FFT news digest — 24 March 2023
FFT news digest — 24 March 2023
TikTok
Reports that the BBC has banned TikTok from corporate devices provoked a flurry of questions from our valued clients. As often happens with cybersecurity news, the real story is less dramatic than the headline. The BBC has simply restated an existing policy that says apps should only be installed on corporate phones if they’re required for business reasons. In any case, as we pointed out last week, banning TikTok from work phones is of little use if it stays on people’s own phones. Danish Radio has imposed a complete ban on TikTok and will only allow it to be installed on special “TikTok phones,” although it’s said nothing about personal devices. Meanwhile, in Washington DC, TikTok’s CEO endured 4 and a half hours of combative (not to say performatively hostile) questioning by a US congressional committee. When Shou Zi Chew managed to get a word in between aggressive interruptions, he tried and failed to convince his interrogators that TikTok isn’t a weapon of the Chinese Communist Party. His efforts weren’t helped by a Chinese government statement saying it would “firmly oppose” any attempt to force a sale of TikTok, as some US lawmakers have suggested. There was little new amongst the sound and fury, though Chew did reveal that TikTok scans videos to verify the age of users. We do believe there are genuine reasons to be concerned about the potential risks of TikTok but a complete ban in the US is probably impractical. Motherboard’s view is that a ban probably wouldn’t work, but it would also be “Unconstitutional, Ludicrous, and a National Embarrassment.” Research by The Washington Post has found that TikTok does gather a lot of information about its users (though not their precise geographic location.) However, as it points out, TikTok’s US rivals actually collect far more. It’s also worth noting that for all the talk of banning TikTok, The Wall Street Journal found ($) more than two dozen US state governments making use of the app’s tracking technology on their websites. As techdirt says , rather than a myopic focus on TikTok, the US might consider the broader picture and pass an effective privacy law to regulate all the organisations that vacuum up as much data as they can.
Threats
Zero-days : Previously unknown vulnerabilities were a serious threat in 2022 with 55 of them weaponised to launch targeted attacks, the majority by Chinese state-sponsored threat actors. Most of the flaws were discovered in software from Microsoft, Google, and Apple, according to Mandiant . China : Beijing-backed hackers are targeting US government networks and private companies – and in many cases they’re evading detection. Mandiant says in some cases the hackers have the ability to gain and maintain persistence, even after software updates. Ukraine : Victims in Donetsk, Lugansk, and Crimea have been attacked with new malicious software designed to steal their data. The software is delivered by a fake PDF file. Once installed, it takes a screenshot every three seconds. Kaspersky Twitter : Attackers are using stolen high-profile verified accounts to scam Twitter users by offering (too good to be true) deals. From Twitter, the only response has been silence (and an occasional poop emoji). Mashable Oscars : With comforting regularity, awards season sees scammers providing booby-trapped copies of Oscar-winning movies. This year has seen a huge spike in pirated copies of Everything Everywhere All At Once. Download at your peril. TorrentFreak Clippers : Another warning not to install apps unless you’re completely sure they’re genuine. ESET has found dozens of copycat Telegram and WhatsApp websites that are trying to trick visitors into installing malicious Android and Windows apps. They contain contain clippers which can steal or modify content from a device’s clipboard. Microsoft 365 : Avanan has a video summarising the manifold ways in which Microsoft 365 is being exploited to launch targeted attacks.
Greece
Greek intelligence used powerful spyware to surveil a manager at Facebook parent, Meta, according to The New York Times. The dual US/Greek national was based in Greece at the time and the paper says it’s the first known instance of a US citizen being targeted with this type of technology in an EU country. The Times says information from a prior wiretap appears to have been used to construct credible text messages to her. After booking a COVID vaccination she received a confirmation message. Five hours later, she received another message, this time with a booby-trapped link that allowed the installation of spyware on her phone. The Greek government has denied using spyware. The lesson for all of us is to be cautious about clicking links, even if they appear genuine.
Screen sharing
Newly revealed flaws in screenshot tools underline why it’s important to avoid sharing edited versions of original photos and documents. Both Google and Windows have admitted that bugs in their tools meant edits could be reversed to reveal some or all of the original picture. The latest Android update addresses the Pixel issue . Microsoft has also released a version of the Windows Snipping Tool to fix the problem. At the moment, it’s only available in Microsoft’s test channel.
AI
There’s so much news about artificial intelligence that it merits a digest one its own. Rather than add another email to your inbox, here are some key developments this week. Warning : The CEO of OpenAI (the power behind ChatGPT) says he’s “a little bit scared” of the power and risks such models pose to society. In an interview with ABC America, Sam Altman warned that the ability to generate text, images, or code could be (ab)used to launch disinformation campaigns or cyber attacks. “I think people should be happy that we are a little bit scared of this,” he said. Insecurity : Open AI temporarily shut down ChatGPT this week after it emerged that a bug allowed allowed some users to see the titles of other people’s chat histories. Bloomberg Extension : Google removed a ChatGPT extension from the Chrome store because it was found to be hijacking Facebook accounts. It had been downloaded more than 9,000 times before it was pulled. Guardio Labs Voices from beyond : It’s now trivially easy to create eerily accurate fakes of real voices. As an example, one researcher has developed a chatbot that enables conversations with Apple’s long deceased founder, Steve Jobs. Meanwhile, deep fake tools are being used as part of Russia’s disinformation efforts. As John Gruber explains , the implications of this technology are scary, to put it mildly. Hallucinations : Researchers at Stanford University took down an AI model after finding it cost too much to run and was too prone to “hallucinations.” By hallucinations, they mean it got things wrong - including a recurring inability to identify the capital of Tanzania. The Register Doctor’s notes : The University of Kansas Health System says it will test software designed to help doctors automatically generate notes from conversations with patients. As The Register reports , “Big Tech is desperately trying to find ways to incorporate generative AI into their services.” What could possibly go wrong? Money maker : This chap gave $100 to GPT-4 (OpenAI’s latest AI model) and told it to make as much money as possible. So far it has investment, products and a growing team, but no substantive revenues. So rather like most startups… MIT Technology Review
In brief
USBang : A journalist in Ecuador escaped serious injury after a booby-trapped USB stick failed to fully detonate the explosive inside it. The government condemned what appeared to be a nationwide campaign targeting the country’s media. The modified brand name memory stick contained a 1cm capsule of RDX, a powerful explosive that would have caused serious damage and probably death had it worked as planned. BBC Stalkerware : The chances of encountering stalkerware have increased by 239% over the past three years, according to Avast . The best way to avoid these vile apps is to keep devices where you can see them, and watch for unusual behaviour such as reduced battery life. Check-up : The UK National Cyber Security Centre has released two security tools aimed at small and medium-sized organisations that lack the resources to address cyber issues on their own. They’re worth a look. Faces : Facial morphing is a method of combining two or more images to create a blended portrait that can be used for nefarious purposes. In one example, activists used a photo of a senior EU official to obtain a German passport. HelpNewSecurity has a simple guide to combatting a sophisticated technique. Breached : One of the most notorious underground data broking sites has shut down after the FBI arrested a 19-year old New York man. Alas, it won’t be long before the same hacked databases emerge elsewhere. KrebsOnSecurity Exclusions : If you have cyber insurance, you might want to check whether your policy still covers losses from social engineering. KnowBe4 says insurers have been responding to growing losses by excluding such threats. Robots : Australian researchers have developed a device that can be worn behind the ear and allows the wearer to control robots by thought. Nextgov