FFT news digest — 31 March 2023
FFT news digest — 31 March 2023
AI
As technology leaders called for a pause on further development of AI systems, Europol warned of a “grim outlook” for their potential exploitation by criminals. The EU’s law enforcement agency pointed to practical examples that emerged “mere weeks” after the public release of ChatGPT. Although such systems can write computer code, experiments in creating ransomware haven’t been very successful. However, where they excel is in composing credible phishing emails that lack the telltale grammatical howlers and spelling mistakes of human-generated content. One example is used to lure people into installing fake ChatGPT software. At the moment, the key security threat probably comes from the ability of generative AI systems to create fake personas and misleading information. This week saw well-publicised fake photos of the Pope in a puffer jacket. A viral TikTok filter is extraordinarily effective in (completely) altering someone’s appearance. Midjourney (a leading image generator) is withdrawing its free version because it’s been used to create so many high-profile deepfakes. And the company behind ChatGPT began rolling out plugins that allow the model to access up-to-date information from common apps including Expedia, Shopify and OpenTable. “We’re working to develop plugins and bring them to a broader audience,” OpenAI says. “We have a lot to learn, and with the help of everyone, we hope to build something that is both useful and safe.” Such hopes haven’t reassured over a thousand technology leaders, including Apple’s co-founder, Steve Wozniak, and Elon Musk (who co-founded Open AI before distancing himself from it). “Advanced AI could represent a profound change in the history of life on Earth and should be planned for and managed with commensurate care and resources,” they wrote in an open letter. “Unfortunately, this level of planning and management is not happening, even though recent months have seen AI labs locked in an out-of-control race to develop and deploy ever more powerful digital minds that no one – not even their creators – can understand, predict, or reliably control.” Not all experts agree - but little specialist knowledge is required to predict that this genie isn’t going back into its bottle.
Threats
Phishing : A reminder that scumbags are exploiting legitimate services like PayPal and Google to send out phishing emails that bypass most security solutions. One commonly-used approach is to create a Google Docs file with a link to a phishing site. By tagging someone in the document, Google will deliver the notification to them. Any services with the same type of functionality can be exploited in the same way. 3CX : Security companies are warning about an ongoing threat targeting 3CX’s (very) widely-used voice and video-calling client. The attacks use booby-trapped 3CXDesktopApp installers to insert information-stealing software inside corporate networks. As a workaround, 3CX is telling customers to uninstall the app and install it again, or alternatively use its PWA client. PDFs : A booby-trapped PDF file led to the takeover of several popular technology channels on YouTube. Their owner said an employee downloaded “what appeared to be a sponsorship offer from a potential partner” and launched an attached PDF. The file allowed attackers to access browser data, including the session tokens used to authenticate users. Chrome : A fake extension for Google’s web browser is designed to steal information from Gmail accounts. The extension (known as ‘AF’) is spread by email. Germany/Korea joint advisory MacStealer : A malicious software service is targeting Mac users to try to steal credentials stored in the iCloud KeyChain and web browsers. Uptycs Tor : Malicious software disguised as installers for the Tor browser has been used to steal some $400,000 in cryptocurrency from nearly 16,000 users worldwide this year. Kaspersky WiFi : There’s been widespread coverage of a(nother) security vulnerability in the IEEE 802.11 WiFi protocol standard. The issue is complex and relates to a fundamental feature in the way WiFi devices communicate with each other. The issue is difficult to exploit so we aren’t overly exercised about it - but it does reinforce the reality that WiFi is not as secure as it should be.
Spyware
President Biden has signed an executive order prohibiting the US government from using commercial spyware that poses a risk to national security. In effect, this means that federal agencies can’t buy tools that have been used by foreign governments to spy on a US citizen or to quash dissent. Naturally, the order doesn’t say anything about spyware created by the US government itself. Nor does it delve into the murky waters of democracies which are reported to have used spyware against their citizens (including systematic use by multiple EU member states.) Meanwhile, ten allies joined the US in committing themselves to imposing controls on the export of commercial spyware. The executive order came as reports said commercial spyware had been used against at least 50 US government employees based abroad. And Google revealed two “limited and highly targeted” campaigns that exploited zero-day (ie previously unknown) vulnerabilities in Android, iOS and the Chrome web browser.
China
Hackers aligned with China are becoming increasingly adept at bypassing security solutions, according to Trend Micro. It says a group (variously known as Earth Preta and Mustang Panda) is using targeted emails and Google Drive links to lure victims to booby-trapped archive files.“To help prevent potential threats such as the one posed by advanced persistent threat (APT) groups, we suggest that organizations conduct phishing awareness training for their employees and partners to stress the importance of caution when opening emails, particularly those messages from unfamiliar senders or with unknown subjects,” Trend Micro says. Meanwhile, a whistleblower has leaked documents from a Moscow IT consultancy that are said to show how it supports the Russian military with cyber warfare tools.
AI
TikTok is China’s “Trojan Horse,” according to the head of the US National Security Agency’s cybersecurity unit. Rob Joyce told a conference that his key concern was not overt spying or data theft but the app’s potential to manipulate the content served up to American users. It’s not a smoking gun, but rather “a loaded gun,” he said. We agree - though we wouldn’t focus such concerns on TikTok alone. Echoing that approach, the French government banned public officials from installing any type of “recreational apps” on their work phones. The order covers TikTok but also other social media apps. Citing national security concerns, the order said no recreational apps had sufficient levels of security for them to be deployed on government-owned devices.
In brief
Twitter : Elon Musk reckons Twitter is now worth half of what he paid for it but, on the plus side, he’s obtained a subpoena aimed at identifying a former employee who leaked parts of the platform’s source code. In other developments; it emerged that Twitter has a secret VIP list (which is why you see so many of Musk’s tweets), it will no longer recommend tweets from unverified accounts, legacy verified checkmarks will disappear on April 1, and it’s blocked 122 accounts belonging to journalists, politicians and authors in India in response to a government request. The verdict of one observer, “Twitter is dying.” Telegram : An investigative news consortium has a report on Telegram’s role in disinformation campaigns. VSquare says , “German language channels play an important role as an extreme opinion hub influencing the rest of Central and Eastern Europe.” Avast : Czech regulators announced a €13.7 million against the cybersecurity and antivirus firm for selling private browsing data without user knowledge or authorisation. FACUA Political ads : German politicians and political parties have been using data about Facebook users’ political preferences to deliver microtargeted adverts, according to a privacy activist group. NOYB has filed complaints of multiple violations of the General Data Protection Regulation . Training : Only 10% of workers remember all their cybersecurity training, according to Cybsafe. Its survey found that most training is web-based and it hasn’t kept up with changes in the way we communicate and use technology. Tagged : A woman who lost her Apple AirPods after a flight from Tokyo to San Francisco tracked them down to the home of an airline worker. When questioned, the employee initially denied having them until he was shown the FindMy screenshots. CNN