The Predator Files. How Hamas may have defeated Israeli surveillance.
"Staggering" losses from social media scams. Anti-phishing phishing. A free tool to read unsolicited documents safely. And is your iPhone taking an overnight nap...
Predator
More details about the extraordinary extent to which Predator spyware has been used across Asia, Africa, Europe and the Middle East. A multi-national investigation called the “Predator Files” found at least 25 countries had purchased products from the Intellexa group of companies. Among them is Vietnam which the investigation accuses of targeting members of the US Congress, including the chairmen of key House and Senate committees.
Amnesty International said the findings revealed a “catastrophic failure” to regulate a surveillance trade which has been allowed “to operate in the shadows without oversight or any genuine accountability”. The Intellexa Group, which produces the Predator spyware, advertises itself as an “EU-based and regulated company” and is controlled by a holding company based in Ireland. Predator can infiltrate a device when the user simply clicks on a malicious link, but it can also be delivered through tactical attacks, which can silently infect nearby devices.
Meanwhile, some members of the EU parliament are pushing for a complete ban on the use of spyware by its member countries. Their assertion is that it should “under no circumstance be considered necessary and proportionate under Union law.” Given the number of member states which have been found using such tools, the parliamentary push doesn’t look likely to go very far. The parliament has also been debating whether it should be allowed to target journalists with spyware. The draft being considered says it should be, but only “on a case-by-case basis.” So that’s fine.
Threats
LinkedIn: Cofense is warning about the renewed use of LinkedIn’s so-called ‘Smart Links’ to bypass email security defences. The links are designed to enable the sender to track user engagement. They can be spotted because they’re much longer than normal. This type of obfuscated link is an abomination - which is why we don’t use them in this digest.
Hijack: A group is using compromised Skype and Teams accounts to distribute malicious software. Its trick is to use the stolen accounts to insert a booby trapped PDF document into existing message threads. As Trend Micro explains, it’s vital to protect accounts in the first place with multi-factor authentication and to ensure users are aware of the risk of hijacked messages.
Insiders: A ransomware gang is increasing its efforts to persuade employees to sell them access to their organisations’ networks. The Everest group says it will offer a “good percentage” of the profits generated from successful attacks to those who assist in its initial intrusion. The Register
WS_FTP: Non-profit organisations are among those to have been attacked via a vulnerability in the file transfer tool. An update is available. SentinelOne
Citrix: Attackers are hijacking login pages for Citrix’s NetScaler Gateways to steal user credentials. Again, there’s an update and there’s also guidance here.
Mail: Scumbags have been impersonating the national postal services of 13 countries, including the US, Australia, Ireland, Spain and The Netherlands. KrebsonSecurity
404: An ingenious scam involves modifying the ‘404’ error pages of online retailers to hide a tool that displays a form designed to entice the visitor into revealing their credit card information. Akamai
Israel
The ghastly events in Israel and the Gaza Strip revealed the dangers of over-reliance on technology to discover what an opponent is planning. Despite Israel’s much-vaunted capabilities, it’s clear that Hamas militants were able to circumvent the security infrastructure that has made the Gaza Strip one of the most surveilled places in the world. Part of this may have been through misdirection; planting messages in conversations that it knew would be overheard. But, as a former US security official told Bloomberg, members of the group very likely avoided technology altogether. “I suspect they never talked about it electronically,” she said. “They broke it up into cells and did individual meetings. And each group was assigned to do different things. Very few people understood how each of the components came together as the whole plan.”
“Staggering”
The US Federal Trade Commission says Americans have lost at least $2.7 billion to social media scams since 2021 - but the actual figure is likely to be vastly higher because only 4.8% of people report their losses. The FTC’s report provides an excellent overview of the myriad ways in which social media can be used to commit fraud. And it points a particular finger at online shopping, saying it represented 44% of all such losses. The FTC’s suggested defences are basic but valid; limit who can see your details and posts, be sceptical (especially about anything that sounds urgent), and research a company or individual before you agree to buy anything from them or send them any money. And ESET also has guidance on how to spot fake profiles.
AI
All seeing: Rewind is a Mac and iPhone app designed to record the user’s life. Its maker is now launching a wearable device called the Rewind Pendant that captures and transcribes the wearer’s real-world conversations. The idea is to create a personalised AI powered by everything the user has seen, said, or heard.
Making it up: As has been amply demonstrated, large language models like ChatGPT have a tendency to make things up when they don’t have the information to answer a query. A post from earlier this year explains why calling this “hallucination” isn’t helpful and why we should use the term “confabulation” instead. Beren’s Blog via Daniel Miessler
Alexa: The Washington Post has a recording of Amazon’s voice assistant using Rumble as the source for its answer to the question, “Was the 2020 election stolen?” Its reply, “From rumble.com, ‘the 2020 election was stolen by a massive amount of election fraud.’”
In brief
Bonus: Alas, that email about a bonus is highly likely to be your employers testing your cybersecurity awareness. We question the use of these phishing simulations because of the risk that they simply irritate the recipients and make them less safe, as The Wall Street Journal explains.
Dangerzone: The Freedom of the Press Foundation has released a free tool that enables suspicious files, including Microsoft Office documents and PDFs, to be read safely. The tool is not completely simple and it’s in its early stages of development but it looks promising.
Authentication: A report from the US Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) will resonate with any organisation which has tried to implement multi-factor authentication. The agencies are urging developers to make the process simpler, including agreeing on terminology to reduce confusion.
Screwed up: The agencies have also released a list of the top 10 misconfigurations they’ve come across at large organisations. And CISA has published a free Security Planning Workbook intended to help with basic security planning.
23andMe: The DNA and genetic testing service has told its users to reset their passwords following a data breach in which details of some individual profiles may have been stolen. TechCrunch
Air Europa: The airline has told customers to cancel their credit cards after attackers managed to install a data stealing tool in its payment system.
MGM: The hotel and casino giant says it expects last month’s ransomware attack to cost it $100 million. It also revealed the attack led to the loss of personal information of customers up to March 2019. Stolen data includes names, phone numbers, email addresses, dates of birth, and driver’s license numbers.
Undersea: The EU is examining proposals to make submarine internet cables more resilient to sabotage attempts. Politico
Copycats: A Russian university has developed a social evaluation system as currently seen in China. The platform produces a score based on personal and public life, education, financial status, criminal record, and internet activity. Moscow Times
Overload: We’ve talked before about security fatigue. Research from Thales underlines how widespread this problem is. 34% of the people in its UK survey said they’d given up on cybersecurity because it felt like an impossible task.
Switched off: There are reports that iPhones have been turning themselves off for a few hours overnight (this is something we’ve seen as well). You can see whether this has happened to you by going to Settings | Battery | Last 24 Hours. The reason isn’t clear and we’ve asked Apple for an explanation.
Updates
iOS: Version 16.7.1 is a (vital) security update for older devices - or those which haven’t yet taken the leap to iOS17.
Chrome: Version 118 is an important security update for Google’s web browser. To be clear, all updates are important but this one addresses 20 unique issues.
Patch Tuesday: Monthly update day brought a slew of offerings from Microsoft, Adobe, SAP, Citrix, Fortinet, Kubernetes, and Siemens.
Exchange: Microsoft has released a new and “better” update for a serious Exchange Server vulnerability initially addressed in August. Meanwhile, it appears that Exchange Online problems are due to anti-spam rules.
VLC: Version 3.0.19 fixes security issues and also improves support for the AV1 video coding format.