FFT news digest — 8 January 2021
FFT news digest — 8 January 2021
The cancer of disinformation
After the US Congress finally confirmed Joe Biden’s election victory, the Senate Chaplain concluded the session with a prayer; “We need to see in each other a common humanity,” he said . The problem is that a sustained campaign of disinformation, enabled by social media, has systematically destroyed the idea of an agreed set of facts. And if you listen to many of the rioters who broke into the US Capitol buildings, the idea of a common humanity has been lost along with it. Putting President Trump on the digital naughty step by removing his ability to tweet for 12 hours was a pitifully ineffectual response to the extraordinary utterances he has been making for years, not just this week. Facebook may have banned the outgoing president from its platforms “indefinitely”, but far deeper changes are needed. Social media platforms are being used consistently to spread ludicrous conspiracy theories, notably about the coronavirus pandemic, with no mechanism to report or effectively control false narratives. (For a forensic look at how this works, Bellingcat follows the online journey of Ashli Babbitt, the woman who died after being shot at the US Capitol, and Wired has a broader analysis .) Perhaps Wednesday’s events will accelerate the process of forcing technology companies to take responsibility for how they’re used. If not, we will look back to January 6 2021 and rue our failure to address the cancer in our societies.
Threats
Covid : Least surprising threat of the week is the torrent of Covid-related messages that so many people are receiving. Anything asking for personal details is dodgy. Ignore it. Trump sex : Some very powerful malicious software will give attackers complete control of an infected machine. And the lure? A Trump sex tape, of course. Threatpost Gaming : Online gaming has emerged as the next field for criminals to till. Researchers have found offers of access to the internal networks of gaming companies, as well as details of nearly a million compromised accounts. Kela Breaches : Data breaches are infuriating, but don’t be tempted to make the situation worse by tweeting personal details about them. The Next Web describes what not to do. Windows 7 : Appears to be running on at least 100 million machines, despite Microsoft ending support for the operating system a year ago. A horrible, horrible risk. The Verge Flash : Sorry to repeat this, but the demise of Adobe Flash is a gift to attackers. Do uninstall it by going to Adobe’s site . Don’t be tempted by messages that purport to provide an uninstaller. Mobile phish : There’s an increasing number of fake text messages - aka “smishing” - doing the rounds. These can be very effective. Never follow a link to do anything important. Motherboard PayPal : A current example is a campaign is using text messages that warn a PayPal account is “limited”. The message is believable. The web address isn’t. Bleeping Computer
SolarWinds fallout
It’s unlikely that we’ll ever know the full extent of the SolarWinds hack, but each week brings new revelations about what and who is affected. The US Department of Justice has confirmed that thousands of its email accounts were compromised, but the breach wasn’t discovered until nine days after news of the hack emerged. Worryingly, the attackers accessed Office365 mailboxes which suggests they could retrieve a wide range of data. US security agencies have formally blamed Russia for an “intelligence gathering effort” that it says is continuing.
WhatsApp redefines privacy
Want to continue using WhatsApp? If you live outside the EU, you’ll have to agree to a new privacy policy which will allow all your personal data to be shared with Facebook. The change is couched in a repeated commitment to user privacy, but what that really means is the information will be protected from prying eyes, as long as they don’t belong to Facebook. (The move has led to a flood of requests to join Signal .) Our advice is always to read the terms and conditions; it would be hard to find a better example of why that’s so important. Yup. It’s a pain and we don’t always follow our own advice. Terms of Service; Didn’t Read can help. And JustGetMyData will help you find out what big tech knows about you.
Media targeted
Media and technology companies make juicy targets for attackers and research suggests 34% of UK businesses experienced a serious security incident last year. The Hiscox Cyber Readiness Report 2020 says the sector is one of the most frequently targeted, together with financial services. Phishing was behind the majority of incidents and Hiscox puts the median cost at $40,000. More positively, it says there is “a new awareness of the cyber challenge” and spending on security rose by 39%.
Location
A couple of real world examples of the power of location tracking on mobile phones. It’s emerged that police located Ghislaine Maxwell thanks to cellphone data. She’d opened a secret account to talk to friends and her lawyer but that didn’t stop police tracking her down; a good example of how hard it is to use ‘burner phones’ effectively. Meanwhile, a researcher has discovered that a feature in the Telegram messaging app makes it easy for hackers to find your precise location. The vulnerability exists if you allow the app to find nearby Telegram users - and Telegram says it has no plans to change it.
In brief
BA data breach : British Airways is reported to be planning to begin talks about compensating customers affected by two data breaches in 2018. Sums of up to £3 billion are mentioned. Your Lawyers via info security Singapore : Predictably, it’s emerged that Singapore is allowing police to access data from its COVID-19 contact tracing app. Information has already been used in one homicide investigation, despite assurances this wouldn’t happen. ZDNet Wikileaks successor : ‘Distributed Denial of Secrets’ has donned Wikileaks’ mantle and is publishing data taken from the vast quantities of information posted by ransomware criminals. Wired Ticketmaster : Will pay a $10 million fine after employees used stolen credentials to spy on a competitor. The credentials were provided by a former employee of the rival company. DoJ Github/Iran : A German startup has regained access to its Github account after it was blocked for an apparent breach of Iranian sanctions. The problem; an employee turned on his laptop while visiting his parents in Iran. The Register Second-hand : Advice on how to protect your personal information when buying or selling computing devices. NCSC S.African kids : To foil ID theft, the government wants to ‘reregister’ every child in the country when they turn five. Business Insider Facial masks : The US Department of Homeland Security is trialling facial recognition technologies that can see through face masks with a “promising” level of accuracy. ZDNet Brexit.eu : As we warned, 80,000 UK-domiciled .eu domains were struck off when the Brexit transition period ended last week. Now it’s emerged that Brexit lobby group, Leave.eu, has moved its registration address to Ireland so it can keep its EU domain. The London Economic
Updates
Zyxel : Attackers are exploiting a serious vulnerability in several firewall and WLAN controller products which contain hardcoded credentials for an undocumented user account that has administrator privileges. Office : January 2021 updates have fixes for known issues impacting some editions of Office 2016, as well as Excel crashes and Outlook problems in Microsoft 365. Android : Monthly security updates for Android devices address 42 vulnerabilities, including four rated ‘critical’. Browsers : Security updates for major web browsers. Latest versions are; Firefox 84.0.2, Edge 87.0.664.75, Chrome 87.0.4280.141. Google : Updates for iOS apps will include privacy labels which disclose how data is collected from users, as required by Apple’s new policies. Dell : How very 2021. Three new monitors from Dell will have a built-in camera and mic, and a dedicated button for Microsoft Teams, so you can make your video calls even easier to start. Lord help us all.