Tag Archives: WhatsApp

VIF Cyber Review: July 2022

Government of India issued a consultation paper on the “Need for a new legal framework governing Telecommunication in India”.

On 28 July 2022, the Ministry of Communications, Department of Telecommunications, Govt. of India, prepared a consultation paper on the requirement for a new legal framework governing the telecom sector in India. Various stakeholders have requested an evolution of the legal framework concerning the changing technology. The consultation paper can be accessed from: Click here to read…

The legal framework for telecommunications in India is governed by the laws enacted before the independence from colonial rule. In recent decades, technology has changed significantly. To keep pace with the dynamics of technology, many nations, including the United States (in 1996), Australia (1979), the United Kingdom (2003), Singapore (1999), South Africa (2000), and Brazil (1997) have advanced the telecommunication legislation.[1]

Indian Telecom Service Providers are likely to launch 5G mobile services during 2022-2023

In a notification dated 15 June 2022, the Department of Telecommunication (DoT), Ministry of Communication has initiated the process of auction of spectrum in 600 MHz, 700 MHz, 800 MHz, 900 MHz, 1800 MHz, 2100 MHz, 2300 MHz, 2500 MHz, 3300 MHz, and 26 GHz Bands which includes the spectrum required for the launch of 5G Services in India. It is expected that the Indian Telecom Service Providers (TSPs) will launch 5G mobile services in India during 2022-2023.

To enable design-led production of 5G-related products in India, the DoT has modified the rules for the Production Linked Initiative (PLI) plan for manufacturing telecom and networking products. One of the amendments included a 01 per cent higher incentive for products qualifying the design-led criteria. [2]

Indian Air Force launched an Artificial Intelligence Centre of Excellence

Under the aegis of UDAAN (Unit for Digitisation, Automation, Artificial Intelligence and Application Networking), the Indian Air Force (IAF) launched a Centre of Excellence (CoE) for AI. The CoE was inaugurated by Air Marshal Sandeep Singh, Vice Chief of the Air Staff (VCAS), on 10 July 2022 at Air Force Station Rajokri, New Delhi. A Big Data Analytics and AI platform for managing all aspects of Analytics, Machine Learning (ML), Natural Language Processing (NLP), Neural Networks, and Deep Learning algorithms has been commissioned in the IAF’s AI Centre. The newest servers powered by Graphical Processing Unit (GPU) would handle the high-end compute requirements.

“The IAF has taken proactive steps to embed Industry 4.0 and AI-based technologies in its war-fighting processes. The AI CoE with high-end compute and Big Data storage capabilities, coupled with full-spectrum AI Software suites, would substantially enhance operational capabilities of IAF,” said the VCAS while addressing the gathering.[3]

MeitY released the Draft “National Data Governance Framework” Policy for public consultation

On 27 July 2022, the Minister of State (MoS) for Electronics & Information Technology (E&IT)— Rajeev Chandrasekhar, informed the Lok Sabha (the Lower House of the Indian Parliament) that the Ministry of Electronics and Information Technology (MeitY) released the Draft “National Data Governance Framework” policy on 26 May 2022, for public consultation, and the draft policy is under finalisation. The policy aims to ensure that non-personal data and anonymised data from both government and private sector are safely accessible by Research and Innovation eco-system. It will also provide a framework for data/datasets/metadata rules, standards, guidelines, and protocols for sharing non-personal data sets while ensuring privacy, security, and integrity/trust.[4]

Government of India may introduce new law regarding IT and Data Protection

On 22 July 2022, the Minister of State (MoS) for Electronics and Information Technology (E&IT)— Rajeev Chandrasekhar, informed the Lok Sabha (the Lower House of the Indian Parliament) that government aims to ensure Open, Safe & Trusted, and Accountable Internet for all users. The Ministry continues to engage in discussions with various stakeholders, including industry, legal experts, and academicians, to achieve the objective of new legislation, amendments to the Rules, etcetera. The existing Information Technology (IT) Act was enacted in 2000, around 22 years ago. Since then, technology and the Internet have evolved at a fast pace.[5]

CERT-In issued an advisory about multiple vulnerabilities in Apple macOS

On 29 July 2022, the Indian Computer Emergency Response Team (CERT-In) issued an advisory highlighting the multiple vulnerabilities that have been reported in Apple macOS, which a remote attacker could further exploit to execute arbitrary code, bypass security restrictions, and cause a denial of service conditions on the targeted system.
The vulnerabilities exist in Apple macOS due to out-of-bounds read in Apple Script, SMB and Kernal; out-of-bounds write in audio, ICU, PS Normaliser, GPU drivers, SMB and WebKit; authorisation issue in AppleMobileFileIntegrity; information disclosure in Calendar and iCloud photo library; logic issue in File System Events, PluginKit, Windows Server and Automation. A remote attacker could exploit these vulnerabilities by persuading a victim to visit maliciously crafted web content. The advisory also suggested applying appropriate patches as mentioned in the Apple Security Updates. [6]

Chinese government’s PR entity approached TikTok to open a “Stealth” propaganda account

According to news reported by Bloomberg, the Chinese government’s entity responsible for Public Relations attempted to open a “stealth” TikTok account targeting western audiences with propaganda. In response, TikTok executives pushed-back the attempt for the stealth account. The push-back highlighted the internal tensions ongoing within TikTok, owned by Beijing-based ByteDance Inc., as it has constantly attempted to distance itself from Chinese state propaganda and influence.

“Chinese government entity that’s interested in joining TikTok but would not want to be openly seen as a government account as the main purpose is for promoting content that showcases the best side of China (some sort of propaganda),” said a TikTok employee and colleague of Elizabeth Kanter, TikTok’s Head of government relations in the UK, Ireland, Netherlands, and Israel, via a message in April7 2020.[7]

Russia fined WhatsApp, Snapchat and others for storing user data outside the nation

On 28 July 2022, Moscow’s Tagansky District Court imposed a fine on Meta Platforms Inc’s— Meta, WhatsApp messenger, Snapchat owner— Snap Inc., and other firms, including Match Group, Hotels.com, and Spotify, for their alleged refusal to store the data of Russian users within the country. Amid the Russia-Ukraine armed conflict, Russia has clashed with big tech firms over content, censorship, data and local representation in escalated disputes.

Following a 04 million rouble fine in August 2021, WhatsApp was penalised 18 million roubles (roughly USD 301,255) by the Tagansky District Court for a repeat offence. The fine imposed on WhatsApp was higher than the 15 million roubles fine imposed in July 2022 for a repeat infraction on Google, a subsidiary of Alphabet Inc. The Court also fined “Tinder” owner— Match Group around 02 million roubles, Snap and Hotels.com, owned by Expedia Group Inc., 01 million roubles, and Spotify— a music streaming service, 500,000 roubles. “The five companies had not provided documents ensuring the storage and processing of Russian users’ data was taking place in Russia in time,” said the Communications Regulator— Roskomnadzor.[8]

China may transform the “Global Internet Conference” into an “International Internet Organisation”, claimed the Chinese State news agency

Since 2014, China’s Cyberspace Administration has been organising a World Internet Conference, where technology companies and government representatives of other nations convene to discuss the Internet and where China propagates its vision of State Internet control. Recently, according to a Chinese State news agency— Xinhua, “Beijing plans to transform the global internet conference into International Internet Organisation.” The organisation’s founding members include institutions, organisations, businesses, and individuals from nearly 20 countries. Some other State news agencies indicated that Afghanistan, Cambodia, North Korea, and Syria are among the member countries. On its successful transformation, Chinese-led International Internet Organisation could threaten global technology standards and the global Internet itself. [9]

A network of 11,000 phoney investments sites targeted Europe

Researchers at a cyber security firm— Group-IB, discovered a network of more than 11,000 domains engaged in promoting numerous fake investment schemes to users in Europe. As a modus operandi, the platforms show fabricated evidence of enrichment and falsified celebrity endorsements to create an image of legitimacy and lure many victims. In the phoney process, the user gets tricked into an opportunity for high-return investments and is convinced to deposit a minimum amount of EUR 250 (₹ 20,410) to sign up for the fake services. At the time of reporting, the countries targeted included the United Kingdom, Belgium, Germany, the Netherlands, Portugal, Poland, Norway, Sweden, and the Czech Republic.[10]

Endnotes :

[1] “Need for a new legal framework governing Telecommunications in India”, Ministry of Communications- Press Information Bureau, 28 July 2022, accessed on 06 August 2022, available from: https://pib.gov.in/PressReleasePage.aspx?PRID=1845920
[2] “5G Networks”, Ministry of Communications, 27 July 2022, accessed on 06 August 2022, available from: https://pib.gov.in/PressReleasePage.aspx?PRID=1845325
[3] “Artificial Intelligence (AI) Centre of Excellence (CoE) launched by IAF”, Ministry of Defence, 10 July 2022, accessed on 05 August 2022, available from: https://pib.gov.in/PressReleasePage.aspx?PRID=1840695
[4] “National Data Governance Framework Policy”, Ministry of Electronics and Information Technology, 27 July 2022, accessed on 05 August 2022, available from: https://pib.gov.in/PressReleasePage.aspx?PRID=1845318
[5] “New law relating to information technology and data protection”, Ministry of Electronics and Information Technology, 22 July 2022, accessed on 05 August 2022, available from: https://pib.gov.in/PressReleasePage.aspx?PRID=1843845
[6] “CERT-In Vulnerability Note CIVN-2022-0313: Multiple Vulnerabilities in Apple macOS”, Indian Computer Emergency Response Team, 29 July 2022, accessed on 07 August 2022, available from: https://www.cert-in.org.in/
[7]Olivia Solon, “Chinese government asked TikTok for Stealth propaganda account”, Bloomberg, 29 July 2022, accessed on 06 August 2022, available from: https://www.bloomberg.com/news/articles/2022-07-29/chinese-government-asked-tiktok-for-stealth-propaganda-account
[8] “Russia fines WhatsApp, Snap and others for storing user data abroad”, Reuters, 28 July 2022, accessed on 06 August 2022, available from: https://www.reuters.com/technology/russia-fines-snapchat-owner-data-law-violation-ifax-2022-07-28
[9]Justin Sherman, “China’s New Organisation Could Threaten the Global Internet”, Slate, 29 July 2022, accessed on 06 August 2022, available from: https://slate.com/technology/2022/07/china-world-internet-conference-organization-standards.html
[10]Bill Toulas, “Huge network of 11,000 fake investment sites targets Europe”, Bleeping Computer, 31 July 2022, accessed on 08 August 2022, available from: https://www.bleepingcomputer.com/news/security/huge-network-of-11-000-fake-investment-sites-targets-europe/

VIF Cyber Review: May 2022


CERT-In issued advisory on Mobile-based Malware

On 30 May 2022, Indian Computer Emergency Response Team (CERT-In) issued advisory on mobile-based malware, along with methods and countermeasures. With the advent of smartphones and high-speed Internet connection, mobile accounts for more than 50 per cent of the Internet traffic worldwide, making it a worthwhile attack surface for cybercriminals.

The advisory included methods through which cybercriminals carried out activities, including fake applications, On-device fraud, Bypassing App store, fake calls, and where mobile-based malware are also using design practices like accessibility engines, infrastructure and C2 protocols that enable them to update their capabilities. Along with, the advisory also suggested countermeasures and best practices for users, including keeping OS (Operating System) and applications updated, use of strong authentication such as biometric and PIN, safe browsing practices, deleting data before discarding the device. [1]

Cisco Launched a tool of SMBs to assess Cyber Security Readiness

Cisco, on 26 May 2022, launched a cyber security tool for Small and Medium-sized Businesses (SMBs) based in Asia-Pacific region to assess their cyber security readiness amid of hybrid work environment. The tool’s concept is based on the premise that no attempt to access an organisation’s network architecture can succeed until trust is verified. As per Cisco’s cyber security for SMBs: Asia-Pacific businesses prepare for digital defense study, 62 per cent of Indian SMBs suffered cyber incidents in 2021 and cyber-attacks cost their business over ₹ 3.5 crore. Around 74 per cent SMBs also reported 85 per cent of customer information loss in cyber incidents.

“When a user accesses an application using a device, both the user and device are verified, with that trust continuously monitored. This helps secure the organisation’s applications and environments from any user, device, and location,” read the statement released by Cisco. The threat landscape for the SMBs becoming more sophisticated due to the digitisation at speed, therefore, securing their businesses is one of the top priorities for SMBs. “With new tool, the SMBs will ensure end-to-end protection across their workforce, and the workplace, with adoption of a zero-trust strategy to manage and strengthen their cyber security posture in a cloud-first world,” said Cisco India & SAARC’s Senior Director (System Engineering)— Anand Patil.[2]

The 7th Edition of India-Japan ICT Joint Working Group meeting recognised the importance of India-Japan Digital Partnership

On 13 May 2022, V L Kantha Rao (Additional Secretary, Department of Telecommunications, India) and Sasaki YUJI (Vice-Minister for Policy Coordination— International Affairs, Japan) virtually co-chaired the 7th edition of India-Japan ICT Joint Working Group (JWG) under the India-Japan ICT Comprehensive Cooperation Framework. Senior representatives from both governments and non-governmental stakeholders from industry, R&D, and Academia attended the meeting.

Recalling the India-Japan Summit held in March 2022, both sides recognised the need to strengthen the growing cooperation under India-Japan digital partnership, with a vision to enhance digital economy through promotion of joint projects for digital transformations. The JWG discussions were focused on enhancing further cooperation in various fields like 5G, Open RAN, Telecom Network Security, submarine cable systems, and Quantum Communications. [3]

Government of India proposed to set up India Data Management Office

Under the Digital India Corporation, India’s Ministry of Electronics and Information Technology (MeitY) will set up an India Data Management Office (IDMO), which will be responsible for framing, managing, reviewing, and revising the National Data Governance Framework Policy. The draft of the National Data Governance Framework Policy was released by the MeitY, seeking public comments on the draft till 11 June 2022.

The earlier version of the policy— India Data Accessebility and Use Policy had faced many criticism from experts, who believed that there was a lack of security safguards for anonymization, privacy infringement, and economic incentivisation. As per the draft of the data governance framework, the IDMO will design and manage the India Datasets platform which will in turn handle the requests of Indian researchers and start-ups which require access to non-personal or anonymised datasets. [4]

CERT-In issued discovery of Remote Code Execution (RCE) vulnerability in Apple products

On 20 May 2022, the Indian Computer Emergency Response Team (CERT-In) highlighted a Remote Code Execution (RCE) vulnerability in Apple watchOS, tvOS, and macOS, affecting Apple Watch, Apple TV, and Apple Mac systems. The vulnerability existed due to an out-of-bounds write issue in the AppleAVD component. Successful exploitation of this vulnerability may allow a remote attacker to execute arbitrary code with kernel privileges on the targeted system.[5]


Canada to ban China’s Huawei and ZTE from its 5G/4G networks

Following to the review by Canada’s independent security agencies and consultation with ‘closest’ allies, the Government of Canada decided to ban China’s Huawei and ZTE products and services from Canada’s 5G/4G communication networks. In a statement released on 19 May 2022, the Minister of Innovation, Science and Industry— Francois-Philippe Champagne has stated that “the Government of Canada is ensuring a long term safety of telecommunication infrastructure. As a part of that, the government intends to prohibit the inclusion of Huawei and ZTE products and services in Canada’s telecommunication systems.” [6]

As per the decision, the companies that already using the Huawei and ZTE equipment installed in their networks would be required to cease its use and remove it. The implementation of these measures are part of a broader agenda to promote security of Canada’s telecommunications networks, in consultation with industry.

Mastercard strengthen cyber security consulting practice with new Cyber Front threat simulation platform

In recent years, Mastercard invested in risk quantification, Always-On security monitoring and fraud prevention, to help its customers strengthen their cyber resilience. On 24 May 2022, Mastercard made an announcement of launching a new attack simulation and assessment platform— Cyber Front. The platform will assist businesses and governments enhance their cyber security operational resilience. Cyber Front is enabled by a strategic minority investment in Picus Security.

By leveraging a continuously updated library of more than 3,500 real-world threat scenarios, the Cyber Front highlights security gaps and provides mitigation insights in real-time so that organisations can improve upon security investments with continuous validation. The goal of Cyber Front is for organisations to understand if their current systems are effective and identify areas of exposure to ensure greater protection in both— immediate and long term.[7]

Spanish Prime Minister’s phone hacked with Pegasus tool

On 02 May 2022, the Spanish government informed that Prime Minister (PM) Pedro Sanchez’s phone was hacked with Pegasus software. Earlier, in May-June 2021, Spanish Defence Minister— Margarita Robles’ phone was also hacked using the same software. Pegasus software is an Israel-made digital hacking tool to snoop on phone communication.

Researchers investigate and revealed that in April 2022, several political figures in Catalonia were victims of digital espionage. [8] It is assumed that top European Union (EU), the United Kingdom (UK), Poland and Hungary officials may also been targeted with Pegasus software. The use of digital hacking tools such as Pegasus has helped security officials around the world fight crime and ward off national security concerns, therefore, European governments have been wary of delving into the intricacies of spyware programs.[9]

Amid foreign hacking threats, Pentagon contractors looking for software flaws through VDP

Considering Russia and China’s efforts to steal sensitive data from the United States (US) defence industrial base, Pentagon’s pilot program discovered an array of software vulnerabilities with dozens of defence contractors. The objective of pilot program— “Vulnerability Disclosure Program” (VDP) is to identify and fix flaws in the e-mail programs, mobile devices and industrial software used by the Pentagon’s defence contractors before hackers can take advantage of these vulnerabilities.

“We really wanted to focus on those smaller defence contractors that may not have the budget and resources,” said Melissa Vice, interim director of the Department of Defense (DoD) Cyber Crime Centre’s DoD VDP. In the business sector, VDPs are widespread practise, in which vetted cyber professionals scan systems for defects and report them internally. The Pentagon has been running a VDP since 2016, but after the pilot, the intention is to permanently expand the programme to include defence contractors.[10]

Cybercriminals used call forwarding technique to obtain WhatsApp accounts

Cybercriminals used call forwarding as a technique, allowing them to hijack a targeted WhatsApp account and gain control to messages and contact list. The method relied on the mobile carriers’ automated service to forward calls to a different phone number, and WhatsApp’s option to send a OTP (One-Time Password) verification code via voice call.

According to the founder and CEO of ‘CloudSEK’— a digital risk protection company— Rahul Sasi, after knowing the targeted WhatsApp account number and some social engineering, the attacker convinced the victim to make a call to a number that starts with Man Machine Interface (MMI) code that mobile carrier set up to enable call forwarding. A separate MMI code can send all calls to a terminal to a different number or merely when the line is busy or there is no reception, depending on the carrier. “First, you receive a call from the attacker who will convince you to make a call to the following number **67* or *405* (subject to be vary as per the mobile carrier). Within a few minutes, your WhatsApp would be logged out, and the attackers would get complete control of your account”, said Rahul Sasi.

As a protection against such attack, turning on Two-Factor Authentication (TFA) protection in WhatsApp is an effective measure. By requiring a PIN (Personal Identification Number) whenever you register a phone with the messaging app, this feature prevents malicious actors from gaining control of the account.[11]

Endnotes :

[1]India. “CERT-In Advisory CIAD-2022-0014”, Indian Computer Emergency Response Team, 30 May 2022, Available from: https://cert-in.org.in/
[2]“Cisco launches new tool for SMBs to assess their cyber security readiness”, Financial Express, 26 May 2022, Available from: https://www.financialexpress.com/industry/sme/msme-tech-cisco-launches-new-tool-for-smbs-to-assess-their-cybersecurity-readiness/2538348/
[3]India. “7th India-Japan ICT Joint Working Group meeting held under India-Japan ICT Comprehensive Cooperation Framework”, Press Information Bureau- Ministry of Communication, 13 May 2022, Available from: https://pib.gov.in/PressReleasePage.aspx?PRID=1825159
[4]ET Tech. “Government proposes to set up India Data Management Office”, ET Telecom, 28 May 2022, Available from: https://telecom.economictimes.indiatimes.com/news/government-proposes-to-set-up-india-data-management-office/91846155?utm_source=Mailer&utm_medium=ET_batch&utm_campaign=ettelecom_news_2022-05-28&dt=2022-05-28&em=YW51cmFnQHZpZmluZGlhLm9yZw==
[5]India. “Remote Code Execution vulnerability in Apple products”, Indian Computer Emergency Response Team , 20 May 2022, Available from: https://cert-in.org.in/
[6]Canada. “Statement from Minister Champagne on telecommunications security”, Ministry of Innovation, Science and Industry, 19 May 2022, Available from: https://www.canada.ca/en/innovation-science-economic-development/news/2022/05/statement-from-minister-champagne-on-telecommunications-security.html
[7] “Another arrow in the quiver: Mastercard strengthens cybersecurity consulting practice with new cyber front threat simulation platform”, Mastercard, 24 May 2022, Available from: https://www.mastercard.com/news/press/2022/may/another-arrow-in-the-quiver-mastercard-strengthens-cybersecurity-consulting-practice-with-new-cyber-front-threat-simulation-platform/
[8]Aarup, Sarah Anne. “Pegasus spyware targets top Catalan politicians and activists”, Politico, 18 April 2022, Available from: https://www.politico.eu/article/pegasus-spyware-targets-top-catalan-politicians-and-activists/
[9]Manancourt, Vincent. “Hack of Spanish PM’s phone deepens Europe’s spyware crisis”, Politico, 02 May 2022, Available from: https://www.politico.eu/article/pegasus-hacking-spyware-spain-government-prime-minister-pedro-sanchez-margarita-robles-digital-espionage-crisis/
[10]Lyngaas, Sean. “Pentagon contractors go looking for software flaws as foreign hacking threats loom”, CNN, 02 May 2022, Available from: https://edition.cnn.com/2022/05/02/politics/pentagon-defense-contractors-software-flaws/index.html
[11]Ilascu, Ionut. “Hackers steal WhatsApp accounts using call forwarding trick”, Bleeping Computer, 31 May 2022, Available from: https://www.bleepingcomputer.com/news/security/hackers-steal-whatsapp-accounts-using-call-forwarding-trick/