FFT news digest — 20 January 2023
FFT news digest — 20 January 2023
Password Managers…again
Another week, another problem for a Password Manager, this time Norton’s. In this case, rather than resulting from a breach of Norton’s systems, it appears to have been caused by a failure by some users to follow basic security rules (though we’re not trying to put the blame on them). NortonLifeLock told customers that attackers used credentials stolen from other services to access some accounts. “Our own systems were not compromised. However, we strongly believe that an unauthorized third party knows and has utilized your username and password for your account,” NortonLifeLock said. In other words, affected users had used the same password for Norton and for other services, making it relatively simple to access their accounts - and anything saved in their Password Manager. This method is known as ’ credential stuffing ’ and it emerged this week that it resulted in nearly 35,000 PayPal accounts being hacked . There are a lot of lessons here but the most important is not to lose faith in Password Managers. They’re still the least worst way to use passwords safely. But it is absolutely essential to protect them with a unique, long, hard to guess password and to enable multi-factor authentication which makes it much harder for an attacker to access an account. The reason we’re not blaming users for this debacle is that there are multiple things the inappropriately named NortonLifeLock could have done to make their service more secure. Users could have been alerted if they tried to use a password that had already been stolen elsewhere or to reuse the same password for different Norton services. And, given NortonLifeLock detected unusual activity on December 12, we’re not clear why it didn’t tell anyone for almost a month.
Threats
Google ads : Just because an ad appears at the top of a Google search doesn’t mean it’s genuine. Google ads for fake versions of Zoom, AnyDesk and OBS are being used to steal users’ credentials. And criminals are also delivering links via YouTube videos. One Twitter user has a toe curling tale. Cyble Squatters : A variation on the malicious advertising theme involves buying ads for websites that look like the real thing but whose domain name is slightly different (a practice known as ‘typosquatting’). HP Wolf Security Amazon : Beware of fake products backed up by fraudulent reviews. ReviewGeek bought what was listed as a 16TB portable solid state disk. It turned out to be a 64GB microSD card in a posh box. It’s an ingenious scam because the hundreds of five-star reviews for the item were actually for completely different products which the scammers had hijacked. DHL : Fake delivery messages have been around for so long that you’d think we’d be immune to them. Apparently not. The DHL variant is still hooking victims. Armorblox has useful examples of how it works (though the company is trying to flog its own products). Dating scams : As the popularity of online dating apps continues to rise, so does the number of scumbags trying to exploit the people using them. ExpressVPN has a good overview of what to look out for. Personal details : ‘Guccifer’ is the nom de guerre of the hacker who broke into Hillary Clinton’s private email server (among many others) and thus helped Donald Trump get elected as US president. Guccifer has just completed a 4-year jail term and has been talking to The Intercept. As The Intercept points out, it’s worth recalling that he managed to access all those servers not through technical wizardry but largely by guessing the answers to people’s security questions. A lesson for us all not to assume that such details are secure.
Breaches
Multiple breaches this week underline the importance of security awareness - and the need to ensure suppliers are as secure as possible. For the second time in less than a year, email marketing firm MailChimp said attackers accessed the accounts of 133 customers after using a social engineering campaign to steal employee credentials. A leading technology company was breached after criminals managed to install malicious software on the laptop of one of its engineers. Nissan North America has been notifying thousands of customers affected by a breach at one of its software development suppliers. (In Nissan’s case, it took them six months to fess up to what had happened.) And, also in the US, T-Mobile says personal details of some 37 million customers were stolen because it failed to secure an application programming interface (API). Corsha explains the problem.
Fake
A new artificial intelligence tool from Microsoft can accurately replicate someone’s voice from a sample lasting just three seconds. Once VALL-E has learned a person’s voice, it can simulate audio of them saying anything. VALL-E’s creators suggest high quality text-to-speech and improved virtual assistants as possible uses. They also appear to be aware of the possible dangers, “Since VALL-E could synthesize speech that maintains speaker identity, it may carry potential risks in misuse of the model, such as spoofing voice identification or impersonating a specific speaker,” they say. Since criminal use of fake audio has already been well demonstrated , we don’t think this will end well. Incidentally, this week, it emerged that technology news site CNET has been using the help of AI to write news articles. Alas, it turns out they’re riddled with errors. CNET’s defence ; “humans make mistakes too.”
In brief
Iran : The government has sought to develop an “unprecedented” mobile surveillance system, and discussed its creation with companies in Russia, the UK and Canada. Citizen Lab Israel/Myanmar : A group of prominent Israelis have filed a complaint that accuses a technology company and Israeli officials of “aiding and abetting crimes against humanity in Myanmar” by selling spyware shortly before the military coup there. Reuters X-ray WiFi : Researchers have developed a method that can detect the three dimensional shapes and movements of human bodies in a room using only WiFi routers. ‘DensePose’ can literally see through walls. Motherboard Stealing time : A woman in Canada has been ordered to pay US$1,929 to her former employer for “time theft.” She had claimed she was wrongfully dismissed but time tracking software on her laptop was used to prove discrepancies in the amount of work she said had done. The Register