Digital consumer protection Vulnerabilities in health apps

As of: 16.06.2021 1:53 p.m.

In the corona pandemic, health apps have gained many users. For some, however, there is a lack of data protection. This was the result of a study by the Federal Office for Information Security. The Federal Office for Information Security (BSI) found numerous security gaps in an investigation of health apps. According to a BSI report, six out of seven thoroughly tested apps transmitted passwords in clear text to authentication services. None of the apps fully met the security requirements of the BSI guidelines for health apps. The BSI did not provide the names of the apps examined.

Exclusive 03/10/2021

Personal data is not adequately protected

“From the point of view of technical IT security, this result must at least be rated as critical, especially in view of the fact that a significant proportion of the apps process sensitive and particularly sensitive data”, criticized the office for taking care of the data security of the federal government. “Because, according to the findings of the study, this does not adequately protect user data against attacks.” The BSI checked the health apps as part of the first report on digital consumer protection 2020, which, due to the corona pandemic, focused on digital health offers.

background 07/11/2019

damage “first of all manageable”

The BSI expert Nicolas Stöcker described the danger for users of the criticized apps when exploiting the identified loopholes as “first of all manageable”. If an attack took place, it would initially only affect a single person. “It would be worse if the backend, where the data is kept, were also insecure.” The authority has a corresponding further investigation for the future “on the screen”, says Stocker. However, BSI President Arne Schönbohm warned that the deficiencies found were also dangerous: “Every gap that is there, every weak point that is there has somehow been exploited at some point.” They are currently working with the app providers to close the gaps. “If we see that this is not fixed, then we reserve the right to issue a corresponding product warning”said Schönbohm.

At WWDC 2021, Apple introduces a lot of new features and many of these features are really worrying for developers, because their products can be “killed” by Apple. Zoom (and other video conferencing applications) It’s hard to imagine a tool as useful during a pandemic as a video calling and conferencing app (with the exception of soap and sanitizer). We’ve all spent countless hours on Zoom, Skype, and Google Meet working, and when it’s done, many of us turn to Apple’s FaceTime to chat with family at home. FaceTime on Android and Windows With its simplicity, even the elderly can easily use FaceTime, but it is too simple to use in the company. With iOS 15, iPadOS 15, and macOS Monterey, FaceTime is about to rival Zoom, with grace features that allow voice enhancement while eliminating background noise, and the ability to create and schedule links in advance. FaceTime calls. Most importantly, Windows and Android users can also participate in FaceTime calls through the web interface, thus no longer relying on Apple hardware. Citymapper Citymapper Traveling on public transport in a city you’ve never been to can be a daunting challenge. Not only do you have to figure out which trains or buses to take, but you also have to know when to get off to get to your desired destination. That’s why there are apps like Citymapper, which function like satellites for subways, buses and trains. But in iOS 15, Apple is incorporating similar functionality into Maps to convince iPhone users not to use Google Maps instead. Not only will you see the progress of your vehicle updated in real time, you’ll also get advanced alerts on when you need to get off and then directions to where you need to go. you back on the road. Peloton Artist Series Training Program Nothing motivates you to work out like the perfect tracks and your favorite artists, which is what Peloton has leveraged in its Artist Series collaboration with celebrity: a series exercises in which the entire music is centered around a single artist as part of a formal partnership. With Fitness, Apple is aiming for Peloton’s success, and with the help of the company’s massive music streaming service, it will soon introduce the new Artist Spotlight Series, where workouts will feature an entire playlist. from a single artist. The first themed workouts will be based on the music catalog of Lady Gaga, Keith Urban, Alicia Keys and Jennifer Lopez. Multi-device keyboard and mouse iPhones and iPads have been compatible with wireless keyboards for years, making typing easier and helping turn both devices into true productivity tools. That’s led to makers of multi-device keyboards and mice that can quickly switch between controlling different devices — like laptops, phones, and tablets — through a single switch. simple change. With macOS Monterey, a new feature called Universal Control will make such accessories unnecessary for Apple users. A mouse and keyboard (or trackpad) can be used to not only control multiple devices, but control them all at once, when the pointer can move to another device’s screen. This feature takes it a step further and allows for easy dragging of files between Apple devices, simplifying the way iOS and macOS devices share documents. You may see this feature as “Mouse without Borders” on Windows, but the way Apple does it is much more intuitive and logical.

This malicious application is called Mods Minecraft. The app doesn’t function like an ad at all, instead it turns the victim’s smartphone and tablet into an ad-player in an extremely sophisticated way. (Photo: Kaspersky) Accordingly, after the first run, the application will hide its icons from the screen and continuously open the browser to display ads. The app can also play videos from YouTube, access the Google Play app store, and more. Security experts at Kaspersky found that the app opens the browser every two minutes, rendering the device essentially inoperable. use to be. (Photo: Kaspersky) What’s especially worrisome is that it’s hard for users to know what’s going on with their devices, which apps are responsible for the trouble, and how to prevent it. The security experts at Kaspersky informed Google of their findings and the malicious app was quickly removed from the store. Minecraft is one of the best-selling games in the world with about 180 million copies worldwide. (Photo: Mojang) However, removing this app from Google’s app store does not mean the removal of all malware. In the past, developers of this type would simply upload new, slightly modified versions, using different names, from different developer accounts to further trick victims. An example can be mentioned is the VK Music Trojan. This app stole VK user accounts, but despite being reported, the app has survived on the Google Play app store for several years. (Artwork: Unsplash) Kaspersky ran a search for malicious Minecraft Mods-like apps – and found a few. In addition to the malicious application Mods Minecraft, a utility called File Recovery was also found to contain malware in version 1.1. However, that version has since been removed and version 1.1.1 of the app, available on Google Play, is safe.

(Artwork: Presse-citron) Specifically, the Teabot (or Anatsa) malware, which can allow hackers to take over the victim’s Android device completely; steal their banking and other important personal information through tools like keyloggers. The analysis report from Bitdefender researchers said that Teabot malware can perform attacks through Android Accessibility Services, view private messages, steal banking information, steal authentication codes. of Google,… and even take full remote control of the victim’s devices. (Artwork: Unsplash) Distributing malware directly from app stores would be difficult, so hackers use the method of impersonating top-rated apps distributed on third-party websites. . According to research by Bitdefender, fake Android apps include antivirus, media player, health, etc. To deceive users, the fake app’s name and logo will be copied. copy almost or exactly like the real application. (Artwork: Panda Security) Here are 6 malicious apps impersonating famous apps to scam users. If you are using Android devices, please check all the applications on the device. In case your phone has 1 of the 6 applications below, quickly remove them immediately. The main app icon (right) and the fake app (left) have some differences in the 5th and 6th apps. (Image: Bitdefender) Bitdefender emphasizes that the campaign against these malicious applications is still active. For this reason, Android users need to be careful about downloading apps, especially apps from third parties, that aren’t part of the Google app market; Don’t click on strange links and always look carefully at the permission requests of Android apps.

Weather forecast with Dark Sky Weather Dark Sky Weather is a user-friendly, intuitive and accurate weather application. Users can easily download the app to their phone within minutes and see the weather forecast at the nearest location. Dark Sky Weather not only notifies bad weather conditions such as storms and floods, but also updates local weather continuously, such as when rain starts and stops at the user’s location. Dark Sky Weather is a weather app with a user-friendly, intuitive and accurate interface. Photo: 9to5mac. The app syncs with the Apple Watch and comes with a widget that helps provide the necessary information to the user. However, Dark Sky Weather is currently only available in a few countries such as the US, UK, and Ireland. Experience AR creation with Reality Composer Through Reality Composer, users can rapidly produce and prototype for AR augmented reality experiences. To get started, users can either import their own projects or USDZ files, or use the AR library built into the app. Users can customize the quality of virtual objects, such as style and size. In addition, users can add behaviors, triggers, spatial sounds and animations using the presets available in the app or create their own. The mobile interface of the Reality Composer application. Photo: The Panther Tech. The direct linking feature makes it easy to transfer projects to iOS and Mac devices. To share with friends, users simply export the AR product and send it to them via iMessage, AirDrop or other means. Measure . measurement app Measure allows users to read the dimensions of rectangular objects and can estimate the measurement of any object using the horizontal, vertical and diagonal lines included in the app to take measurements. Measure does not allow users to save measurements or track previous measurements, but the application has a shutter button for users to save images with measurement metrics. In the app there is also a Level tab, which allows you to check the flatness of the surface and indicate whether it is angled or not. The Measure app allows users to read the dimensions of rectangular objects and estimate the measure of any object. Photo: Makeuseof. Translation application Translate Translate allows users to quickly translate text and audio in 11 languages ​​(English, Chinese, Korean…). Rotating the device to landscape mode turns the app into a conversational, split-screen display of source and destination text. Tapping the play icon will provide the audio of the target language. To enlarge the translated text, the user can tap the full screen button. Translate’s intuitive design allows users to easily manipulate the record (mic) and speak buttons, making dialogue sound more natural while communicating. In addition, users can save the translation for easy access next time. Translate only supports 11 languages ​​in the world. Photo: Makeuseof. In addition, the application’s automatic language detection feature helps users to instantly translate the spoken sentence into another language. While this is an interesting and quite useful app for language learners or foreign tourists, the limited number of languages ​​in it limits its access to many users. Support from Apple Support The Apple Support app was developed by Apple with the aim of offering support to all iPhone users. Apple Support allows users to access a wide range of topics related to devices, services to which the user is subscribed, and other products in the Apple ecosystem. Each topic includes many articles that provide detailed information on different issues. Apple allows users to access a wide range of topics related to devices, services to which the user is subscribed, and other products within the Apple ecosystem. Photo: Makeuseof. Apple Support also allows users to connect with others via web chat or phone calls, they will help with troubleshooting and step-by-step instructions to get the problem resolved. In the app, there is a Support for Services feature, which helps to solve problems related to the list of services that users subscribe to such as iCloud, Apple TV + and Apple Music. If the device needs repair intervention, the app helps find an Apple Authorized Service Provider based on the user’s recent location. Apple COVID-19 Screening Tool The Apple COVID-19 Screening Tool is a simple screening tool that checks for symptoms and possible contact with an infected person. Photo: Makeuseof. The Apple COVID-19 app is a collaboration between Apple and the Centers for Disease Control and Prevention (CDC). To ensure privacy, the user’s stored data is encrypted and protected with a password. The Apple COVID-19 Screening Tool is a simple screening tool that checks for symptoms and possible contact with an infected person. After the user’s answer, the app will provide helpful advice based on CDC guidelines, including self-isolation, social distancing, and talking to a doctor. However, this software is not yet supported in Vietnam.

The report found that as many as 23 apps are available on Google Play, each with between 50,000 and 10 million downloads, violating privacy guidelines in the collection and storage of user information. Some applications are less secure, leaving users vulnerable to personal data leakage. (Photo: Check Point) Of these, there are 13 applications that store user data in the cloud but are not secure. This means hackers can easily access data from the outside. Hackers can even modify the developer’s notice, and replace it with malicious links or misleading content. Users’ personal information is easily leaked when using these applications. (Photo: Check Point) These vulnerabilities put at least 100 million Android users at risk of phishing, identity theft, and malware attacks. 13 out of 23 apps have extremely poor security, allowing hackers to access public data, but Check Point only lists 5 applications that need attention: This Screen Recoder app was found to be storing users’ passwords on an unsecured cloud service, leaving the data vulnerable to leaks. (Photo: Check Point) – Astro Guru : Horoscope app with over 10 million downloads. Astro Guru stores each user’s name, date of birth, gender, GPS location, email address, and payment information. – iFax : Mobile fax application, stores all documents sent by more than 500,000 users in a cloud database. – Logo Maker : Logo design app with over 170,000 users. The user’s full name, account ID, email and password are all accessible. (Artwork: Crystal Cox/Business Insider) – Screen Recorder : This app has more than 10 million downloads. The developer stored the user’s password on an unsecured cloud service, making the data vulnerable to leaks. – T’Leva : Taxi hailing app from Angola with over 50,000 downloads. This application saves the history between the driver and the rider, the location data, name and phone number are accessible. Check Point said it notified the app developers, but only Astro Guru responded, and some of the apps are still available on Google Play.

According to the Reuters , OkCupid will join many major online dating platforms such as Tinder, Match and Bumble to participate in the US government’s vaccination incentive program. This is the latest effort by the Biden administration to attract young people to get the Covid-19 vaccine, thereby achieving at least one shot of the vaccine for 70% of Americans by July 4. A user opens the Tinder dating app. Photo: Reuters. “(People who have been vaccinated) will have their own certification badge, have a filter to find people who have been vaccinated, and can use many exclusive functions for free,” Mr. Slavitt said. Shar Dubey, CEO of Match Group, which owns dating apps like Tinder and OkCupid, said she feels “honored to work with the White House to increase vaccination rates across America”. “(Immunization) will help people meet face-to-face and interact in meaningful ways. It also makes dating safer for everyone and anywhere,” added Ms. Dubey. Last week, the White House also teamed up with two ride-hailing apps, Lyft and Uber, to provide free rides to people getting vaccinated against Covid-19. According to data from Johns Hopkins University, the US currently has more than 33 million cases and nearly 590,000 deaths from Covid-19. The country has fully vaccinated nearly 39% of the population, or about 128 million people.

The Microsoft Office app for Android is now getting a dark mode soon. Photo: Google However, at the time of launch of the integrated Microsoft Office application, there was no dark mode for devices running the Android operating system. Many users have complained and asked Microsoft to add dark mode in Office applications. This feature will help them edit documents without the glare of the device’s blue light affecting their eyes. Recognizing user feedback and realizing the lack of updating dark mode for Android operating system, after more than 1 year of development this mode is now available to Android users in an update Upcoming. Android users with the latest version of Office apps will automatically adjust to dark mode if the device is already set to that option. In addition, users can also enable or disable dark mode by touching the profile icon on the home tab in the Office application. Then select the settings and choose light, dark or the system default to customize the theme. Microsoft product manager Sourab Nagpal said this is a feature that has been requested by many customers. This mode is well-received by many people because it provides comfort when reading documents and working on mobile devices. Microsoft says it will roll out dark mode for Office on Android in the coming weeks, so it may not be available to all users right away. Dark mode was updated by Micorosoft for iOS operating system last year along with the release of integrated Office. Devices like iPhone, iPad can read documents using Office applications comfortably just like Twitter, Facebook or WhatsApp experience with a dark color adaptive interface.

The rate of ordering food through 3rd party applications has reached 82% compared to 2018 only 58% According to the report “Mobile apps 2021” released by Appota, Vietnamese people are tending to download and use more mobile applications after the pandemic. In which, the most exciting are food delivery and OTT applications with rapid growth. Food delivery app is a familiar concept Before the outbreak of the pandemic, food delivery services via 3rd party applications was a concept that was not yet popular with Vietnamese people. However, things have changed when in 2020 the number of regular users of this service has reached 80% while in 2016 only 20% of the number of users according to the survey. The special thing is that the dense appearance of food ordering applications on smartphones has changed the way to use this service. The food delivery market has also become active with competition from many big players Specifically, in QandMe’s 2020 survey, the rate of ordering food through 3rd party applications has reached 82% compared to only 58% in 2018. Direct calling to order has dropped from 71% to 23%. The food delivery market has also become active with competition from many big players such as Now.vn, LoShip, BaeMin… to both big online car booking giants like Grab and Go-jek in 2020 as well. Expanding services to food delivery with GrabFood and Go-Food utilities. Because the market size in Vietnam is very small, the fast food delivery industry is considered a “hot” market that attracts many domestic and foreign investors. In addition, the unit with the fastest delivery, the most promotions and the most extensive menu will win the race for this market share. OTT – “new trend” OTT has grown rapidly and become a new trend OTT stands for Over The Top, this is a term used to refer to taking advantage of the large space of the Internet to provide users with content such as images, sounds, messages, calls. Currently, watching movies and VOD content has become a popular form of entertainment during the pandemic. In Vietnam, OTT has developed rapidly and has become a new trend in the period of social distancing, whereby the rate of viewing OTT on smartphones accounts for 67%, 86% of users are willing to watch ads in return. free content, 35% purchase ad conversion rate on OTT platforms in Vietnam. Thanks to the popularity and bloom in 2020, OTT applications are increasingly attracting new users, with the majority of users preferring free but ad-containing OTT platforms making this gradually become a popular choice. Potential advertising channel for brand developers.

CEO Tim Cook speaks at WWDC 2018 (Image: Getty Images) This is the first time Apple publish this data. It is a sign of “defective apple” becoming more transparent in the process of approving and rejecting iPhone applications under pressure from many countries. Thanks to the application review system, comparing with the App Store regulatory list, the company can keep iPhone users safe from fraud, malware or poor experience. Apple also published some notable figures for 2020. Accordingly, the manufacturer Iphone rejected nearly 1 million applications submitted for the first time; deny nearly 1 million application updates. 48,000 applications removed due to use of “hidden or unreported features”; 150,000 applications removed for spam or other application copying; 215,000 apps removed for collecting too much user data or violating privacy; 95,000 applications were removed due to phishing, usually they change to other types of applications such as gambling, porn. 470,000 accounts disabled from the developer program for phishing. Additionally, last month, Apple declined 3.2 million app downloads using an enterprise license. This is how large businesses often use to circumvent the App Store law to install internal apps on employees’ iPhones. Currently, the lawsuit between Apple and Epic Games is taking place. Game maker Fortnite denounces the App Store as a “closed garden”, hurting developers, and Apple discriminates against many. Epic Games also confirmed that Apple’s process is not perfect, sometimes approving malware. Apple employees themselves have admitted their process is not good enough to prevent scams. At the trial, Apple said, combining 500 automated reviewers and testers to review nearly 5 million applications per year, from 2017 to 2019 (updates included), the rate from declined from 33% to 36%. The flaws are too small for the size of the App Store. Apple sees the App Store as a fundamental, irreplaceable part of its business. This is the only way for users to install software on the iPhone. Apple’s attorney argued that if users let users download apps from outside the App Store the way Android is doing, they would be at risk of security. Apple doesn’t want to be Android. Du Lam (According to CNBC)

Introducing the application “Путешествую без COVID-19”. On April 23, at the headquarters of the Russian Foreign Ministry, Russian Deputy Prime Minister Alexey Overchuk introduced the mobile application “Путешествую без COVID-19” (temporarily translated Travel No Covid-19) to the Heads of foreign missions. assigned by many countries, including Vietnam. Participating in the presentation and answering questions about the application “Путешествую без COVID-19” and questions related to the situation of Covid-19 also included representatives of the Russian Ministry of Foreign Affairs, the Health Protection and Monitoring Agency. consumer interests in Russia (Rospotrebnadzor), Eurasian Development Bank. At the application session, Russian Deputy Prime Minister A.Overchuk explained the principles and procedures for using “Путешествую без COVID-19”, and invited foreign partners to consider the possibility of connecting the technical platform. this number. According to Deputy Prime Minister A.Overchuk, Russia is considering a complete transition to the application “Путешествую без COVID-19” to receive foreigners entering Russia. That is, this application may become mandatory upon entry to Russia. Deputy Prime Minister A.Overchuk also said that currently citizens of the Eurasian Economic Union (EAEU) entering Russian territory from Belarus, Armenia and Kyrgyzstan can use the application “Путешествую без COVID-19”. In Belarus, Armenia, Kyrgyzstan and Russia, 348 laboratories connected the application. In principle, before departure, passengers need to download the application “Путешествую без COVID-19” to their mobile phones. Then, from the list of recommended laboratories, select the closest facility for Covid-19 assay. The lab will display the results in the national system, and this information in the form of a QR code appears in the application. User submits this QR code to third parties for verification.

The results show that the removal rate of e-commerce applications in Vietnam is currently the highest in Southeast Asia. Specifically, the rate of deleting online shopping applications in Vietnam was recorded at the highest level of 49% in the second quarter of 2020. With this result, it can be seen that e-commerce users in Vietnam are the most difficult group in the region. They tend to remove inappropriate e-commerce apps as soon as they try them out. To solve the above problem, experts of AppsFlyer and iPrice Group said that e-commerce floors need to improve the quality of their services to be able to engage users. Vietnam is actively promoting the development of e-commerce in recent years. Photo: Trong Dat Despite a high rate of app deletion, it is worth noting that Vietnamese businesses occupy 5 positions in the top 10 regional e-commerce websites. Enterprises in this list can be named Gioi Di Dong, Tiki, Dien May Xanh, Sendo and FPT Shop respectively. This shows that the e-commerce development rate is very high in the Vietnamese market. According to a report by the Vietnam E-commerce Association (VECOM), in 2020, Vietnam’s e-commerce will reach a scale of about 13.2 billion USD and have a growth rate of about 15%. During the peak quarantine period from February to April 2020, e-commerce has become the only shopping channel for accessing certain goods and services. Recognizing this, many domestic enterprises have been active in applying IT in production and business activities, promoting digital transformation and training human resources to maximize the advantages of platforms. online. Facing the rapid and hot development of the Vietnamese e-commerce market, Google, Temasek and Bain & Company also predicted that the average growth rate in the period 2020 – 2025 of Vietnam’s electrical commerce is 29%. By 2025, the scale of our country’s e-commerce market will reach US $ 52 billion.

A scam app gang in Shanghai was smashed

The Shanghai police recently successfully smashed a criminal gang that provided technical services to telecommunications network fraud gangs. This is also the most comprehensive professional production and sales fraud APP criminal gang in Shanghai in recent years. In September last year, Shanghai Changning police received a report that a citizen was defrauded of 115,000 yuan in an investment app called “New Year’s Dance”. After sorting out the information, the police locked a criminal network that used false foreign exchange trading platforms to solicit “agents” to commit fraud. After further analyzing the background data, the police found another important clue.

Tan Siwei, a policeman from the Anti-fraud Division of the Criminal Investigation Division of Shanghai Changning Public Security Bureau: We have seen a large number of 24-hour uninterrupted logins, of which one IP address is concentrated in our Shanghai city.

Through reverse tracking, the police finally locked an information technology company. After investigation, this company produced more than 50 fraudulent apps including “New Year’s Dance”, installed more than 12,000 devices, and the amount involved exceeded 100 million yuan. The police subsequently closed the net in Shanghai, Guangdong, Anhui and other places and arrested more than 110 suspects. In March of this year, 70 criminal suspects were transferred to the procuratorial organ for prosecution in accordance with the law.

Qian Jun, deputy head of the Criminal Investigation Division of Shanghai Changning Public Security Bureau: The core of all APPs is an investment trading platform. According to the needs of fraudsters, on the surface, normal market data such as foreign exchange, futures, stock market, and precious metals can be quoted separately, but in the trading link, The company was given the right to modify the data at any time by the fraud group to achieve the purpose of fraud.

Scammers use multiple social platforms to spread fraudulent apps

According to the police, at present, all kinds of fraudulent apps such as making friends, swiping orders, and shopping have become an indispensable link in the criminal chain of telecommunications network fraud. In particular, fraudulent apps such as foreign exchange transactions that can change data at will have become a support for investment and financial management. An important accomplice of fraud. Criminals will deliberately let the victim download these apps.

Police Officer Zhuang Liqiang from the Spokesperson’s Office of the Shanghai Municipal Public Security Bureau: These fraudulent apps are generally spread in forums, chat tools, and text messages through short links, QR codes, and other methods.

National Anti-Fraud Center: Over 60% of Internet frauds involve fraudulent apps from January to March

According to the National Anti-Fraud Center, from January to March, more than 220,000 telecommunications network fraud cases occurred nationwide, with losses reaching more than 18.5 billion. Among them, more than 60% of them used APP to implement fraud.

Chen Minjie, National Anti-Fraud Center: This kind of app that commits crimes is generally not available on the regular app market. The functions are relatively simple and the production is relatively rough. Judging from the current combat situation, many criminal gangs can easily package it from a website involved. An APP, the cost is very low. So when we download the APP in the future, try to download it from a regular website.

Knowing that criminal gangs use APP to commit crimes, but still provide technical support, these fake APP gangs have violated the criminal law.

Chen Minjie, National Anti-fraud Center: APP download can be downloaded and installed with just one link. In the next step, our public security organs will work with industry and internet information departments to further strengthen the rectification of APP.

Anti-fraud and anti-fraud National Anti-fraud Center APP launched

In addition, the National Anti-fraud Center APP, organized and developed by the Criminal Investigation Bureau of the Ministry of Public Security, has recently been launched nationwide, and will be further optimized in the future. After downloading and installing the APP, when receiving a call or text message from a suspicious person, or a URL contained in the suspicious text message, or installing a suspicious APP application, it can intelligently identify the scammer’s identity and warn in advance. It can also report various fraud information to the platform at any time. Greatly reduce the possibility of users being deceived.