Just under half of UK citizens believe the contact tracing app under development by NHSX to track the spread of the coronavirus will be used by hackers to launch cyberattacks.
This is according to a survey of 1,000 UK citizens conducted by Censuswide on behalf of intelligence-led cybersecurity solutions provider Anomali, which found that 48% believed the app would be exploited by cybercriminals.
This is a concern that is echoed by cybersecurity experts, who point to criminals currently using the coronavirus to conduct phishing attacks by posing as government organisations. They believe cybercriminals will extend their efforts to the contact tracing app by sending consumers emails and text messages with bogus links to download the app.
“At this stage, nobody knows where to get the NHSX app from, so it can be reasonably expected that consumers will be faced with floods of emails with bogus links to convincing looking domains to download the app from,” said Jamie Stone, head of EMEA at Anomali.
“There is also the danger of smishing attacks; similar to a phishing attack, but the phish is done via SMS message. Due to the smaller screen real estate, people will be less able to check the veracity of the link so will be more trusting and might click it.”
Of those surveyed, 43% said they thought the contact tracing app might be used for smishing or phishing cyberattacks, but only 52% considered themselves to be able to identify a bogus email or text.
Contact tracing app cyberattacks: Personal data under threat
While some phishing and smishing attacks may be used to install malware on users’ devices, the nature of the app may also make it a powerful target for acquiring detailed personal data.
Stone posited that cybercriminals may use such cyberattacks to direct a user to a page that prompts them to provide personal data, under the impression that it is for the contact tracing app. And as the app is provided by the government, users may more readily provide detailed data about themselves that could then be used to conduct identity theft.
With this being the case, there is an urgent need for vigilance among consumers and clear, detailed government advice about the availability of the app to ensure would-be users don’t become victims.
“It’s tough to predict the increase in the volume of attacks we’ll see. However, we’re already seeing thousands of rogue and spoof Covid-19 domains being registered and used in attacks,” said Stone.
“Global interest around the virus, and each nation’s track-and-trace apps, means that attackers will likely use many of these domains to host phishing attacks via both email and SMS. People using Covid tracking apps need to be extremely vigilant and aware, ensuring that they’ve installed official government apps and that they are interacting with authentic messages from the agencies.”