Man who set himself on fire outside Trump trial dies of injuries, police say
A man who doused himself in an accelerant and set himself on fire outside the courthouse where former U.S. President Donald Trump is on trial has died, police said.
Researchers at a Toronto-based tech laboratory have uncovered security vulnerabilities and censorship frameworks in an app all 2022 Beijing Olympics attendees must use.
The Citizen Lab, a research institute at the University of Toronto's Munk School of Global Affairs and Public Policy that studies spyware, found a "simple but devastating" flaw in the MY2022 app that makes audio files, health and customs forms transmitting passport details, and medical and travel history vulnerable to hackers.
Researcher Jeffrey Knockel found 'MY2022' does not validate some SSL certificates, digital infrastructure that uses encryption to secure apps and ensures no unauthorized people can access information as it is transmitted.
This failure to validate means the app can be deceived into connecting with malicious hosts it mistakes as being trusted, allowing information the app transmits to servers to be intercepted and attackers to display fake instructions to users.
"The worst case scenario is that someone is intercepting all the traffic and recording all the passport details, all the medical details," said Knockel, a research associate, who investigated the app after a journalist curious about its security functions approached him.
Olympic organizers have required all games attendees, including athletes, spectators and media members, to download and start using the MY2022 app for submitting health and customs information like COVID-19 test results and vaccination status at least 14 days ahead of their arrival in China.
The app from a state-owned company called Beijing Financial Holdings Group also offers GPS navigation and text, video and audio chat functions and the ability to transfer files and provide news and weather updates.
Knockel found it's unclear with whom the app shares highly-sensitive medical information.
The Olympic playbook outlines that personal data such as biographical information and health-related data may be processed by Beijing 2022, International Olympic and Paralympic committees, Chinese authorities and "others involved in the implementation of the (COVID-19) countermeasures."
Knockel say MY2022 outlines several scenarios where it will disclose personal information without user consent, which include but are not limited to national security matters, public health incidents, and criminal investigations.
However, the app does not specify whether court orders will be required to gain access to this information and who will be eligible to receive data.
The final concern Knockel uncovered was that the app allows users to report "politically sensitive" content and found it has a censorship keyword list.
The list includes 2,442 political terms, including some linked to tensions in Xinjiang and Tibet, as well as references to Chinese government agencies. On the list are Chinese phrases translating to "Jews are pigs" and "Chinese are all dogs," Uyghur terms for "the Holy Quran" and Tibetan words referring to the Dalai Lama.
Knockel couldn't find evidence that the list was being used by the app.
"We don't know whether they intended for it to be inactive or whether they intended for it to be active, but either way, it's something that....can be enabled at the flick of a switch," said Knockel.
The Citizen Lab disclosed the concerns it found with MY2022 to organizing committees on Dec. 3, giving them 15 days to respond and 45 days to fix the issues, before it publicly disclosed the problems.
A new version of MY2022 for iOS users was released on Jan. 6, but Citizen Lab said no issues were resolved with the update. In fact, Citizen Lab said the update introduced a new "Green Health Code" feature that collects more medical data and is vulnerable to attacks because of its lack of SSL certificate validation.
The Beijing Organizing Committee said in a statement that the report failed to provide necessary evidence to support its conclusions and claimed the app is not compulsory to download on cellphones.
It said the Google Play store and Apple's App Store had both approved MY2022 for use. Neither Google nor Apple responded to a request for comment.
The International Olympic Committee said in a statement that it has requested a copy of the Citizen Lab's report to better understand its concerns.
The IOC noted it has conducted independent third-party assessments on MY2022 with two cyber-security testing organizations and found there are no critical vulnerabilities in the app.
Meanwhile, the Canadian Olympic Committee did not address the report specifically, but said it has reminded all members of Team Canada that the Games present a unique opportunity for cybercrime and they should be extra diligent about these risks.
It said in a statement that it has recommended Team Canada members leave personal devices at home, limit personal information stored on electronics brought to the Games, only connect to official Wi-Fi, turn off transmitting functions when not in use and remove any Games related apps when they're no longer necessary.
Knockel recommends anyone headed to the Olympics only use the app when connected to networks they trust, like a virtual private network (VPN).
Olympic participants should also consider taking conversations and other actions that are not mandatory to complete in MY2022 to other apps with better security, he said.
"But it's tricky," he said. "Even if they are aware of the security vulnerabilities in the app, they might not have a choice."
This report by The Canadian Press was first published Jan. 18, 2022.
A man who doused himself in an accelerant and set himself on fire outside the courthouse where former U.S. President Donald Trump is on trial has died, police said.
An Israeli airstrike on a house in Gaza's southernmost city killed at least nine people, six of them children, hospital authorities said Saturday, as Israel pursued its nearly seven-month offensive in the besieged Palestinian territory.
One day after a Montreal police officer fired gunshots at a suspect in a stolen vehicle, senior officers were telling parliamentarians that organized crime groups are recruiting people as young as 15 in the city to steal cars so that they can be shipped overseas.
Soulful gospel artist Mandisa, a Grammy-winning singer who got her start as a contestant on 'American Idol' in 2006, has died, according to a statement on her verified social media. She was 47.
Iraqi authorities said Saturday that they were investigating an explosion that struck a base belonging to the Popular Mobilization Forces, a coalition of Iran-allied militias, killing one person and injuring eight.
The House is preparing in a rare Saturday session to approve US$95 billion in foreign aid for Ukraine, Israel and other U.S. allies.
A rescue operation for an orca calf trapped in a remote tidal lagoon off Vancouver Island has been put on hold after it started eating seal meat thrown in the water for what is believed to be the first time.
Michael Gordon Jackson, a Saskatchewan man accused of abducting his daughter to prevent her from getting a COVID-19 vaccine, has been found guilty for contravention of a custody order.
Scottish comedian Samantha Hannah was working on a comedy show about finding a husband when Toby Hunter came into her life. What happened next surprised them both.
At 6'8" and 350 pounds, there is nothing typical about UBC offensive lineman Giovanni Manu, who was born in Tonga and went to high school in Pitt Meadows.
Kevin the cat has been reunited with his family after enduring a harrowing three-day ordeal while lost at Toronto Pearson International Airport earlier this week.
Molly Knight, a grade four student in Nova Scotia, noticed her school library did not have many books on female athletes, so she started her own book drive in hopes of changing that.
Almost 7,000 bars of pure gold were stolen from Pearson International Airport exactly one year ago during an elaborate heist, but so far only a tiny fraction of that stolen loot has been found.
When Les Robertson was walking home from the gym in North Vancouver's Lower Lonsdale neighbourhood three weeks ago, he did a double take. Standing near a burrow it had dug in a vacant lot near East 1st Street and St. Georges Avenue was a yellow-bellied marmot.
A moulting seal who was relocated after drawing daily crowds of onlookers in Greater Victoria has made a surprise return, after what officials described as an 'astonishing' six-day journey.
Just steps from Parliament Hill is a barber shop that for the last 100 years has catered to everyone from prime ministers to tourists.
A high score on a Foo Fighters pinball machine has Edmonton player Dave Formenti on a high.
A compound used to treat sour gas that's been linked to fertility issues in cattle has been found throughout groundwater in the Prairies, according to a new study.