FFT news digest — 11 August 2023
FFT news digest — 11 August 2023
Breached
As the UK government insists it will force messaging platforms to compromise end-to-end encryption, details have begun to emerge about two disastrous data breaches in official systems. The first affected the country’s Electoral Commission which holds basic details about every registered voter - that’s about 40 million people. The Commission and the country’s regulators are saying little about the incident but reports suggest the issue behind the breach may be a notorious vulnerability in Microsoft’s Exchange email platform. As we’ve mentioned before, there was a six-week lag between confirming the problem and fixing it. While the information in the breach may be basic, it does seem to include home addresses which we always advise clients to do their best to remove from publicly available data sources. The second incident affected the Police Service of Northern Ireland and is far more serious. In response to a freedom of information request, the service mistakenly included details of every one of its officers and staff. A member of the public had requested a breakdown of rank and grades but instead received a much larger dataset. Given the very real danger faced by police in Northern Ireland, this is catastrophically bad. To compound matters, it has now emerged that the Service is investigating the theft of a police-issued laptop from a parked car. There are obvious lessons from these incidents; updating systems is crucial, effective monitoring is essential, and data protection checks are vital. But it also underlines the reality that it is impossible to guarantee the security of information; mistakes happen, technology is flawed and governments are particularly poor at securing the data of their citizens. Despite that, the UK government insists it wants access to end-to end encrypted messages which at the moment can be read only by the sender and recipient. The Online Safety Bill containing this requirement is likely to be become law later this year. WhatsApp, Signal and Apple have said they’ll withdraw their services from the UK if it does.
Threats
PowerPoint : A sophisticated campaign is using a variety of methods to try to steal credentials and crypto wallets. Mainly focussed on the UK and Australia, the techniques include fake banking pages and even a PowerPoint presentation pretending to be a security guide. Its main message is to install a malicious browser extension. Bleeping Computer Shadow IT : The UK’s cybersecurity agency, the NCSC, has new advice about the enduring problem of unapproved IT solutions at work. COVID-19 made a bad situation worse and the NCSC has practical suggestions. Tech : Github is urging technology companies to be on their guard for a social engineering campaign that’s targeting their employees’ personal accounts. Top 12 : The Five Eyes intelligence alliance has released a list of the 12 most commonly exploited vulnerabilities of 2022. Many have been around for years - as have the fixes for them. As the US cybersecurity agency warns , “In 2022, malicious cyber actors exploited older software vulnerabilities more frequently than recently disclosed vulnerabilities and targeted unpatched, internet-facing systems.” Over-sharing : We’ve written before about why posting photos of boarding passes is a really dreadful idea but it probably bears repeating. Forbes explains the range of information they contain - and how it can be used. Fake profiles : Someone is impersonating well known cybersecurity journalists and researchers. The fake Twitter/X profiles are pretty easy to spot because of the comparative lack of followers. Keystrokes : University researchers in the UK have demonstrated that the recorded sounds of laptop keystrokes can be used to reveal sensitive user data such as passwords…with 95% accuracy.
AI
Zoom : As we reported in March, Zoom changed its terms of service to give it the right to use any data passing through its platform to train its AI programs. This caused a kerfuffle and Zoom has tried to calm things down by amending the terms. As ZDNet explains , many people believe the change is basically meaningless. Crawler : Website owners can now stop OpenAI harvesting content from their sites to train its GPT models. OpenAI says it already filters sites to remove those with paywalls or which are known to gather personally identifiable information. Ban : More than 60% of organisations in the UK have banned, or are considering banning, the use of generative AI tools on employee- or business-owned devices, according to Blackberry. Computer Weekly Unlearning : University researchers in California have discovered that ChatGPT’s ability to perform basic maths operations is getting worse. The phenomenon is known as “drift.” It happens when efforts to improve one part of a model makes things worse elsewhere. WSJ Reputation : Given its (apparently increasing) predilection for making things up, what can you do if artificial intelligence creates a falsehood about you. According to The New York Times, not much. It looks at several cases, including that of a prominent Dutch politician labeled a terrorist by an AI chatbot. Garbage : There’s a growing problem of authors having their names given to ‘garbage’ books that are uploaded to Amazon in an attempt to exploit their reputation. One author describes what happened to her. Extras : Production companies are scanning the faces and bodies of TV and movie extras leading to some fearing they will be replaced by their AI likenesses. NPR
In brief
Ukraine: The cyber attack that crippled satellite communications as Russia prepared to invade Ukraine was broader than first thought and the perpetrators had detailed knowledge of the targeted system. Cyberscoop The Record Privacy : Google says it’s trying to make it easier to find and delete personal details that appear in its searches. The Results about you dashboard allows you to search for your name (though you may have to add other details to narrow down the results). It now allows US users to ask for information to be removed. Russia : Mobile users say their VPN connections aren’t working. Last week, Moscow said it would begin blocking services that provided access to banned websites. vpn central Human factor : Social engineering is by far the biggest cybersecurity risk for organisations, according to the latest survey by the SANS Institute. Its annual report provides useful facts and figures, as well as a link to its (free) Security Awareness Maturity Model. Blue Jeans : Three years after acquiring the video collaboration platform, Verizon is to close it down citing changing market conditions. There’s no confirmation of a date but 9TO5Google reports that Blue Jeans’ free tier won’t be available after the end of this month. The Register The state of IT : A Mastodon user has posted a picture of an HP printer which has a sticker covering its USB port in an apparent bid to make users sign up for the HP app. We haven’t been able to confirm this but it has a horrible ring of truth about it. Casino : Researchers looked into the card shuffling machine most widely-used by casinos. They found a flaw that gave them access to an internal camera and with it the hand of every player at the poker table. WIRED