FFT news digest — 7 April 2023
FFT news digest — 7 April 2023
AI
Another bumper week of news from the wild world of artificial intelligence. The highlights; - There has been a 135% increase in the number of ‘novel’ social engineering attacks using generative AI (such as ChatGPT). In this case ‘novel’ means such attacks are much more realistic…and much more likely to succeed. Darktrace Meta has an app that can identify individual objects in images and videos even if it has never come across them in the data it’s been trained on. In other words, you can remove the background in a click. It’s impressive. ChatGPT can be tricked into generating valid activation keys for an app or an operating system. It’s not simple and the demonstration is for Windows 95 but then ChatGPT isn’t supposed to do this at all. Italy announced a ban on ChatGPT, citing concerns over its potential to spread false information and possible violations of the General Data Protection Regulation. BBC Confidential Samsung information was exposed after semiconductor engineers used ChatGPT to try to fix problems with their source code. TechRadar In a significant test for AI-powered surveillance, France is planning to use automated systems to identify suspicious activity during next year’s summer Olympics. Reclaim the Net A fascinating article on Medium examines how the “American smile” dominates images created by AI models because the majority of training data is drawn from pictures of modern Americans. Who do tend to smile in a particular way. Amid all the hype, Stanford University has an in-depth report examining what’s happened in AI - and where it’s going next. It’s long (386 pages) but even the highlights are well worth a look.
Threats
MacStealer : New malicious software is designed to steal sensitive data from Mac devices, including a user’s entire Keychain database. It arrives as an unsigned DMG file which, hopefully, no-one will be tempted to try to run. Uptycs EE : A spate of emails are targeting EE mobile customers. The messages are entitled, “We were unable to renew your monthly plan.” Malwarebytes YouTube : Take care with emails that appear to come from YouTube and claim to share a video explaining changes to rules and policies. It’s a scam and could be hard to spot at first glance. YouTube QuickBooks : Scumbags have restarted their use of QuickBooks as a means to send fake invoices from what looks like a genuine domain address. As Avanan explains , the only giveaway in these emails is a fake phone number. Credit terms : The FBI is warning about a clever fraud in the US which involves criminals applying to vendors for credit terms. They use fake documents to pass credit checks. Once they’ve done that they go on a spending spree before disappearing. Fake ranswomare : Criminals are exploiting the number of data breaches and ransomware attacks by pretending to have stolen information which they threaten to publish unless a ransom is paid. The gang better hope their own security is good because they’re also impersonating real ransomware operators. Bleeping Computer Backups : Given the ongoing threat from ransomware, it might be worth listening to the head of the US National Security Agency cybersecurity arm. His message; get religious about backups. The Register
Remote
Remote workers are still using personal solutions to carry out work tasks, mostly it seems because they’re just more convenient. A pretty comprehensive report by Lookout found 92% of those surveyed were using their own mobile devices for work. And nearly half of them used the same password for work and personal accounts. A particularly popular approach is to download, save or send work-related content to personal accounts. There’s plenty of evidence that the reason employees engage in risky behaviour is not because they don’t care. In fact, a University of Florida study found the most common reason for breaking rules is because employees are stressed and they just want to get the job done.
Breaches
High profile breaches this week include Western Digital, Uber and the UK’s criminal records office. In response to the Western Digital incident, the company shut down a range of services which has prevented users from accessing their MyCloud files (the current status can be found here ). Driver details were stolen from a law firm working with Uber. And ACRO took its customer portal offline while it investigates a “cyber security incident.” ACRO provides clearance certificates for a wide range of purposes including visa applications, employment and vetting. It takes its data from the UK’s National Police Computer and the information includes addresses, passport details as well as any cautions, arrests, charges or convictions. At the moment, it says there’s no “conclusive evidence” that personal evidence has been affected. Or put another way, there’s no evidence it hasn’t been.
Elections
As the 2024 US presidential election looms on the horizon, a report from the Global Cyber Alliance warns democracies to remember that there’s no such thing as down-time. The GCA, which is a non-profit focused on reducing cyber risk, says it’s vital to adopt a policy of continuous improvement to make elections as secure as possible rather than ramp up efforts in the run-up to polling day. As the GCA points out, there are plenty of cybersecurity resources around but they may be inaccessible in many parts of the world because of lack of funds or technology. In many ways, the report’s recommendations mirror those that apply to information security in general. It’s just that in this case, the future of democracy is literally at stake.
In brief
Fraud : Not to put too fine a point on it, the security surrounding consumer finance today is a continent-sized dumpster fire. A Business Insider journalist explains how her credit card was stolen by postal workers, her phone account was hijacked and she ended up facing a $10,000 bill with police saying they wouldn’t investigate. Good Samaritan : It’s notoriously hard to recover a hijacked social media account which is where a TikTok influencer comes in. Kyle Tobener provides security tips but also helps people regain access to their accounts. It’s a valuable resource. Bloomberg Telegram : Why bother with the dark web when you can just head to Telegram to manage your dastardly deeds. Kaspersky explains how it has become the key platform for selling and managing phishing tools and services. All in plain sight. Twitter : A researcher has warned that Elon Musk’s decision to open-source Twitter’s content recommendation algorithm can be exploited to silence specific accounts. CyberScoop . Crooks : A good week for law enforcement, Not only have some 120 people been arrested after a notorious cyber fraud marketplace was taken down, but Spanish police detained an equally notorious hacker. He’s accused of accessing government information and creating a service that could provide details about 90% of Spaniards. He’s 19 years old. Tesla : Reuters reports that Tesla employees shared highly invasive videos and images recorded by customers’ car cameras, even when the cars were turned off. Of course, given how common cameras are in all makes of car and in general, this is highly unlikely to be solely a Tesla problem. Open sesame : A security researcher says vulnerabilities in the Nexx brand of smart garage openers means they can be taken over remotely from anywhere in the world. As can their alarms and other smart devices. Ultrasound : And in more smart home news, US university researchers have come up with a way to exploit vulnerabilities in smart device microphones and voice assistants. The method works by modulating voice commands into near-ultrasound signals that humans can’t hear but voice assistants can. It’s then a simple case of embedding them in a video or a call. The Register