The CyberWire Pro Privacy Briefing for 4.6.20

Summary

By the CyberWire staff

At a glance.

COVID-19 epidemiological data collection prompts privacy concerns.
Potential exposure of PII at US Small Business Administration.
Thousands of Android apps collect device information without permission.
Privacy in Zoom.

Epidemiological data and the individual's permanent record.

The Intercept collects opinion from privacy advocates concerning the effects of COVID-19 tracking on individual privacy. Their consensus is that the key to limiting damage to privacy lies in restricting the collection, structure, and use of such data to public health organizations only.

Some emergency loan applicants' personal data may have been exposed by the US Small Business Administration.

CyberScoop reports that the US Small Business Administration warned Saturday that "Personal identifiable information of a limited number of Economic Injury Disaster Loan applicants was potentially exposed to other applicants on the loan application site.” The Small Business Administration says the unspecified problem has been contained and fixed, and its COVID-19 information and assistance site is back up and functioning. The agency says it's notifying the individuals affected and offering them free credit monitoring.

Android apps found unpleasantly intrusive.

Researchers at the University of L’Aquila in Italy, Vrije University in Amsterdam, and ETH in Zurich have published research into apps on Google Play, where more than four-thousand apps collect information about other installed applications, and do so without user permission. A follow-on study by the same team showed that such information can be reliably used to develop profiles of the affected users: gender, for example, seems relatively easy to infer. The motivation appear to be monetization through marketing utility as opposed, say, to identify theft. Intelligence services call this sort of profile a "target package." Marketeers think of it as the kind of dossier that can address users' wants, needs, interests, and commitments with rifleshot accuracy. WIRED has a useful summary of the research.

Zoom routed calls through China (by mistake).

The teleconferencing service, which has had some hard good fortune as demand surged during a general period of remote work, acknowledged at the end of last week that messages from users outside of China were mistakenly “allowed to connect to systems in China, where they should not have been able to connect.” The company's statements, reported by Yahoo News, came in response to a critical report by the University of Toronto's Citizen Lab. Zoom's CEO explained, “In February, Zoom rapidly added capacity to our Chinese region to handle a massive increase in demand, In our haste, we mistakenly added our two Chinese datacenters to a lengthy whitelist of backup bridges, potentially enabling non-Chinese clients to connect to them.”

Zoom's privacy practices are beginning to draw some unfriendly scrutiny from the US Congress. Nineteen members of the House of Representatives sent the company a letter Friday in which they requested answers to nineteen specific questions.

Selected Reading

Privacy Experts Say Responsible Coronavirus Surveillance Is Possible (The Intercept) Data collected to fight the pandemic should not be used for other purposes and should only be requested by health officials.

Rights groups appeal to governments over COVID-19 surveillance (Naked Security) Digital and human rights groups have joined in a rare worldwide appeal to governments to respect privacy when handling the COVID-19 crisis.

How Taiwan is tracking 55,000 people under home quarantine in real time (Quartz) The country, which acted early and has kept Covid-19 cases low, set up an electronic fence system that uses cellular signals on mobile phones to keep people inside.

In coronavirus fight, oft-criticized Facebook data aids U.S. cities, states (Reuters) Infectious disease researchers are using Facebook Inc mobile location data to provide daily updates to U.S. cities and states evaluating the effectiveness of social distancing orders aimed at slowing the novel coronavirus.

Russian telco hijacks internet traffic for Google, AWS, Cloudflare, and others (ZDNet) Rostelecom involved in BGP hijacking incident this week impacting more than 200 CDNs and cloud providers.

Zoom Admits Some Calls Were ‘Mistakenly’ Routed Through China (Yahoo) Popular video-conferencing company Zoom Video Communications (ZM) admitted that it had “mistakenly” allowed calls to flow through China, adding to a number of mis-steps raising doubt on the security of the platform.Zoom said in a statement on Friday that certain meetings held by its non-Chinese users

School districts, including New York City’s, start banning Zoom because of online security issues (Washington Post) Online security issues are growing with the mass rush to virtual education during the coronavirus crisis.

Zoom will enable waiting rooms by default to stop Zoombombing (TechCrunch) Zoom is making some drastic changes to prevent rampant abuse as trolls attack publicly shared video calls. Starting April 5th, it will require passwords to enter calls via Meeting ID, as these may be guessed or reused. Meanwhile, it will change virtual waiting rooms to be on by default so hosts hav…

Zoom vows to spend next 90 days thinking hard about its security and privacy after rough week, meeting ID war-dialing tool emerges (Register) Passwords-by-default feature may be faulty. But hey, who else just went from 10 to 200 million daily users?

Coronavirus Pandemic Reminds Us That Security Is Important During the Zoom Boom (Cointelegraph) Under the guise of the COVID-19 pandemic, governments may target our civil liberties, and cryptography could become the technological protector of our rights.

5 things you can do today to make Zooming safer (Naked Security) 5 things you can do to make your Zooming safer, more private and more secure…

Spies are already in your phone. A highly controversial private firm may be next (Times of Israel) Fighting the coronavirus contagion, the government has introduced extremely intrusive tracking. Now it wants to bring in the NSO Group, a company accused of human rights violations

We Saw NSO's Covid-19 Software in Action, and Privacy Experts Are Worried (Vice) We got a demo of the infamous Israeli spyware company's Coronavirus surveillance software.

Zoom Admits Some Calls Were ‘Mistakenly’ Routed Through China (Yahoo) Popular video-conferencing company Zoom Video Communications (ZM) admitted that it had “mistakenly” allowed calls to flow through China, adding to a number of mis-steps raising doubt on the security of the platform.Zoom said in a statement on Friday that certain meetings held by its non-Chinese users

Rep. McNerney and Colleagues Push Zoom for Answers About the Company’s Privacy Practices (Congressman Jerry McNerney) Today, Rep. Jerry McNerney sent a letter to Zoom’s CEO, Eric Yuan, raising concerns and questions regarding the company’s privacy practices. He was joined by 18 of his Democratic colleagues from the House Committee on Energy and Commerce. Zoom has experienced a surge in users during COVID-19, and in March of this year, hit a record 200 million daily users.

NHS-Big Tech axis a sign of what's to come (The Telegraph) The NHS has turned to technology companies for support in the fight on coronavirus amid concerns around patient privacy

Inside Palantir's work with the CDC, HHS to synthesize COVID-19 data (FedScoop) Palantir is working with the CDC and HHS, according to the company. It's work centers on synthesizing the disparate data sources that report COVID-19 cases.

SBA: Small business owners applying for COVID-19 relief may have had PII exposed (CyberScoop) Some of the Small Business Administration's loan applicants may have had their personally identifiable information exposed, a spokeswoman tells CyberScoop.

Russian telco hijacks internet traffic for Google, AWS, Cloudflare, and others (ZDNet) Rostelecom involved in BGP hijacking incident this week impacting more than 200 CDNs and cloud providers.

Cyber security agency cautions against fake PM-CARES UPI IDs (The Pioneer) The national cyber security agency has alerted donors against fake ‘UPI IDs’ for a special fund launched by Prime Minister Narendra Modi to combat the COVID-19 pandemic. In an advisory issued on Saturday, the Indian Computer Emergency Response Team (CERT-In) said it has “tracked several fake

()

We uncovered a secret network of 27 app developers in the Google Play store (CyberNews) Our new research discovered that there’s a secret group of at least 27 app developers, with 101 apps in total for a combined 69 million installs, that seem to be connected, copying each others’ apps, stealing apps from popular developers, and committing other fraud.

"Zoombombing" is a federal offense that could result in imprisonment, prosecutors warn (The Verge) You could get arrested for "Zoombombing."

Russia postpones smartphone software law until January 2021:TASS (Reuters) Russia on Tuesday pushed back legislation that would require all smartphones, computers and smart TV sets sold in Russia to come pre-installed with Russian software, by six months until January 1, 2021, the TASS news agency reported.