SolarWinds accused of hiding security deficiencies.
Ryan Gosling tops the fraudsters' list. A major upgrade to ChatGPT. Apple warns of an Indian state-sponsored cyberattack. And HBO really doesn't like criticism.
Solar Winds
The US Securities and Exchange Commission has filed fraud charges against software company SolarWinds and its chief information security officer, Timothy Brown. The agency says that for at least two years before the hack, the company knew about its deficiencies and discussed them internally but misrepresented the risks to investors. According to the SEC, an engineer raised concerns about the company’s virtual private network saying it could act as a digital backdoor for future attacks and allow attackers to roam through the company’s resources “without anyone noticing.” Despite repeated warnings, SolarWinds managers took no notice.
The list of ‘deficiencies’ produced by the SEC is scary. Among them, SolarWinds failed to;
-
Consistently maintain a secure development lifecycle (SDL) for its software
-
Enforce the use of strong passwords on all systems
-
Remedy access control problems that persisted for years
-
Fix vulnerabilities in its software in time
-
Staff its cybersecurity roles
The result was a devastating data breach carried out by hackers linked to Russia’s SVR intelligence agency. The APT29 group broke into SolarWinds network in early 2019 and inserted malware into its Orion software. Through Orion updates, the malicious software spread to more than 18,000 corporate and government networks across the world, including several US federal agencies. Perhaps the most notable thing about all this is that SolarWinds - and its CISO - are not being sued for their appalling security failures but for lying to their investors.
Threats
Amazon: Beware of PDF attachments, particularly if you’re a user of Microsoft Live Outlook. Netskope has been studying a series of phishing campaigns and found most of them use an Amazon theme.
Celebrity: Ryan Gosling is the personality most often used by scumbags in their phishing schemes. That’s according to McAfee which has been tracking this sort of thing for years.
Pepsi: Fraudsters are impersonating PepsiCo and targeting businesses with a booby-trapped Request for Quote. INKY
Facebook: A information stealing campaign is using adult images and targeted advertising to entice victims into clicking on a link that installs malicious software - and hijacks their social media accounts. Bitdefender
Messaging: People are often tempted to install a modified version of messaging apps like WhatsApp. As Kaspersky explains, this is a very bad idea because of the risk that the modified version hides malicious software inside it.
Iran: Pro-Teheran attackers are showing signs of increasing sophistication, according to Check Point. A key aim is to gather intelligence – and email is a favoured target.
Link shortening: An on-demand URL-shortening service is being offered as part of a novel Cybercrime-as-a-Service scheme. The aim is to provide shortened URLs that avoid detection as attackers distribute phishing, scams and malicious software. Infoblox
SME: Insurance giant Hiscox says smaller organisations are increasingly the target of cybercriminals. Over the last three years, the number of organisations with under ten employees that experienced a cyber attack more than doubled from 23% to 36%.
AI
While politicians and business leaders discussed how to manage the risks of artificial intelligence, ChatGPT announced a major update that is likely to revolutionise how humans interact with information. Among the features it offers is the ability to analyse documents, browse the web and generate images all at the same time. Previously, it was necessary to do these things separately. VentureBeat describes it as a ‘Voltron’ upgrade; a reference to an animated series about a giant super robot. While technology giants at the UK summit may have agreed to work with governments to test new models before they’re released, many analysts question the ability of any entity to control the development of ever more powerful tools.
Call centre: A demonstration of the disruptive capability of AI is provided by a company offering a solution to replace call centres and customer service agents. Air AI can hold a 10-40 minute phone call and - as its demo shows - it sounds scarily like a human. And of course, it doesn’t take time off or get sick.
Imaginary friend: A researcher has spotted Instagram working on a feature that would enable users to create a customised AI friend. Screenshots suggest users would be able to chat with the AI to “answer questions, talk through any challenges, brainstorm ideas and much more.” TechCrunch
In brief
India: Apple has warned at least prominent 20 Indian nationals, including opposition politicians and journalists, that they were the target of a state-sponsored cyberattack. The news has revived allegations that the government is using hacking and surveillance to suppress political rivals. Washington Post
Security: Microsoft has announced a ‘Secure Future Initiative’ in what it says is an effort to improve the built-in security of its platforms and products. Bleeping Computer
Batterygate: Apple has failed to block a mass UK lawsuit that alleges it hid battery issues in iPhones. Apple says the suit is “baseless”
YouTube: Google has stepped up its efforts to stop people using Adblockers. 404 Media says it shows how the company controls the internet.
Blocker: Samsung has introduced a new security feature for its latest line of smartphones. Auto Blocker prevents users from installing apps downloaded from outside the Samsung Galaxy and Google Play stores.
Meta: The introduction of a paid subscription plan for Instagram and Facebook appears to be an effort to circumvent EU data protection controls. The idea is that by choosing between paid and free accounts, users are making a conscious decision about whether to hand over their personal information for targeted advertising.
Ransomware: A US-led coalition of 48 countries has pledged not to pay ransom demands from cyber attackers. TechCrunch
Canada: The government has banned WeChat and Kaspersky products on official devices.
Trolls: Rolling Stone reports that HBO executives used networks of Twitter trolls to harass TV critics who gave poor reviews to their shows. Its investigation is based on text messages that provide a salutary reminder to never put in writing something you wouldn’t be happy to see in public later. (See also, Her Majesty’s Government/COVID.)
Updates
iOS: Apple recognises that some iPhones are experiencing slow WiFi and general connectivity issues. It says iOS 17.2 will fix the problems. It should be released shortly. It will also introduce the security of iMessages by verifying the identity of users.
Citrix: Attackers are busily exploiting issues in vulnerable NetScaler ADC and Gateway appliances. There are fixes but they don’t address existing breaches. Mandiant explains.
Atlassian: Confluence customers are being urged to install fixes for a critical security flaw immediately.
Tor: Updates following security audit that identified three issues.
Tails: Updates Tor Browser, Thunderbird and Linux kernel.