Public health versus personal privacy: chose only one?

As the world turns to technology to track and contain the COVID-19 pandemic, could this spell the end of digital privacy rights?

Health organizations and governments all over the world are using technology to communicate, track, monitor and predict the spread of COVID-19. In recent years, data has proven to be a valuable resource – more valuable than oil in some instances – and the use of data to understand the movement of people and their interactions to help control the spread of infection during a global pandemic seems like an excellent use of technology. There are likely to be very few people who would object to the use of technology to track an infected person to ensure they maintain quarantine; I may even advocate such use.

However, unprecedented times should not result in any long-term removal of our privacy rights, especially in cases where legislation has been rushed through to allow the fulfillment of medically urgent needs for data collection or use. In some instances, data is being extracted from smartphones on an individual basis or en masse. In the current age of COVID-19 concern, data potentially relevant to tracking the disease is being gathered, or there are proposals to gather it, via several mechanisms:

·       Custom apps developed to enable communication between health care professionals and patients, to keep people informed with official communications and to provide a warning if an individual has been in close proximity to someone testing positive. There are other use cases mentioned below.

·       Mobile phone companies are being asked, or already have, subscribers’ geotracking data, or already have, allowing the modeling of infection predictions based on actual phone subscribers’ movements.

·       Popular social media apps also track location, unless the member has elected not to share location data. There are stories circulating in the media that some governments have approached the leaders of social media companies to explore the opportunity of using their data to see if social distancing is effective.

Coping with COVID-19

At the time of writing, there are infections in 172 countries and regions around the world, some with devastating numbers of both infections and deaths. Each country is developing its own strategy to limit the outbreak and included in this is the differing use of technology and tracking data.

At the start of the outbreak in China, the authorities there required citizens in Wuhan to provide personal information so that device tracking could be linked to individuals. The Guardian then reported that Taiwan used phone tracking to enforce self-quarantine, citing an example of automated text messages being sent when a quarantine-mandated individual left a  geo-fenced perimeter.

Singapore’s ministry of health made victims’ personal information publicly available, which allowed developers to create maps and show locations, raising security fears for those concerned. In the last few days the authorities there have also released an app called TraceTogether that identifies, using Bluetooth, if you have been in close proximity to a coronavirus patient.

In Germany, UK, Austria, Belgium, Italy and South Korea, mobile operators have been reported to be sharing aggregated or anonymized location data with health authorities. In South Korea, data was also shared by credit-card companies. The European countries where personal data is protected by the General Data Protection Regulation are using an option to suspend the regulation in face of a civil crisis. Article 9 of the GDPR allows for processing of health and other usually sacrosanct data when necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.

Despite the exceptions in regulations being used to share data with health and government authorities, the regulations that cover the protection of data should be adhered to. For example, the GDPR states that data must be encrypted when at rest and in transit, and these requirements are still mandatory.

In Israel, authorities approved new surveillance measures allowing citizens to be tracked by monitoring mobile phones. In contrast, Hong Kong tagged new arrivals to the region using wrist bands that log and transmit location data to authorities, maintaining the privacy of the individual’s phone.

An intriguing use of an app has been by the Polish authorities, requiring a quarantined individual to have an app released by the Ministry of Digital Affairs and for them to send a selfie with geo-metadata on a regular basis to prove compliance.

Several countries have passed emergency legislation to permit the use of personal data to combat the spread of the virus. For example, Italy lifted a restriction on the sharing of personal data when doing so was necessary for the performance of civil protection functions.

A few countries, including Russia and China, are using facial recognition technology to ensure that those identified as infected observe quarantine rules. The systems are collecting video through CCTV, drones and other camera-based systems.

Many of these initiatives demonstrate that innovative methods are being explored, and are in use, with governments, health professionals, technology and phone companies working together to combat the medical emergency facing the world. At the same time, privacy advocates are also being vocal about these issues. The BBC reports that in the UK a group identified as “responsible technologists” has urged for open disclosure of the UK government’s plans to collect personal data through an app being created to tackle COVID-19.

Exceptional circumstances call for exceptional actions; the issue, though, is what happens when these circumstances have passed. Will governments return to the emergency legislation and revoke the additional rights to use personal data? Will organizations that received the data be required to delete it? Will individuals whose data was affected be notified that it was shared?

It’s our responsibility as technologists and privacy advocates to ensure that normality is restored and that we return to a where privacy rights are respected and enforced once the current emergency world is resolved.

ESET Top Player in Radicati’s Market Quadrant voor APT- bescherming

ESET, een wereldleider in cybersecurity, werd erkend als Top Player’ in Radicati’s 2020 Market Quadrant APT Protection Rapport, met betrekking tot het Advanced Persistent Threat (APT) Protection segment van de beveiligingsmarkt. Het is de eerste keer dat ESET werd erkend in deze specifieke Radicati-rapport. Voorheen werd het bedrijf als een ‘Top Player’ in een rapport van Radicati over Endpoint Security. Dat ESET opgenomen werd in het Market Quadrant rapport verstevigt nog zijn plaats als een vooraanstaande speler op het vlak van cybersecurity. In deze uitdagende tijden zijn detectie- & responscapaciteiten hoognodig om bedrijfscontinuÏteit te verzekeren.

Het ‘Radicati Market Quadrant’ is een meetinstrument dat gebruikt wordt om een beeld te krijgen van een specifieke technologiemarkt. Deze editie bestudeerde Advanced Persistent Threat Protection, een reeks ingebouwde oplossingen voor detectie, preventie en mogelijk herstel van zero-day bedreigingen en persistente kwaadaardige aanvallen. ESET Enterprise Inspector, de in-huis ontwikkelde EDR tool, samen met ESET Dynamic Threat Defense, de cloudbeheerde  sandboxing oplossing voor zero-day bedreigingen werden voor dit onderzoek geëvalueerd.

Het rapport onderzocht 12 vooraanstaande security vendors. ESET was een van de vier vendors die de status van ‘Top Player’ behaalde. Radicati positioneert de vendors volgens twee criteria in een kwadrant: functionaliteit et strategische visie. Functionaliteit heeft betrekking tot de ruimte en de diepgang van de oplossing van een vendor terwijl strategische visie de manier evalueert waarop elke vendor de noden van de klant alsook zijn capaciteit om met betaalbare prijzen en verkoopkanalen klantondersteuning en vernieuwing te bieden. Bij de belangrijkste eigenschappen en capaciteiten die in het rapport worden onderzocht zijn implementatie-opties, platformondersteuning, malware detectie, sandboxing en in quarantaine plaatsen, legaal onderzoek en analyse van zero-day en nieuwe bedreigingen, herstelmogelijkheden en Endpoint Detection & Response (EDR).

Na het onderzoeken van ESET’s complete aanbod, prees het rapport de oplossingen om hun sterke EDR-capaciteiten en data reporting in real time, management console en on-premise oplossingen, alsook meertalige ondersteuningssystemen. Het rapport benadrukt eveneens dat ESET wel bekend is om zijn gemakkelijke implementatie en probleemloze gebruikservaring. Dit is het resultaat van ESET’s prioriteit om steeds een kleinere voetafdruk te hebben en weinig systeemmiddelen te gebruiken.

Juraj Malcho, Chief Technology Officer bij ESET, legt uit: ” Het verheugt ons als ‘Top Player’ geklasseerd te worden in het nieuwste rapport van Radicati dat gericht is op Endpoint Detection & Response. Dit is een weerspiegeling van ESET’s  inzet om cutting-edge beveiligingssoftware te ontwikkelen en van onze verbintenis om innoverend te zijn. Terwijl de cyberbeveiliging steeds meer getroffen wordt door persistente en zero-day bedreigingen zullen talloze kleine en grote bedrijven zich moeten aanpassen aan deze nieuwe realiteit. We zijn fier om voor de eerste keer in dit rapport opgenomen te zijn en erkend te worden.”

Lees het volledige rapport op https://www.eset.com/fileadmin/ESET/INT/Landing/2020/Radicati_2020/Licensed_APT_Protection_-_Market_Quadrant_2020.pdf

Microsoft warns of two Windows zero‑day flaws

Updates for the critical-rated vulnerabilities, which are being actively exploited in the wild, are still weeks away

Tomáš Foltýn 

Attackers are actively exploiting two previously undisclosed security vulnerabilities that affect all supported as well as some of the no-longer-supported versions of the Windows operating system, Microsoft announced in an out‑of‑band advisory on Monday.

The security flaws, rated as critical, are being abused for limited targeted attacks. This would imply campaigns by advanced threat actors compromising carefully chosen targets. That said, citing the need to “help reduce customer risk until the security update is released”, the tech giant disclosed the flaws publicly.

“Two remote code execution vulnerabilities exist in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font – Adobe Type 1 PostScript format,” said the tech giant. Adobe Type Manager is a font management tool that helps Windows handle and render fonts.

There are several ways how bad actors can leverage the flaws, including by tricking their targets into opening a booby-trapped file or into viewing it in the Windows Preview pane, said Microsoft.

Security Response

✔@msftsecresponse

Microsoft is aware of limited targeted attacks that could leverage unpatched vulnerabilities in the Adobe Type Manager Library, and is providing guidance to help reduce customer risk until the security update is released. See the link for more details. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200006 …

Patch?

The flaws affect all supported versions of Windows, including Windows 10, as well as systems that are past end‑of‑life, notably Windows 7. Importantly, no patch is available for any of them, and Microsoft hinted that the fix wouldn’t arrive until the forthcoming Patch Tuesday rollout of security updates on April 14^th. Even so, machines running the retired operating systems won’t receive the update even after it’s shipped – unless their owners are enrolled in Microsoft’s Extended Security Updates (ESU) program.

While the flaws are rated as critical for all affected systems, the company noted that on Windows 10 the potential for exploitation is limited. “For systems running supported versions of Windows 10 a successful attack could only result in code execution within an AppContainer sandbox context with limited privileges and capabilities,” said the tech giant. As of the time of writing, the vulnerabilities have yet to be assigned CVE identifiers.

Microsoft suggested a slew of temporary mitigations and workarounds to counter the risk while the patch is in the works. These include disabling the Preview Pane and Details Pane in Windows Explorer and renaming the library (atmfd.dll). Step-by-step guidance is available in the company’s advisory.

Weeks ago, Microsoft released patches for a critical cryptographic flaw in Windows and a zero-day in Internet Explorer. ESET researchers uncovered an exploit in 2018 that leveraged a pair of two zero-days in Adobe Reader and Windows, while last year they found an exploit that abused another Windows zero-day vulnerability (CVE‑2019‑1132).

The good, the bad and the plain ugly

A prolific ransomware gang vows to dial back its campaigns and spare healthcare organizations altogether during the COVID-19 crisi. It’s no cause for celebration

by Tony Ascombe

 When ransomware attacks a healthcare establishment, it can have a devastating effect. This was witnessed in 2017, when WannaCryptor.D (aka WannaCry) hit multiple sites across the United Kingdom’s National Health Service, limiting their ability to provide services and causing nearly 20,000 appointments to be cancelled.

The COVID-19 pandemic is stretching the resources of health services to their maximum, across the globe. This includes not only the courageous frontline healthcare professionals but all the support teams that create the environment for them to work in, such as IT security teams. Those teams may be pleased, and amazed, to hear that one of their adversaries – the team behind Maze ransomware – has decided to stop activities that target medical organizations, at least until the current situation is stabilized.

A “press release” dated March 18 states that the Maze team is also willing to offer exclusive discounts to their partners due to economic conditions. I think their use of the word “partner” actually refers to victims, which is like arsonists calling the owners of the building they torched their “partners”.

The group has been responsible for a number of recent attacks including against both the City of Pensacola and manufacturing company Southwire. In both instances the victims refused to pay and the Maze operators released data that had been stolen.

Maze Team is also attributed with publishing medical data from a number of healthcare organizations that refused to pay, the largest organization being New Jersey’s Medical Diagnostics Laboratories (MD Lab). About 9.5 GB of MD Lab’s data was published by the Maze operators in an attempt to force negotiations for payment.

According to an article on CyberScoop, the FBI issued a flash alert in December 2019 about the dangers of Maze ransomware. The alert details how the threat actors behind Maze use several different methods to breach a network, including fake cryptocurrency sites and malspam campaigns to impersonate government agencies and security vendors.

These are cybercriminals with a history of disruption and destruction; isn’t it thoughtful of them, though, in this time of crisis to stop attacking medical organizations? I must invite them over for tea to say thank you.

Apologies; that is my British sarcasm getting the better of me!

Any attack on a healthcare institution at any time has the potential to be responsible for a degradation in patient care, the consequences of which could be fatal. Offering discounts and the willingness to stop attacks in the current situation should not distract from the fact these are cybercriminals who have a reputation and history of attacking healthcare systems with complete disregard for patient care.

And they need to be caught and brought to justice!

Security flaws found in popular password managers

Not all they’re cracked up to be? Several password vaults contain vulnerabilities, both new and previously disclosed but never patched, a study says

 by  Amer Owaida 

Several popular password managers contain security vulnerabilities that could be exploited to breach the walls that are supposed to keep your passwords safe, according to researchers from the University of York.

After considering a pool of 19 password managers, the academics chose to test LastPass, Dashlane, Keeper, 1Password, and RoboForm based on their popularity and features. They uncovered a total of four new vulnerabilities, including a flaw both in the 1Password and LastPass Android applications that made them susceptible to phishing attacks. The vulnerability is caused by their use of weak matching criteria for identifying which of the stored credentials should be suggested for autofill.

“Our study shows that a phishing attack from a malicious app is highly feasible – if a victim is tricked into installing a malicious app it will be able to present itself as a legitimate option on the autofill prompt and have a high chance of success,” said Dr. Siamak Shahandashti from the Department of Computer Science at the University of York. He went on to add that, in order to remedy the situation, the password vaults should add stricter matching criteria that aren’t based just on “an app’s purported package name”.

The researchers also discovered that the Android applications of both RoboForm and Dashlane are susceptible to PIN brute force attacks. This flaw allows endless attempts at entering the master PIN that may ultimately unlock the password vaults.

“Through extrapolation of manual testing, it is estimated that even a manual random guessing attack is on average expected to find a randomly selected PIN in 2.5 hours,” the researchers explained, adding that factoring in additional variables can significantly reduce the time it takes to break the PIN.

The tools’ respective vendors were duly notified about the newly discovered vulnerabilities. “Some were fixed immediately while others were deemed low priority,” said Michael Carr, the lead author of the study.

In addition, the password managers also underwent rigorous testing against six previously disclosed vulnerabilities to see if the security holes had been plugged. The test showed that all except one of the password managers were susceptible to URL mismatch, and all of them were vulnerable to Ignoring Subdomains and HTTP(S) Autofill exploits. Dashlane fared the worst, as it was vulnerable to five out of the six vulnerabilities disclosed earlier.

Although the team admitted that “rigorous security models and canonical security tests for password managers” are needed, they still recommend their use to businesses and individuals alike, as they continue to be a more secure and useable option than resorting to password recycling or trying to memorize them all.

Food for thought, since people continue to make questionable choices when choosing passwords to protect their data, as can be evidenced by the fact that “12345” and similarly easy-to-hack passwords remain popular choices for many netizens.