FFT news digest — 3 March 2023
FFT news digest — 3 March 2023
LastPass
So here’s how LastPass says it got hacked. (Warning; it’s a painful read). There were four people in the password manager company with access to the ‘decryption keys’ needed to access its most sensitive data which was stored on Amazon’s S3 service. Attackers managed to compromise the home computer of one of those engineers by exploiting a vulnerability in video streaming software on it. They installed a tool to record any keystrokes on the machine. The engineer promptly entered the decryption keys. Game over. It’s hard to know where to start with this level of incompetence. LastPass hasn’t provided any details as to why on earth an engineer with access to the company’s crown jewels was accessing them on his obviously vulnerable home computer. Seemingly, there was no additional authentication required to access the Amazon storage which is a fundamental element in securing this type of online resource. And neither has LastPass given any details about its internal policies which would be expected to address these issues. Accidents happen - but this appears to be a case of an accident caused by incomprehensible incompetence. On the positive side, there are some great lessons to take away from LastPass’s misery. 1. Sensitive work should never be done on a personal device. 2. Online storage must be secured with the maximum level of security available. 3. Documents such as Acceptable Use Policies matter and 4. Consistent awareness sessions are essential to make sure such policies are understood and observed.
Threats
Proofpoint’s annual report has some scary statistics, including a dramatic increase in the number of organisations suffering a financial loss as a result of an email-based phishing attack. Based on data from Proofpoint’s own security products, the State of the Phish report found eight in 10 organisations had been affected - a rise of 76% over 2021. Proofpoint warns that while traditional phishing attacks continue, attackers have started using new techniques including live voice calls and methods designed to defeat multi-factor authentication. Avanan also has details of the latest tactics being used by fraudsters. Browsers : A separate report on web browsers reinforces our view that they’re a security menace, not least because they’re so ubiquitous. LayerX says they’re frequently misconfigured, out of date and used by employees to access unapproved apps. Slow down: There’s one thing we can do to help reduce the potential risk of these threats. Research funded by the University of Southampton suggests we should just slow down. Admittedly, this is hardly ground-breaking advice (we’ve been saying it for seven years) but the study does include concrete research – and we liked its definition of “pseudo-profound bullshit.” Amazon Prime : Phishing emails are using LinkedIn’s URL shortening tool to disguise bogus web links. The messages suggest there’s been a problem with Amazon Prime renewals. Malwarebytes Mobile malware : Attackers would love to take over your mobile device and the easiest way for them to do that is by getting you to install a booby-trapped app. Kaspersky found 1.6 million malicious installers last year; nearly 200,000 of them designed to steal financial information. We should all be careful about the apps we install and the permissions we give them. Pig butchering : This repulsive term refers to a scam that begins on dating sites (or even on LinkedIn) and then moves the conversation to money. Victims are conned into investing sometimes huge amounts of cash in non-existent schemes. Sophos has uncovered one scam that operates from Cambodia but is managed from China. It has earned more than $3 million in cryptocurrency in just five months.
iPhone risks
We’ve long suggested that mobile devices should be secured with alpha numeric passwords rather than simple passcodes. Having scanned hundreds of smartphones for spyware (and therefore needing the passcodes to unlock them) we can testify to just how dreadful the majority of them are. A birth year and a couple of zeroes really doesn’t do much to keep you safe. Now The Wall Street Journal is warning that crooks are stealing phones after watching people unlock them. As the paper points out, Apple allows all sorts of far reaching changes to be made if you know the passcode to a device. This includes locking you out of your accounts and accessing bank accounts.
Hacking Telegram
Following last month’s revelations about the exploits of cyber mercenaries, there’s some clarity about how it’s possible to hijack Telegram accounts. As a security researcher explains on Mastodon, the technique requires the help of a local mobile phone operator to intercept authentication texts. As we explain in our awareness sessions, many countries place security operatives inside the control rooms of phone operators so this is hardly a barrier. It’s always important to consider whether you trust who controls the network you’re using. But it’s also essential to enable 2-step verification on messaging accounts; without the verification code the account cannot be installed on a new device. These are the instructions for Telegram , WhatsApp and Signal .
TikTok
How much of a threat is TikTok? After all, numerous governments have now told their employees to delete it and the US House Foreign Affairs Committee has just given President Biden the power to ban it altogether. Our view is that TikTok is a definite risk factor for politicians, officials and, conceivably, for anyone of interest to the Chinese government. Despite repeated assurances from TikTok’s parent company that it protects personal data, Chinese law means it has no option but to comply with any official request to hand over anything it has. For most users, the risk is not immediate. The higher level issue stems from the rich data being accumulated by the app and what the information reveals about the lives of TikTok’s one billion users and the societies in which they live.