FFT news digest — 13 January 2023
FFT news digest — 13 January 2023
Spyware
More evidence of how the international market in spyware and surveillance technology is riding roughshod over so-called rules and regulation. Haaretz says (R) official government documents and international export records reveal that Israel allowed advanced surveillance equipment to be sold to the Bangladesh government, despite it not being on the list of countries to which such technology may be sold. Bangladesh said it did not buy the equipment “directly.” It’s not the first time Bangladesh has bought spyware tools from Israeli companies. In 2021, a notorious paramilitary unit purchased phone-hacking tools. The same year, the text “valid for all countries of the world except Israel” was removed from Bangladesh’s e-passports - although diplomatic relations between the two countries have not been normalised. The US Supreme Court has rejected attempts by the company behind Pegasus spyware to block a lawsuit filed by WhatsApp. The lawsuit against NSO Group alleges that it exploited a vulnerability in the messaging platform to install Pegasus on devices and secure complete control over them. NSO argued that it should be recognized as a foreign government agent and as such entitled to immunity under US law which limits lawsuits against foreign countries. Given that NSO Group is a private company (managed by a financial fund based in London), their argument is something of a stretch.
Threats
Cyber attacks on UK organisations increased by 77% in 2022 compared to the previous year, according to research by Check Point. That equates to an average of 788 attacks per week. Check Point says the rise is driven mainly by smaller, more agile threat actors and by sophisticated ransomware groups. In the latest high-profile incidents, The Guardian has now confirmed that the disruption it continues to experience was caused by a ransomware attack. And ransomware is also behind a “cyber incident” that has stopped the Royal Mail from accepting international shipments. Mass disruption to US domestic flights on Wednesday appears to have been caused by a corrupted database (rather than a cyber attack, as early reporting suggested). ChatGPT : Anyone looking to try out the latest thing in artificial intelligence should be aware that the iOS and Android stores are infested with apps trying to charge for a free service. TechRadar Android : There’s been a surge in infections from malicious software that impersonates banks including HSBC and Deutsche Bank. The SpyNote malware requests permissions to install new apps, intercept SMS messages, monitor calls, and record video and audio. Bleeping Computer Cars : Ford, Toyota, Mercedes, BMW, Porsche, Ferrari are among manufacturers whose vehicles are wide open to attacks which could allow them to be remotely controlled. Sam Curry Pokemon : A malicious website has been taken down after it was revealed that it could allow remote control of Windows devices. The website purported to host an NFT Pokemon card game. PC World OnlyFans : Visitors to the UK DEFRA’s website might have been surprised to find themselves redirected to fake OnlyFans adult dating sites. The problem was caused by a configuration failure . Pen Test Partners Shagle : A malicious Android app is impersonating the Shagle adult chat app which actually is entirely web-based (apparently). ESET
Metadata
The New York Times appears to be the latest news organisation to fall victim to the the perils of metadata. Motherboard reports that a “blockbuster” Times investigation “inadvertently exposed the apparent phone numbers of Russian soldiers as well as civilian family members they were speaking to.” Some of the sources provided frank assessments of the war in Ukraine and blunt criticisms of Russian leaders, including President Putin. Motherboard says the metadata, as well as internal notes for fact checkers, were contained in the article’s source code - and that the details remained online for months after publication.
Passwords
If you’re looking for an example of lamentably bad passwords, the US Department of the Interior has kindly provided a classic of its kind. An internal investigation was able to crack 21% of people’s work passwords, including hundreds of accounts with elevated privileges. Among the offenders were Changeme$12345, Polar_bear65, Nationalparks2014! and password1234. These were all allowed by the Department’s password complexity requirements.
The Twitter leak we reported last week appears to be cleaned-up data from a previous incident rather than a new one. Twitter said the data didn’t result from any “exploitation” of its systems, although it didn’t explain how the leaked data was accurately linked to email addresses associated with user accounts. Whatever the source or the cause, we’re not reassured. In other news, Bloomberg says more of Twitter’s content moderation team has been dismissed while the German government reminded Twitter that removing disinformation is mandatory. Meanwhile, The Information reports that Twitter’s “ad business is not recovering,” with Elon Musk’s cost-cutting “undermining” his efforts to drive up revenues.
In brief
Experian : Depressingly, it’s emerged that a misconfiguration in Experian’s website meant that a stranger who knew someone’s name, address, social security number (SSN), and birthday could view their full credit report. Brian Krebs explains the credit reference agency’s pathetic failure. Threema : Researchers identified multiple serious security vulnerabilities in Threema’s “maximum security app.” The issues could have allowed an attacker to impersonate a user and gain access to Threema servers, so not trivial. Threema dismissively said the issues affected an old version of its protocol rather than admitting the research was what made them fix it. Facial : Iran is to use facial recognition technology to identify women who aren’t wearing hijabs. Ars Technica Free : The UK’s National Cyber Security Centre is funding Cyber Essentials accreditation for organisations, including charities and legal aid firms. Roomba : An investigation by MIT Technology Review found that photos of product testers taken by iRobot’s robotic vacuum cleaner ended up on social media. It’s a tangled tale that says much about how artificial intelligence is trained (in this case involving contractors based in Venezuela).