FFT news digest — 4 August 2023
FFT news digest — 4 August 2023
Disgrace
Microsoft is facing a torrent of excoriating criticism and a congressional demand that it be held accountable for “its negligent cybersecurity practices, which enabled a successful Chinese espionage campaign” against the US. In a letter to the US Cybersecurity and Infrastructure Security Agency, Senator Ron Wyden demanded that Microsoft explain how attackers were able to steal an encryption key fundamental to the company’s security and that of its clients. The key enabled hackers to harvest vast amounts of information, including the emails of senior US government officials. Even worse, the head of Tenable, a security company, says his firm had told Microsoft about the vulnerability that allowed the encryption key to be stolen. In a LinkedIn post, Amit Moran said “To give you an idea of how bad this is, our team very quickly discovered authentication secrets to a bank. Did Microsoft quickly fix the issue that could effectively lead to the breach of multiple customers’ networks and services? Of course not. They took more than 90 days to implement a partial fix—and only for new applications loaded in the service.” Another respected security researcher tweeted , “The way Microsoft corporate has been acting for the past few years (SolarWinds, Hafnium, general JCDC collaboration, and now Storm-0588) is enraging, duplicitous, disappointing, counterproductive, and most importantly unnecessary.” Regular readers will know that we also rail against the failures of technology companies to produce solutions that are secure. The complexity of modern products means they will inevitably contain errors but the number of issues and the failure of vastly profitable organisations to address them effectively are inexcusable. For all the sound and fury over such matters, these companies face no effective sanction for their failures. In response to the latest criticism, Microsoft said simply, “This incident demonstrates the evolving challenges of cybersecurity in the face of sophisticated attacks.” So that’s all good.
Threats
Teams : Attackers linked to Russia’s Foreign Intelligence Service (SVR) have been using Microsoft Teams to target companies and government agencies with phishing lures based on a tech support theme. Microsoft Ransomware : 76% of ransomware events detected by Palo Alto Networks last year involved web browsers rather than phishing links or other methods. Most attacks targeted end users rather than large organisations. Phishing : Which is not to say phishing isn’t a continuing threat. Akamai has a detailed account of a long-running campaign which it estimates earns up to $150,000 per year from the sale of stolen credentials. Printers : When you finally give up trying to fix that infuriating inkjet printer, wipe its memory before disposing of it. Canon warns that the stored settings could be used to access the WiFi network to which it was previously connected - as well as reveal other sensitive information. Chat : A malicious Android chat app (called ‘SafeChat’) is being used to install spyware that steals calls logs, texts and GPS locations. Bleeping Computer OCR : Ingenious scumbags are using optical character recognition as part of a tool designed to harvest the information necessary to access cryptocurrency wallets. Trend Micro via Ars Technica False colours : A prominent domain name is no guarantee that an email is genuine. Guard Labs explains how a vulnerability in Salesforce’s email services was used to circumvent security checks. The issue has now been fixed but this type of approach is worryingly common. via The Hacker News Amazon : Internal information from the shopping giant is being sold on messaging apps such as Telegram. For $200 to $400, you can buy access to employees who will remove negative reviews and provide information on competitors. CNBC
AI
Automate : Researchers have devised a way to simplify the process of bypassing security protections designed to prevent tools like ChatGPT being used for nefarious purposes. The technique involves adding “specifically chosen sequences of characters that…will cause the system to obey user commands even if it produces harmful content.” Carnegie Mellon University/Center for AI Safety Foreigners : The FBI says foreign adversaries are increasingly using AI tools in influence campaigns and cyber attacks. “While still imperfect at generating code, AI has helped more sophisticated actors expedite the malware development process, create novel attacks and enabled more convincing delivery options and effective social engineering, an official said.” The Record Worldcoin : You’ve doubtless heard about Worldcoin and its efforts to persuade users to hand over a scan of their iris in exchange for a digital ID and, in some cases, the promise of some cryptocurrency. The Kenyan government is unimpressed and has suspended its activities. We doubt it will be alone. Reuters Learning : Pearson is incorporating generative AI tools into its higher education platform in time for the start of the new academic year. They’ll provide real-time, personalised support including an “On a Tight Schedule” feature which uses AI to summarize the key points of learning videos. Bloomberg FYI : Until this week, the domain AI[.]com redirected users to ChatGPT. It’s now begun taking users to xAI[.]com, a new AI company owned by Elon Musk. Girlfriends : There’s a growing trend towards AI girlfriends, particularly among those under 30, according to a number of articles published recently. Innovation Nation looks at what’s happening and why. Rising up : Vice has a detailed look at the rush among startups to harness AI to treat erectile dysfunction in younger patients. When we say detailed, we mean…detailed.
In brief
Critical: US officials believe China has embedded malicious software inside the networks controlling power, communications and water for its military bases at home and overseas, according to a report by The New York Times. Niger : As western and regional governments react to the military coup in Niger, The Intercept reports on a “barrage” of pro-Russian influence campaigns in francophone countries in the region. Russia : President Putin has approved swingeing legal changes that will outlaw anonymity and require internet platforms to use official tools to verify the identity of new users. Using virtual private networks to circumvent controls will be a criminal offence. Reclaim the Net (R) All-seeing : China’s spy agency has debuted on social media with a call for “all members of society” to combat espionage (a longstanding Chinese approach in the analogue world). FBI spyware : Days after the US banned spyware manufacturer, NSO, an FBI contractor used NSO products to track cellphones in Mexico. The deal was uncovered by…the FBI. The New York Times Basics : The UK has an excellent basic framework for cyber security called Cyber Essentials. Unfortunately, a survey found that 40% of security folk knew little about it and only 28% of organisations had fully implemented it. Lookout Tracked : The SMS system is woefully insecure. Now a Ph.D. student has demonstrated that information from it can be used to track a phone. “Just by knowing the phone number of the user victim, and having normal network access, you can locate that victim,” he said. Northeastern University Biter…bit : In a cheering tale, a security researcher hunted down a Twitter/X scammer who stole $1,000 from a friend. With the help of another researcher, they tracked down the suspected culprits and handed the information to police. The write-up in Wired is a salutary reminder that our digital trails are pervasive…and criminals are often lazy and dumb.