Spyware features found in Chinese state benefits app

guest · Jul 30, 2021

Spyware features found in Chinese state benefits app
July 29, 2021
https://therecord.media/spyware-features-found-in-chinese-state-benefits-app/

Spyware-like features have been discovered inside an app named “Beijing One Pass” that foreign companies operating in China are forced to install on their systems in order to access a digital platform to manage employee state benefits.

The spyware behavior was discovered last month by Insikt Group, the threat research division of Recorded Future, which analyzed a copy received from a customer who was forced to install the suspicious on its systems.
According to the team’s analysis, the app contained features that could be considered “suspicious for a benefits software application” and which are ordinarily found in malware strains.
Click to expand...

Recorded Future: “Beijing One Pass” Employee Benefits Software Exhibits Spyware Characteristics

We cannot confirm the intent behind Beijing One Pass’s containing spyware-like capabilities; however, the presence of software with similar spyware-like functionality, developed by at least one other Chinese region, the Shaanxi CA, is notable. These capabilities could be evidence of a deliberate attempt to gain access to devices (such as in support of China’s Cybersecurity Law that allows security organizations to inspect corporate networks remotely), the result of lax security practices by the certificate authorities (CA) and developers, or features designed to comply with Chinese laws and regulations.

Whatever the motive, installing such software on devices that have access to sensitive data is not advised. Recorded Future recommends that companies with China-based employees who need access to state benefit information using “One Pass” software not use it on devices with access to sensitive corporate data.
Click to expand...

During preliminary analysis, Insikt Group found that the “Beijing One Pass” PC client exhibits behaviors similar to spyware applications. The software contains built-in functionality that, taken in aggregation, raise considerable suspicions about the implication of its data collection capabilities:
Click to expand...

• Ability to autorun at Windows startup to ensure persistence
• Checking periodically for human interaction with the operating system as the file is run
• Attempting to read, create, or modify system registry ROOT certificates
• Disabling security and backup services on the host device
• Allowlisting domains for ActiveX use, which potentially allows it to connect to additional internet resources
• Reading data from the clipboard
• Recording screenshots
• Capturing and retrieving keystrokes
Click to expand...

Log in or Sign up

Spyware features found in Chinese state benefits app

guest Guest

Log in or Sign up

Spyware features found in Chinese state benefits app

guest Guest

Useful Searches