FFT news digest — 8 September 2023
FFT news digest — 8 September 2023
Disinformation
Facebook parent, Meta, says it has taken down the largest covert influence operation it has seen. The campaign used thousands of accounts on more than 50 platforms (most not belonging to Meta) to push pro-China narratives. Meta says the operation was run from many different parts of China, with clear shift patterns and breaks for lunch and supper. In its latest Adversarial Threat Report, Meta also said it had taken down an expansive pro-Russia operation. Meta’s report underlines the pervasiveness of disinformation campaigns. As well as the Chinese and Russian operations, it also took down multiple schemes targeting audiences in Turkey. As Meta explains, these operations tend to be persistent so even when one is closed, it starts up again shortly afterwards. And the tactics deployed - particularly by Russia - are sophisticated. Meta gives the example of a fake Washington Post article based on a fake Russian-language video that appeared to show President Zelenskyy of Ukraine admitting he was a puppet of the CIA. The phony article used the same byline and timestamp as a real Post interview published the same day. The disinformation operation then tried to share the fake article on social media as “evidence” of US interference in Ukraine.
Threats
Middleman : Microsoft is warning about an increase in ‘Adversary in the Middle’ attacks which are designed to defeat multi-factor authentication. Where protections are available, it’s essential to activate them. (See Exchange below) Passwords : The good news; passwords are on the way out. The bad news; they haven’t gone yet and there are four common mistakes attackers love to exploit. ‘Base’ words, short lengths, keyboard patterns, and reuse – all make life easier for the scumbags. Bleeping Computer Skyped : You can acquire someone’s IP address simply by sending a link over the Skype mobile app. All that’s required is for the recipient to open the message. 404 Media Messaging : A warning to take care even when installing apps from official stores. ESET found a fake version of the Signal messaging app which managed to get into Google’s Play Store. It appears to be linked to a Chinese espionage operation. Its method of attack is ingenious. Urgency : Cofense examines how dates in subject lines are used to create a false sense of urgency - and make it more likely that we will open a malicious message. Google Groups : Attackers are using Google Groups to send notifications of fake orders. The idea is to scare the recipient into trying to cancel the order by calling a number which of course belongs to the fraudsters. Trustwave Quickbooks : Avanan says it has spotted a surge in fake QuickBooks emails designed to persuade people to call the attacker’s call centre and hand over their credentials. Whiffy : Criminals are using a new tool (dubbed Whiffy Recon) to triangulate the location of infected devices. It works by using WiFi scanning and Google’s geolocation service. Bleeping Computer PDF : Beware PDF documents. Researchers have found examples of malicious Word documents hiding inside them as a way to evade detection. Cisco : Cisco says attackers are targeting ASA VPN devices that don’t have multi-factor authentication enabled. Airbnb : An investigation by SlashNext has found that Airbnb has become a growing target for fraud, with thousands of stolen accounts offered for sale on the Dark Web.
AI
Enterprise : In recognition of business concerns and government warnings about security, OpenAI has launched an enterprise version of ChatGPT. It says users of ChatGPT Enterprise will retain control and ownership over their data which will not be used to train the model. Military : A recent study found a third of military contracts in China and the US were for intelligent and autonomous vehicles. And the analysis looked at an eight-month period…in 2020. OODALOOP Politics : ChatGPT can be easily incited to break rules designed to prevent it amplifying political disinformation. The Washington Post suggests that the purported restrictions are not in fact being enforced. Meetings : Want to skip yet another meeting? Google has a solution. Among new features in Meet is an “attend for me” button which will auto-generate some points you’d like the meeting to cover. It will then send you a summary of the discussion. The Verge Thief : Low quality websites are using AI to rewrite content from mainstream outlets without crediting them. They’re then published together with automatically placed adverts from leading brands. NewsGuard Porn : AI products from major technology companies are “supercharging” deepfake porn, according to Bloomberg . Nearly 150,000 videos, with 3.8 billion views, have appeared across 30 sites in May 2023, an independent analyst says. Deadly : Mushroom experts are warning about a proliferation of AI-generated guides to foraging, As the The New York Mycological Society says , it can literally be a matter of life or death.
In brief
China: When Chinese state hackers broke into Barracuda Email Security Gateways, they were already prepared to counteract fixes when they were deployed. Google Mandiant says the attacks are evidence of trends in Chinese espionage towards “more purposeful, stealthy, and effective operations.” It also explains why Barracuda advised the “immediate replacement of compromised ESG appliances, regardless of patch level.” Meanwhile, this week Microsoft reported on a new Chinese operation that has been targeting Taiwan since 2021 and China is also believed to be behind the infiltration of Japan’s National Center of Incident Readiness and Strategy for Cybersecurity (NISC). Air traffic : It’s still not clear what caused the UK’s air traffic control system to collapse this week - although it looks suspiciously like a badly formatted flight plan was the culprit. Of course, it’s possible a precise explanation will never be released for security reasons. What is clear, as covered in an informed discussion on the PPRuNe forum, is the extreme complexity and age of the system on which the UK depends for the management of flights in its airspace. Senior service : Attackers are hacking the email accounts of government and law enforcement officials and using them to creature convincing phishing lures. 404 Media recounts the experience of receiving messages from the (real) account of Montenegro’s Prime Minister and the tactics behind it. Takedown : The FBI has taken down a long-running operation which has been running since 2008. Qakbot’s business model involved infecting systems via malicious spam messages and then selling access to them to other crime groups. Copped : London’s police force says names and photos of its 47,000 officers and staff were accessed because of a security failure at the company that supplies its warrant (ID) cards. UN : Microsoft has joined human rights groups in criticising the current draft of a UN cybercrime treaty. “The risk is that the treaty will not be a tool for prosecuting criminals but rather a weapon that allows for intrusive data access and surveillance instruments,” it said . Drained : A substantial number of iPhone 14 owners are complaining about battery performance. appleinsider looks at the evidence but concludes that the jury remains out for the moment. If you feel your battery is draining more quickly than expected, make sure you document it with Apple. Data : An updated privacy policy says the company will collect biometric data together with details of users’ jobs and education. It says the motive is “safety, security, and identification.” Hard truths : From a US Twitter user; “My 8-year-old asked Alexa if he will die one day and man Alexa does not hold back.” @mommajessiec