FFT news digest — 24 February 2023
FFT news digest — 24 February 2023
One year on
A year after Russia invaded Ukraine, reviews of Moscow’s cyber operations award full marks for effort but a barely passing grade for results. Three separate reports all found that Ukraine experienced an unprecedented volume of data-destroying software over the past year. In one attack in January, attackers used a “cocktail” of data wipers to try to take down Ukraine’s national news agency. Ultimately, the attack only destroyed a few files rather than wiping all the news agency’s systems. Likewise, an attempt to take down a Ukrainian energy provider was largely unsuccessful. As a whole, Moscow’s strategy appears to have prioritised quantity over quality in a marked change from its approach in previous years. Data released by Meta suggests this approach has also extended to (dis)information operations. Instead of slowly building up an audience, operatives have been flooding Facebook and Instagram with low-quality accounts hoping some would evade detection. Meta’s head of security policy said it has been the sort of operation you might see from a spammer rather than stealthy and sophisticated Russian influence activity. Before writing off Moscow’s cyber capabilities, it’s worth mentioning a cautionary report from two Dutch intelligence agencies. Their view is that many of Moscow’s cyber operations against Ukraine and NATO members during the past year have not yet become public knowledge. In one notable success, Moscow did manage to disable the Viasat satellite network hours before the invasion began. This was a potential disaster for Ukraine which depended on Viasat’s broadband connectivity for part of its command and control communications (although the gap was swiftly filled by Elon Musk’s Starlink system.) Analysis by Sekoia examines in detail how the attack took place and concludes the attackers succeeded in taking control of Viasat modems and wiping their firmware by compromising their SSH network protocol. Initially though, the attackers managed to access Viasat via the “misconfiguration” of a VPN appliance.
Threats
iPhone calendar : If you’re receiving annoying messages on your iPhone, it’s possible you’ve unwittingly subscribed to a public calendar which scammers like to use as a way of delivering spam messages. The links often lurk on dodgy websites; another reason to steer clear of them. Malwarebytes ChatGPT : Malicious apps pretending to offer ChatGPT services are being promoted on Google Play and third-party Android app stores. Avoid! Dominic Alvieri Final Cut Pro : Beware pirate copies of Final Cut Pro. Jamf says some of them contain malicious software designed to steal cryptocurrency and hijack system resources to create it. Most Mac security apps don’t detect the threat. Telecoms : A previously unknown group is targeting telecoms companies in the Middle East in an apparent espionage campaign. The attacks begin with WhatsApp messages sent to specific individuals. They include a Dropbox link to content purporting to be about poverty in the region. SentinelOne South Korea : Suspected North Korean attackers targeted a journalist in South Korea with a malicious Android app as part of a social engineering campaign. Interlab Info stealer : Fake YouTube tutorials are being used to deploy malicious software that’s designed to harvest personal data from victims’ devices. The videos masquerade as guides on cracking (modifying) software but include boogy-trapped links in the descriptions. Social Media : An ongoing campaign is targeting YouTube and Facebook users in an attempt to infect their computers with an information stealer designed to hijack their accounts. Bitdefender
Hard times
While reliable figures are hard to come by, it does appear that raids on cyber crime markets are having a noticeable effect. Chainalysis says revenues earned by markets on the dark web fell from $2.6 billion in 2021 to $1.3 billion last year. Much of the decline was attributed to the shutdown of Hydra Market, which was taken down by German and US law enforcement agencies in April 2022. Hydra was based in Russia and specialised in drug sales, money laundering and other illicit services. High value cyber crime is no longer a low-risk activity. This week, Europol dismantled a Franco-Israeli group that use business email compromise (BEC) attacks to divert payments from organisations to bank accounts under its control. In a single fraud, the group had stolen $40 million from a single company buy masquerading as consultants.
Voice ID
We’re not keen on using voices to prove people’s identity - and the experience of a Motherboard reporter suggests our concerns are well-founded. Joseph Cox managed to log into his account by playing a series of AI-generated clips that mimicked his own voice. After he played the last clip (“My voice is my password”), the bank allowed him to access his account details. He carried out the test on Lloyds Bank in the UK. Its website assures customers that its “Voice ID” program is safe, saying “Your voice is like your fingerprint and unique to you.” It’s worth pointing out that most banks will require some other form of authentication before allowing payments or transfers. But even the details of recent transactions could be enormously helpful to a fraudster.
Second factor
Probably unintentionally, Twitter has given a significant boost to the security of its users by restricting the use of text-based two-factor authentication. From next month, Twitter says only paying subscribers will be able to use SMS messages to receive second factor authentication codes. Everyone else will have to use authenticator apps or security keys. The good thing is that these are far more secure than text messages (which were never designed with security in mind). If you’re about to start using an authenticator app, do beware of fake versions that are doing the rounds at the moment.