The CyberWire Pro Privacy Briefing for 1.2.20

Summary

By the CyberWire staff

The Wall Street Journal has published its investigation into the Cloud Hopper cyberespionage campaign that Reuters reported in December 2018. The US Justice Department at that time indicted two Chinese nationals (both of whom remain at large) and alleged that the duo had been working for the Chinese Ministry of State Security's APT10. It now appears, according to the Journal, that the espionage was far more widespread than originally reported. Cloud Hopper actively pursued managed service and cloud providers, and in addition to the usual culling of trade secrets now familiar in Chinese industrial espionage campaigns, the Ministry also went after personal information on a large scale. The US Government now believes APT10 succeeded in collecting some hundred-thousand Naval personnel records.

ToTok, a messaging app developed in the United Arab Emirates, is now believed to have been a surveillance tool prepared by Breej Holding, which the New York Times characterizes as a front operation for the Emirati cybersecurity firm Dark Matter.

Yahoo News reports that the US Department of Defense has warned service members to avoid using consumer DNA kits on the grounds that the personal information collected by the private companies that offer the kits could amount to a security risk.

vpnMentor has found that Autoclerk, a reservations management system owned by Best Western Hotels and Resorts Group, has been leaking travel information belonging to US Department of Defense personnel.

A privacy fail comes from a surprising source: the UK Cabinet Office. The Guardian reports that the Cabinet Office has apologized for exposing the addresses of a thousand celebrities who were in this year's Honours List.

Selected Reading

Ghosts in the Clouds: Inside China’s Major Corporate Hack (Wall Street Journal) In the breach known as Cloud Hopper, cyberattackers allegedly working for China’s intelligence services broke into cloud companies, including CGI and IBM, to steal volumes of intellectual property and records from scores of companies.

Report: Cloud Hopper Attacks Affected More MSPs (BankInfo Security) A persistent question over the past several years is which managed service providers were affected by APT10, a tenacious Chinese hacking group. But a Wall Street

Chinese 'Cloud Hopper' campaign targeting cloud providers was more extensive than admitted (Computing) Cloud Hopper hack enabled the attackers to steal large volumes of intellectual property and other sensitive data

Major US companies breached, robbed, and spied on by Chinese hackers (Fox Business) In 2016, and U.S. prosecutors charged two Chinese nationals for the global operation last December. The two men remain at large.

It Seemed Like a Popular Chat App. It’s Secretly a Spy Tool. (New York Times) ToTok, an Emirati messaging app that has been downloaded to millions of phones, is the latest escalation of a digital arms race.

India Used Israeli Spyware To Target Top Pakistani Officials, Diplomats (EurAsian Times: Latest Asian, Middle-East, EurAsian, Indian News) According to a report in the British newspaper – The Guardian, mobile phones of at least two dozen Pakistani government officials have been targeted using technology developed by Israeli company NSO. Iran Days Away From Developing Nuclear Weapons – Israeli Intelligence Reports It is unclear who was involved in the attack, but it was feared […]

IoT vendor Wyze confirms server leak (ZDNet) Details for 2.4 million users were exposed online for 22 days.

Wyze camera security breach: personal data from 2.4M users (9to5Mac) A Wyze camera security breach has seen a large amount of personal data leaked for more than 2.4 million users. This includes ...

One Day, Three Credit Card Data Breach Notifications (BleepingComputer) On the same day this week, two restaurants and a convenience store, all with locations across the U.S., disclosed security breach incidents that may have enabled attackers to steal customer payment card data.

Opinion | How Your Phone Betrays Democracy (New York Times) You protest, they watch.

Celebrity addresses posted online in New Year’s Honours List leak (Naked Security) Too much information.

Hackers keep dumping Ring credentials online 'for the giggles' (ZDNet) Three cache of Ring user credentials have surfaced this week.

Report: Travel Reservations Platform Leaks US Government Personnel Data (vpnMentor) Led by Noam Rotem and Ran Locar, vpnMentor’s research team discovered a breach in a database belonging to Autoclerk, a reservations

Exclusive: Pentagon warns military members DNA kits pose ‘personal and operational risks’ (Yahoo News) The Pentagon is advising members of the military not to use consumer DNA kits, saying the information collected by private companies could pose a security risk, according to a memo co-signed by the Defense Department’s top intelligence official.

Celebrity addresses posted online in New Year’s Honours List leak (Naked Security) Too much information.

Hackers keep dumping Ring credentials online 'for the giggles' (ZDNet) Three cache of Ring user credentials have surfaced this week.

Report: Travel Reservations Platform Leaks US Government Personnel Data (vpnMentor) Led by Noam Rotem and Ran Locar, vpnMentor’s research team discovered a breach in a database belonging to Autoclerk, a reservations

Exclusive: Pentagon warns military members DNA kits pose ‘personal and operational risks’ (Yahoo News) The Pentagon is advising members of the military not to use consumer DNA kits, saying the information collected by private companies could pose a security risk, according to a memo co-signed by the Defense Department’s top intelligence official.

US Accounting Firm Moss Adams Discloses Data Breach (Latest Hacking News) US public accounting firm Moss Adams has recently disclosed a data breach that exposed names and Social Security Numbers of the affected individuals.

Wawa establishes ID protection service after breach (The Delaware County Daily Times) Wawa is taking a proactive approach to help customers who may have been affected by a months-long data breach this year that may have compromised credit card information used at

Private and Public CCPA Enforcement Will Launch on January 1, 2020 Despite California AG Delay (Cooley) As we approach the January 1, 2020 effective date of the California Consumer Privacy Act (CCPA), many companies are feeling in the dark about how and when the CCPA will be enforced. Will the Califo…

California is rewriting the rules of the internet. Businesses are scrambling to keep up (Los Angeles Times) A new law that will let you opt out of the online data economy goes into effect on Jan. 1 — assuming businesses can figure out how to make that happen in time.

U.S. Navy bans TikTok from government-issued mobile devices (Reuters) Earlier this week the United States Navy banned the social media app TikTok from...