FFT news digest — 26 May 2023
FFT news digest — 26 May 2023
Spyware
At least 12 people in Armenia, including two journalists, are reported to have been targeted with Pegasus spyware, in the first recorded instance of such tools being used in a military conflict. The investigation by a number of organisations including Amnesty International, Access Now and Citizen Lab concluded its use was connected to the conflict in Nagorno-Karabakh. Among the victims were two journalists working for Radio Free Europe/Radio Liberty’s Armenian Service. The investigation began in 2021 after Apple implemented a policy of informing users who it suspected might have been targeted with state-sponsored spyware. The first infected device belonged to an NGO worker who had previously been a spokesperson for the Armenian Foreign Ministry. Others swiftly followed and at least 30 infections were eventually identified. They were clustered around two key episodes in the ongoing conflict between Armenia and Azerbaijan over the disputed territory of Nagorno-Karabakh. What’s less clear is who was behind the use of Pegasus. As the investigation notes, the content on the victims’ phones would have been of interest to the governments of both Armenia and Azerbaijan. Both are believed to use spyware products and the case demonstrates how deeply entrenched their use has become. It also illustrates the reality that there is little an individual can do to prevent infection with such tools, though products do exist that (for a price) will scan for potential threats. Otherwise, it is a case of installing updates as soon as they’re available. One other spyware item. Pegasus spyware has also been found on the phone of Mexico’s under-secretary for human rights. He had begun investigating abuses committed by the nation’s military…
Threats
ChatGPT : The latest AI scam involves an email from what appears to be OpenAI. It asks the recipient to verify their email address in order to continue using their ChatGPT account. To add credibility, the email looks like it originated from their IT team. Inky Ransomware : Almost all ransomware attacks target backups, according to a survey by (data security company) Veeam. And most succeed. To account for the evolving tactics of ransomware operators, the US Cybersecurity and Infrastructure Agency has updated its #StopRansomware guide, including an injunction to stop using remote desktop services if at all possible. Doubling up : People are more likely to reveal personal information if they’re asked to do so repeatedly, according to University of East Anglia researchers. They suggest this explains the “privacy paradox,” in which we say we care about personal data but frequently agree to provide it anyway. SIM swap : A sophisticated attack involves SMS-based phishing messages and SIM swaps to gain access to Microsoft Azure administrator accounts. Mandiant Brute force : Chinese researchers say they’ve found a vulnerability in the biometric authentication protection on Android devices. They say the issue allows brute force attacks in which repeated attempts are made to unlock the phone. TechxXplore Android : Google has removed a popular screen recording app from the Play Store. “iRecorder - Screen Recorder” turned out to to have a hidden remote-control backdoor. ESET QR code : (As we’ve said before) we really don’t like QR codes because they can hide where they take you. KnowBe4 has a good example of what looks like a postcard from Amazon but is anything but. Dropbox : A current campaign is using Dropbox links to try to persuade targets to install malicious software on their devices. Do be cautious about links to cloud services, even if they come from someone you trust. Check Point via Techradar
AI
Do you reckon you would be fooled by the deep-fake tools that are readily available today? CBS 60 Minutes decided to find out and you probably won’t be surprised by the result. They hired a consultant (who’s made something of a speciality of bemusing journalists). She found the cellphone numbers for a reporter and their assistant, spoofed the reporter’s phone number to call the assistant, used AI to mimic the reporter’s voice and asked the assistant for a passport number. The assistant complied instantly. All this took about 5 minutes. In other AI-related news; Video : A scammer in China used AI to pose as a businessman’s trusted friend in a video call and convince him to hand over millions of Yuan, authorities said. AFP Brain : Researchers have used generative AI to reconstruct “high-quality” video from brain activity. They’ve called their website Mind Video . Dark and light : Two opinions on AI. From former Google CEO Eric Schmidt ; AI represents an “existential risk” that could get many people “harmed or killed.” From J ürgen Schmidhuber , the ‘Father Of Modern AI’; “AI does not introduce a new quality of existential threat.” Of course, neither view necessarily excludes the other…
China
Small office and home office routers are being compromised as part of a Chinese campaign to target US critical national infrastructure, according to the Microsoft. Devices from manufacturers including ASUS, Cisco, D-Link, Netgear, and Zyxel are at risk. Microsoft says it’s vital to ensure they are kept up to date (see Updates) - and not to expose their management interfaces to the public internet. The state-sponsored “campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises,” Microsoft says. Meanwhile, Reuters reports that China hacked a range of Kenyan government ministries amid tensions over debt payments.
In brief
Twitter : A fake image of what appeared to be an explosion at the Pentagon went viral on Monday after appearing on a ‘verified’ Twitter account called “Bloomberg Feed” (no relation to the real thing). As if we needed proof of the dangers of Twitter’s ridiculous paid verification. All photos : Something you may not have thought about. If you have an iPhone and you give social media apps access to “All Photos,” they could listen to any audio in your Live Photos. As a Twitter user explains . Surveillance : The FBI misused powers (known as Section 702 of the Foreign Intelligence Surveillance Act) more than 278,000 times between 2020 and early 2021, according to an unsealed court ruling. In San Francisco, police gained permission to access private security cameras to monitor a protest. Under a temporary city ordinance, no warrant was required. Rogue : An IT security analyst has been convicted of fraud after trying to steal a ransomware payment from his employer. He used his position to log into his boss’s account and change the Bitcoin address being used for the payment. Despite working in IT, it appears he didn’t hide his IP address. It was his home connection.