FFT news digest — 17 February 2023
FFT news digest — 17 February 2023
Killing democracy
A wide-ranging international investigation has revealed the tactics of a group of Israeli-led cyber mercenaries willing to undermine democracy for anyone willing to pay them enough. The investigation, called Story Killers , was coordinated by the Paris-based Forbidden Stories and involved more than 100 journalists from 30 media organisations. The Israeli cyber contractors were lured into pitching their services to journalists posing as potential clients interested in disrupting an African election. Among the contractors’ suggested tactics were hacking, forging blackmail material, spreading disinformation, planting false intelligence, physically disrupting elections, and deploying targeted social media campaigns. During the discussions, one of the contractors’ leaders boasted about how easy it was to access the Telegram accounts of influential politicians and their advisers. “I know in some countries they believe Telegram is very safe,” the leader said in a Zoom demo. “So, here, I’ll show you how safe it is…this is some minister of some country, I can go [and] I can check all his calls.” The accounts appeared to belong to an adviser to the now Kenyan president, William Ruto. It seems access to them was obtained by exploiting the lamentably insecure system that underpins international cellphone services. The lesson is not to rely on SMS messages as a second authentication factor. The investigative project was initiated following the killing in 2017 of Gauri Lankesh, an Indian journalist who was shot while reporting on Hindu extremism and the rise of online disinformation in her country. Shortly before her death, she was subjected to relentless attacks on social media that depicted her as an enemy of Hinduism. This is just one of the tactics employed by the cyber mercenaries. Obviously, it illustrates the consequences that online abuse and disinformation can have in real life.
Threats
OneNote : With apologies for repeating ourselves, do be on the lookout for OneNote attachments (with the extension .one). Multiple security companies have spotted these being used to try to infect computers with malicious software. Now Sophos says a a more prominent group has begun using the method in a much more automated, streamlined fashion. Pakistan : A new group is targeting organisations in Pakistan by using news-related content as phishing lures. Blackberry Geotargeting : Attackers are using the same geolocation tools as marketers to make sure their phishing emails and fake websites are relevant to the location of their target. Avanan Spearphishing : On the same theme, GreatHorn says that criminals are increasingly using specific themes and highly targeted emails to increase their chances of success. Surveillance : Proofpoint says a threat actor has developed a tool that’s designed to analyse potential victims to see if they’re worth attacking. The malicious software arrives in emails containing Microsoft Publisher (.pub) attachments or PDFs containing URLs that download dangerous JavaScript files. Sextortion : Romance scams brought in $1.3 billion dollars in the US last year, according to the Federal Trade Commission . Some 70,000 people suffered a median loss of $4,400. The FTC also highlighted a rise in the use of sexually explicit images. Facebook : The latest trick to hijack your Facebook account is to tell you it’s been disabled because you’ve violated “Community Standards.” If you receive this type of email, never click on the link! Malwarebytes
Weakest link
Following last week’s data breach at Reddit, its chief technology officer was quick to point the finger of blame at employees saying , “as we all know, the human is often the weakest part of the security chain.” There’s a rich history of organisations blaming staff when something goes wrong - and doing so is entirely unhelpful. Of course mistakes are inevitable but effective awareness training should empower employees to be a key part of an organisation’s defences, rather than be dismissed as the weakest link. Equally, it’s essential to protect against attacks that are designed not only to steal passwords but also bypass multi-factor authentication - as happened with Reddit. Its CTO might be better off focussing on that rather than pointing the finger at employees.
Pentagon
If you’re concerned about the security of the smartphones in your organisation, we’re pretty sure the situation is unlikely to be quite as bad as it is at the Pentagon. An audit found that unauthorised apps were commonplace on official phones - and many of them had been downloaded from the Defence Department’s own internal app store. The report also concluded that the Pentagon’s employees had little idea about what constituted acceptable use of their devices. Meanwhile, it’s emerged that the US military also failed to train its middle ranking officers in the proper use of email. In a perfect ’Reply Al’l storm, Military.com says thousands of inboxes became buried in an avalanche of emails after an army captain replied to an entire 13,000-member distribution list. “There are far too many technically illiterate captains who would benefit from learning how to properly use Microsoft Outlook…instead of replying like boomers using new technology,” an anonymous columnist wrote.
Torturing AI
We’re surprised that Microsoft is surprised that people have been trying to break its new artificial intelligence-powered search tool. In a frankly hilarious response to some of the weird things that have been going on with Bing, Microsoft says it says it didn’t “fully envision” it being used for “general discovery of the world” or for “social entertainment.” Hmm. A little over a week after testing began, an entire subreddit is filled with examples of Bing insulting and manipulating users, lying to them, questioning its own existence, and describing someone who forced the bot to disclose its hidden rules as its “enemy.” Entertaining as all this is, it simply underlines the limitations of such tools in their current form - and the fact that they are neither sentient nor truly intelligent.