course this system-specific value could easily be retrieved by the actor when having access to the system of the victim,” the security researchers explained. “As it turns out, the actor does not actually need to go through the trouble of obtaining the victim’s system-specific value, because this specific value is only checked when importing the SecurID Token Seed, and has no relation to the seed used to generate actual 2-factor tokens. This means the actor can actually simply patch the check which verifies if the imported soft token was generated for this system, and does not need to bother with stealing the system-specific value at all.”

While specifically applying to software-based tokens, the method is disturbing particularly given that 2FA is regularly held up as a way to prevent hacking such as this.

A full copy of the research into the group can be found here.

Nigerian citizen to stand trial in Memphis for cyber crimes

A Nigerian citizen living in Accra, Ghana, has been extradited to Memphis to stand trial for an indictment charging him with cyber crimes and identity theft.

According to the U.S. Department of Justice, a federal grand jury in the U.S. District Court for the Western District of Tennessee indicted 64-year-old Babatunde Martins with wire fraud, aggravated identity theft, and conspiracy to commit money laundering.

Martins was also charged with conspiracy to commit wire fraud and conspiracy to commit computer fraud.

The indictment alleges that Martins, along with other Africa-based co-conspirators, hacked into the servers and email systems of a Memphis-based real estate company in June and July of 2016. Martins and his co-conspirators allegedly sent fake emails to “relevant business parties,” and redirected money to final destinations in Africa.

The indictment was handed down on August 23, 2017, but Martins did not make his initial appearance in a West Tennessee court until Monday, December 9, 2019.

The Department of Justice says that Martins is also charged with perpetrating romance scams, fake check scams, gold-buying scams, advance-fee scams, and credit card scams. The indictment alleges that proceeds from these scams were transferred from the U.S. to locations in Africa.

Five other people have pleaded guilty to being involved in the scheme. Olufalojimi Abegunde, 33, and Javier Luis Ramos-Alonso, 30, were convicted in March after a week-long trial in the U.S. District Court for the Western District of Tennessee. Abegunde received a 78-month sentence, and Ramos-Alonso received a 31-month sentence for their roles in the scheme.

The Department of Justice says that several others are still at large.

wreg.com

Bitcoin ransomware locks 10 years’ worth of government data in Argentina

Bitcoin-hungry hackers have attacked a data center in Argentina which houses local government files.

According to Alicia Bañuelos, the country’s Minister of Science and Technology, the attack took place on November 25.

In an interview with Agencia de Noticia de San Luis — a local government digital news outlet — on December 2, Bañuelos said the center had already recovered 90 percent of the encrypted data. Some 7,700 GB — approximately 10 years worth data — was originally compromised as a result of the attack.

“Decrypting the files will take at least 15 days, mostly due to the sheer size of the archive,” Bañuelos added during the interview.

The size of the Bitcoin ransom is unknown, but reports suggest attackers asked for somewhere in between approximately $37,000 and $370,000 (0.5 and 50 BTC) in exchange for decrypting the files.

Just last week, Hard Fork reported on how a major US data center had been hit by Sodinokibi, a prominent strand of ransomware which several months ago earned a hacker $287,000 worth of Bitcoin in just three days.

Governments have proved to be popular targets. A group of cybercriminals calling themselves the “Shadow Kill Hackers” attacked the City of Johannesburg (South Africa) administration website in late October and threatened to upload the stolen data on the internet unless they received a $300,000 (4 BTC) Bitcoin ransom.

Hackers are also targeting private companies, including Spanish multinational security firm Prosegur, which was hit by Ryuk ransomware under two weeks ago.

thenextweb

Apple Warns iPhone Users Not To Answer Apple Support Calls

iPhone users have been warned not to answer calls from Apple unless they have specifically requested one using the official Apple online support page. This comes off the back of a rash of spoofed support calls that have become increasingly sophisticated in their efforts to get access to Apple iCloud accounts. How sophisticated? How does displaying the Apple logo, address and correct support telephone number grab you? Here’s what you need to know.

The scam

The telephone calls are straightforward phishing, the same as you will have seen countless times in your email no doubt. They have more success because most people still aren’t expecting voice to be used in such social engineering scams. The scammers employ caller-ID spoofing techniques so as to impersonate the real telephone number of the service they claim to be representing. Most commonly as far as this particular threat is concerned that will be Apple support, although I have been told by those on the receiving end of such calls that AppleCare and Apple customer service have also been used in an attempt to gain the trust of the victim.

By spoofing that number and displaying the Apple logo, the fraudsters hope that the person answering the call will be less suspicious than if they were taking an unsolicited call from a number they didn’t recognize. This kind of brand recognition leverage is high on the phishing 101 list of ways to garner victim trust. It’s why telephone scams supposedly from Microsoft support, which don’t have the same trust-enhancing methodologies, tend to be less successful. As the fact-checking site Snopes confirms, “if the recipient is an iPhone user who then requests a call back from Apple’s legitimate customer support web page, the fake call gets indexed in the iPhone’s recent calls list as a previous call from the legitimate Apple Support line.”

The bait will vary but is always going to be a variation on the theme of your account has been compromised, there’s been a data breach or there has been suspicious activity in your iCloud account. The latest bunch of these calls have been automated with a message informing the user to call a number that purports to be Apple support, complete with estimated waiting times and convincing welcome messages and call purpose options. Sometimes the user will be asked to “press 1” to connect to a support advisor. In all cases, the danger to your data story will be spun out and you will be asked to confirm your iCloud account credentials.

What Apple says

The Apple support presence on Twitter is, unsurprisingly, getting regular tweets from concerned iPhone users who have received such a call and want to know if it is genuine and their accounts have been compromised. The response is most always the same: “Your security is our number one priority. You can find more information about phony calls and learn how you can report them by following the steps from this article here.”

If you follow that link it will take you to a support post entitled “Avoid phishing emails, fake ‘virus’ alerts, phony support calls, and other scams” which has a section covering suspicious telephone calls. Apple says that users should always verify a caller’s identity before providing any personal information. However, while that advice might seem logical it is often harder in practice than it sounds. As I’ve already pointed out, the scammers are getting increasingly sophisticated in their methods of convincing potential victims that they are genuine. Caller-ID spoofing makes it ever harder to separate fiction from reality. I think Apple could easily delete most of the advice it gives in this section and just leave the final line: “If you get an unsolicited call from someone claiming to be from Apple, hang up and contact us directly.”

Apple will never ask you for your Apple ID password, iCloud credentials or verification codes in order to provide you with support. Simple as. Never. And talking of verification codes, Apple also advises iPhone users to activate two-factor authentication as an additional layer of security to protect your account.

Programmer finds ridiculous ATM loophole that let him withdraw ₦377 million in cash

It sounds like something straight out of a movie: an unsatisfied bank programmer discovers the perfect scheme for making an ATM spit out free money.

But apparently, this story is true: The South China Morning Postand China’s Daily Economic News report that 43-year-old Qin Qisheng managed to withdraw over 7 million yuan (upwards of ₦377 million) from ATMs operated by his employer, Huaxia Bank — all by exploiting a crazy loophole.

According to the reports, the bank’s system didn’t properly record withdrawals made around midnight — effectively spitting out cash without removing the total from a user’s account. Normally, that might send up a red flag that a transaction had failed, but Qisheng allegedly inserted scripts into the system that suppressed those alerts.

Qisheng started pulling out money in November 2016, but it wasn’t until January 2018, some 1,358 withdrawals later, that the bank discovered the bad code in its system and brought him to the authorities.

Perhaps the most surprising part of this story: the bank didn’t want to keep pressing charges once he’d returned the money. Maybe fearing the bad publicity (apparently the loophole has already been fixed), Huaxia Bank reportedly asked police to drop the case — reportedly accepting Qisheng’s explanation that he was merely testing the bank’s security and was holding onto the money for the bank to reclaim. As one does.

The courts refused, though, and Qisheng is now looking at 10 and a half years in prison after losing his appeal. They didn’t buy the argument, considering that he’d moved the money to his personal bank account, instead of the bank’s dummy account, and had apparently been investing some in the stock market, too.

The Verge

Potential global cyber attack could cause $85 billion-$193 billion worth of damage: report

A co-ordinated global cyber attack, spread through malicious email, could cause economic damages anywhere between $85 billion (₦30,794,650,000,000) and $193 billion (₦69,921,970,000,000), a hypothetical scenario developed as a stress test for risk management showed.

Insurance claims after such an attack would range from business interruption and cyber extortion to incident response costs, the report jointly produced by insurance market Lloyd’s of London and Aon said on Tuesday.

Total claims paid by the insurance sector in this scenario is estimated to be between $10 billion and $27 billion, based on policy limits ranging from $500,000 to $200 million.

The stark difference between insured and economic loss estimates highlights the extent of underinsurance, in case of such an attack, the stress test showed. An attack could affect several sectors globally, with the largest losses in retail, healthcare, manufacturing and banking fields.

Regional economies that are more service dominated, especially the United States and Europe, would suffer more and are vulnerable to higher direct losses, the report said.

Cyber attacks have been in focus after a virus spread from https://www.reuters.com/article/us-cyber-attack/new-computer-virus-spreads-from-ukraine-to-disrupt-world-business-idUSKBN19I1TD Ukraine to wreak havoc around the globe in 2017, crippling thousands of computers, disrupting ports from Mumbai to Los Angeles and even halting production at a chocolate factory in Australia.

Governments are increasingly warning against the risks private businesses face from such attacks, both those carried out by foreign governments and financially motivated criminals.

For example, Britain’s National Cyber Security Centre announced on Friday it was investigating a large-scale Domain Name System (DNS) hijacking campaign that hit governments and commercial organizations across the world.

In another recent incident, French engineering consultancy Altran Technologies was the target of a cyber attack that hit its operations in some European countries.

On a larger scale, personal data and documents from hundreds of German politicians and public figures, including Chancellor Angela Merkel, were published online in what appears to be one of Germany’s most far-reaching data breaches.

The report was also co-produced by MSIG, SCOR TransRe and Cyber Risk Management (CyRiM).

Reuters

WhatsApp Is Merging With Facebook Messenger

WhatsApp and Instagram are to be integrated with Facebook Messenger, it has been revealed. Facebook CEO Mark Zuckerberg apparently wants to combine the services under a single underlying messaging platform or protocol.

The idea is to allow users to communicate across the three services more easily, with the project set to complete by the end of this year or early next, according to The New York Times.

According to reports, the new unified backend will support the end-to-end encryption needed to stop messages being viewed by third parties. In theory, this means all three platforms should be more secure, but in reality, there are doubts.

For this reason, the news has not been well received by many users. People are already leaving Facebook in droves and with good reason: The social networking giant has been hacked and suffered data leaks several times over the last year. As part of this, the messaging app was possibly affected seeing users’ private conversations exposed to hackers.

This, of course, is in addition to the ongoing Cambridge Analytica scandal which saw Facebook abusing its user data with results that could have influenced elections.

The exact logistics of what is going to happen once the three services are combined are not yet clear. But you can bet your life that data will be at the heart of this integration. There are even suggestions that if pressured, Facebook could build a handy back door allowing law enforcement to spy on WhatApp users when needed.

Forbes

China creates app to tell you if you are near someone in debt and encourages you to report them

The Chinese Government has developed a mobile app that tells users if they are near someone who is in debt. The app, called a “map of deadbeat debtors,” flashes when the user is within 500 meters of a debtor and displays that person’s exact location.

News of the app has caused quite a bit of controversy after it was originally reported by the state-run China Daily. It is an extension to China’s existing “social credit” system which scores people based on how they act in public. It’s no secret that China keeps a very close watch on its citizens, but this new public shaming approach takes it one step further.

The app is available through the WeChat platform which has become immensely popular in China. The government stated that “Deadbeat debtors in North China’s Hebei province will find it more difficult to abscond as the Higher People’s Court of Hebei on Monday introduced” the app.

Once a user is alerted that they are close to a debtor, the user can then view their personal information. This will reveal their name, national ID number, and why they were added to the debtor list. The debtor can then be publicly shamed or reported to the authorities if it is deemed that they are capable of repaying their debts.

The full social credit system will be operational in 2020 when plans indicate will be used to bar people with low scores from traveling, getting loans, and getting jobs. A person’s score can be lowered if they do things like playing an excessive amount of video games or posting fake news. On the other hand, a social credit score can be raised by things like volunteering or donating blood.

TechSpot

Google Fined $57 Million for Burying Privacy Terms Where Users Won’t Find Them

Google has been fined $56.8 million (₦20,391,200,000.00) by privacy regulators in France, marking the country’s first use of the tough new privacy rules enacted in Europe last year. Specifically, the company is accused of violating provisions of the General Data Protection Regulation (GDPR) by using, without proper consent, the private data of users to craft personalized ads; and by burying key privacy disclosures pages deep, amid oceans of text.

In a statement Monday, France’s privacy watchdog, CNIL, said that Google had been fined for needlessly obscuring information concerning the processing of its users’ data, which Europe’s privacy rules demand be made more easily accessible. Essential information about how user data is processed, stored, and used, it said, was “excessively disseminated across several documents.” It required, in some cases, up to five or six steps to unearth key disclosures, including details of how Google amasses personal information to help it pinpoint a user’s location.

Some of the information, it said, “is not always clear nor comprehensive.”

While Google says it obtains the consent of consumers prior to using their data to personalize ads, the French commission found Google’s process for informing users about what precisely they’re consenting to to be wholly inadequate. Users are “not sufficiently informed,” it said, finding Google’s language “vague” and its violations to be “continuous.”

In regard to the violations, CNIL wrote:

Users are not able to fully understand the extent of the processing operations carried out by GOOGLE. But the processing operations are particularly massive and intrusive because of the number of services offered (about twenty), the amount and the nature of the data processed and combined. The restricted committee observes in particular that the purposes of processing are described in a too generic and vague manner, and so are the categories of data processed for these various purposes. Similarly, the information communicated is not clear enough so that the user can understand that the legal basis of processing operations for the ads personalization is the consent, and not the legitimate interest of the company. Finally, the restricted committee notices that the information about the retention period is not provided for some data.

Google told reporters in response that it was “studying the decision” to inform its next steps. “People expect high standards of transparency and control from us,” it said, adding that it remained “deeply committed to meeting those expectations and the consent requirements of the GDPR.”

TV station France 24 reported that CNIL’s judgement followed complaints filed by two advocacy groups in May—one by La Quadrature du Net, the French digital rights group, and another by Austrian privacy activist Max Schrems.

“We have found that large corporations such as Google simply ‘interpret the law differently’ and have often only superficially adapted their products,” Schrems reportedly told the station. “It is important that the authorities make it clear that simply claiming to be compliant is not enough.”

gizmodo