FFT news digest — 10 February 2023
FFT news digest — 10 February 2023
Assume the worst
Every week brings new reports of data breaches, often because organisations have simply been too incompetent to protect the information they’ve gathered about us. The situation is so out of control that we should assume attackers will gain access to any details we provide online… if they haven’t already. This week, a survey of more than 2,000 online stores found that 250 of them were leaving backup files exposed to the internet - without any protection. Meanwhile, the TruthFinder and Instant Checkmate background check services confirmed they suffered a breach after hackers leaked a 2019 backup database containing the information of millions of customers. While organisational incompetence is often responsible for breaches, it’s a truism that unbreakable cybersecurity doesn’t exist - as criminal users of an encrypted messenger service have been discovering. As Motherboard reports , the Dutch authorities spent five months reading supposedly secure messages before arresting the alleged owners of the Exclu service along with some of its users. Its website boasted that “Our communication platform has integrated the most sophisticated encryption protocols in the world to ensure no one gets access to your data.” So that worked well. Given that we should assume nothing is secure and most personal details aren’t safe, the only defence is to make ourselves more difficult to attack than most of the rest of the population. In practice, that means adopting a password manager, enabling multi-factor authentication wherever possible, and keeping devices and software up to date. Effective security awareness sessions help to explain that it’s relatively easy to protect yourself. Here’s a handy checklist (PDF) , courtesy of the Quad Cyber Alliance. The worst thing is to assume it won’t happen to you. If you do, sooner or later, it will.
Threats
Overview : 42% of UK organisations reported a cyber attack in the past 12 months, according to insurance giant Hiscox . That’s up from 36% the previous year. The most common entry method was through cloud servers and business email. In the media sector (that comprises most of our clients), 71% of organisations have a standalone cyber insurance policy. It’s worth remembering that for smaller organisations this comes free as part of Cyber Essentials . Earthquake : Predictably, scumbags are exploiting the disaster in Turkey and Syria. They’re stealing donations by abusing legitimate platforms like PayPal and Twitter. One scam purports to be a “Turkey Earthquake Relief” appeal on Twitter. Bleeping Computer Booking.com : Be very careful with messages and emails relating to reservations made with Booking.com. An extraordinary article in Ars Technica explains that a mysterious leak of information means some customers have been enduring scams for almost five years. Vendors : Another warning about how supply chains are being exploited to defraud organisations. Malwarebytes and Abnormal Security explain how attackers map relationships to identify the weakest link. (This week, it emerged that a researcher managed to break into Toyota’s Global Supplier Portal.) Students : College students in the US are being targeted with fake part-time job opportunities. The phishing emails appear to come from the colleges’ job placement departments. Avanan Surveys : Online surveys and quizzes are as dangerous as they are popular. ESET explains how to spot the fake ones. Face swaps : As biometric face verification is more widely adopted, there’s been an increase in the use of synthetic imagery and video recordings (i.e. ‘deep fakes’) to attack systems. Help Net Security Illegal streams : The UK government says 3.9 million people in the country streamed live sports illegally in 2022. We reckon that’s probably an underestimate but, whatever the figure, the practice is really dangerous because of the risk of fake streams and malicious software.
Stalkerware
A software developer in New York has been fined $410,000 for creating apps that enable users to stalk their victims, enable harassment and access their cloud storage. The man was also ordered to modify the apps so that they would tell people they are being monitored. The order from the New York Attorney’s office sets out just how powerful the apps are. Among their capabilities, they let users secretly monitor text messages, locations, Gmail, WhatsApp messages and social media activity. The Coalition Against Stalkerware says one in four victims of stalking in the US reported that technology played a role in the harassment they experienced.
AI
Hackers have worked out how to bypass ChatGPT’s restrictions and are using it to sell services that allow the creation of malware and phishing emails, according to Check Point. It successfully tested one bypass that created a phishing email and a script to steal PDF documents from an infected computer and forward them to the attacker. Meanwhile, Reddit users have been enjoying themselves by forcing the hapless chatbot to do things it’s not supposed to. ChatGPT uses artificial intelligence to answer questions and perform tasks in a way that mimics human output. The OpenAI foundation that created the chat bot is well aware of the risks and has done its best to mitigate them. Unfortunately, that’s clearly not enough.
Phished
A Scottish National Party MP and a vocal supporter of Ukraine says Russian state-affiliated hackers accessed his personal email account after successfully phishing one of his staff members. It’s a classic attack. The MP said he received an email from his colleague which included a password-protected document with an apparent update on the military situation in Ukraine. He clicked on it which brought up a login page for the email account he was using. He entered his password which led to a blank page. It was days before he realised anything was wrong. The attack is exactly what the UK’s cybersecurity agency has been warning about. Even emails from trusted sources should be treated with caution.