FFT news digest — 27 January 2023
FFT news digest — 27 January 2023
Embarrassing
The owner of the LastPass password manager says unidentified attackers managed not only to steal customer data from some of its other services but also made off with the key needed to decrypt some of the information. Just to emphasise; this data doesn’t relate to LastPass but to other GoTo services including RemotelyAnywhere, Central and join.me. GoTo, which was previously called LogMeIn, has 800,000 customers but hasn’t said how many of them are affected. Despite taking two months to release these details, GoTo’s statement leaves many questions unanswered and it’s been ignoring journalists’ attempts to get some clarification. In the meantime, if you or your company have used any GoTo services (including the popular GoTo webinar service), you should; - Change any related passwords - Delete and reinstall app-based two-factor authentication codes - Recreate backup codes - If you’re using SMS authentication codes, switch to app-based two-factor authentication As for LastPass itself, we continue to advise users to migrate to another service such as 1Password, Bitwarden or KeePass. It’s also important to be aware of current campaigns that try to fool users into revealing the master password used to secure their password vaults.
Threats
Brands : Bizarrely, Yahoo turned out to be the most-used brand in phishing emails in the last quarter of 2022. Check Point says they accounted for 20% of all phishing attempts and contained the subject line “YAHOO AWARD.” DHL was second with 16% and Microsoft third with an 11% share. OneNote : Attackers are using OneNote attachments in phishing emails to infect devices with remote access tools which allow them to install further malicious software. Bleeping Computer The Last of Us : Scumbags are exploiting the popularity of HBO’s TV adaptation of the video game. Kaspersky says the lures include a spin off game and the offer of a fake activation code. WhatsApp : Have you set up Two-Step Verification ? If not, your account is vulnerable to several different ways of hijacking it. This twitter thread explains how attackers can exploit voicemail to steal the code needed to take over the account. Tech support : Scams offering fake technical support are one of the oldest tricks in the book…and they’re still working. The FBI says they cost people in the US nearly $348 million in 2021. ESET has examples of the latest variations. Some are fiendishly clever. Android : A thoroughly wicked app masquerades as banking software and, once installed, gives attackers complete control over an Android device. Threat Fabric Routers : Also on Android, a new malicious app can remotely tamper with the wireless router that an infected phone is connected to. This allows it to change the settings that control how requests for web pages are handled. That enables the hackers to silently route victims to malicious sites. Kaspersky Airlines : There’s a long running scam on Twitter which involves a fraudster creating an account that mimics leading airlines. A new example includes a phone number. Fortunately, it’s deeply unconvincing but it’s worth being aware that some are more credible.
Spear-phishing
The UK’s National Cyber Security Centre is warning about ongoing attacks by Iran and Russia that are targeting individuals and organisations. The NCSC says its advisory aims to raise awareness among sectors including journalism, NGOs, think-tanks and academia. The campaigns are sophisticated and involve considerable research to identify the targets’ interests and contacts. The attackers use fake social media profiles that impersonate respected experts - and initial approaches have included invitations to conferences and events. The NCSC also warns that the attackers are frequently making contact through personal email addresses in an effort to circumvent corporate security controls.
A mass hijacking of Instagram accounts in Japan underlines how risky it is to base passwords on information that can be easily discovered such as birthdays and names. Police arrested a 28-year-old man on charges of hacking into the accounts of more than 60 people, most of them women. He is alleged to have worked out their birthdays from social media posts and used combinations of their names and dates of birth to guess their passwords. Yomiuri Shimbun newspaper reports that he admitted to the charges, saying he wanted to “harass people who are living a fulfilling life.”
Charm offensive
The company behind Pegasus spyware has admitted that some of its clients have misused its tools but says it has learned from its mistakes. In his first interview since taking over as CEO last year, Yaron Shohat told The Wall Street Journal that it only sells to “the customers or countries that the US would sell weapons to.” He added that NSO was committed to continuing to develop Pegasus because of demand from law enforcement and intelligence agencies. The interview took place in Washington DC where Mr Shohat has most likely been talking to lobbyists about persuading the Biden administration to relax swingeing sanctions imposed on NSO in 2021.