Pegasus used against an exiled Russian editor - as a report suggest adverts can be used to deliver spyware.
The UK Online Safety Bill. MGM back online. Virtual kidnapping. And a woman, her Apple Watch and an outside toilet.
Spyware
Traces of Pegasus spyware were found on the iPhone of the head of Russian independent news agency Meduza. AccessNow and CitizenLab said the infection took place a day before Galina Timchenko was due to attend a private meeting in Berlin with other exiled heads of independent Russian media outlets. Neither AccessNow nor CitizenLab attributed the infection to a specific group or government. As AccessNow says, “The Pegasus attack was conducted within the larger context of attacks against Meduza and other Russian independent media organizations, at home and in exile.”
Part of the difficulty in attributing Pegasus attacks is that it’s designed specifically to make this difficult. But attribution is also complicated by the sheer number of governments known to have bought the tool. An EU parliamentary inquiry found no less than 14 member states to be customers of the NSO Group which is responsible for Pegasus. It seems unlikely that Russia would have used the spyware directly - but plenty of its close allies are customers, including Azerbaijan, Kazakhstan and Uzbekistan.
Meanwhile, an investigation by Israeli newspaper Haaretz says several Israeli cyber companies have developed technologies capable of using online ads to deploy spyware on targeted devices. The report identifies NSO Group as one of them. Haaretz says the technology began by collecting data on individuals but has now developed the capability to deliver spyware as part of targeted advertising.
Threats
Quickbooks: New campaign warns users to upgrade or lose access to key parts of the accounting service. Avanan
Google Docs: Avanan also has a useful video showing how attackers are exploiting Google’s services as the launchpad for their dirty deeds.
Android: A remote access tool impersonates YouTube in order to hijack Android devices. The campaign appears to originate in Pakistan and is focussed on the sub-continent. Sentinel Labs
Smishing: Phishing with text messages is trivially easy to carry out because you can rent a kit to do all the work for you. Currently, users of the US Postal Service are being targeted with fake messages. Resecurity
USB: Mandiant says China-linked attackers are using booby-trapped thumb drives to pursue the staff of international organisations with operations in developing countries. Wired
RaaS: The US is warning about a Ransomware-as-a-Service that forces Windows computers to reboot into Safe Mode before encrypting the files on them. So far, most of the targets have been critical industrial sectors.
Online Safety
Three Prime Ministers and seven Secretaries of State down and the UK’s Online Safety Bill has finally completed its passage through parliament. The government says it will make the UK the safest place to be online. Opponents say it will lead to a much more censored, locked-down internet for British users and could empower the UK government to undermine not just the privacy and security of residents, but internet users worldwide as well. One of the key points of contention has been the issue of end-to-end encryption which ensures only the sender and recipient can read the contents of a message. The bill says companies need to scan such messages for harmful content. The companies say that’s technologically impossible. The result is a traditional British fudge.
MGM
The casino and hotel giant has managed to get its systems back online following a ransomware attack and the incident has focused attention on the need to protect privileged administrator accounts. It appears a key part of the attack involved the Okta authentication platform. Its Chief Security Officer has said five of its clients - including MGM - had become victims of ransomware groups since last month. MGM hasn’t said whether it handed over any money in order to restore its services. According to an industry website, MGM was given an “F” grade from a cybersecurity analytics company regarding its speed in addressing cyber vulnerabilities.
AI
Virtual kidnapping: Eset examines the particularly vile practice of fooling people into thinking a friend or relative has been kidnapped. The scam involves creating a fake version of the ‘victim’s’ voice, aka ‘voice spoofing’. As we’ve reported before, this is ridiculously easy to do.
Attacks: 91% of cybersecurity professionals have experienced email-based cyber attacks that have used AI as part of their modus operandi. The statistic comes from a wide-ranging report from SlashNext that looks at how the security sector sees the use of AI developing.
Alexa: Amazon says children will soon be able to have natural conversations with its voice assistant. A pared-down version of its chatbot will specialise in subjects like animals and nature and provide daily fun facts. It will even play trivia games. So you can engage with your kids as little as possible.
Bard: And Google’s AI assistant can now read your emails, plan trips and check its answers for “confabulations.”
Writers: The Authors Guild is suing OpenAI for allegedly using the works of some of its (very) well-known members to train ChatGPT. The complaint argues that OpenAI’s services “endanger fiction writers’ ability to make a living, in that the large language models allow anyone to generate – automatically and freely (or very cheaply) – texts that they would otherwise pay writers to create.”The Register
Headline: After the death of a former NBA player at a tragically young age, AI came up with the headline, “Brandon Hunter useless at 42.” It followed this up with, “Former NBA participant Brandon Hunter who beforehand performed for the Boston Celtics and Orlando Magic, has handed away on the age of 42.”
Text to Audio: Project Gutenberg has turned thousands of non-copyright titles into audiobooks. As TechCrunch reports, the selection is “idiosyncratic.” The technical achievement is impressive.
In brief
Board: Many board members lack the level of security awareness and understanding of cyber threats required to ensure their organisations are suitably protected. Savanti via Infosecurity Magazine
OSINT: The US Army is planning to prioritise the collection of intelligence from publicly available sources and commercial data. It says these sources have proved invaluable in both Afghanistan and Ukraine. Federal News Network
Gen Zzz: A survey by Deloitte suggests that Americans born from (roughly) 1990-2010 were three times more likely to get caught up in an online scam than their boomer grandparents (16% vs 5% respectively). Vox quotes research that says Gen Z are well aware of what they should do, but many just don’t do it.
TikTok: The Irish data regulator has fined the platform €345 million for breaking European law over how it processed children’s data. The decision follows an investigation into the use of TikTok by children under the age of 13.
Singapore: The island state is to issue proposals for a scheme that would split the liability for financial scams between consumers and banks. The Register
Quantum: Signal has moved to protect messages from the ability of future computers to decrypt today’s communications. This is a problem many organisations are working on but which so far few have solved.
Waste: A woman in Michigan had to be rescued from beneath an outdoor toilet after climbing in to try to retrieve an Apple Watch. USA Today
Updates
Apple: Within days of releasing the latest version of the operating system for iPhones and iPads, Apple has had to rush out emergency updates to address three previously unknown (‘zero-day’) vulnerabilities. It’s highly likely these were used to deliver spyware. One of them is especially nasty because it involves the way that web pages are handled and so could be used to attack a target by luring them to a booby-trapped site. This means there are updates for a variety of Apple products; Safari, iOS and iPadOS (including versions 17 and 16), macOS (including Ventura and Monterey), andwatchOS.
Facebook: Meta is to allow Facebook users to create multiple personal profiles and switch between them while remaining logged in. “Whether you’re new to Facebook or a longtime user, you may want to keep your personal and professional relationships separate, or you may want to keep one profile tied to a community you’re a part of and another profile just for friends,” Meta said. We are strong supporters of separating work and personal accounts but the way Meta is implementing this means there will be fertile ground for muddling up accounts. We will be watching with interest.
Atlassian: Updates for multiple high-severity vulnerabilities in Jira, Confluence, Bitbucket, and Bamboo.
Fortinet: Updates to address vulnerabilities affecting multiple FortiOS and PortiProxy versions.
Juniper: More than a month after it was fixed, about 80% of public-facing Juniper SRX firewalls are still vulnerable to a security issue that could allow an unauthenticated attacker to remotely execute code on the devices. VulnCheck
Trend Micro: Update to address a previously unknown vulnerability in the Apex One security suite.