The latest on social engineering, data breaches and online fraud.
Scammers exploit the Israel-Hamas conflict. Russian efforts to underminedemocracies. Cellphone surveillance. Okta criticised. And not so smart meters.
Overview
The EU’s cybersecurity agency says this year has seen a significant rise in social engineering attacks, with information stealing software becoming the biggest threat. In its yearly threat landscape report, it says there’s been a decline in the use of other types of malicious software and an increase in the number of law enforcement operations. It warns that ransomware and denial of service attacks are the highest specific threats while attackers have been “professionalising” the services they offer to would-be criminals.
The number of publicly disclosed data breaches in the US has reached an all-time high this year, with the numbers for the third quarter already passing the previous record. More than 2,100 data breaches have been disclosed this year, far above the 1,862 peak recorded in 2022. The ID Theft Center says the rise is partly attributable to the MOVEit hack, with 1,300 data breaches this year being related to it.
Meanwhile, the rate of cyber fraud in the UK fell slightly over the first half of this year (by 2% compared to the same period in 2022), but scumbags still managed to steal approximately £580 million. UK Finance says banks prevented a further £651m worth of losses through improved security systems and policies, suggesting some progress is beginning to be made on tackling the issue (at the expense of consumer irritation with the measures).
Threats
Israel: Researchers have found hundreds of scams centred on the conflict between Israel and Hamas. Most are seeking to take advantage of people’s willingness to aid those affected by the war. Many contain links to websites providing information about the situation which encourage individuals to make financial donations. Dark Reading
Roundcube: Pro-Russia attackers have been exploiting a previously-unknown (‘zero-day’) vulnerability in the widely-used webmail software to target government agencies and a think tank. Roundcube is a server application used by over 1,000 webmail services. An update has been issued to address the problem. ESET
Apple: Researchers have discovered a way to force Apple’s Safari browser to reveal information including passwords and the content of Gmail messages. Exploiting it requires a visit to a specially-designed website. The method takes advantage of a weakness in Apple’s WebKit browser engine which means it’s effective against any browser running on an iPhone or iPad. While the researchers have shown the method does work, the real significance is the way in which it demonstrates the frailty of web browsers.
QR codes: ‘Quishing’ is the term coined to describe phishing with QR barcodes. Multiple security organisations say the practice is on the rise. Help Net Security rounds up what’s going on - and what can be done to mitigate the threat, notably not to trust a webpage that opens as a result of clicking on a QR code which asks for important information.
Surgery: The FBI is warning that criminals are targeting plastic surgery offices to steal data and extort surgeons and patients. They combine the stolen information with social media details and threaten to publish it unless they receive a cryptocurrency payment.
Phones
Cellphones are a privacy nightmare, mainly because of the archaic, obscure technologies that make roaming possible. This is a well-known problem but a comprehensive new report from the University of Toronto’s Citizen Lab provides a wealth of detail about how the system is being abused. The root of the issue lies in the way messages are exchanged in order for cellphone connections to be seamlessly handed from one network to another. The information underlying those handoffs provides rich material for anyone wanting to track a target’s movements. While 5G networks potentially offer more protection, Citizen Lab warns that policymakers need to move quickly “to compel telecommunications providers to adopt the security features that are available.” The problem is that governments are the main consumers of surveillance data, so they like them just the way they are.
Elections
Russian efforts to weaken the world’s democracies have expanded to focus on sowing doubt in the integrity of elections, according to a declassified US State Department cable. “Our insights suggest that Russia is focused on carrying out operations to break public confidence in election integrity, and that they are doing this on a global scale,” a senior US intelligence official said. “Our information indicates that senior Russian government officials, including in the Kremlin, see value in this type of influence operation and perceive it to be effective in undermining confidence in the outcomes and legitimacy of the elected government,” the official told The Washington Post.
AI
Out of control: There’s a growing chorus of concern about the potential risks of artificial intelligence - particularly uncontrollable development and an almost complete lack of regulation. The latest warning comes from a group of distinguished academics, including the so-called godfathers of AI. In an open letter, they point out that AI has already surpassed human abilities in some areas, while saying “unforeseen abilities and behaviours” may emerge without explicit programming. To put it in context, in 2019 OpenAI’s model could not reliably count to ten. Now, as Daniel Miesssler explains, you can have a lifelike conversation with ChatGPT on your smartphone. Meanwhile, Stanford University researchers have accused the companies behind the leading AI models of lacking transparency and have urged them to reveal more about their use of data and human labour to train their creations.
Evasion: A majority of cybersecurity professionals believe the development of AI by adversaries will outpace defensive AI capabilities. Cybersecurity Insiders
Shadow AI: Plenty of organisations have banned their employees from using AI tools because of the attendant security risks. The BBC reports that this isn’t stopping people from using them for work purposes - even if they often do so at home to circumvent the restrictions.
PimEyes: Concerns about children’s privacy have led the public face search engine to ban searches for minors as part of a “no harm policy.” PimEyes has a database of nearly 3 billion faces and uses facial recognition technology to find online photos of a person. New York Times
Image verification: Google has released a new tool that examines the metadata of images to establish context and identify fakes.
In brief
Okta: The identity and access giant says a hacker managed to break into the system it uses for customer support and stole sensitive files uploaded by customers. Okta says it “identified adversarial activity” except it didn’t; its customers did and they’re very unhappy with how Okta has handled the incident. One of those affected is Cloudflare which has set out how long it took Okta to respond to reports of a compromise and urges it to do better in future. Cloudflare also suggests customers make sure they have enabled hardware multi-factor authentication for all Okta user accounts. The use of physical keys makes it much harder for attackers to circumvent authentication processes.
Casinos: The hacking group behind recent attacks on several Las Vegas entertainment resorts has used graphic threats of violence in order to force their victims to hand over network credentials. In at least one case, they said they would shoot someone’s wife unless he handed over his login details. Microsoft
GOST: 404 Media reports on Giant Oak Search Technology (GOST), a system used by US Immigration and Customs Enforcement to find “derogatory” social media posts by people seeking entry into the US.
Surveilled: And The Observer says the UK government has substantially increased its surveillance of what educators are doing online. The aim appears to be to monitor social media posts that critique official education policies.
Meta: 41 US states and the District of Columbia are suing the Facebook and Instagram owner for allegedly deliberately designing algorithms and features to addict children and teens to the platforms. Meanwhile, Mark Zuckerberg says its Twitter competitor, Threads, now has nearly 100 million monthly users.
Tinder: In what sounds like a nightmare or a source of rich comedy, ‘Tinder Matchmaker’ lets a user’s family and friends recommend suitable matches. Since would-be cupids don’t need a Tinder profile to make their suggestions, it sounds more like a security horror show to us.
Meters: 2G and 3G cellular networks are a security risk and are gradually being turned off around the world. That’s obviously a good thing. Less good, as British MPs have pointed out, is that when the switch is thrown, it will render millions of electricity smart meters defunct by removing the connectivity on which they rely.
Updates
Apple: Important security updates for macOS and iOS. They address multiple issues (at least 44 for macOS and 21 for iOS). Apple has also released updates for older versions of its operating systems. Meanwhile, the latest macOS (Sonoma) could stop third-party cameras working. Howard Oakley explains why.
WiFi: And one other note about Apple. It emerged this week that a feature supposed to enhance the privacy of iPhones and iPads has never worked as intended. The issue surrounds the address used by a device when it joins a WiFi network. Normally, it never changes which means a device could be tracked between networks. Apple had said the new feature would hide the real address and replace it with a different one for each network. Except a bug meant it didn’t. It’s now been fixed…three years after it was released. Ars Technica
Cisco: After a six-day wait, a fix was issued for a vulnerability in IOS XE which enabled attackers to hijack thousands of Cisco switches and routers. Unhappily, the attackers appear to have updated their methods to appear hidden. Thousands of devices remain compromised.
Citrix: Has urged owners to ensure NetScaler ADC and Gateway appliances have been updated to protect against ongoing attacks.
Firefox: Version 119 includes security updates and a bunch of new features, the most notable of which is an improved ability to manage PDFs. Next month, version 120 is expected to include a tool to help identify fake reviews.
Microsoft: Neowin says some users trying to install Google’s web browser on a Windows machine have been asked to fill in a survey explaining why they’re not happy with Microsoft’s Edge product.
VMware: Security updates for Aria and Fusion products.
SolarWinds: Security updates for its Access Rights Management platform.
BIG-IP: F5 has warned about a critical security vulnerability impacting BIG-IP that could result in unauthenticated remote code execution. Its advisory explains which versions include fixes for the issue.