Govt mulls clearly defined bail law to end court's discretion

Several India-based firms are spoofing the World Health Organisation (WHO) by creating fake Gmail accounts and luring business leaders in disguise of informing them of latest COVID-19 announcements and hack their personal and financial information, Google has warned.

These "hack-for-hire" firms, many based in India, have been creating Gmail accounts spoofing the WHO, largely targeting business leaders in financial services, consulting, and healthcare corporations within numerous countries including, the US, Slovenia, Canada, India, Bahrain, Cyprus, and the UK.

"The lures themselves encourage individuals to sign up for direct notifications from the WHO to stay informed of COVID-19 related announcements, and link to attacker-hosted websites that bear a strong resemblance to the official WHO website," security researchers from Google's Threat Analysis Group said on Wednesday.

The sites typically feature fake login pages that prompt potential victims to give up their Google account credentials, and occasionally encourage individuals to give up other personal information, such as their phone numbers.

On any given day, Google's Threat Analysis Group (TAG) said it is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.

Last month, it sent 1,755 warnings to users whose accounts were targets of government-backed attackers.

"Our team of analysts and security experts is focused on identifying and stopping issues like phishing campaigns, zero-day vulnerabilities and hacking against Google, our products and our users," said the tech giant.

Google continues to see attacks from groups like Charming Kitten on medical and healthcare professionals, including WHO employees.

"We're seeing a resurgence in COVID-related hacking and phishing attempts from numerous commercial and government-backed attackers," said the company.

Government-backed or state-sponsored groups have different goals in carrying out their attacks: Some are looking to collect intelligence or steal intellectual property; others are targeting dissidents or activists, or attempting to engage in coordinated influence operations and disinformation campaigns.

Google said that since March, it has removed more than 1,000 YouTube channels that were part of a large campaign and behaving in a coordinated manner.

"These channels were mostly uploading spammy, non-political content, but a small subset posted primarily Chinese-language political content similar to the findings of a recent Graphika report," said the company.

Several cybersecurity firms have seen a spike in COVID-19 related scams and hacking attempts. Hackers are also creating scam sites similar to COVID-19 relief packages.

Researchers at Check Point Software Technologies revealed in mid-May that they have seen 192,000 coronavirus-related cyber-attacks per week over the past three weeks, a 30 % increase compared to previous weeks.

New Delhi, Jul 6: The Indian Academy of Sciences, a Bengaluru-based body of scientists, has said the Indian Council for Medical Research's (ICMR) target to launch a coronavirus vaccine by August 15 is "unfeasible" and "unrealistic".

The IASc said while there is an unquestioned urgent need, vaccine development for use in humans requires scientifically executed clinical trials in a phased manner.

While administrative approvals can be expedited, the "scientific processes of experimentation and data collection have a natural time span that cannot be hastened without compromising standards of scientific rigour", the IASc said in a statement.

In its statement, the IASc referred to the ICMR's letter which states that "it is envisaged to launch the vaccine for public health use latest by 15th August 2020 after completion of all clinical trials".

The ICMR and Bharat Biotech India Limited, a private pharmaceutical company, are jointly developing the vaccine against the novel coronavirus -- SARS-CoV-2.

The IASc welcomes the exciting development of a candidate vaccine and wishes that the vaccine is quickly made available for public use, the statement said.

"However, as a body of scientists including many who are engaged in vaccine development IASc strongly believes that the announced timeline is unfeasible. This timeline has raised unrealistic hope and expectations in the minds of our citizens," it said.

Aiming to launch an indigenous COVID-19 vaccine by August 15, the ICMR had written to select medical institutions and hospitals to fast-track clinical trial approvals for the vaccine candidate, COVAXIN.

Experts have also cautioned against rushing the process for developing a COVID-19 vaccine and stressed that it is not in accordance with the globally accepted norms to fast-track vaccine development for diseases of pandemic potential.

The IASc said trials for a vaccine involve evaluation of safety (Phase 1 trial), efficacy and side effects at different dose levels (Phase 2 trial), and confirmation of safety and efficacy in thousands of healthy people (Phase 3 trial) before its release for public use.

Clinical trials for a candidate vaccine require participation of healthy human volunteers. Therefore, many ethical and regulatory approvals need to be obtained prior to the initiation of the trials, it added.

The IASc said the immune responses usually take several weeks to develop and relevant data should not be collected earlier.

"Moreover, data collected in one phase must be adequately analysed before the next phase can be initiated. If the data of any phase are unacceptable then the clinical trial is required to be immediately aborted," it said.

For example, if the data collected from Phase 1 of the clinical trial show that the vaccine is not adequately safe, then Phase 2 cannot be initiated and the candidate vaccine must be discarded.

For these reasons, the Indian Academy of Sciences believes that the announced timeline is "unreasonable and without precedent", the statement said.

"The Academy strongly believes that any hasty solution that may compromise rigorous scientific processes and standards will likely have long-term adverse impacts of unforeseen magnitude on citizens of India," it said.

New Delhi, Jun 3: Over 1 lakh scanned copies of Indians' national IDs, including Aadhaar, PAN card and passport, have been put on dark web for sale, cyber intelligence firm Cyble said on Wednesday.

The leaked data seems to have originated from a third party and not from the government system, according to a report by Cyble.

"We came across a non-reputed actor who is currently selling over 1 lakh Indian National IDs on the dark net. With such a low reputation, ideally, we would have skipped this; however, the samples shared by the actor intrigued our interest -- and also the volume. The actor is alleged to have access to over 1 lakh IDs from different places in India," Cyble said.

The personal data leaked by cyber criminals leads to various nefarious activities such as identity thefts, scams, and corporate espionage. Many criminals use the personal details in the IDs to win trust of the people over a phone call for fraudulent activities.

Cyber criminals leak personal data of 2.9 cr job-seeking Indians on dark web for free

The Cyble researchers acquired around 1,000 IDs from the seller and confirmed that the scanned IDs belong to Indians.

"Preliminary analysis suggests that the data originated from a third party, and no indication or artefact is indicating that it came from a government system. At this point, Cyble researchers are still investigating this further -- we are hoping to share an update soon," Cyble said.

The scanned ID documents indicate that the data may have been leaked from a company's data base in the segment where they have to comply with 'Know Your Customer' (KYC) norms.

"Cyble researchers have also learned about a surge in KYC and banking scams -- leaks such as this are often used by scammers to target individuals, especially elderlies," Cyble said.

The cyber intelligence firm has recommended people to refrain from sharing personal information especially financial information over phone, e-mail or SMS.

"Regularly monitor your financial transaction, if you notice any suspicious transaction, contact your bank immediately," the company said.

In May, Cyble showed two instances where personal data of 7.65 crore Indians have been put on sale in the dark web. In one instance, the seller claimed to have sourced data of 4.75 crore Indians from online directory Truecaller and in other, the seller claimed to have sourced from job websites.

Truecaller, however, had denied the claim of breach in its database.