FFT news digest — 15 September 2023
FFT news digest — 15 September 2023
Spies agogo
Organisations around the world providing critical national infrastructure are coming under increasing attack, according to a report by Symantec. In the latest incident this year, it says intruders compromised a national grid in an unnamed Asian country for as long as six months. Although Symantec doesn’t ascribe responsibility for the attack, the tools were the same as those used last year to infect the Indian power grid near the border with China. In May, the Five Eyes intelligence alliance warned that Chinese state attackers had broken into critical infrastructure organisations in the US by using a “living off the land” attack that hides offensive action among everyday Windows admin activity. At the other end of the scale, a UK communications specialist has recounted his experience of being recruited to spy for China. Gawain Towler said he had been contacted on LinkedIn and offered consultancy work for a number of unnamed firms. Following a series of online messages, he was offered an all-expenses paid trip to Hong Kong. Once there, he took part in a series of increasingly peculiar meetings at which he was offered substantial amounts of money in return for passing on reports and other information. Before leaving, he was given a Huawei phone which he was told to use to send photographs with the information embedded inside them. He says he was also given 6,000 Euros in used banknotes which he promptly spent. He informed the UK security services and then ignored any further messages from his Chinese contacts. Such approaches on LinkedIn are more common than one might think. In many cases, they’re part of an attempted fraud or credential theft but they’re also a popular way of engaging journalists, academics and businesspeople in what appear to be innocuous conversations. China, North Korea and Iran are particularly keen on this tactic. We advise extreme caution with LinkedIn. Take a look at what your public profile reveals about you - and make sure the level of detail is minimal. Be sceptical about approaches out of the blue. LinkedIn is aware that it’s being exploited by bad actors and has introduced a number of features to “help verify identity, detect and remove fake accounts, boost authenticity.” They’re not perfect - but they can help keep you safer.
Threats
https://www.microsoft.com/en-us/security/blog/2023/09/12/malware-distributor-storm-0324-facilitates-ransomware-access/ Deepfakes : “Synthetic media” represent a growing threat to brands, bank accounts and corporate information, according to US law enforcement and cyber agencies. Fake text, video, audio, and images can all be created with limited or no technical expertise, they warn . Telegram : Yet again, spyware pretending to be modified versions of the messaging app has been found in Google’s Play Store. The apps are designed to steal sensitive information from compromised Android devices. Kaspersky LastPass : A highly convincing phishing campaign is targeting users of the hapless password manager following its data breach last year. The emails ask users to confirm their information. They’re very realistic. Malwarebytes Teams : An open-source tool called TeamsPhisher is being used to send messages with malicious attachments to organisations that allow the Microsoft messaging tool to be used for external communications. Microsoft Word : A sophisticated phishing campaign is using a Microsoft Word document to distribute malicious software. Opening the document displays a blurred image and a counterfeit reCAPTCHA challenge. Fortinet Facebook : Some 100,000 Facebook business accounts per week are falling victim to an information stealing tool. It’s being distributed via Facebook Messenger from a network of fake and hijacked personal accounts. Guardio Labs CSAM : The FBI says online groups are targeting minors and forcing them to record child sexual abuse material. It warns that LGBTQ+, racial minorities, and those struggling with mental health issues are particularly at risk. Rubbish : ESET says old devices continue to be discarded without having sensitive data removed first. In a small sample (of 18 routers), configuration details and data were found on 56% of them.
AI
Socials : An investigation by The Guardian found that New York law enforcement agencies paid millions of dollars to a company to track social media activity. Voyager Labs, which was banned from Facebook, claims it can use AI to analyse online activity and predict fraud and other crimes. Voices : Harry Styles and One Direction fans have been paying money for leaked songs that may have been created by AI. As 404 Media reports , this “highlights just how complicated the underground leaked song industry has become” and also the growing sophistication of AI-generated music. Voices: And it’s not just music; turning text into believable speech is now trivially easy. The Verge looks at the various tools that are available while concluding the runaway winner is ElevenLabs (which is the one we use for demonstrations). Images : Bellingcat warns that tools to detect AI-generated images may be good at working with high-quality images but struggle with compressed, lower-quality versions. As it points out, this is particularly important for open source researchers who may only have access to low quality images. Ideation : MBA students competed against ChatGPT to come up with the most innovative “idea for a new product or service appealing to college students that could be made available for $50 or less.” ChatGPT wiped the floor with them. University of Pennsylvania WSJ
In brief
Chips: A ransomware attack has created chaos at hotel and casino group, MGM, with its systems out of action for several days. Reuters reports that a group of young adults (known as Scattered Spider) is behind the attack. The same group is said to be responsible for extorting tens of millions of dollars from Caesars Entertainment. The group’s tactics include attacking suppliers (in Caesars’ case, an IT vendor) and using social engineering to obtain account credentials and multi-factor authentication tokens. It’s reported that they compromised MGM by finding an employee on LinkedIn and then talking to the company’s helpdesk for ten minutes. It’s worth noting that one approach (known as ‘notification fatigue’) is to bombard a target with fake authentication requests until they click on one in a desperate attempt to make them go away. Ransomware : A reminder courtesy of the UK’s cybersecurity agency that the best way of avoiding ransomware is to focus on the basics, beginning with multi-factor authentication and strong passwords. In the light of attacks like that on MGM, we should point out that user vigilance is also essential. UnWyze : Users of Wyze security cameras reported seeing other people’s streams because of a ‘web-caching’ issue. And on the subject of cameras, if you have a Zavio device it needs to be junked. The company is defunct but its products are still in use and unfortunately they’re wide open to being hijacked remotely. Criminal empire : Cyber crime is now a highly organised operation with gangs raking in millions of dollars. Often they do this by selling tools to other criminals rather than carrying out attacks themselves. Group-IB reports on W3LL which is providing sophisticated kits to target Microsoft environments; the starting price is US$500 for a three-month subscription. Stylebook : The AP is warning customers of its Stylebook to watch out for phishing attacks. The style guide, seen as a bible for journalistic writing, was breached in July. Spyware : More than 200 journalists have called on the European Parliament to introduce an absolute ban on the use of spyware to surveil journalists. Pointing to the use of such tools by several EU governments, the journalists said the ban should be incorporated in the upcoming European Media Freedom Act. CPJ The talk : 30% of parents have never spoken to their children about cybersecurity, according to a survey by Keeper.