FFT news digest — 7 July 2023
FFT news digest — 7 July 2023
Social media
Meta’s Twitter competitor is now live across most of the world, except in the EU where its release has been put on hold. That’s not surprising because the launch of ‘Threads’ came as the European Court of Justice ruled that Meta’s interpretation of EU data protection rules is illegal. The court agreed with a German decision that Meta was circumventing privacy protections by combining information from its various services without proper user consent. That meant Meta was able to continue tracking German and EU users for advertising purposes. (If you’re in Europe and you’d like to contribute your information to Mark Zuckerberg, a VPN is all you need - as many Europeans have demonstrated.) Threads is intimately woven into the rest of Meta’s activities . Signing up requires an Instagram account and, as TechCrunch spotted , its Supplemental Privacy Policy says you can only delete your Threads profile by deleting the linked Instagram account. Some 30 million users signed up for the new service within hours of its launch, but Threads is pretty underwhelming at the moment. While it bears a more than passing resemblance to Twitter, it lacks many of its competitor’s features (though Twitter is threatening to sue). That may not trouble users since the key thing missing is the endless chaos that has been the hallmark of Twitter since it was taken over by Elon Musk. Elsewhere in social media land, The New York Times reports that Russia has developed new digital tools to track and suppress domestic opposition to the war in Ukraine. The tools are designed to monitor encrypted apps like WhatsApp, Signal, and Telegram, and track phone locations, social media users, and phone locations. As a leading researcher points out , the content of the messages may be safe but you can learn an awful lot if you control the network used to send them. Russia’s tools are not just for internal use. Moscow is selling them to other countries, especially in regions nearby. Two other items. it emerged that a viral left-wing Twitter account was probably fake. And among Twitter’s many problems, it’s now being plagued by automatically generated adult posts.
Threats
macOS : There’s an updated version of malicious software designed to target macOS devices. ‘RustBucket’ has improved capabilities to establish persistence and avoid detection by security software. It arrives via a functional but booby-trapped PDF reader. Elastic Security Labs Truebot : US and Canadian cybersecurity agencies say new versions of Truebot malicious software are being used in new campaigns, mostly targeting organisations in North America. Truebot is operated by a criminal gang and is designed as an initial way of infecting a device. It usually arrives as a fake document, often a PDF file. Clickjacking : Panda Security has a guide to ‘clickjacking’ which is a devious way of persuading us to click on links that we can’t even see. Authentication : And Jeffrey Appel has an invaluable report on the way in which attackers are trying to defeat more advanced authentication methods. Stressed : Employees feeling overwhelmed at work are more likely than others to fall for a phishing attack, according to US federal researchers. They say awareness is key to defence. That’s undoubtedly true, though of course it risks creating more stress. PNLL Mortgage : Criminals are emailing fake mortgage offers with rates “as low as 2.39%” to try and trick people into clicking on dodgy links. They lead to malicious websites designed to steal personal and financial information. Action Fraud
AI
Google : A new privacy policy says “publicly available information” may be used to train its AI models and build products like Translate and Bard. Bing : OpenAI temporarily withdrew the Browse with Bing beta feature from ChatGPT Plus after users discovered that they could bypass some paywalls by requesting a weblink’s full text content. Dross : Low value AI-generated websites are increasingly showing up in search results, according to MIT Technology Review . And techradar reports that Amazon is trying to stem a flood of AI-generated books in Kindle Unlimited. Banks : Mastercard says nine UK banks have signed up to a new AI-powered tool designed to spot transfers to fraudsters. Bloomberg
In brief
Iran: An attack targeting a nuclear expert at a US think thank provides an excellent case study in the patience and sophistication Iran deploys in its cyber espionage. Proofpoint Unnoticed : Almost a third of security incidents aren’t spotted by IT or security teams, or by the tools they use, according to Gigamon. Its report (R) focuses on the ‘hybrid cloud’ which is increasingly dominating the way organisations structure their technology. Management : Talking of hybrid environments, The Wall Street Journal says ($) the move to the cloud is changing the role of Chief Information Security Officers. Increasingly, they’re taking on an IT management role, according to the paper. Cheats : British police are investigating multiple incidents in which the papers for GCSE and A-Level exams were stolen and sold online to students seeking to cheat on their tests. The Record China : Beijing is imposing export restrictions on two key elements used in semiconductors and other electronic components. The Chinese Commerce Ministry said the controls would affect gallium and germanium, for which China is the world’s largest source. Reuters Amazon : A former Amazon warehouse manager has been sentenced to 16 years in jail for being the “mastermind” behind a multimillion dollar fraud using fake invoices. The Register $922 million : That’s the value of cryptocurrency assets that were stolen in the first half of this year, according to SlowMist. A huge amount but less than half compared to the first half of 2022, when $2 billion was lost. $200 million : In one incident, a 19-year old Argentinian hacker stole nearly $200 million worth of cryptocurrency in March. But he then gave it back. He tells Coinage why.