FFT news digest — 28 July 2023
FFT news digest — 28 July 2023
Microsoft
Microsoft is disputing a report that a stolen security key could have allowed Beijing-backed spies to break into far more than a few email accounts. It’s still unclear how someone was able to obtain one of Microsoft’s internal private cryptographic keys that are used to authenticate access to its online services. If Microsoft knows what happened, it’s not saying. It does dispute a report from security company Wiz which claims the spies could have used the key to access a variety of apps including SharePoint, Teams and OneDrive. However, while Microsoft’s statement to The Register says there’s no evidence for Wiz’s findings, it doesn’t exactly deny them either. What is not disputed is that, as a result of the theft, attackers gained access to the email accounts of a number of US government officials including the Commerce Secretary and Washington’s ambassador in Beijing. Microsoft says about two dozen organisations worldwide have been affected. It also says it will provide customers with free access to cloud security logs, something that normally attracts a fee. As a former US National Security Agency analyst tweeted , “This is a nightmare scenario for anyone assessing impact…If I were a threat actor, I’d be riding that now-revoked key like a rented mule, seeing where I can get ANY mileage from it. Pretty much checking anywhere “
Threats
Alexa : Security guru, Jake Moore, explains how Amazon’s Alexa smart speakers can be used as listening devices. Stalkerware : A Swiss researcher has revealed details of a phone surveillance app called Spyhide which is harvesting private data from thousands of Android devices around the world. Unlike expensive spyware, this type of ‘stalkerware’ is most often installed by someone who knows the passcode of a phone they want to surveil. TechCrunch Tech support : Another warning from the FBI about this sort of scam. This time, the bureau says scammers are trying to persuade the elderly to send cash through the post to pay for unnecessary technical support. Amazon : Fraudsters are using texts, emails and phone calls to try to obtain login credentials and financial information from Prime subscribers. The messages say accounts are about to be suspended or deleted. techradar Games : A widespread campaign is targeting both Mac and Windows devices with fake games. They’re being promoted on social media and have names like Brawl Earth, WildWorld, Dawnland, Destruction, and SaintLegend. Bleeping Computer HR : Attackers think employees are most likely to open emails that appear to come from their HR department. KnowBe4 found half of malicious emails had subjects such as dress code changes, training notifications, holiday updates and the like.
AI
Guardrails : Seven of the top Artificial Intelligence companies agreed new guidelines designed to improve the safety and security of their systems and users. The commitments came after a meeting at the White House – although there’s a conspicuous lack of detail about what they actually contain. One specific commitment is to watermark AI-generated content in an effort to separate reality from fiction. But, as OpenAI said , even that will require the companies to work together to develop the necessary technology. Detector : OpenAI has shut down its tool for determining whether text was written by another AI tool. The reason, not to mince words; it was crap. Unfortunately, so far, efforts to find identifying features or patterns in AI-genreated text have been unsuccessful. TechCrunch FraudGPT ; Last week it was WormGPT, this week we introduce you to FraudGPT – yet another way to harness the power of AI for nefarious ends. “This is an AI bot, exclusively targeted for offensive purposes, such as crafting spear phishing emails, creating cracking tools, carding, etc.,” Netenrich said . Patterns : US law enforcement agencies are harnessing AI to analyse vast license plate databases. In a recent drug trafficking case in New York, the system sifted through 1.6 billion records leading to the identification and arrest of a suspect. Forbes
In brief
Twitter: Another fascinating week in the helter skelter world of Elon Musk. After rebranding Twitter as ‘X’, it emerged that the company commandeered the @X username from the account holder who registered it 16 years ago. The user, a San Francisco-based photographer, told Ars Technica that no financial compensation was offered. Journalists : The Committee to Protect Journalists has joined calls for the UK government to publish the findings of an investigation into alleged surveillance of two journalists by police in Northern Ireland. Police were apparently trying to identify a whistleblower. Not so secure : Researchers say they found an apparently deliberate backdoor in encrypted radios used by police, military and critical infrastructure organisations around the world. They say it may have been in the TETRA:BURST devices for decades. Motherboard TikTok : As many as 700,000 Turkish TikTok accounts were hacked in the run-up to the recent presidential election, according to Forbes. The hack allowed access to private information and control of the accounts. Forbes explains the vulnerability in the SMS system that made it possible, an issue TikTok had been told about a year earlier. Confused : Computer security advice is often confusing, not to say self-defeating, according to a study by North Carolina State University. “Overly long, misleading or just plain wrong” was its verdict. (We agree - and we do our best to make sure the policies we provide are as simple - and short - as possible.) TechXplore China : A Chinese marketing firm has been operating a network of at least 72 websites that purport to be independent news outlets but actually focus on amplifying Chinese propaganda. Some of the articles have been picked up by legitimate publications including the Arizona Republic and the Pittsburgh Post-Gazette. Google Mandiant Car theft : There’s been a spike the number of stolen vehicles and the blame is being pinned on TikTok which hosts excellent tutorials on how to drive away in a Kia or Hyundai that doesn’t belong to you. The University of Michigan has a solution .