Connect with us

E-Business

Sophos Schools Google, Users After ‘Docs’ Users’ Phishing Scam

Published

on

sophos new.jpg
Kindly share this post

Following the disclosure by Google saying it has stopped a phishing email that reached about a million of its users, security firm Sophos has identified a number of factors Google should consider, going forward, on how best to manage cases like this.

Recall, the scam claimed to come from Google Docs – a service that allows people to share and edit documents online.

Users who clicked a link and followed instructions, risked giving the hackers access to their email accounts.

Google said it had stopped the attack “within approximately one hour”, including through “removing fake pages and applications”.

“While contact information was accessed and used by the campaign, our investigations show that no other data was exposed,” Google said in an updated statement.

Advertisement

“There’s no further action users need to take regarding this event; users who want to review third party apps connected to their account can visit Google Security Checkup.”

In an email to Nigeria CommunicationsWeek Chester Wisniewski, principal research scientist, Sophos, observed, “First and foremost, this is an abuse of Google’s APIs. While at first glance it appears to be a phishing attack, the emails come from Google and you are logging into the real Google”.

Wisniewski said that attacks on systems that are open for anyone to sign up as a developer using OAuth have been vulnerable to this type of attack for a long time, and the onus is on Google to do a better job vetting application developers.

“This is no different than the abuse of the Google Play store by malware authors. There is very little individuals can do other than be forever suspicious about legitimate requests from services provided by Google, Twitter, Facebook and other online services that use OAuth with an un-vetted application developer program. Twitter’s users were attacked using these techniques a few years back. Unfortunately, Google has also fallen victim to a similar attack vector. When users see official emails from Google and official login pages used in scams, this leads the goodwill Google has garnered from its users to be potentially damaged. All providers of OAuth have a responsibility to police the use of their platforms to stop users from being tricked through official requests from services like Google, Twitter and Facebook.

“We do suggest that users keep an eye on social media. As the Google Doc “phishing” attempt demonstrates, Twitter is a great early-warning system. There’s little doubt that the tweeted warnings saved people from being victimized.

Advertisement

“As a reminder, users should check the apps they have approved to access their accounts and remove anything that may be suspicious on all OAuth-based platforms. For Google it is under your Google account -> Sign-in & Security -> Connected apps & sites. On Twitter and Facebook it is Settings & Privacy -> Apps.

Sophos also went ahead to demonstrate how this type of attacks worked: 

You get a real email from Google saying someone wants to share a file with you.

You get sent to a real Google login page and sign in.

You get a prompt that an “add on” wants access to your mail and contacts. The developer name is listed as “Google Docs,” but it could say anything (this is where Google could do more to prevent this).

Advertisement

The only way to attempt to check if it is real is to click on “Google Docs” and see the actual account creating the request, but it could say many believable things and there is no specific thing to watch for.

“The only reliable way to not fall victim is to never accept apps connecting to your account and requesting access to read/write your mail and contacts, or just about any other thing they might request access to unless you are specifically trying to hook into some new service, which you still may not be able to trust”.

Wisniewski also warned that when attacks like this happen, “it’s a good reminder to go back to your social media accounts and review what applications you’ve given permission to access your information and revoke permission if you no longer trust or use that particular app.”

 

Advertisement

Kindly share this post

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading
Advertisement
Comments

E-Business

Kaigama,Catholic Archbishop of Abuja Warns against Misuse of AI

Published

on

Kindly share this post

Ignatius Kaigama, Catholic Archbishop of Abuja, has warned that the misuse of artificial intelligence (AI) could pose serious risks if technological innovations are not guided by strong ethical principles.

Kaigama,Catholic Archbishop of Abuja Warns against Misuse of AI

Artificial intelligence is a branch of computer science focused on creating machines or software capable of simulating human cognitive processes.

Kaigama gave the warning on Sunday during his homily at St. Anthony Mary Claret Pastoral Area, Zuba, in the Federal Capital Territory,

He said that while artificial intelligence has enormous potential to improve lives, its irresponsible use could have harmful consequences.

Citing the teachings of Pope Leo XIV, the Archbishop said scientific and technological advances should serve humanity, uphold human dignity and promote the common good.

Advertisement

“We witness the misuse of human freedom, the unethical application of science and medicine, and now, in Artificial Intelligence,” he said.

The Catholic prelate also warned against what he described as an increasing pursuit of material wealth at the expense of moral values, saying greed and the love of money continue to contribute to many of society’s problems.

According to him, the excessive pursuit of wealth has diverted many people from the values of truth, justice and service, weakening the moral fabric of society.

 

 

Advertisement

Kindly share this post
Continue Reading

E-Business

TeKnowledge, Equinix Partner to Advance Nigerian Digital Infrastructure

Published

on

Kindly share this post

TeKnowledge and Equinix announced a partnership to accelerate secure hybrid and multi-cloud adoption and enable AI-ready digital infrastructure across the region.

Nigeria’s digital transformation is accelerating rapidly, with the digital economy being a significant contributor to the country’s gross domestic product (GDP).

As demand for cloud services, AI adoption, digital payments and data-driven innovation continues to accelerate across West Africa, the partnership is positioned to advance the region’s digital transformation.

By combining Equinix’s in-country and global data centre infrastructure and secure interconnection capabilities with TeKnowledge’s expertise in designing, deploying and managing AI, data, customer experience and cybersecurity solutions, organisations can accelerate innovation while maintaining data residency and sovereignty requirements.

Together, the organisations empower enterprises and government institutions to bridge the gap between digital ambition and execution through secure, high-performance digital environments built on local infrastructure and delivered by local talent.

Advertisement

Speaking, CEO and President, TeKnowledge, Aileen Allkins, said: “Organisations across Africa are increasingly looking to modernise their infrastructure while maintaining the performance, security, and compliance required to support growth.

Through our partnership with Equinix, we are combining world-class digital infrastructure with deep local expertise to help customers accelerate cloud adoption, strengthen resilience, and unlock new opportunities through AI and emerging technologies.”

Managing Director of Equinix West Africa, Wole Abu, expressed delight at partnering with TeKnowledge to bring together Equinix’s globally interconnected platform, spanning over 280 data centres and 10,000 customers worldwide.

Kindly share this post
Continue Reading

E-Business

New NIMC Act Strengthens Data Protection, Privacy – Director

Published

on

Kindly share this post

Uche Chigbo, coordinating director of Operations, National Identity Management Commission, (NIMC), has said the newly enacted NIMC Act strengthens data protection and privacy, expands identity coverage to include everyone in Nigeria and Nigerians in the diaspora, and provides the legal framework for a secure and trusted digital identity ecosystem.

New NIMC Act Strengthens Data Protection, Privacy - Director

She said the new law replaces the 2007 NIMC Act, which had become outdated due to rapid technological advancements, evolving cybersecurity threats, the growth of the digital economy, and the enactment of the Nigeria Data Protection Act.

According to her, the updated legislation better positions the Commission to deliver Nigeria’s digital identity agenda and improve access to government and private sector services.

“The Act itself has taken in a whole lot of things to make sure that NIMC is well-positioned to be able to deliver on the identity agenda and program of Nigeria. The area of universal coverage was expanded within the Act so that NIMC can enroll everybody that is within the soil of Nigeria—male, female, children, whether they are IDPs or orphans or whatever it is, and even Nigerians in diaspora.

“There is quite a lot within the Act that over the few days and weeks, even with my Director-General’s courtesy visit, we are trying to sensitize and educate the general public, and also bring awareness to this new Act so that people will know what are the rights that exist within it, what are the obligations, what are the stronger enforcement and penalties that has also been expanded within the Act, and then what are also the regulatory autonomy that has been given to NIMC to make sure that they drive the digital identity ecosystem in Nigeria,” she explained.

Advertisement

“There’s a lot of provisions and changes with the new Act. Um, the NIMC 2007 Act has been operating for close to 19 years now. So, we can see that, um, you can actually say it’s almost obsolete. And then with a lot of technological advancements in the world now, with the enactment of the Nigeria Data Protection Act, and then with also a lot of evolving security challenges, cybersecurity challenges, as well as the ever-growing digital economy, it became very necessary that a comprehensive review of the NIMC Act should be done.

So, that 2007 Act has been repealed and a new NIMC 2026 Act is in place,” she explained.

Chigbo clarified that the National Identification Number (NIN) is Nigeria’s unique identifier and the only valid means of identification for accessing government services.

She added that it enables secure identity verification and improves access to services.

“NIN has been designated as the unique identifier in Nigeria and then by the government of Nigeria establishing it as the only valid means of identification for assessing government services. So, NIN, it’s positioned to be a valuable tool for empowering citizens and legal residents to facilitate access to service delivery in Nigeria. And it’s also a tool for people to be able to prove their identity as they go about their daily businesses,” she said.

Advertisement

Speaking on identity harmonisation across government agencies, Chigbo said NIMC is integrating identity databases to enable Nigerians to access services seamlessly using the National Identification Number (NIN), while other agencies continue to issue functional identities for specific purposes.

“There’s a distinction between a foundational identity and a functional identity. NIMC provides the foundational identity, which answers the question, ‘Who are you?’ Are you a Nigerian or a legal resident? Who are you? That’s what NIMC is providing. All these other agencies that you have mentioned, they provide functional ID, which is an ID that relies on the foundational ID, where they have established who you are and then they are now trying to answer the question, ‘Are you now eligible to have these services? Are you now eligible to benefit from this transaction or scheme?’ So, those are two different distinctions.”

However, Chigbo said NIMC’s mandate is to harmonise and integrate identity systems across government, with the amended Act designating the Commission as the sole repository for biometric data.

“However, NIMC mandate is to make sure that we harmonize and integrate with all these agencies so that you’re one and the same person in any of the databases or registries that you have. The Act that has been expanded and amended also positions NIMC as the only repository for biometric data capture so that we can have effective identity management and coordination in Nigeria.

“So, that harmonization is already happening, the integration is already happening,” she stated.

Advertisement

She also disclosed that NIMC has introduced an online modification portal that allows Nigerians to begin the process of correcting or updating their personal information from the comfort of their homes or offices.

“But also, NIMC we have a modification portal that enables you to sit in the comfort of your home or office to be able to start the process of correction or updates of your data. We already have a self-service modification portal that allows you to make corrections,” she disclosed.

On the cost of obtaining a NIN, Chigbo clarified that enrolment and issuance of the National Identification Number are free.

She, however, noted that some other identity-related services attract approved fees, which are published on the NIMC website and paid electronically through the government Remita platform.

“Enrollment for the issuance of the National Identification Number, NIN, is free. There are other services, identity services that NIMC provide. Those ones have their charges, and those fees and charges are publicized on the NIMC website so that people can see what those charges are. And NIMC does not collect cash. Our transactions and the charges are paid electronically through the government Remita platform,” she said.

Advertisement

 

Kindly share this post
Continue Reading

Trending