FFT news digest — 21 April 2023
FFT news digest — 21 April 2023
Spyware
Suitably mixed messages from the world of spyware. One company is reported to be closing and there’s talk of a shrinking sector in Israel while a new report says Mexico has continued to use Pegasus and the UK is warning about the extent of the threat from surveillance software and hackers-for-hire. Of course, the nature of the industry means all these things are perfectly capable of being true at the same time. The apparent closure of QuaDream follows last week’s report from Citizen Lab and Microsoft that at least 10 governments had used one of the Israeli company’s tools against journalists and activists. Calcalist says increasing publicity about the Israeli spyware industry had led to problems obtaining new export permits from the government. The Israeli business news site adds that QuaDream’s problems reflect wider difficulties facing what was a substantial sector in Israel. But the demand for spyware products means, while companies may close, the skills that powered them will find welcome homes elsewhere. Nowhere illustrates that demand better than Mexico which, according to The New York Times , has been an enthusiastic user of the NSO Group’s Pegasus product since 2011. This week, Citizen Lab reported that Pegasus was deployed in 2022 against Mexican human rights activists. Researchers found the spyware exploited at least three “zero-click” issues that enabled the activists’ iPhones to be compromised without them doing anything. Researchers at Jamf came to similar conclusions and said mobile spyware continues to evolve. In its warning, the UK’s National Cyber Security Centre said hackers-for-hire and surveillance software are targeting thousands of people every year. Among its conclusions, the report says the sophistication of commercial spyware rivals the capabilities of state-linked groups and this creates a threat that extends to corporate espionage. Other than keeping devices up to date, there’s little that can be done to combat these threats. There are (expensive) scanning tools and Apple’s security-focussed Lockdown Mode appears to have worked in Mexico. But in a race between attackers and defenders, the bad guys continue to set the pace.
Threats
Trends : The number of phishing attacks in the first quarter of this year reached the highest total since 2018, according to Vade. Its report highlights a focus on stealing credentials for office apps such as Microsoft 365. It says tactics are becoming more sophisticated and include warnings about expired passwords, fake CAPTCHA challenges and the use of Google Translate to obfuscate web links. PDF : Windows users should beware of booby-trapped PDF documents that tell you to open “protected” files.” To make it more likely the files will be opened, they arrive as an attachment in a hijacked email thread. Once opened, the malicious payload accesses and extracts sensitive data. Bleeping Computer Linktree : The social media landing page platform is being used to create pages that contain malicious web links. (In case you haven’t come across it, Linktree allows a user to showcase their personal details and social media handles in a single place.) Avanan Browsers : A tool designed to steal credentials from a wide range of web browsers is being distributed on a Telegram channel, according to Uptycs. It says it’s designed to steal login information for banks, email accounts and other high value targets. Another reason not to store passwords in browsers and to keep them up to date. macOS : A researcher says , for the first time, a leading ransomware gang has created a tool targeting Macs. This isn’t a cause for alarm because it’s hard to deploy ransomware on macOS devices but it does show criminals are trying to work out how to exploit an untapped market. SentinelOne Routers : More than half of the secondhand business routers bought by ESET researchers hadn’t been wiped before being sold. This meant they contained credentials as well as enough information to identify their previous owners. Weebly : A “massive” malicious advertising campaign is using hundreds of fake websites designed to trick elderly computer users into falling for technical support scams. The attackers are taking advantage of the Weebly platform. Malwarebytes
Training
There’s a ton of AI-related news this week (some links below) but we wanted to focus on the issue of leaking confidential information - something that has already happened to Samsung . Perhaps the most significant risk at the moment concerns the use of generative AI tools like ChatGPT to transcribe (and translate) meetings. The latest version of ChatGPT has a remarkably accurate voice-to-text feature - and an equally useful shortcut to create minutes. But the way generative artificial intelligence works means it can learn from the information it is given - including anything that’s confidential. A University of New South Wales Professor explores the issue (via TechXplore ). Here are links to other stories in case you’re interested. Google : Bard chatbot a “worse than useless..pathological liar.” The Verge Schumacher : A fake interview with Michael Schumacher. Engadget Voice Changer : Voicemod arrives on macOS. Kidnap: Could voice copies be used in fake kidnaps. Malwarebytes Stolen : How AI affected a voice artist. Writer : $80 per hour author replaced by ChatGPT. Cybersecurity : the double-edged sword. OpenAI Snapchat : Your personal assistant. Snapchat Google : AI tools will ‘remix’ content for advertisers. FT Musk : TruthGPT - his plan for “a maximum truth-seeking AI.”
Gen Z
The publication of hundreds of secret documents by a US National Guard airman has highlighted the challenge of keeping information secret among a generation which has grown up online. While this recent leak concerned the US defence establishment, the same threat exists for all organisations, both public and private. The issue is complicated by the widespread use of online forums to attract and recruit people in their 20s (a longstanding tactic used by the US military to address its recruitment shortfall.) There’s no easy solution to this issue but it’s essential to discuss the issue of confidentiality with new employees and ensure they’re fully aware of their responsibilities to exercise discretion on social media - and when using AI chatbots.
In brief
3CX : The recent attack on a major business communications provider began with one of its suppliers. Mandiant says this is “the first time it has seen a software supply chain attack lead to another software supply chain attack.” If nothing else, this underlines our longstanding warning that companies are only as safe as their least secure supplier. Twitter : Elon Musk told Fox News that the US government had full access to private messages on the platform. Insiders say this is probably nonsense - though it’s certainly true that Saudi spies had such access. (The Saudi sovereign wealth fund is now the second-largest Twitter shareholder .) Swatting : Motherboard says a single Telegram channel is behind many of the swatting incidents in the US. The extraordinarily dangerous practice involves making hoax emergency calls so that armed police turn up at a target’s address. This is one victim’s disturbing story . China : The US accused 44 people of targeting Chinese dissidents and spreading disinformation to “sow division within the United States.” The accused live in China and elsewhere in Asia so the chances of them standing trial are…small.