FFT news digest — 26 June 2020
FFT news digest — 26 June 2020
Morocco, journalism, spyware
Morocco says it’s investigating a journalist for receiving “foreign funding” for “intelligence services”, days after Amnesty International alleged the government had used Pegasus spyware to bug his phone. On Monday, Amnesty said Omar Radi had been “systematically targeted by the Moroccan authorities due to his journalism and activism”. That attack is alleged to have taken place shortly after the spyware developer, NSO Group, published a policy that assured its tools would only be used to fight serious crime. Pegasus enables a user to take complete control of a target device, and it has become notorious for attacks against journalists and activists. Meanwhile, in a warning to users of privacy-focussed tools, details have emerged of a successful attempt to compromise Tails, a well-known operating system used by journalists, dissidents and activists. Facebook paid a cybersecurity firm to develop a tool to exploit an undisclosed vulnerability in the video player included with Tails.
Opening up time
The challenge of COVID-19 has been clear for at least 3 months, but the hospitality sector has been given just over a week to figure out how to comply with government guidelines to record customer details. Pubs, restaurants and other affected outlets are being asked to keep this data in case their customers need to be contacted in the event of an infection. But the only guidance so far is to keep “a temporary record of your customers and visitors for 21 days, in a way that is manageable for your business”. What sounds simple on the surface will be a nightmare in practice. As well as the actual process of collecting and storing the (personal) data securely, there are obvious risks and challenges. Among the most obvious; accessing details for criminal purposes; using data for marketing; disposing of it securely. As with much of the UK’s response to the pandemic, this has the feel of too little thought, too late. Of course, a track and trace app would have been quite helpful…
MFA before it’s too late
Multi-factor authentication is a great idea, but here’s an additional reason to use it; if you don’t, there’s a good chance an attacker will. Veteran cybersecurity journalist, Brian Krebs, has the story of an Xbox user who suddenly found he couldn’t access his account. When he tried to reset his password, he found he couldn’t because a new Gmail address had been connected to the account, and multi-factor authentication had been turned on. While the criminals went on a spending spree with his Xbox account, the user wrestled with Microsoft bureaucracy to regain control of it. As Krebs says, the moral of the story is clear; turn on MFA before someone else does. The criminals accessed the account in the first place because the victim had reused the password for his Xbox account elsewhere. Every week brings more evidence that passwords are a dreadful security mechanism. Gradually, replacements are being introduced, but the process is slow because organisations are worried users won’t like them. They’ll like having accounts hijacked even less.
Tech giants face EU challenge
Germany’s highest court has ordered Facebook to stop aggregating data collected through Whatsapp and Instagram, saying it had abused its social media dominance to harvest data about its users illegally. The ruling upholds a decision by antitrust regulators that consumers faced a false choice; agree to hand over virtually unlimited personal data or not use Facebook’s social media services at all. The decision came as France’s Supreme Court dismissed a challenge by Google against a €50 million fine for failing to provide adequate information about its data consent policies. The decisions underline the challenges facing the business models of the mostly US-based technology behemoths. As the EU’s own evaluation makes clear , the full potential of the General Data Protection Regulation remains to be realised - but the fine levied on Google is a good indicator of the power that can be brought to bear. It’s also worth mentioning that Facebook faces a growing advertising boycott as part of the ‘Stop Hate for Profit’ campaign.
Safer browsing
Browsers know an awful lot about us, so it’s no surprise they’re such a popular target for attackers. Among the most effective ways to compromise them is to persuade us to install unnecessary applications that promise to warn about dodgy websites or carry out file conversions. Two examples this week should act as loud warnings to steer well clear of such offers. First, Google removed more than 70 malicious extensions from the official Chrome Web Store after researchers alerted it to “a massive, criminal surveillance campaign”. The researchers said the extensions could ’take screenshots, read the clipboard, harvest credential tokens stored in cookies or parameters, grab user keystrokes (like passwords)“. Meanwhile, a software installer targeted macOS users with multiple unwanted applications under the pretext of installing a single legitimate one. Three of the applications exploited the Safari web browser to inject ads, hijack download links and redirect search queries to steal clicks and generate income.
Email compromise gets smart
Email remains one of the most effective ways of attacking individuals and organisations, and this week Microsoft issued guidance on how to defend against efforts to compromise Exchange servers. While attackers frequently try to get hold of employees’ credentials, it says they are also increasingly focussed on exploiting out of date Exchange servers. In April, Rapid7 searched for Exchange servers and found 82.5% of them hadn’t been updated to fix a specific vulnerability. Other attacks are more sophisticated. Check Point discovered a complex campaign that involved exploiting Samsung, Adobe and Oxford servers to bypass normal security checks. And Armorblox has details of a campaign aimed at stealing login details of Bank of America customers. Criminals evaded normal protections by using a personal Yahoo address together with a newsletter platform, and by focussing on a limited number of users.
In brief
Australia’s National Science Agency has developed a tool to protect consumers from voice spoofing attacks. These use recorded clips of someone’s voice to trick victims into transferring money or revealing information. The tool distinguishes between live and recorded speech. CSIRO ‘Threat model’ is a bit of jargon we don’t much like, but it’s used to describe the particular issues that affect you. And research suggests that senior executives should be particularly aware of the threats they face. Research says 46% of those surveyed had been targeted with spyware in 2019. Atlas VPN Don’t be fooled into thinking reCAPTCHA puzzles are any guarantee a webpage is safe. Microsoft has details of a malicious software campaign that redirects users to a fake Cloudflare page complete with reCAPTCHA. Solving it downloads a malicious Excel file. Microsoft This week saw another effort by US lawmakers to force developers to redesign encryption with backdoors for use by law enforcement agencies. Alas, the ambitions of the latest bill bear as little relation to technological reality as previous efforts. Senate Judiciary Committee The end of Flash is nigh, and a welcome demise it is. This week Adobe said it would urge users to uninstall the unloved media player before it reaches its official end of life on December 31. After that, not only will there be no updates, all download links will also be removed. Adobe Despite bans in some US cities, we suspect the march toward ubiquitous facial recognition is unstoppable. This week, 7-Eleven Australia deployed it on customer feedback tablets. But its fallibility has been amply demonstrated. The American Civil Liberties Union has filed a complaint against Detroit police over a wrongful arrest caused by faulty facial recognition technology. itnews
Updates
Windows 10 : Another update, another set of problems - this time causing devices to crash with a c0000008 status code. Microsoft says it’s working on a fix for the issue that affects versions 1809, 1903 and 1909. Outlook : Microsoft is also trying to get to the bottom of error messages telling users there’s a problem with one of their data files. The message suggests using the Inbox Repair tool to fix it, but this doesn’t work. Teams : Collaboration platform is being launched for personal users, initially as a preview for iOS and Android devices. VMWare : Fixes for 10 vulnerabilities affecting ESXi, Workstation and Fusion products. Bitdefender : Update to address vulnerability in Safepay browser component. SecureDrop : Version 1.4.1 is a bugfix release. Apple : Big changes ahead for Apple users. At its (virtual) developers’ conference, it confirmed that - after nearly 20 years - it will soon be time to bid farewell to OS X and say hello to version 11.0 (which will be called Big Sur). Apple will return to building its own processors; it says this will introduce “a whole new level of performance’. Despite promises of an easy transition for developers, we suspect it will also bring a whole new level of compatibility issues. The next version of iOS (14) was released to developers this week. It too will bring big changes with a new home screen and improvements to Siri, including support for speech-to-text transcription to be carried out on the device itself.