FFT news digest — 2 June 2023
FFT news digest — 2 June 2023
Spyware
The latest chapter in the tangled tale of Pegasus spyware sees ownership of its manufacturer return to one of its original founders. The Wall Street Journal says creditors forced the change which effectively wiped out NSO’s previous owners who had bought the company in 2019 in a deal that valued it at some $1 billion. Clearly the creditors, which include Credit Suisse, believe there’s ongoing value in the company, despite it being blacklisted by the US in 2021 over persistent reports that Pegasus had been used to target journalists, human rights advocates and members of parliaments around the world. The Biden administration may have banned Pegasus but reports say the US Drug Enforcement and Administration Agency is among the top customers for a very similar tool from a rival company. The Financial Times says Paragon’s ‘Graphite’ product offers almost identical capabilities to Pegasus. “The malware surreptitiously pierces the protections of modern smartphones and evades the encryption of messaging apps like Signal or WhatsApp, sometimes harvesting the data from cloud backups – much like Pegasus does,” it claims. An earlier report by The New York Times provided a detailed overview of the spyware industry, describing it as “out of control.” Meanwhile, a leading US senator says the US has admitted promoting the export of spyware but won’t answer questions about what’s going on. Senator Ron Wyden chairs the Senate Finance Committee and has a long record of asking difficult questions about sensitive technology issues. In a letter to the US International Trade Administration, he says “given the administration’s stated interest in limiting the human rights abuses made possible by these technologies, ITA must be transparent about its past and current promotion of these technologies abroad.”
Threats
macOS : A good reason to make sure your Apple laptops and desktops are up to date. Microsoft found a new issue that could allow attackers to bypass the crucial System Integrity Protection. Android : A Russian cybersecurity firm has found a malicious Android software development kit that contains the sort of features usually provided by spyware tools. 101 apps have used the kit. They’ve been downloaded 421 million times. Dr.Web Picture in picture : Avanan explains how attackers are hiding malicious links inside pictures to redirect users to phishing sites. Dead : A revival of the Facebook “look who just died” scam. The untargeted campaign tries to pique the recipient’s interest and get them to click on a link that requires their Facebook credentials. DataProt Extensions : Panda Security has a useful list of malicious extensions for the Chrome browser, how to detect them and what to do if you find one. ZIP : Another (ingenious) way has been spotted to exploit the ZIP domains that were launched last month. The kit displays fake WinRAR or Windows File Explorer windows in the browser to convince users to launch malicious files. Bleeping Computer RomCom : A new campaign is impersonating well-known websites to fool users into downloading and launching installers for ‘RomCom’ malicious software. RomCom has been associated with ransomware, espionage, and warfare. TrendMicro Hot Pixels : The week’s most exotic threat comes from university researchers in the US and Germany. They’ve found a way to retrieve pixels from the content displayed in a browser and infer the navigation history. It’s complicated! Via Bleeping Computer
Apple
More evidence that iPhones aren’t as secure as Apple would like to suggest. Russian security outfit, Kaspersky, says it found spyware on “several dozen” iPhones belonging to its senior and middle management. “The attack is carried out using an invisible iMessage with a malicious attachment, which, using a number of vulnerabilities in the iOS operating system, is executed on the device and installs spyware,” Kaspersky said. At the same time, Russia’s Federal Security Service - the FSB - accused Apple of helping the US conduct a widespread espionage campaign in Russia. The FSB said the campaign targeted the iPhones of both Russian officials and foreign diplomats. Unsurprisingly, Apple denied helping the US - or anyone else - insert backdoors in its products. That’s almost certainly true. But it’s also true that there’s a vibrant industry in the purchase and sale of iPhone vulnerabilities.
Sophisticated
In the seven years since we started this company, we’ve seen a steady increase in the sophistication of cyber criminals. Part of this trend has involved highly organised crime groups offering kits that do all the technological heavy lifting for would-be scumbags. Group-IB says last year saw a 25% increase in the use of phishing kits - and the adoption of advanced techniques to gain access to systems and avoid detection. Among their tactics, Egress highlights the use of legitimate websites such as Google Docs and YouTube to bypass standard security checks. Meanwhile, as if small and medium-sized businesses don’t have enough to cope with, Proofpoint says they’re increasingly the targets of ‘Advanced Persistent Threat’ or ’ APT ’ actors. As their name suggests, APT groups are among the most capable attackers and are often, but not always, connected to nation states.
AI
You probably saw the latest warning about Artificial Intelligence; that it represents an existential risk to humanity. CNN followed up by talking to a leading AI expert at the University of California, Berkeley. Stuart Russell says it highlights our need for a sea-change in our approach to technology. “What the digital infrastructure does now is it runs anything unless it recognizes it is dangerous…But what we need, actually, is for systems to work the other way around — we need to ensure that the hardware and the operating system won’t run anything unless it knows that it’s safe,’ he said. China : Foreign Affairs assesses (R) the risk from AI in China. “Due to Beijing’s lax approach toward technological hazards and its chronic mismanagement of crises, the danger of AI accidents is most severe in China,” it says. Voices : AI-powered deepfakes are so easy to create, it’s no surprise they’re becoming commonplace. Among the findings of a survey by McAfee, 35% of respondents couldn’t tell whether or not a voice was real. Photos : ‘Paragraphical’ is a camera that takes photos using location data by describing a place and converting it into an AI-generated “photo.” Bjørn Karmann
In brief
Amazon : Despite being accused of some of the most egregious security failures imaginable, the US Federal Trade Commission has decided to fine Amazon the whopping sum of…$30.8 million. Recycling : It’s essential to dispose of old devices securely but a Financial Times investigation found significant issues with the way some UK retailers recycle what they’re given. In the case of Argos, two laptops ended up on eBay. Double-blind : Specops explains an approach to make really important passwords harder to hack. It involves storing the main password in a password manager, but remembering a PIN code or word that you add to it. Combined with multi-factor authentication, this does represent an improvement - though it’s still not foolproof. Space : China is developing hacking tools to take over satellites in the event of war, according to a leaked document reviewed by the Financial Times. WhatsApp crash : Typing a simple weblink (wa[.]me/settings] into WhatsApp on Android devices crashes the app. Android Authority says the app will continue to crash until the offending message is deleted.