FFT news digest — 16 June 2023
FFT news digest — 16 June 2023
Disinformation
France says a Russian foreign influence campaign targeting several European countries has been “amplifying false information” since September. The Foreign Affairs Ministry said It involved the creation of fake web pages impersonating French media including 20 Minutes, Le Monde, Le Parisien and Le Figaro and government sites, as well as the creation of fake accounts on social networks. Russian-speaking individuals, Russian embassies and cultural centers, and “several Russian companies,” were involved in the campaign, the Foreign Affairs Minister said. VIGINUM, a French government agency set up to counter foreign disinformation efforts, said the campaign combined the full spectrum of false narrative tools. The themes of the campaign are much as you would expect; to cast doubt on the effectiveness of western sanctions, accuse Ukraine of war crimes, and sow discord around Ukrainian refugees. As such, the campaign may say reveal more about Moscow’s own preoccupations than it might like.
Threats
Risky : Security awareness outfit, KnowBe4, has done some research to ‘uncover’ the top ten risky behaviours of employees. The results are hardly surprising but they’ve produced an infographic that provides a handy checklist to assess what’s going on in your organisation. Strava : As has been repeatedly demonstrated, fitness apps can be a security menace. The latest example shows how ‘heatmaps’ can reveal a user’s home address. NC State University Impersonation : A huge impersonation campaign has been targeting popular clothing and footwear brands, including Nike, Puma, Vans, Adidas and Columbia. The fake websites are designed to trick people into entering their account credentials and financial information. Bolster RDP : If you use remote desktop connections, you should be aware of how attractive they are to attackers. GoSecure set up a Remote Desktop Protocol (RDP) ‘honeypot’ that recorded nearly 3.5 million login attempts in just three months. Bleeping Computer MFA : The good news; the use of Multi-Factor Authentication has nearly doubled since 2020. The bad news; attackers are getting smarter at finding ways to circumvent it, as Microsoft explains . Pirate : Another reminder (if one’s needed) that downloading pirated software and movies is a really, really bad idea. This week sees an extension (add-on) for Google’s Chrome browser which is designed to hijack devices of thieving users. And also a Windows 10 installer which includes a tool to steal cryptocurrency.
AI
Sensitive : As Google parent, Alphabet, warned staff not to enter confidential information into chatbots, research suggests (R) 6% of employees do exactly that. This is another very bad idea, as numerous organisations have already discovered. Bard : The Irish data protection regulator has forced Google to delay the launch of its Bard chatbot in the EU. The agency says it hasn’t received a “detailed” privacy briefing. Politico Conflict : The relationship between Microsoft and OpenAI is marked by “conflict and confusion,” according to The Wall Street Journal. It says Microsoft ignored OpenAi’s warning not to rush into integrating its latest AI model into the Bing search engine earlier this year. Overblown : The head of AI at Meta says warnings about the technology’s threat to humanity are “preposterously ridiculous.” “If it’s not safe, you don’t build it,” he told the BBC. Not sure the history of human inventions would quite support such an optimistic view. Indeed experience might suggest precisely the opposite. Mechanical Turk : Amazon’s service is designed to enable simple tasks to be performed by humans for pennies a time, for example assessing whether a product might interest a particular set of people. It now appears that the people doing the work are in fact using AI tools to carry out the tasks for them. Even though these were things AI was supposed to be unable to do. TechCrunch
In brief
MoveIT : New vulnerabilities have been identified in MoveIT’s ‘secure’ file transfer solution and its manufacturer has told users to “Disable HTTP and HTTPS traffic” to it “immediately. The warning comes despite repeated efforts to fix vulnerabilities in the software; efforts that simply haven’t worked. Cat and mouse : A great report from TorrentFreak examines how the UK Premier League eventually managed to take down a long-standing pirate TV operation. An investigation culminated in 30-year prison sentences for the people behind the operation, but only after it was stymied for years by a mole inside the inquiry. TorrentFreak Contractors : Vendor and contractor accounts often enjoy expanded privileges and access which makes them highly attractive to attackers. Cisco Talos explains why extreme prejudice is advised. North Korea : Pyongyang loves fake websites. South Korea’s spy agency says it’s spotted an almost identical copy of a popular web portal in what it describes as “more elaborate” hacking efforts. Reuters Spyware : The EU parliament has adopted a resolution calling for investigations and guarantees on the use of spyware. In Israel, a spyware company has shut down after its efforts to find customers in Asia and Africa failed to bear fruit. Alas, this doesn’t mean spyware tools are going to disappear - just dive deeper under the surface.