FFT news digest — 17 March 2023
FFT news digest — 17 March 2023
AI
We’re reluctant to add to the mountains of coverage about ChatGPT and artificial intelligence but there are growing concerns about their impact on cybersecurity. As you probably know by now, ChatGPT is built on a ‘large language model’ which is a fancy way of saying it’s been trained on a vast amount of text-based data (in ChatGPT’s case, the entire content of the open internet). As you may have discovered, it has some extraordinary capabilities (including producing convincing responses that are complete nonsense). But it definitely can simplify everyday tasks at work such as summarising reports and creating slide decks. Unfortunately, according to research by Cyberhaven, this means employees have been feeding it with sensitive business data and personal information. It gives the example of an executive who cut and pasted his company’s 2023 strategy document into ChatGPT and asked it to create a PowerPoint presentation from it. In another case, a doctor entered the name of a patient and their medical condition and asked it to produce for a letter to the patient’s insurance company. The issue is that, once entered, the information is available to the organisation behind the large language model and, as the UK National Cyber Security Centre says, it “will almost certainly be used for developing the LLM service or model at some point.” And once incorporated, researchers have demonstrated that it’s perfectly possible to extract it. Verbatim. Microsoft, Amazon and Wal-Mart are among companies that have warned employees about using tools like ChatGPT. With the launch this week of GPT-4 and its even more sophisticated capabilities, it’s important that everyone understands why not everything is suitable for its consumption. Given that Microsoft is going to incorporate ChatGPT-like functionality into Microsoft 365, we await the results with interest - notwithstanding assurances that data will be used “in a secure, compliant, privacy-preserving way.”
Threats
Banking : Malicious software designed for Android devices is capable of spoofing more than 20 financial applications and creating fake phone conversations with what appear to be bank employees. CheckPoint Banking 2 : If you tweet to your bank (to complain for example) be aware that scammers are abusing the ‘quote-tweet’ feature to make you think a reply is authentic. The scammers’ message provides a number for a “helpline” and urges the recipient to call it. Bleeping Computer SVB : Scumbags are already trying to exploit the collapse of Silicon Valley Bank in the US. They’ve been contacting companies, claiming to be business partners and trying to redirect future payments. SANS Pig butchering : Yet another warning from the FBI about this vile scam which involves softening up a victim before stealing as many of their assets as possible. You’d think it wouldn’t work. The figures say otherwise. LinkedIn : North Korea is believed to be behind a new campaign that uses fake job offers on LinkedIn to target victims in the media, technology and defence sectors. The New York Times was among the companies impersonated. Mandiant Amazon : Yet another campaign is doing rounds to try to obtain credentials for Amazon accounts. This one warns that a Prime subscription has been deactivated. Avanan explains (in an irritating video). Acrobat Sign : Criminals are abusing Adobe’s document signing service to distribute malicious software designed to steal information from victims. Avast
Sleuthing
An amateur cyber sleuth in Chicago reckons she can find out your date of birth. Usually within 30 minutes. Engadget’s profile of Kristen Sokatoun highlights the importance of what friends and family post on social media. “My goal is always to find context clues, or find people who care less about their online presence than you do,” Sotakoun says. You can see the results of what she calls her “consensual doxxing” on TikTok where her exploits have resulted in 411,000 followers. Her modus operandi is very similar to ours; when we research what information is available online for our clients, it’s often other people’s posts that enable us to identify home addresses and other personal information. Obviously, fixing this is hard - but one key thing is for everyone to lock down their social media accounts so that they’re not visible to strangers like us.
Defeating MFA
We’re evangelical supporters of multi factor authentication - but we’re also realistic about the limitations of some of the ways it’s implemented. This week, Microsoft warned about software for sale in online forums that makes it worryingly simple for anyone to defeat the most commonly-used forms of MFA. It costs just $300 for the basic version and Microsoft says it’s behind more than a million phishing emails a day. The kit uses a technique called Adversary in the Middle (AiTM) which involves stealing an authentication file that is generated when someone logs into a site using a code generated by an app or received in a text message. This doesn’t mean we shouldn’t use such solutions - but we should be aware of their limitations and, for highly sensitive accounts, we should use a more secure solution such as a hardware key.
TikTok
The UK government’s decision to ban TikTok on official devices is eye catching but essentially nonsensical. As we’ve discussed before, there are legitimate reasons to be concerned about the data gathered by the app because there’s no doubt the information could be of use to a foreign power. Key amongst those details are geolocation data and information about what content users have viewed. But banning TikTok on official devices isn’t going achieve much if politicians and others connected with government continue to use the app on their personal phones. For most people, TikTok represents an insignificant risk. For people in sensitive roles, it should never have been used in the first place. Meanwhile, Forbes reports that the FBI is investigating the use of TikTok by its parent company to spy on journalists in an attempt to identify the source of leaked information.
In brief
Ukraine : Microsoft says Russian attackers exploited a (now fixed) vulnerability in Outlook to access European military networks. In a detailed report, it also warns that Russian cyber operators are preparing a new wave of espionage attacks against Ukraine and its partners. In Poland, security services are reported to have dismantled an extensive espionage network around Rzeszów Jasionka Airport, the largest NATO air hub for military aid to Ukraine. Amazon : Motherboard explains an ingenious fraud allegedly engineered by an Amazon operations manager in the US. Prosecutors say she conspired to defraud Amazon of more than $10 million by submitting fake invoices from vendors she had created for the purpose. Cables : An extraordinary letter from Micronesia’s outgoing president provides a detailed insight into how China conducts its foreign relations, including attempts to take control of the country’s submarine cables and telecommunications infrastructure (not to mention rampant bribery). The Register Cover-up : A salutary lesson from the US where a technology company tried to cover up a ransomware incident and has agreed to pay $3 million to settle the resulting charges (without admitting the charges). The Register Catholic : The Washington Post reports that a group of rich donors supported a a non-profit which bought tracking data that identified priests who used gay dating and hookup apps.