Cybersecurity news headlines for September 1-30, 2020

September’s edition of cybersecurity news headlines reports on Google’s ban of stalkerware apps on the Play Store, ransomware possibly contributing to a woman’s death after hospital in Germany is infected, and a federal judge blocking TikTok’s ban in the US.

Without further ado, here’s what made cybersecurity headlines in September.

Google bans stalkerware apps from the Play Store

Starting September 16, Google has banned stalkerware apps from its Google Play store. Stalkerware, also known as spouseware, are apps that allow someone to monitor devices of other people. While generally advertised as apps for monitoring children, they’re often used by people to spy on their partners. The biggest issue with these apps is that they are installed on people’s devices without their consent, thus the monitoring is unauthorized as well. They are quite popular because of their easy setup, as all users need to do is install the app on the device they want to monitor. These apps have a wide range of features, some might only show the location, while others may allow access to messages, images, etc. Due to their intrusive features and because they are often used without the device owner’s knowledge, Google has received criticism for allowing them on the Play Store. Though Google has taken down plenty of stalkerware apps from the App Store in the past, once their intrusive nature has been pointed out.

While Google has rarely actually addressed the stalkerware issue in the past, the company has now taken an official stance in the update to the Developer Program Policy, released on September 16, 2020.

Google’s official stance from September 16 is that apps that transmit personal information off the device now have to give adequate notice/get consent and display persistent notifications that data is being transmitted. App developers have been given 15 days from September 16 to comply with the changes. Apps that do not comply with these new guidelines will not get approval to be listed on the Play Store.

Google has noted that it will only allow apps that are “exclusively designed and marketed for parental (including family) monitoring or enterprise management”, provided they meet these requirements:

• Apps must not hide or cloak tracking behavior or attempt to mislead users about such functionality.
• Apps must present users with a persistent notification and unique icon that clearly identifies the app.
• Apps and app listings on Google Play must not provide any means to activate or access functionality that violate these terms, such as linking to a non-compliant APK hosted outside Google Play.
• You [the developer] are solely responsible for determining the legality of your app in its targeted locale. Apps determined to be unlawful in locations where they are published will be removed.

This will certainly not stop people from downloading stalkerware apps from third-party app stores, but it’s a step in the right direction.

For the first time, woman’s death may be directly linked to a ransomware attack on a hospital

A woman has reportedly died during a ransomware attack on a German hospital. While an investigation is still ongoing, if it becomes clear that the woman’s death is directly linked to the attack, it may be classified as negligent manslaughter.

Duesseldorf University Hospital was hit with a ransomware attack on September 10, during which it was unable to accept emergency patients. Because the hospital was unable to receive her, a women in need of urgent medical care was rerouted to a hospital 30 kilometers away. She, unfortunately, died soon after.

The hospital clarified that the ransomware used a vulnerability in a widely used commercial add-on software. Once the ransomware was in, it took down the hospital’s systems, which caused serious disruptions, potentially contributing to the woman’s death.

German news outlet RTL reported that the ransomware gang withdrew its ransom demand once it was contacted by police and sent a decryptor so the hospital could restore its systems. It was later revealed that the ransom note was addressed to the Heinrich Heine University, to which the hospital is affiliated with. That means that the ransomware attack was not intended for the hospital, instead its target was the nearby university.

While it appears that law enforcement was able to make contact with the ransomware gang to inform them that the attack affected a hospital and endangered patients, they are no longer reachable.

The ransomware gang has not been named but law enforcement is investigating. If it turns out that the death occurred because the hospital was unable to accept the patient, the incident would classified as negligent manslaughter.

Federal judge blocks TikTok ban from US app stores

US President Trump has signed an executive order last month banning viral Chinese app TikTok in the US. The deadline for the ban was September 27, 2020 but has since been extended last minute after a federal judge ordered an injunction against it in response to TikTok filing a lawsuit to fight the ban.

Had the ban gone into effect, tech-giants Apple and Google would have been required to remove TikTok from their respective app stores. This would have prevented new users from downloading TikTok but would not have blocked access for users who already have TikTok on their devices. However, US district judge Carl Nichols has granted preliminary injunction to allow TikTok to stay on the app stores, at least temporarily.

Another set of restrictions is due to take effect on November 12, and these will obligate US companies to stop providing services to TikTok, which would make the app impossible to use. The judge has declined to block these restrictions at this time.

TikTok’s parent company ByteDance is currently in the middle of negotiating a deal that would allow TikTok to continue operating in the US, making the ban unnecessary. The deal involves setting up a new entity, TikTok Global, that would oversee US operations. Software company Oracle and retail giant Walmart would acquire 20% of the TikTok Global, and an IPO would take place within 12 months. Trump has reportedly given his blessing for the deal but it still needs to be reviewed by the US government’s Committee on Foreign Investment in the United States (CFIUS).

References

1. Developer Program Policy: September 16, 2020 announcement.
2. Nicole Wetsman. Woman dies during a ransomware attack on a German hospital. The Verge.
3. Court temporarily blocks Trump order banning TikTok from US app stores. The Guardian.