inspiring canadians to live better.

healthing leaf

inspiring canadians to live better.

healthing leaf
get healthing in your inbox with the morning checkup and weekender newsletter!
home / 世界杯决赛2022

hackers target canadians with fake covid-19 contact-tracing app disguised as official government software

downloading the bogus app activates a hidden program that hijacks the user’s data and holds it for ransom

by adrian humphreys, national post

jun 24 2020
read time 3 minute read
join the conversation
malicious computer ransomware specifically targeting canadians was embedded in a fake covid-19 contact-tracing app disguised as official government of canada software.
the bogus application for mobile phones was advertised as health canada-approved and cleverly distributed through coronavirus-themed websites that look remarkably like formal government of canada sites.
the malware was compiled the same day prime minister justin trudeau announced a nationwide contact-tracing phone app that will alert a user if they have come into contact with someone who tests positive for covid-19, according to eset, a computer security firm that discovered the malware’s purpose.
downloading the bogus app activates a hidden program called crycryptor that hijacks the user’s data and holds it for ransom. the hackers demand payment for releasing the private data files.
“once the user falls victim to crycryptor, the ransomware encrypts the files on the device — all the most common types of files — but instead of locking the device, it leaves a ‘readme’ file with the attacker’s email in every directory with encrypted files,” said lukáš štefanko, an eset malware researcher.
the company alerted the canadian centre for cyber security, a government computer security agency that is part of the communications security establishment, on tuesday, eset said.
powered by
canadian centre for caregiving excellence

advertisement

the fake government websites distributing the app went offline shortly afterwards. they remained offline on wednesday.
meanwhile, eset researchers also managed to crack the malicious app’s code and wrote a decryption tool that can rescue victims’ data.
“clearly, the operation using crycryptor was designed to piggyback on the official covid-19 tracing app,” said štefanko.
hackers prepared the source code for the malicious program on june 11. the next day, a website was registered using a .ca domain, the internet country code for canada, according to štefanko.
on june 18, at a televised media briefing, trudeau announced an official, nationwide contact-tracing app was in the works and encouraged all canadians with a smartphone to download it to help officials slow the spread of the novel coronavirus.
“people can be confident that this is an easy measure that they can have to continue to keep us all safe as we reopen,” trudeau said. “the app will be most effective when as many people as possible have it.”
the public announcement seems to have spurred the hackers into action. a second official-looking website pushing the app was registered june 21.
“let’s work together to stay safe,” the bogus sites declare above health canada and government of canada logos. “the more canadians who voluntarily download and use the app, the safer we’ll be, and the faster we can reopen the economy,” the site says, mimicking the message outlined by canadian officials. the sites use convincing domain names and avoid the obvious grammar and spelling mistakes often found on fraud sites that make it easier to spot a dodgy site.
powered by
obesity matters

advertisement

“this scheme looks close to the real deal,” said alexis dorais-joncas, head of eset’s montreal-based research and development team.
the app was only for phones using the android mobile operating system, the most widely used phone software system.
eset researchers in slovakia discovered the dangerous purpose behind the malicious apps after it was first flagged as a banking app.
the real government-approved covid contact-tracing app is not yet available. the official app will be released in ontario first and then rolled out across canada.
with the bogus sites down, security companies aware of it and a decryption solution available, this specific app no longer poses a threat, eset said.
other malevolent apps based on the crycryptor code could be produced and released in the future.
the communications security establishment did not respond to requests for comment prior to deadline.
• email: ahumphreys@postmedia.com | twitter:
don’t miss the latest on covid-19, reopening and life. subscribe to healthing’s daily newsletter coming out of covid.

comments

postmedia is committed to maintaining a lively but civil forum for discussion and encourage all readers to share their views on our articles. comments may take up to an hour for moderation before appearing on the site. we ask you to keep your comments relevant and respectful. we have enabled email notifications—you will now receive an email if you receive a reply to your comment, there is an update to a comment thread you follow or if a user you follow comments. visit our community guidelines for more information and details on how to adjust your email settings.

you may also like
041321-png0413nquarantine-04
b.c. could face travel restrictions as variant screening stepped up
041321-0813_covid_vulnerable
can your employer require you to be vaccinated?
041221-health-coronavirus/australia
ontario daily case count jumps back above 4,000
041321-png0413n_pharmacyvaccine
horgan says he'd have no hesitation taking astrazeneca shot
covid-icu-3
ontario hospitals 'surging like absolute crazy' in third wave
you may also like
041321-png0413nquarantine-04
b.c. could face travel restrictions as variant screening stepped up
041321-0813_covid_vulnerable
can your employer require you to be vaccinated?
041221-health-coronavirus/australia
ontario daily case count jumps back above 4,000
041321-png0413n_pharmacyvaccine
horgan says he'd have no hesitation taking astrazeneca shot
you may also like
041321-png0413nquarantine-04
b.c. could face travel restrictions as variant screening stepped up
041321-0813_covid_vulnerable
can your employer require you to be vaccinated?