FFT news digest — 10 March 2023
FFT news digest — 10 March 2023
Fake
These are still early days for accessible implementations of artificial intelligence but it’s already easy to see how dangerous they can be. These are just a selection of the stories we’ve seen this week; - Voice-cloning is being used to scam elderly victims. - A pro-Putin propaganda operation has used celebrity deepfakes to target politicians and celebrities. - Hackers have demonstrated how to turn Bing’s AI chatbot into a convincing scammer. - The Stable Diffusion image generation model has been used to create accurate high-resolution images from brain activity. - US special forces are planning to use deepfake videos to conduct internet propaganda campaigns. Given all this, perhaps it’s not surprising that a columnist in The Register has written an article entitled , “Why ChatGPT should be considered a malevolent AI – and be destroyed.” Alexander Hanff asked ChatGPT to tell him who he is. The chatbot promptly replied that he died in 2019. It then went on to provide a link to a non-existent obituary. The column is a good example of the limitations of AI as it exists today. For a wider perspective, Noam Chomsky has an opinion piece in The New York Times in which he discusses “The False Promise of ChatGPT.”
Threats
Email : 91% of cybersecurity leaders told a survey that data had been leaked externally by email. The top three causes; risky behaviour including copying files to personal accounts, human error such as sending messages to the wrong person, and stealing data in preparation for a new job. Egress (R) Zoom : A virtual event featuring the governor of the US Federal Reserve was abandoned after it was bombarded with pornographic images. It’s easy to prevent this by implementing basic controls . The organiser of this event said a security switch was set incorrectly…but he wasn’t sure which one. Reuters Location : Another example of the risks of fitness tracking and hiking apps. The popular AllTrails app enabled a security researcher to identify the movements of a former senior White House official, including his home address. Motherboard Investments : Household names including Barclays, BlackRock, Shell and DJI are among the brands being used by a gang to try to trick would-be shareholders out of their money. The scams begin on social media with YouTube videos and WhatsApp chats promoting fake websites. Resecurity Word: Do make sure your version of Microsoft Word is up to date. There’s a nasty vulnerability that was fixed last month. Just previewing a rich text format (RTF) document could allow code to be executed remotely on an unpatched version. Bleeping Computer DrayTek : The risk of using unsupported hardware is illustrated by two Vigor router models which are being targeted by attackers. Support for the 2960 and 3900 models ended in 2021 but they’re still widely used, with more than 4,000 vulnerable devices connected to the internet. Lumen
Stalkerware
Digital stalking remains commonplace, according to Kaspersky’s latest State of Stalkerware report. Kaspersky’s own products identified nearly 30,000 instances but, as the report points out , the real number is certainly far higher. Stalkerware is readily available, relatively cheap and gives its operator complete access to the device on which it’s installed. Installation does require physical access to a device which means the apps are often used in abusive relationships. “Research show[s] it is mainly women who are affected by this form of digital violence,” Kaspersky says. Russia, Brazil, India, Iran, and the US are the countries most affected. The most popular app is called Reptilicus. It markets itself rather unconvincingly as an “anti-theft program.” It costs just $50 per year.
Harvest
More than 28,000 mobile applications are collecting data from their users and selling the information to TikTok’s parent company even if those users have never installed the TikTok app, according to Gizmodo. An investigation found thousands of apps using TikTok’s software development kits. Last year Gizmodo showed how trackers embedded on webpages enable TikTok to track online activity even if someone doesn’t have the TikTok app. (Facebook’s parent company has a similar product .) Meanwhile, university researchers in the US have demonstrated that opting out of online tracking is frequently completely ineffective.
Lateral surveillance
Privacy advocates have long warned against the implications of technology like home security cameras. A homeowner in Ohio has just found out what that means in practice. Police investigating one of his neighbours demanded footage from his Ring cameras. Initially, they only asked for videos from a two-hour period. Later, the homeowner discovered the police had obtained a week’s worth of footage thanks to a court warrant that he knew nothing about. Among the footage was video from cameras in his living room and bedroom. As Politico reports , the homeowner is still trying to understand “how a a judge could have signed off on a warrant asking for footage from a camera inside his home, when the investigation was on his neighbor.”
In brief
Investment scams : The cost of internet crime recorded by the FBI reached an all-time high of $10.3 billion in 2022. For the first time, investment scams resulted in the highest losses, totalling more than $3.3 billion. IC3 Encryption : WhatsApp says it will pull out of the UK if the government’s proposed Online Safety Bill requires it to weaken the security of encrypted messages. We suggest there’s likely to be only one winner here. BBC Responsibility : An aggressive new cybersecurity strategy in the US would make technology manufacturers responsible for incidents caused by flaws in their products. This would be a major step forward in addressing the ongoing insecurity of most of the technology we use…but an official has already warned it could take a decade to enact. Bloomberg Drones : Researchers have reverse-engineered the radio signals from a drone, proving it’s possible to identify the location of its operator. Wired Bitwarden : A flaw in the password manager’s autofill feature could be exploited to steal credentials, according to Flashpoint . Autofill is a highly convenient feature of Bitwarden’s browser extensions. It’s disabled by default and it’s safer to leave it that way. Dating : Kidnappers in Brazil are using dating apps to target men between the ages of 30 and 51. Younger women lure them to meetings in secluded locations where they’re robbed and/or held for ransom. rest of world