The CyberWire Pro Privacy Briefing for 2.18.20

Summary

By the CyberWire staff

At a glance.

Google expels ToTok from the Play store, again.
13 million Britons lost data in the Equifax hack.
Canadian Federal agencies responsible for compromising personal data.
California's Attorney General offers clarification of key points in the California Consumer Privacy Act (CCPA).
Improperly configured AWS S3 bucket exposes PhotoSquared user data.

Google gives ToTok a second strike.

ToTok, the messaging app alleged to be laced with spyware installed on behalf of the Emirati government, was quietly removed from Google Play Friday. 9to5Google noticed the disappearance and reached out to Mountain View for clarification. Google did confirm, to TechCrunch, that the company had removed the app, but little additional information was provided, beyond a statement that the removal wasn't an action taken to comply with any external direction or request. This means, TechCrunch observes, that this wasn't a US Government enforcement action, but rather a decision taken by Google itself, probably because of policy violations.

This is the second time ToTok has been kicked out of Google Play. The messaging app was first ejected in December, quietly restored on January 4th, and now it's out again. Android Central has an account of ToTok's history. They note that Apple also removed ToTok from the App Store in December, and that, unlike Google, Apple has never let it back in. ToTok's statement at the time of the December removals put the actions down to a campaign of defamation, and denied that the app behaved improperly.

An appreciation of the Equifax data breach's effect on the UK: 13 million Britons' data lost.

The effects of US credit bureau Equifax's data breach weren't confined to the US. The Times observes that some 13 million people in the UK also had their data stolen. The British concern is the same as that of their US counterparts: the information could be used in the traditional way of intelligence services, to compromise people working in sensitive positions. On February 10th the US Department of Justice announced the indictment of four People's Liberation Army officers on charges of committing the breach, which the US asserts was a cyberattack carefully planned and executed by Chinese intelligence services.

Canadian Federal agencies compromised thousands of individuals' data over the past two years.

The CBC reports that Canada's Office of the Privacy Commissioner responded to an order paper question filed by Conservative MP Dean Allison with an acknowledgement that the Federal government had "mishandled" the personal information of 144 thousand individuals over the last two years. The response also said that the Office of the Privacy Commissioner had found "strong indications of systemic under-reporting" on the part of the agencies. The victims have little recourse beyond filing a complaint with the Privacy Commissioner; the law as it stands doesn't provide for compensation.

A bit more clarity on the California Consumer Privacy Act.

Cooley has a rundown of clarifications California's Attorney General has offered concerning the CCPA. The clarifications cover:

Unsecured AWS S3 bucket exposes photo app users.

Researchers at vpnMentor found an improperly configured AWS S3 bucket belonging to PhotoSquared, an app available to both Android and iOS users that allows them to upload photos that PhotoSquared converts to lightweight photoboards. The exposed data, which has now been secured, included:

Users' full name.
Home or delivery addresses.
Photos uploaded for editing.
USPS shipping labels for delivery of photo tiles.
Order records and order values.

Selected Reading

There's finally a way to remove xHelper, the unremovable Android malware (ZDNet) Malwarebytes researchers find a way to remove the malware, but they still don't know how it really operates.

Strike Two: Google Eliminates ToTok From Google Play Again For Mass Spying People (Tech Times) The app was reinstated in Play Store last January but has been pulled out again.

Google removes ToTok app from Play Store again (Outlook India) Google has removed the popular messaging app ToTok amid claims that it is being used for spying by the United Arab Emirates (UAE) government for mass surveillance for a second time.

It is with a heavy heart we must inform you, once again, folks are accidentally spilling thousands of sensitive pics, records onto the internet (Register) Plus: Iranians accused of hacking IT service providers to get at their customers

Chinese army’s elite hackers steal Equifax data on 13m Britons (Times) The personal information of more than 13 million Britons was stolen by a team of Chinese military hackers in an elaborate “criminal heist” spanning the globe.Four members of the People’s Liberation

PhotoSquared app leaks photos & home addresses of 100,000s of users (HackRead) Another day, another data breach putting user data at risk – This time, PhotoSquared, a popular photo app for Android and iOS has suffered a massive leak after exposing highly personal data of hundreds and thousands of users.

Personal information belonging to 144,000 Canadians breached by federal departments and agencies (CBC) Federal departments or agencies have mishandled personal information belonging to 144,000 Canadians over the past two years, according to new figures tabled in the House of Commons — and not everyone who was swept up in a privacy breach was told about it.

Many municipalities hit by cyber stick-ups (CommonWealth Magazine) DOZENS OF MASSACHUSETTS MUNICIPALITIES have been targeted by ransomware attacks — cyberattacks on computer systems that are designed to extort money. A shocking investigation from NBC 10 Boston found that many municipalities have been attacked and at least 10 municipalities have ponied up the cash, all of it taxpayer money. Many of the payments have(...)

Hackers are selling card details of EE customers on the dark web (The Sun) HACKERS are selling card details of EE customers on the dark web. Our investigator was offered data — including name and address, card number, expiry and security digits — for just £29. The seller …

Port Lavaca City Hall suffers cyber attack (The Victoria Advocate) Port Lavaca City Hall’s server fell at the hands of the Russian ryuk virus last week.

Incident Of The Week: Quaker Steak & Lube Alerts Customers To Payment Card Incident (Cyber Security Hub) Several independently owned restaurants in the Quaker Steak & Lube chain announced their retail point-of-sale terminals were remotely accessed and infected with malware that captured customer payment card data. Cyber Security Hub explains the scope and cause of this data breach.

New report finds internet users overwhelmed by identity theft worries (F-Secure) A new report from cyber security provider F-Secure finds a steady barrage of major data breaches have left a vast majority of consumers worried about the online crimes that lead to identity theft and account takeovers.

Treat us like something between a telco and a newspaper, says Facebook's Zuckerberg (Reuters) Online content should be regulated with a system somewhere between the existing ...

Round 2: California AG Revises Proposed CCPA Regulations (Cooley) On February 7 and 10, 2020, the California Attorney General released modifications to the proposed regulations implementing the California Consumer Privacy Act. The modifications substantially revi…

DfE in 'serious data breach' after naming whistleblowers (Schools Week) The disclosure casts doubt on the government's commitment to protecting teachers who raise concerns in the public interest

Mark Zuckerberg: Israeli NSO can try to defend legality of actions (Jerusalem Post) Facebook CEO Mark Zuckerberg released comments Saturday afternoon on the current lawsuit launched that accuses Israeli spyware vendor NSO itself of exploiting a flaw in WhatsApp messaging service.

Google forced to reveal anonymous reviewer’s details (Naked Security) A court has forced Google to reveal the details of an anonymous poster who published an unpalatable review of a dentist.