Israel tells people to lock down their security cameras - or turn them off.
Malicious adverts. Signal denies vulnerability. Online image detection createsdisinformation. Advice on how not to be phished. And the CIA's Telegram channel for recruiting spies is hijacked.
Israel
The Israeli government has told its citizens with home security cameras to secure them or turn them off saying they could be hacked and used to collect intelligence. Among the precautions, it says passwords should be changed, 2-factor authentication enabled and automatic updates turned on. It adds that anyone who can’t change the settings should cover the camera or disconnect its power supply. Israel may be heeding lessons from Ukraine where security cameras were hacked to track military convoys and inform missile targeting. It’s long been our policy to suggest similar precautions when dealing with sensitive information (and that includes ‘smart’ TVs).
The European Commission has given Meta and TikTok until next Wednesday to explain how they’re handling illegal content and disinformation related to the ongoing conflict. The inquiry falls under the EU’s newly enacted Digital Services Act (DSA), which makes large online platforms legally accountable for the content posted on them. Last week, the Commission sent a similar request to X/Twitter. Insider reports that proprietor, Elon Musk, is now mulling the removal of the app from the EU. (As well as the Israel/Hamas conflict, the Commission is looking into what Meta and TikTok are doing to safeguard the integrity of elections.)
Many analysts believe Musk has a lot to answer for because of the way he has changed X/Twitter, to the extent that it might be no bad thing if he did yank European access. As 404 Media reports (R), a key issue is the confusion over “verified” users - a term that now encompasses anyone willing to stump up some cash. This has had a huge effect on open source intelligence (OSINT) with many accounts creating misleading content in the hope they will earn some money for themselves - and for Musk himself. When you add this to the problem of deliberately misleading information on the platform, you can see the extent to which the platform’s value has been debased.
One final note on the conflict. Hamas has used the social media accounts of the hostages it’s holding to livestream attacks and issue death threats. It’s a new and particularly gruesome tactic. Social media companies have yet to comment. New York Times
Threats
Cisco: Attackers have exploited a previously unknown (‘zero-day’) vulnerability in IOS XE to compromise tens of thousands of devices. It’s believed smaller organisations and individuals are the most affected. There’s no fix so far; Cisco’s only advice is to disable the HTTP Server feature on all internet-facing systems.
Admin: A survey analysed 1.8 million administrator credentials and found 40,000 of them were using “admin” as the password. That was closely followed by “123456”. Words fail. Outpost24
WinRAR: Google says several state-backed hacking groups are taking advantage of a serious vulnerability in the compression software which is used by over 500 million users. A fixed version (6.23) is available but the software has been around for so long that many users may not have installed it.
Voice: We’ve seen increasing use of voice messages as a favoured way of initiating an attack. The latest variation on the theme involves including an ‘access key’ in the initial email. That is then repeated in the attached voice message. They key doesn’t do anything - it’s just intended to make it more likely that the recipient eventually installs a malicious file. Cofense
Copy: Attackers created a copy the Women Political Leaders Summit website to target attendees of the actual conference with espionage malware. Trend Micro
North Korea: The US and South Korea have updated their guidance on how to avoid hiring North Korean agents touting for work as freelance IT practitioners. The FBI and US Justice Department say thousands of such workers have earned millions of dollars from US companies and sent much of it back to North Korea.
Messed up
Despite saying it vets the adverts it hosts, Google showed a highly convincing malicious ad for a password manager – and it was paid for by a “verified” advertiser. As Ars Technica explains, there’s no easy way to tell from the ad (for KeePass) that it leads to a site that will install a suite of malicious software on the visiting device. Information on Google’s Ad Transparency Center showed that the ads ran for several days and were paid for by a company whose identity has been verified. Booby-trapped ads and search results are particularly popular with attackers at the moment (fake browser updates are a favourite) and we advise being very cautious given that Google either can’t be bothered or is unable to keep its house in order.
Signal
The cybersecurity world got hot under its collective collar this week over rumours of a previously unknown (‘zero-day’) vulnerability in the secure messaging platform, Signal. Signal said it responded to the “vague viral reports” by carrying out a “responsible investigation” which found no evidence of anything untoward. The reports had suggested the alleged issue was connected to the Generate Links Previews feature but no-one has come forward so far with any concrete evidence of a vulnerability. We believe Signal remains the most suitable secure messaging solution for most people - mainly because it’s not for profit and it’s easy to use. That doesn’t mean it’s necessarily the best solution for all situations and no-one should believe that using it makes one immune to sophisticated surveillance.
AI
Image detection: Online tools to detect fake images are labelling real photographs from the war in Israel and Palestine as fake, creating a “second level of disinformation.”404 Media
Porn: Deepfake adult content is out of control, with the number of such videos increasing exponentially and major search engines merrily sending clicks to sites dedicated to the nonconsensual fakes. WIRED
Copilot: There are security concerns about Microsoft’s AI assistant because of its access the user data within Microsoft 365 apps. Bleeping Computer
Afterlife: A “digital afterlife industry” is enabling the reconstructions of dead people based on the data they’ve left behind. As IEEE Spectrum reports, even Microsoft has filed a patent in the field.
Safe words: Should you have a family ‘safe’ word to protect you against AI voice-spoofing scams? The Washington Post talks to one family that does.
Workforce: AI is likely to lead to seismic changes in the workforce, eliminating many professions and requiring a societal rethink of how people spend their time. That’s The Wall Street Journal’s take on a conference of prominent tech leaders that it organised.
In brief
Advice: US security agencies have published advice on avoiding the ridiculous amount of phishing activity at the moment. The guidance focuses on basic measures, including secure forms of multi-factor authentication. It has specific advice for small and medium-sized organisations.
India: Between 2016 and last May, India accounted for more than half of all internet shutdowns recorded worldwide. Indian officials say they were needed to tamp down online rumors and unrest. Critics argue they were used to stifle discourse and control the public narrative. Washington Post
23andMe: Last week, the DNA and genetic testing servicetold users to reset their passwords following a data breach. Now at least 4 million user records have appeared on a cybercrime forum. The poster claims the dataset contains information from “the wealthiest people living in the US and Western Europe.” TechCrunch
China: The Five Eyes intelligence alliance has accused China of becoming more brazen in its targeting of businesses, saying “there is no greater threat to innovation than the Chinese government.” The alliance brings together the US, UK, Canada, Australia and New Zealand. The Register Reuters
Tanzania: The government appears to be tightening rules on the use of virtual private networks (VPNs). Organisations and individuals have been told to report their VPN usage by the end of the month.
USB: Kaspersky reports on a sophisticated operation that targeted “government entities” in the APAC region by compromising a specific type of secure USB drive used to safely transfer data between systems.
Glitch: A researcher exploited a glitch in the CIA’s official account on X/Twitter to hijack a Telegram channel used to recruit spies. The issue involved the way in which X/Twitter shortens links to webpages. BBC
Updates
Microsoft: Administrators will be relieved that a misbegotten anti-spam rule has been disabled. It was mistakenly tagging all emails sent to external emails as spam and sending a copy to the Exchange Online admin.
Sonicwall: An update has just been released to fix multiple issues that could cause a firewall to crash. The SonicOS Management web interface and the SSLVPN portal were both affected.
Atlassian: US government agencies are warning private sector and governmental organizations about an expected “widespread, continued exploitation” of a known issue in Atlassian Confluence. They’re urging administrators to apply the update to address the flaw immediately.
Exim: A further security update addresses three remaining long-standing issues with the mail server platform. The only version now supported is 4.96.2.
Meta: You can now stop Instagram from collecting your data across apps and websites you visit. The control is in the platform’s Accounts Center.
WhatsApp: Meta says users can now have two accounts on the same device (about time too). It also warns about downloading fake and imitation versions of the app. We tried it out on an iPhone and saw no sign of the change, so presumably it’s rolling out gradually.
Oracle: Another whopping set of updates - 387 no less, 40 of them addressing critical severity issues.
Zimbra: Updates for Zimbra Daffodil 10.0.5, 9.0.0 Patch-37 & 8.8.15 Patch-44.