FFT news digest — 9 June 2023
FFT news digest — 9 June 2023
MOVEit
We’re still probably only scratching the surface of the MOVEit security incident that has engulfed numerous high profile organisations around the world. It’s now emerged that the Cl0p group thought to be behind the attack may have been exploiting a vulnerability in the ‘secure’ file transfer service since 2021. Kroll said it identified activity indicating that the group was probably experimenting with ways to exploit the flaw in April 2022 and as far back as July 2021. And it was hardly unexpected. As one security researcher wrote , “This is the third time Cl0p ransomware group have used a zero day in [web applications] for extortion in three years. In all three cases they were products with security in the branding.” It’s fiendishly difficult - and perhaps impossible - for organisations to defend themselves against this type of ’ supply chain ’ attack which targets a service they use rather than their own infrastructure. What particularly worries us about this incident is that we work with one of the organisations affected. We’re convinced there’s little more it could do in practical terms to assure itself of the security of companies handling its data. But, as we’ve seen, this still didn’t stop its data being held to ransom. In this case. Progress, the company behind MOVEit, now has some very tricky questions to answer. More widely, the incident also raises questions about the value of the phalanx of security certifications that Progress boasts .
Threats
Streaming : Netflix’s crackdown on password sharing has created “an ideal scenario for criminals.,” according to Check Point. It says users are turning to deeply discounted deals being offered on the dark web. Caveat emptor. Gmail : Do be sceptical of the blue ticks next to emails from companies. They’re supposed to denote that the message is genuine but scumbags have figured out how to subvert them. Cyberscoop SMS : There’s been a sharp rise in the use of scam text messages. Help Net Security has a video explaining the problem and how to move away from SMS authentication. Card skimming : Fraudsters have launched a new campaign to infect e-commerce websites with malicious software designed to steal credit card data. In a new development, they’re also using the compromised websites to deliver the malware to other sites. Akamai Journos : Hackers linked to the North Korean government have been impersonating journalists and academics to target think tanks, academic institutions, and media organisations. Again. NSA et al Forced verification : A security company has spotted an increase in the number of incidents of ‘forced verification.’ This is where someone verifying their identity online is being forced to do so by an attacker. The number of cases is small - but, in N. America, Sumsub says it has nearly doubled in the first quarter of this year.
Apple
A variety of news lines from Apple’s developer event . Here are the ones we think matter most. Privacy : Several new features will improve the privacy - and security - of Apple users. The next versions of the iPhone and Mac operating systems will automatically remove advertisers’ tracking parameters. And iOS 17 will require authentication to view Private Browsing history. Apple Home : ‘Check In’ will automatically notify family members when the user arrives at a preset destination. Too old : The latest operating systems may be impressive but plenty of perfectly good devices won’t be able to run them. They include the iPhone 8 series and Mac models from 2017 and earlier. Ducking : Apple says it will improve its hopeless, dreadful, infuriatingly crap autocorrection feature. This means iPhones will let you type what you want - allegedly with the help of AI. Resist : No matter how tempting the new features may seem, we implore Apple users to resist the temptation to install early versions of the operating systems. A world of pain and misery awaits those who fail to resist. Headset : Typically, just as Meta’s metaverse ambitions appear constrained, Apple pops up with its own take on how we’ll interact with the online world. Of course, being Apple, the Vision Pro is eye-wateringly expensive (so much so that the announcement of its price was greeted with groans and guffaws ). While it’s obviously not going to be adopted en masse in its present form, it does provide a glimpse into how our eyes, voice - and probably brainwaves - will become our primary interfaces with technology.
Authentication
Welcome momentum towards the disappearance of passwords, with Google and others announcing further support for ‘passkeys.’ These enable users to log into accounts by authenticating against their device using a PIN or biometric challenge instead of typing in passwords. Google and 1Password are both offering the capability as beta (trial) programmes. There’s been a lot of research into the use of passkeys and there’s little doubt they’re far more secure - and easier to use - than passwords. As Google says, “Unlike passwords, passkeys don’t need to be remembered or typed and cannot be written down or accidentally given to an adversary. Google early data (March – April 2023) has shown that passkeys are 2x faster and 4x less error prone than passwords.”
Data breach report
Verizon’s annual Data Breach Investigations Report is probably the best overview of cybersecurity trends and threats. The key findings from an analysis of events in 2022; - Hijacking email threads (aka ‘pretexting’) replaced phishing as the most prevalent social engineering tactic. - 74% of breaches involved the “human element.” The main cause of incidents were denial of service attacks (in which websites collapse under a flood of requests). - 83% of breaches involved an external attacker. Stolen credentials, phishing, and vulnerability exploitation were the top 3 reasons behind data breaches. - Ransomware attacks were involved in 24% of breaches.
AI
Nudes : Scumbags are taking social media photos and using them to create explicit content as part of extortion schemes. The FBI says the deepfake content can look remarkably real. Replaced : ChatGPT is replacing marketing and social media writers. Lower costs are worth the lower quality, The Washington Post reports . Defamation : A radio host in the US is suing the company behind ChatGPT. He claims it generated a false legal complaint accusing him of embezzling money. Bloomberg Law Electioneering : An attack ad supporting Florida governor, Ron De Santis, uses fake images showing Donald Trump embracing former US medical chief, Anthony Fauci. The Verge Instagram : It seems Instagram is testing an AI-powered chatbot that will enable users to ask questions and get advice in their direct messages.
In brief
Paedophilia : Instagram is the most important platform for buyers and sellers of underage sex content, according to investigations by the Wall Street Journal, Stanford Internet Observatory, and the University of Massachusetts Amherst (UMass) Rescue Lab. Ars Technica Training : Some good news. Google has launched a cybersecurity training and certification scheme in partnership with the UK’s National Cyber Security Centre (NCSC). It’s designed to increase the number of cyber professionals to help secure the UK’s small and medium-sized enterprises. Tails : The folk behind the security-focussed operating system have published the material they used to train human rights defenders in Latin America. Capitulation : YouTube has joined Twitter and Meta in giving up on removing lies about the 2020 US presidential election. Platformer Social : Motherboard has got hold of documents detailing a US Department of Homeland Security project to give ‘risk scores’ to social media users.