More Signal. Less Noise.

V2 | Issue 81 | 4.27.20

The CyberWire Pro Privacy Briefing for 4.27.20

Summary

By the CyberWire staff

At a glance.

Hupigon RAT is back.
Contact tracing and its implications for privacy.
National approaches to contact tracing and quarantine enforcement.

Hupigon remote access Trojan is back, again.

Proofpoint reports that the venerable Hupigon remote access Trojan—venerable by Internet standards, since it's been around since 2006—has been repurposed to lure American university students with adult-themed dating phishbait designed to attract the lovelorn and insufficiently skeptical. While Hupigon has been used by state-sponsored organizations, Proofpoint thinks that in this present round it's being distributed by criminal gangs with commonplace criminal goals. But should you receive an offer to get to know Ashley, a student who’s “looking for adventure,” or to make the acquaintance of Lora, an artist who “loves funny men,” please do think twice. You will receive a nice helping of Hupigon, whose features include, Proofpoint says, giving “access [to] the infected machine,” “rootkit functionality, webcam monitoring, and the ability to log keystrokes and steal passwords.”

Contact-tracing app update.

Android Police describes how Apple and Google intend to make their contact-tracing technology more private, and more acceptable. One change is in branding: they now refer to their technology as an "exposure notification apparatus," which the companies believe better captures the tech's purpose, and which in their view sounds less intrusive and not so threatening. A device with the app installed would use Bluetooth Low Energy to ping other Android or iOS devices within, roughly, ten to fifteen feet (about three to four-and-a-half meters). The entire process is voluntary: not only would users have to opt-in, but they'd also have to self-report any positive COVID-19 diagnosis. Bluetooth metadata would be encrypted, and the generation of ID keys will be completely randomized. The apparatus is expected to become available in mid-May.

National approaches to contact tracing.

With Apple refusing to budge on privacy standards, Reuters reports that Germany yesterday abandoned its plans for a centralized approach to contact tracing. Berlin had through Friday at least strongly favored the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) system. The reversal means Germany is likely to adopt the exposure notification apparatus Apple and Google have been working on.

The UK's National Health Service (NHS) is working to build trust in its own version of a Bluetooth Low Energy contact-tracing system, according to ComputerWeekly. NHSX, the Service's "digital innovation unit" hopes to field its app, which is based on work done by Oxford University’s Nuffield Departments of Medicine and Population Health, soon. It's being tested at a Royal Air Force facility in Yorkshire.

Indonesia has also deployed its own version of a Bluetooth Low Energy based proximity tracer, PeduliLindungi, the Jakarta Post writes. Concerns being expressed locally, at least according to the Post, are more about security than privacy: people are being warned to keep their Bluetooth devices up-to-date.

Given that most of the decentralized systems are opt-in, how many people are actually opting in? About 1.9 million in Indonesia (a country of 268 million) according to the Jakarta Post. Norway's Smittestop system has done better: Forbes says more than 1.4 million Norwegians have downloaded the app, which for a country of less than 5.4 million isn't that bad.

For an account of some recent work on contact tracing, see the CyberWire's Research Saturday for 4.25.20.

Selected Reading

Pakistan Using Spy Agency – ISI To Trace Covid-19 Infected Patients: Imran Khan (EurAsian Times) Inter-Services Intelligence (ISI) is Pakistan’s infamous and notorious spy agency responsible for detecting, analyzing and warding-off national security threats. In a sudden turn of events due to the COVID-19 pandemic, Islamabad has put the ISI in charge of tracing coronavirus infected patients.

How Virus Surveillance And Civil Liberties Could Collide (Law360) After weeks of social distancing in isolation, public health experts say widespread public health surveillance is the next stage of America’s COVID-19 pandemic response. Court battles are likely to follow over the balance between preventing new outbreaks and protecting privacy rights, especially for phone-generated data.

Spy agencies and human rights in the era of coronavirus (The Jerusalem Post) Can the public’s right to privacy coexist with the government’s fight to curb the pandemic?

SBA Spoofed in COVID-19 Spam to Deliver Remcos RAT (Security Intelligence) As the ongoing COVID-19 pandemic impacts small businesses in the U.S., cybercriminals are trusting that people will be more likely to open unsolicited emails purporting to come from relevant entities.

Hackers set up fake NHS website to spread malware (HackRead) Over the past few months, we’ve seen the rise of crooks using the COVID-19 crisis to their advantage. Some have been doing so through selling fake goods such as fake vaccines on the dark web whereas some have been using dedicated phishing and typosquatting campaigns in conjunction with trojans to lure innocent users.

Routers Pose Remote Working Risk (Infosecurity Magazine) VPNs are a great security asset, but don't forget to check your employees' router security too

Zoom announces 90-day security plan to earn back user trust (Phone Arena) Zoom has announced a 90-day security plan to earn back user trust, alongside the release of Zoom 5.0.

Phishing uses lay-off Zoom meeting alerts to steal credentials (BleepingComputer) Zoom users are targeted by a new phishing campaign that threatens those who work in corporate environments that they're contracts will either be suspended or terminated during a Zoom meeting.

Zoom’s Biggest Rivals Are Coming for It (New York Times) Facebook, Google and other behemoths are training their sights on Silicon Valley’s company of the moment.

Hackers deface church service on Zoom with child abuse content (HackRead) Just yesterday it was reported that a critical Zoom vulnerability lets hackers record meetings anonymously even if the host has disabled the recording feature.

Google Releases Security Measures To Help Users Fight COVID-19 Scams (Digital Information World) Going into further depth, the company also shared details regarding one notable campaign which was targeted at phishing the personal accounts of US government employees by impersonating the names of American fast-food franchises and COVID-19 messages as well.

Google takes on stronger measures to tackle covid related phishing emails (Livemint) In G Suite, advanced phishing and malware controls are turned on by default, ensuring that all G Suite users automatically have these proactive protections in place

Messenger Rooms are Facebook’s answer to Zoom and Houseparty for the pandemic (The Verge) Facebook is introducing new products to fend off competition

Netskope's security controls and protection now available for Microsoft Teams (Help Net Security) Netskope, a leading security cloud, announced the availability of its security controls and protection for Microsoft Teams.

BazarBackdoor: TrickBot gang’s new stealthy network-hacking malware (BleepingComputer) A new phishing campaign is delivering a new stealthy backdoor from the developers of TrickBot that is used to compromise and gain full access to corporate networks.

Cyber Criminals Are Hacking Ad Servers, Luring Victims to Malware-Infected Sites (BeInCrypto) Cybersecurity firm Confiant has exposed the operation of a hacker group that breaks into ad servers with the intent of running malicious ads straight from the networks.

South Korean and US payment card details worth nearly $2M up for sale in the underground (Group-Ib) Group-IB, a Singapore-based cybersecurity company, has detected a dump containing details for nearly 400,000 payment card records uploaded to a popular darknet cardshop on April 9.

Hackers are exploiting a Sophos firewall zero-day (ZDNet) Sophos releases emergency patch to fix SQL injection bug exploited in the wild, impacting its XG Firewall product.

Emotet banking trojan possibly being prepped for a new attack (SC Media) Security researchers are seeing signs that the Emotet banking trojan is about to awaken from its latest hiatus by deploying newly improved credential and email stealing modules.

SeaChange video platform allegedly hit by Sodinokibi ransomware (BleepingComputer) A video delivery platform company is the latest victim of the Sodinokibi Ransomware, who has posted images of data they claim to have stolen from the company during a cyberattack.

SafeBreach Hacker’s Playbook Updated for Maze Ransomware (SafeBreach) The SafeBreach Labs is a dedicated offensive team that ensures the SafeBreach platform has all the latest attacks to test your defenses aagainst Maze Ransomware.

Three firmware blind spots impacting security (Help Net Security) Many organizations are still suffering from firmware blind spots that prevent them from adequately protecting systems and data.

We could have pwned Microsoft Teams with a GIF, claims Israeli infosec outfit (Register) Proof-of-concept vuln patched a week ago

CERT warns of a phishing scam through Google Docs (Sri Lanka News - Newsfirst) Sri Lanka's cybersecurity institute has warned the public against entering details in a google document circulating under the name - Get the latest breaking news and top stories from Sri Lanka, the latest political news, sports news, weather updates, exam results, business news, entertainment news, world news and much more from News 1st, Sri Lanka's leading news network.

Simple loopholes in Facebook and PayPal helping victims to lose millions in scam (CyberNews) A big scam involving security loopholes in Facebook and PayPal is making its rounds, causing victims to lose millions every month in the UK.

Parkview Medical Center confirms cyber attack (KOAA) News 5 has learned on Friday night that Parkview Medical Center in Pueblo was the target of a cyber attack.

Norway: 1.4 Million People Download Coronavirus Tracking App Despite Security Concerns (Forbes) 1.4 million people have downloaded Norway's new coronavirus tracker app, but controversy on the security, privacy and procurement process for the app dominates Norwegian media.

NHSX reveals full details of UK Covid-19 contact-tracing strategy (ComputerWeekly.com) National Health Service’s digital innovation unit aims to allay fears over privacy and confidentiality in forthcoming contract-tracing app.

What to know before using PeduliLindungi surveillance app, according to cybersecurity expert (The Jakarta Post) Following the launch of the government’s PeduliLindungi surveillance app, which aims to trace and track suspected patients as well as confirmed cases of COVID-19, questions arose over the safety of the users’ personal data stored in the app.

Coronavirus app: will Australians trust a government with a history of tech fails and data breaches? (the Guardian) The contact tracing app could work well to slow the spread of Covid-19, but will need to be accepted by a sceptical public

People-tracking wristbands put to the test (BBC News) Several nations are testing people-tracking wristbands to make sure citizens stay at home.

Germany flips to Apple-Google approach on smartphone contact tracing (Reuters) Germany changed course on Sunday over which type of smartphone technology it wanted to use to trace coronavirus infections, backing an approach supported by Apple and Google along with a growing number of other European countries.

Apple and Google add new tech specs for coronavirus tracking tool to boost user privacy (Android Police) Getting over the novel coronavirus outbreak, health experts and officials say, will take an extensive contact tracing regime in order to determine who