FFT news digest — 3 February 2023
FFT news digest — 3 February 2023
Deep fakes
Just two months after the launch of ChatGPT, UBS says it’s estimated to have reached 100 million monthly active users making it the fastest-growing consumer application in history. The chatbot can discuss any topic in a way that mimics human interaction. For comparison, it took TikTok nine months to reach the same number of monthly users, and Instagram about 2.5 years. The capabilities - and popularity - of ChatGPT have caused concern about the potential for it to be used for nefarious purposes. Its makers have already released a tool to distinguish between text written by a human and AI-generated text, although it warns that its ‘classifier’ is not “wholly reliable.” One security risk to be aware of is that ChatGPT can create highly credible phishing emails that lack the telltale grammatical errors we may be used to. Research from Blackberry says most IT professionals believe it’s already being used in nation state attacks. Meanwhile, a new artificial intelligence tool is already being used to make fake audio clips of celebrities. Its only a few days since ElevenLabs released its tool which allows users to create entirely new synthetic voices for text-to-speech audio or to clone somebody’s voice. The company now says it’s “seeing an increasing number of voice cloning misuse cases.” More positively, there’s a proposal that such generated content should be watermarked so that it can be easily identified as such.
Threats
Phishing ads : 1Password is the latest password manager to be targeted by scammers. As with Bitwarden , new and existing users of 1Password are targeted through malicious ads that appear in Google Search results. Sharing passwords : Most of us share our passwords with our partners, at least that’s what a survey by ExpressVPN suggests . In the US, it found the second most-shared passwords were banking PINs. Another reason for using a password manager. Reward apps : A new scam involves creating activity tracking apps and putting them in Google’s official store. They offer rewards for reaching targets and they’re a con - but they’ve been downloaded on over 20 million devices. Dr. Web USB : It’s an old threat but still an active one. Palo Alto Networks’ Unit 42 has uncovered a tool designed to create malicious removable USB drives that can affect any Windows host to which they’re connected. DocuSign : A malicious DocuSign document was used to try to steal the credentials of more than 10,000 people across multiple organisations. DocuSign is one of the most popular brands with scammers. Armorblox JD Sports : The UK retailer says some 10 million customers are affected by a data breach. Its less than comprehensive account suggests the stolen details included names, addresses, phone numbers, email addresses, order details, and the last four digits of payment cards. Financial advisers : Fraudsters are impersonating genuine US financial advisers in order to gain the trust of victims and persuade them to put money in fake investments. Domain Tools
Microsoft
News from Microsoft illustrates why it’s essential to be paranoid about giving third-party apps permission to access information. In December, attackers managed to impersonate legitimate companies and dupe users into granting access to their online accounts. They did this by registering fake versions of legitimate-sounding apps, such as “Single Sign On (SSO)” and “Meeting” that came with convincing designs, including Zoom icons. Proofpoint says the apps displayed equally convincing dialog boxes asking for complete access to user accounts. Once granted, that access would last up to a year, giving attackers free rein over the compromised account.
Hard line
This is mainly a story for anyone who has the unenviable responsibility of procuring and managing the devices used by employees. Be warned; it’s a wild ride. The short version is that an unnamed company decided that it would enforce a zero-tolerance approach to compliance for end user devices. In other words, devices with out of date software would be wiped and deleted from the Intune management platform. It’s a big company, so there were 1,647 such devices. Many weeks of warnings cautioned that the consequences of such a plan would be ‘sub-optimal’ but they were ignored. The Mastodon thread detailing this series of unfortunate events is amusing and instructive in equal parts.
Redaction
Redacting documents so that sensitive information can’t be read is a minefield and has led to numerous unintended and unfortunate exposures. Now, research by Panda Security has found that the redaction features in some PDF applications don’t actually work. Although portions of text appeared to be hidden, copying them into a new document allowed them to be read. Our own view is that redacting content should never be done in the original document because of the possibility of hidden watermarks. And even manually writing over it may not hide the original source because of the possibility that the wording of a document is unique.