Why spyware is so dangerous...and why it affects us all. US border risks.
Insecure websites. Remote workers more secure than their office colleagues. Extracting audio from still photos. And the latest iPhone's form over functionality.
How spyware works
A Russian exploit broker is offering up to US$20 million for ways to remotely access iPhones andAndroid devices. Operation Zero, which is based in Russia, said the increase was “due to high demand in the market.”
It added, “As always, the end user is a non-NATO country.” In an email exchange with TechCrunch, Operation Zero’s CEO said, “Full chain exploits for mobile phones are the most expensive products right now and they’re used mostly by government actors. When an actor needs a product, sometimes they’re ready to pay as much as possible to possess it before it gets into the hands of other parties.”
There are many similar companies, including Zerodium and Crowdfense (based in Washington DC and the UAE respectively), publicly offering US$2.5 to 3 million dollars for similar exploits. Operation Zero says those sums are probably out of date but the companies haven’t bothered to change them in public because they don’t need to. Buying and selling ways to break into smartphones (and to a lesser extent all IT platforms and devices) is a huge business and attracts highly sophisticated research. Just how sophisticated is illustrated by a recent case involving Pegasus spyware. As Malwarebytes explains, it leveraged a vulnerability in a tool that handles a specific image format which would have taken a vast amount of work to identify.
Most of us won’t be targeted with spyware based on such issues but that doesn’t mean we’re not affected by them. Once zero-day exploits are used and identified, they’re (usually) fixed pretty swiftly. But because not everyone installs updates immediately (or at all) they continue to be a threat. And that’s particularly true of the image handling vulnerability. As Rezilion reports, the image format affected (‘webp’) is extraordinarily widely used and “ascertaining the full extent of this vulnerability’s impact becomes a formidable undertaking.” The issue has already led to emergency updates for Chrome and Firefox (below).
Threats
Dropbox: Avanan explains how legitimate pages are used to hide malicious links designed to steal credentials. Not surprisingly, since Avanan is a security solution, its recommended defence is an AI-powered security solution. While that’s true, it’s also essential to be cautious with Dropbox links. Avanan says it saw 5,440 instances of this type of attack in the first two weeks of this month.
Authentication: The other phishing favourite du jour is to use kits to bypass multi-factor authentication. ZeroFox describes (R) one campaign in which malicious files arrive as email attachments. Its says attackers are increasingly leveraging formats such as Windows image (ISO), archive (RAR), Windows Shortcut (LNK), OneNote, restricted permission messages (RPMSG), and Windows Script to deploy malicious payloads.
Ukraine: A campaign is targeting Ukraine’s military with fake drone manuals.
Bitwarden: Password-stealing software is being distributed by “a very convincing lookalike to the real bitwarden.com.” The fake has the domain name bitwariden[.]com. Proofpoint
Mimic: Eset spotted a similar tactic being used to display what appeared to be Microsoft web pages. In this case, Cyrillic “M” and Greek “o” alphabet letters were employed to fool victims.
Invisible: There’s also a warning about “zero-point font obfuscation” which is a fancy way of describing a technique that uses text in a font with zero-pixel size. Previously, it’s been used to fool antivirus scans. In a new case, it’s employed to make the Outlook summary of an email look more trustworthy. Dark Reading
Sprawl: We have always advised clients to be open to IT solutions that are suggested by their employees. So-called ‘Shadow IT’ is an unavoidable reality so it’s much better to embrace it than to try to outlaw it. Entrust surveyed (R) 1,000 US-based IT professionals; 97% said employees were more productive when allowed to use preferred technologies.
Travel
While many of our clients work in highly hostile environments where the dangers of crossing borders are obvious, it’s important to keep in mind that there are also risks in travelling to countries like the US. Security researcher, Sam Curry, discovered exactly this at border control in Washington DC when he returned from a trip to Japan. Agents seized his electronic devices and served him with a Grand Jury subpoena. All because his details appeared in the log files of a cryptocurrency wallet that he had been investigating as part of a fraud inquiry. He had been working on the case from his home and this enabled law enforcement agencies to identify him. Other US border detentions include a BBC journalist (who was able to live tweet his experience from a toilet).
HTTPS
An Egyptian politician was targeted with spyware that exploited unsecured websites, i.e. those missing the S in HTTPS. It’s an excellent example of the risk of such sites which enable a visitor to be redirected to a malicious destination. Citizen Lab says this is what happened in the case of former Egyptian MP Ahmed Eltantawy. His phone was targeted with Predator spyware via links sent in SMS and WhatsApp messages. Thanks to a device installed in Vodafone Egypt’s network, clicking on a link would automatically redirect him to a malicious website. It’s a technique called network injection and it means extreme caution should be exercised when connected to any network whose operator you don’t trust.
AI
AI is fundamentally a surveillance technology, according to the Meredith Whittaker who runs the foundation behind the Signal secure messaging platform. Speaking at a technology conference, she said, “It requires the surveillance business model; it’s an exacerbation of what we’ve seen since the late 90s and the development of surveillance advertising. AI is a way, I think, to entrench and expand the surveillance business model. The Venn diagram is a circle.”
Facial: Clearview’s facial recognition app harvested some 3 billion photos of people’s faces from social media platforms and websites. Rolling Stone explains how in its initial stages the result was used as an identification tool by the rich and powerful.
Senses: ChatGPT can now see, hear and speak, meaning users will be able to have a conversation with it or show it what they’re talking about. The features will roll out in coming weeks. OpenAI
CIA: The agency has developed a ChatGPT-style tool to enable its analysts to better manage open-course intelligence. Or as it rather confusingly puts it, “find the needles in the needle field.” Bloomberg
Alexa: If you want a more customised version of Amazon’s voice assistant, you’ll be handing over your voice data and conversations to train the AI model behind it. NBC News
Subliminal: AI is being used to create images with messages hidden inside them. As one researcher told Vice, it’s likely to be irresistible to marketers - even if it doesn’t quite amount to subliminal messaging in the usual sense.
In brief
Remote: People who don’t work at the office are more aware of cybersecurity risks than those that do. That comes from a study (involving a pretty small sample) by a researcher in the US. Although the results were pretty clear, as the author says, “we still need to determine whether heightened cybersecurity awareness and precautionary behaviour among remote workers will diminish over time.”
Eavesdropping: US university researchers have come up with a way to extract audio from still photos. It works by exploiting the image stabilisation technology used in smartphones. Accuracy varies from 80%-90%. Arxiv
Spreadsheet hell: In the wake of some ghastly gaffes by UK police forces, the UK’s data protection regulator has told public bodies to stop using spreadsheets to respond to freedom of information requests.
LastPass: Following the loss of users’ password vaults last year, we strongly advise against using the service. The fact that it’s now forcing its remaining customers to choose longer master passwords does nothing to reassure us. KrebsonSecurity
Silence: Nearly half of organisations that have experienced a cyber incident did not report it to the appropriate authorities, according to Keeper Security. Its study of IT and security team leaders found 41% of those surveyed didn’t even disclose attacks to their own boards.
Piracy: Disney Plus is rolling out restrictions to prevent password sharing. Amazon Prime users will have to pay more if they want to avoid watching adverts. No wonder an EU study has found online piracy is on the up.
Taiwan: China has been conducting a disinformation campaign to spread rumours that the US is making bioweapons in Taiwan. It comes ahead of January’s presidential election and is just one part of a vast Chinese disinformation operation described by The Wall Street Journal.
Shut down: Legal pressure from conservative politicians and activists is prompting academics and government agencies to change or end research into misinformation and disinformation, according to The Washington Post.
Too darn hot: Overheating problems with the iPhone 15 Pro series are probably the result of compromises designed to save weight. A leading researcher says “improvements may be limited unless Apple lowers processor performance.” Ming Chi-Kuo
Updates
Apple: Another update to iOS 17, this time to address a data transfer problem.
Sonoma: The latest iteration of Apple’s operating system for laptops and desktops emerged this week. The consensus is that it doesn’t do anything ground-breaking, so it would be wise to wait for the first update before installing it. One thing it does do is add a bunch of features to the list of items that are only supported on newer models using Apple rather than Intel processors. Ars Technica has an in-depth review.
Google: New version fixes the fifth and sixth previously undisclosed (‘zero-day’) vulnerabilities to affect the browser this year.
Firefox: Security updates for both Firefox and Thunderbird, addressing a total of nine vulnerabilities in its products, including high-severity flaws.
Cisco: Vulnerabilities in multiple products, including a particularly nasty one affecting SD-Wan Manager.
Tinder: For a mere US$500 a month you can sign up to Tinder Select and be matched with the platform’s “most sought after profiles,” as well as bother people with direct messages without the need to match first.