2021

Human rights defenders need information from many sources to do their work effectively. But as issues evolve and new precedents are set, finding the right information to defend a particular case can be like looking for a needle in a haystack.

For example, a human rights advocate campaigning for LGBTQ rights may want to know which countries have made the most progress and what resolutions they’ve passed. To do so, they have to manually sift through thousands of pages of dense documentation covering global laws and victims’ testimonies to find what they’re looking for.

The curation and cataloging of documents makes this process much easier, but still relies on the manual work of skilled experts. To help, the non-profit organization HURIDOCS looked to machine learning. With support from Google.org Fellows and grant funding, they’ve built new tools that can automatically tag human rights documents so they are searchable — making the curation process 13 times faster.

How machine learning can make information more accessible

Typically, non-governmental organizations collect and curate large bodies of human rights information, with the goal of making these collections useful for advocates. Manually processing these documents can take several days, particularly when they’re published in unfamiliar languages or in PDF format which is difficult to search through. As a result, many NGOs face a large backlog of documents that remain to be processed, and by the time they’re added to collections new documentation often supersedes them.

Based in Geneva, HURIDOCS has been developing tools to manage and analyze collections of human rights evidence, law and research for nearly four decades. In 2016, they had an idea: What if machine learning could skim through documents, make terms extractable, and classify the content to catalog documents more quickly?

HURIDOCS took their idea to the Google AI Impact Challenge and was selected for a $1 million grant from Google.org and six months of technical support from a team of seven full-time pro bono Google.org Fellows. As one of the Fellows, I helped train AI models and make sure that the tool was useful to human rights experts, not just machine learning experts.

The curation process of human rights documents gets a boost

Since then, HURIDOCS has launched ML-powered features to improve platforms they’ve built with other NGO partners, and, earlier this year, they began integrating the technology into more of its tools, including their flagship application Uwazi. As a result, updating documents now takes one week instead of two to three months, and curators have been able to catch up on multi-year document backlogs.

In June, HURIDOCS won a CogX Award for its machine learning work, and now the organization is continuing to explore what else its machine learning models can do — from creating automatic tables of contents for documents to identifying references within text. With the power of artificial intelligence, HURIDOCS hopes to solve the trickiest challenges facing human rights defenders.

Nearly 4 billion people around the world don’t have access to the essential healthcare services they need, like immunizations or pediatric care. Complicating matters, the World Health Organization (WHO) estimates a global shortage of 18 million healthcare workers by 2030 — primarily in low-and-middle income countries (LMICs).

In many countries, healthcare workers use smartphone applications to manage data specific to certain diseases like malaria and tuberculosis. However, the data is often stored across multiple applications using different data formats, making it difficult for healthcare workers to have all the information they need. Additionally, it’s difficult for healthcare providers and organizations to exchange data, so they often don’t have a holistic view of individual or community health data to inform health decisions.

To give healthcare workers access to advanced mobile digital health solutions, we’re collaborating with the WHO on building an open source software developer kit (SDK). This SDK will help Android developers around the world, including in LMICs, build secure mobile solutions using the Fast Healthcare Interoperability Resources (FHIR), a global standard framework for healthcare data that is being widely adopted to address fragmentation and foster more patient-centered care. With Android OS powering 3 billion active devices worldwide, this collaboration provides an opportunity to support more healthcare workers on the frontlines.

Supporting developers and frontline health workers

Frontline health workers often work in areas where connectivity is unreliable. The SDK allows Android applications to run offline by storing and processing data locally, so health workers can deliver care without worrying about connectivity. When there is connectivity, the SDK will send the server the latest data collected on the device, and receive new updates to patient records.

The SDK is being designed to provide healthcare workers with access to decision support tools. For example, the WHO is using the SDK to develop EmCare, an app for healthcare workers in emergency settings. This application provides clinical decision support, based on the WHO SMART Guidelines content, which ensures compliance with evidence-based recommendations at the point of care.

By providing a common set of application components – like on-device storage, data-access and search APIs – the SDK reduces the time and effort it takes to build FHIR-based, interoperable digital health applications on Android, maximizing the efforts of local developers and unlocking their potential to meet their community’s needs.

The FHIR SDK facilitates interoperability and high-quality data exchange and is designed with a high level of security. Interoperability not only opens up the ability for healthcare workers to more easily gather community health data, but also makes it possible to use high-quality data to understand health trends, better prioritize high-risk patients and deliver more patient-centered care to everyone. All data stored by apps built on the SDK is strongly encrypted, and the SDK does not send or share any data with Google.

Extending interoperability globally

The global digital health community is rallying around FHIR to help improve health data interoperability, and we are committed to helping developers everywhere safely use our SDK to build secure and interoperable digital health solutions for their communities.

We are collaborating with WHO and a group of developers to make sure the SDK meets the needs of the community. We plan to release it more widely in the coming months and look forward to supporting developers as they build digital health tools for healthcare workers everywhere.

Every day, millions of people come to Google Search to ask important questions about their wellbeing. The COVID-19 pandemic drove even more concern for our health and the health of our loved ones – and this year, searches for ways to heal reached record highs. We saw questions about vaccinations, therapists, body positivity and mental wellbeing, to name a few. Today, we launched our annual Year in Search, which takes a look back at the top-trending searches of the year. Here’s a glimpse into some of the trending searches of 2021, a year we looked for ways to feel better and heal together.

Finding resources near me

Across the world, people searched for information on COVID-19 vaccinations and testing. The top trending “near me” queries in 2021 were “covid vaccine near me” and “covid testing near me.” To help people find credible, timely testing and vaccine information, we updated Google Search information panels, and worked with national and international partners to help people get vaccinated and tested.

Learning how to help

Helping ourselves and our communities was a priority for many of us. We asked questions about how to help others with anxiety and depression, and we also looked for help with our own mental wellbeing. Search interest for “therapists near me” hit record highs in 2021, and the phrase “why do I feel anxious for no reason” also hit an all-time high this year, spiking more than 400%. In addition to providing mental health resources and helplines, a quick Google Search also surfaces self-assessments to help you learn more about mental health topics like depression, anxiety, PTSD and postpartum depression.

Evaluating information effectively

Is it allergies or COVID? A sinus infection or COVID? Pfizer or Moderna? As many of us searched for health related information online, we wanted to know what we found was trustworthy. Connecting people with critical, timely and authoritative health information has been a crucial part of our role over the last year, and our team is constantly working to find ways to help people everywhere find credible and actionable information to help manage their health. To help people evaluate information online, we launched a new tool called About This Result, so you can learn more about the pages you see across a range of topics. About This Result helps people evaluate the credibility of sources, and decide which results are useful for them.

Search continues to be one of the first stops people make when making decisions, big and small, about their health — and so much more. To dive deeper into some of the other trending topics that defined 2021, visit yearinsearch.google/trends.

This year, searches for “how to heal” reached an all time high. Across the world, we were looking for ways to come back stronger.

We reflected on difficult times that continued to test our resolve. We thought about those we lost, asking “how to honor someone.” We looked inward, searching for “how to take care of your mental health” and asking the big questions, like “how to be yourself” and “what is my purpose?”

We looked outward, too – thinking about how we could help rebuild and strengthen our communities. We searched for how to make sustainable choices, how to help Afghan refugees, how to stop Asian hate and how to support people in need across the world – from communities in India battling the pandemic to communities in Texas facing severe weather.

And we looked to move forward, searching, “how to make a come back.”

As the world asked “how to be hopeful,” 2021 brought us hope. This was the year that search interest for “covid vaccine” officially surpassed interest in “covid testing.” Searches soared for “covid vaccine near me” – just as people eagerly asked when they could visit their family or eat in a restaurant again.

Like last year, people continued to search for ways to stay connected and entertained at home (“Squid Game” took the top spot this year for searches for TV shows to watch). But we also started to navigate a return to life outside the house, wondering how we should go about ditching the sweatpants (the top trending search for “how to style…” was “how to style straight leg jeans”).

As this year of comebacks comes to a close, we’re taking a closer look at trending topics across searches, news, people, “how to’s,” entertainment, trends and more from across almost 70 countries. Search can help you find a world of information – and what people search for can be a window into the world. So join us in taking a closer look at this year’s trending lists at yearinsearch.google/trends.

Today, we took action to disrupt Glupteba, a sophisticated botnet which targets Windows machines and protects itself using blockchain technology. Botnets are a real threat to Internet users, and require the efforts of industry and law enforcement to deter them. As part of our ongoing work to protect people who use Google services via Windows and other IoT devices, our Threat Analysis Group took steps to detect and track Glupteba’s malicious activity over time. Our research and understanding of this botnet’s operations puts us in a unique position to disrupt it and safeguard Internet users around the world.

We’re doing this in two ways. First, we are coordinating with industry partners to take technical action.

And second, we are using our resources to launch litigation — the first lawsuit against a blockchain enabled botnet — which we think will set a precedent, create legal liability for the botnet operators, and help deter future activity.

About the Glupteba botnet

A botnet is a network of devices connected to the internet that have been infected with a type of malware that places them under the control of bad actors. They can then use the infected devices for malicious purposes, such as to steal your sensitive information or commit fraud through your home network.

After a thorough investigation, we determined that the Glupteba botnet currently involves approximately one million compromised Windows devices worldwide, and at times, grows at a rate of thousands of new devices per day. Glupteba is notorious for stealing users’ credentials and data, mining cryptocurrencies on infected hosts, and setting up proxies to funnel other people’s internet traffic through infected machines and routers.

Technical action

We coordinated with industry partners to take technical action. We have now disrupted key command and control infrastructure so those operating Glupteba should no longer have control of their botnet — for now.

However, due to Glupteba’s sophisticated architecture and the recent actions that its organizers have taken to maintain the botnet, scale its operations, and conduct widespread criminal activity, we have also decided to take legal action against its operators, which we believe will make it harder for them to take advantage of unsuspecting users. .

Legal Strategy & Disruption

Our litigation was filed against the operators of the botnet, who we believe are based in Russia. We filed the action in the Southern District of New York for computer fraud and abuse, trademark infringement, and other claims. We also filed a temporary restraining order to bolster our technical disruption effort. If successful, this action will create real legal liability for the operators.

Making the Internet Safer

Unfortunately, Glupteba’s use of blockchain technology as a resiliency mechanism is notable here and is becoming a more common practice among cyber crime organizations. The decentralized nature of blockchain allows the botnet to recover more quickly from disruptions, making them that much harder to shutdown. We are working closely with industry and government as we combat this type of behavior, so that even if Glupteba returns, the internet will be better protected against it.

Our goal is to bring awareness to these issues to protect our users and the broader ecosystem, and to prevent future malicious activity.

We don’t just plug security holes, we work to eliminate entire classes of threats for consumers and businesses whose work depends on the Internet. We have teams of analysts and security experts who are dedicated to identifying and stopping issues like DDoS, phishing campaigns, zero-day vulnerabilities, and hacking against Google, our products, and our users.

Taking proactive actions like this are critical to our security. We understand and recognize the threats the Internet faces, and we are doing our part to address them.

Google TAG actively monitors threat actors and the evolution of their tactics and techniques. We use our research to continuously improve the safety and security of our products and share this intelligence with the community to benefit the internet as a whole.

As announced today, Google has taken action to disrupt the operations of Glupteba, a multi-component botnet targeting Windows computers. We believe this action will have a significant impact on Glupteba’s operations. However, the operators of Glupteba are likely to attempt to regain control of the botnet using a backup command and control mechanism that uses data encoded on the Bitcoin blockchain.

Glupteba is known to steal user credentials and cookies, mine cryptocurrencies on infected hosts, deploy and operate proxy components targeting Windows systems and IoT devices. TAG has observed the botnet targeting victims worldwide, including the US, India, Brazil and Southeast Asia.

The Glupteba malware family is primarily distributed through pay per install (PPI) networks and via traffic purchased from traffic distribution systems (TDS). For a period of time, we observed thousands of instances of malicious Glupteba downloads per day. The following image shows a webpage mimicking a software crack download which delivers a variant of Glupteba to users instead of the promised software.

While analyzing Glupteba binaries, our team identified a few containing a git repository URL: “git.voltronwork.com”. This finding sparked an investigation that led us to identify, with high confidence, multiple online services offered by the individuals operating the Glupteba botnet. These services include selling access to virtual machines loaded with stolen credentials (dont[.]farm), proxy access (awmproxy), and selling credit card numbers (extracard) to be used for other malicious activities such as serving malicious ads and payment fraud on Google Ads.

This past year, TAG has been collaborating with Google’s CyberCrime Investigation Group to disrupt Glupteba activity involving Google services. We’ve terminated around 63M Google Docs observed to have distributed Glupteba, 1,183 Google Accounts, 908 Cloud Projects, and 870 Google Ads accounts associated with their distribution. Furthermore, 3.5M users were warned before downloading a malicious file through Google Safe Browsing warnings.

In the last few days, our team partnered with Internet infrastructure providers and hosting providers, including CloudFlare, to disrupt Glupteba’s operation by taking down servers and placing warning interstitial pages in front of the malicious domain names. During this time, an additional 130 Google accounts associated with this operation were terminated.

Parallel to the analysis, tracking, and technical disruption of this botnet, Google has filed a lawsuit against two individuals believed to be located in Russia for operating the Glupteba Botnet and its various criminal schemes. Google is alleging violations under the Racketeer Influenced and Corrupt Organizations Act (RICO), the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, the Lanham Act, and tortious interference of business relationships, and unjust enrichment.

While these actions may not completely stop Glupteba, TAG estimates that combined efforts will materially affect the actor’s ability to conduct future operations.

Glupteba’s C2 Backup Mechanism

The command and control (C2) communication for this botnet uses HTTPS to communicate commands and binary updates between the control servers and infected systems. To add resilience to their infrastructure, the operators have also implemented a backup mechanism using the Bitcoin blockchain. In the event that the main C2 servers do not respond, the infected systems can retrieve backup domains encrypted in the latest transaction from the following bitcoin wallet addresses:

• ‘1CgPCp3E9399ZFodMnTSSvaf5TpGiym2N1’ [1]
• ’15y7dskU5TqNHXRtu5wzBpXdY5mT4RZNC6’ [2]
• ‘1CUhaTe3AiP9Tdr4B6wedoe9vNsymLiD97’ [3]

The following 32 byte AES keys for decryption are hard coded in the binaries:

• ‘d8727a0e9da3e98b2e4e14ce5a6cf33ef26c6231562a3393ca465629d66503cf’
• ‘1bd83f6ed9bb578502bfbb70dd150d286716e38f7eb293152a554460e9223536’

The blockchain transaction’s OP_RETURN data can be decrypted using AES-256 GCM to provide a backup command and control domain name. The first 12 bytes of the OP_RETURN contains the IV, the last 16 bytes the GCM tag, while the middle section is the AES-256 GCM encrypted domain. Full details of Glupteba’s network protocol can be found in this report from 2020, the following Python script illustrates how one can decrypt an encrypted domain name:

IOCs

Recent domains used for command and control:

• nisdably[.]com
• runmodes[.]com
• yturu[.]com
• retoti[.]com
• trumops[.]com
• evocterm[.]com
• iceanedy[.]com
• ninhaine[.]com
• anuanage[.]info

Recent sha256 hashes of malware samples:

• df84d3e83b4105f9178e518ca69e1a2ec3116d3223003857d892b8a6f64b05ba
• eae4968682064af4ae6caa7fff78954755537a348dce77998e52434ccf9258a2
• a2fd759ee5c470da57d8348985dc34348ccaff3a8b1f5fa4a87e549970eeb406
• d8a54d4b9035c95b8178d25df0c8012cf0eedc118089001ac21b8803bb8311f4
• c3f257224049584bd80a37c5c22994e2f6facace7f7fb5c848a86be03b578ee8
• 8632d2ac6e01b6e47f8168b8774a2c9b5fafaa2470d4e780f46b20422bc13047
• 03d2771d83c50cc5cdcbf530f81cffc918b71111b1492ccfdcefb355fb62e025
• e673ce1112ee159960f1b7fed124c108b218d6e5aacbcb76f93d29d61bd820ed
• 8ef882a44344497ef5b784965b36272a27f8eabbcbcea90274518870b13007a0
• 79616f9be5b583cefc8a48142f11ae8caf737be07306e196a83bb0c3537ccb3e
• db84d13d7dbba245736c9a74fc41a64e6bd66a16c1b44055bd0447d2ae30b614

All year, developers from around the world build Chrome extensions that make browsing easier, more productive and more personalized — whether you’re on the web to work, learn, play or all of the above. Today, we’re sharing our favorite extensions of the year that help people continue to virtually stay connected, get things done and have some fun along the way. Let’s take a closer look at them.

Communicate and collaborate

Whether you’re working from the office, your couch or a bit of both, extensions can help keep you connected with your teammates. Loom makes it easier to capture and share videos with others, while Mote allows you to give quick feedback through voice commenting and transcripts. Wordtune also helps you clearly communicate by rephrasing sentences and catching typos in emails and documents.

Stay productive

Other extensions offer new ways to stay focused and efficient. Forest gamifies productivity through virtual tree planting and rewards, and Dark Reader protects your eyes (and sleep schedule) during long workdays. Tab Manager Plus also saves you from drowning in a sea of never-ending tabs, and Nimbus Screenshot & Screen Video Recorder makes it easier to quickly screenshot and record content to share across platforms.

Learn virtually

With education happening online more than ever before, students and teachers need helpful virtual classroom tools. Kami creates an interactive online learning space for students and teachers, and InsertLearning helps you easily take notes and integrates with Google Classroom. Meanwhile, Toucan makes learning a new language fun and immersive, and Rememberry organizes vocabulary words into flashcard decks for quick studying throughout the day.

Make (and save) some change

To give your browsing experience a personal twist, Stylus helps you build and install custom themes and skins for your favorite sites. And Rakuten puts cash back in your pocket by automatically finding coupons and deals across the web — particularly helpful during one of the busiest years for online shopping.

To install and learn more about these extensions, visit our Chrome Web Store Favorites of 2021 collection. And if you’re a developer looking for tips to design a high-quality Chrome extension, check out our best practices.