Security News

Cyber-threats taking advantage of the COVID-19 pandemic are evolving, and Google is seeing an increase in related phishing attempts in countries such as Brazil, India, and the UK. As the coronavirus crisis spreads worldwide, cyber-criminals and state-sponsored actors have adapted their attacks to leverage pandemic-related lures. Google says it has observed an increase in the number of scams targeting Aarogya Setu, an initiative where the government is trying to connect people across India with essential health services.

A blog post published Wednesday by Google explains what the company is doing to fight coronavirus-related attacks and what users can do to protect themselves as well. Implementing proactive monitoring for COVID-19-related malware and phishing emails, Google said that most of the observed threats are not new but are simply repackaged malicious campaigns designed to exploit all the attention on the coronavirus.

VMware this week informed customers that it has patched a high-severity information disclosure vulnerability affecting its Workstation, Fusion and vSphere virtualization products. The flaw, tracked as CVE-2020-3960, was reported to VMware by Cfir Cohen, a researcher from Google's cloud security team.

GnuTLS, a widely used open source library implementing Transport Layer Security, last week fixed a bug that had been hiding in the code for almost two years that made resumed TLS 1.3 sessions vulnerable to attack. The flaw allowed GnuTLS servers to use session tickets issued during a previous secure TLS 1.3 session without accessing the function that generates secret keys, gnutls session ticket key generate().

Google Cloud will be the preferred cloud platform for HCL Commerce, providing global, secure and elastic infrastructure to power businesses' eCommerce strategies. Bringing HCL Commerce to Google Cloud will enable businesses to maintain their investments in HCL's trusted Commerce platform while also taking advantage of the global reach, security, and elasticity of Google Cloud.

UPDATE. A researcher is warning that a WhatsApp feature called "Click to Chat" puts users' mobile phone numbers at risk - by allowing Google Search to index them for anyone to find. The phone numbers are revealed as part of a URL string and so, this in effect "Leaks" the mobile phone numbers of WhatsApp users in plaintext, according to the researcher's view.

UK government has published the contracts it holds with private tech firms and the NHS for the creation of a COVID-19 data store, just days after campaigners fired legal shots over a lack of transparency. Campaign groups Foxglove and openDemocracy, which brought the action, said that the documents show the tech firms were set to build data models for commercial purposes from NHS training data before being challenged.

Google this week announced expansions to the Advanced Protection Program, with the addition of Google Nest and support for more types of security keys for iOS users. Over the years, Google rolled out Advanced Protection Program features for many of its services, including GSuite, Google Cloud Platform, Chrome and, most recently, Android, and this week made it available for Google Nest as well, providing its users with an additional layer of security.

Campaign staffs for both President Donald Trump and Democratic rival Joe Biden have been targeted recently by foreign hackers, Google researchers said Thursday, highlighting persistent data security concerns ahead of the November US election. A tweet from Google's threat analysis chief Shane Huntley said the internet giant warned the Biden campaign about "Phishing" efforts from China and the Trump campaign from Iran.

Google faces a $5 billion class-action lawsuit over claims that it has been collecting people's browsing information without their knowledge even when using the incognito browsing mode that's meant to keep their online activities private. The lawsuit, filed in the federal court in San Jose, California, alleges that Google compiles user data through Google Analytics, Google Ad Manager and other applications and website plug-ins, including smartphone apps, regardless of whether users click on Google-supported ads, according to a report in Reuters.