Forum Topic

NHS app scams

Wow! It hasn't even left the IoW - bet they've still got some fixes to apply after the trial - and the scammers are on the job already ...https://eandt.theiet.org/content/articles/2020/05/phishing-scam-detected-hooked-into-nhs-coronavirus-contact-tracing-app/

Michael Ixer ● 2218d11 Comments

Ed. The FCC seem to be making more progress in the US. However, I believe the STIR/SHAKEN protocol to implement CLI authentication is a US not an international solution (although I think cross border tests with Canada have been done). I'm not sure it will handle spoofed calls arriving from outside of the US and the mandate, if I've interpreted it correctly, seems to be only for the VoIP part of networks not POTS/PSTN or mobile networks so I'm not sure how useful that is for the average consumer user. Not sure how helpful it would be in the UK if most spoof calls are initiated abroad. Skimming an Ofcom document they don't seem to think it's feasible to start STIR implementation until 2022 (if I didn't miss something in the skim); Jammed Bond would not be impressed!https://www.fcc.gov/call-authentication

Michael Ixer ● 2217d

One has to wonder why Ofcom hasn't plugged the CLI issue until an international solution is found???Looks like the standard excuse.That's why Ofcom is working with the international regulators - as well as the telecoms industry - to find solutions to the problem.

Ed Robinson ● 2217d

A while ago there were doubts whether the Bluetooth mechanism would work. This was one of the articles from security companies I referred to and is on a public website. https://www.pentestpartners.com/security-blog/short-beacon-analysis-on-the-nhs-ios-tracking-application/
I was referring to general comments on other topics regarding test, track, trace, etc so i think you're correct, there's nothing specific about the apps ability regarding that.

Michael Ixer ● 2217d

"And I think discussed on topics elsewhere?"I shall have to get a nom de plume - once they are back in stock!"I wasn't making any comment on the suitability of the apps"Apologies - I shouldn't have bit when I saw the words "on the tin".It is interesting that even in today's world of technology that distraction is still used as a means of fraud especially by governments - but that's another topic.

Ed Robinson ● 2218d

No, Ed. Wrong. I was just flagging and commenting that an organisation reported scammers were latching onto the new NHS as a vector for enticing users to give them PII, and then confirming with Andy that I wasn't suggesting any security deficiency in the app, particularly as some professional testers hadn't noted any flaws so far looking at what was public available, and that I wasn't commenting on the back end system's privacy or security (other than some other agencies have been found lacking in that area). I wasn't making any comment on the suitability of the apps functionality and its backend systen or their fitness for purpose for their intended use. That's a completely different subject. And I think discussed on topics elsewhere?

Michael Ixer ● 2218d

I think your missing the point Michael."NHS COVID-19: the new contact-tracing app from the NHS"If this is a contact-tracing app then that data should be published.I think this app will be used to give an estimate of where a postcode population is in terms of the virus spread. Which is good - but where does that leave contact tracing?It is the contact tracing bit that is needed - otherwise we are just flattening the curve to keep within icu capacity and the vulnerable will be hit.

Ed Robinson ● 2218d

Ed. I suspect those rules will be "tuned" depending on the results ... but my point in the post was really a reminder to bve aware of scams ...Andy. Fair comment but I was just posting this as I suspect introduction of the app will coincide with increased scamming. Apparently, cyber crime hasn't uncreased significantly during lockdown, just a change in emphasis to COVID related scams. The change in emphasis is no surprise but I thing a more substantial increase in cyber crime was anticipated.

Michael Ixer ● 2218d

"seems to do what it says on the tin."The tin description seems very vague when it comes to how this will work.It is the backend that will determine what rules are used for distance/time and how many people to contact and that has not been shared. It may be work in progress - just like the airport quarantine.Please note the words "idea" and "all the phone"."Importantly, the app knows how close it has been to other phones running the app, and for how long. This allows the app to build up an idea of which of these phones owners are most at risk.If you then use the app to report that you’re experiencing coronavirus symptoms, all the phones that have been nearby will receive an alert from the app."

Ed Robinson ● 2218d

I accept that Michael butvthd 2 things are completely separate. There is no suggestion that this  scam stems from information in this app. There is nit even a suggestion it us IOW based.Some people will look af your first post without reading ths attachment and jump to a very wrong conclusion.

Andy Pike ● 2218d

Andy. I wasn't get to give the impression there was anything untoward with the app. In fact a couple of articles I've read by security companies suggests it seems to do what it says on the tin. The concerns are mainly around the privacy and security of the centrally stored data collected by or associated with it. Stories like this don't inspire confidence in government agencies:https://www.theregister.co.uk/2020/04/28/anpr_sheffield_council/

Michael Ixer ● 2218d

Phew reading your post I thought it was a fault with the app. But reading the article it's a scam about the app. Like scans about  banks or tv licence etc. So to be clear it's not a fault with the app its thieving ba...ds dressing up in wolf's clothing to scam folk

Andy Pike ● 2218d