What went wrong at Okta. ChatGPT fuels phishing flood. Regulators gotta regulate.
Chinese cyber superpower. Spyware in India and Armenia. And Rentahitman.com strikes again.
Okta
When things go tits up, blame the staff. That seems to be the approach deployed by authentication giant, Okta, in a report on an incident which gave attackers administrative access to the accounts of some its customers. Okta said the most likely cause of the breach was an employee who logged into a personal Google account on a company-managed laptop. According to Okta, the employee had used their Google account to store credentials for a business administration tool. When the Google account was compromised, so was the Okta ‘service account’. Result; delighted attackers, furious customers, frantic back-covering.
There are plenty of learnings here but, for a start, you can’t possibly blame the incident on a single individual who was foolish enough to ignore the company’s policy which (almost certainly) prohibits accessing personal accounts on company devices. The fact that attackers were able to exploit the service account means Okta clearly failed to protect it sufficiently (by for example limiting access to specific devices or IP addresses). Equally though, a company that specialises in security, should have ensured that it was impossible to log into a personal account on a corporate device. Like anyone working in cybersecurity, we could have assured them that regardless of what policies say, if people can access such accounts, then sooner or later they will.
More evidence of exactly that comes courtesy of US Immigration and Customs Enforcement. An audit of phones belonging to the agency’s staff and contractors found apps that threatened its security, including some that were supposed to be banned on government devices. Device management issues at the agency made it more vulnerable to “potential espionage, leaks and attacks from viruses,” the oversight report said.
Threats
Phishing: The number of malicious phishing emails has grown by 1,265% since the launch of ChatGPT, according to SlashNext’s State of Phishing Report 2023. It adds that 68% of phishing emails used text-based ‘business email compromise’ (BEC) tactics designed to steal funds or sensitive information. And atttempts to steal login credentials saw a rise of 967% compared to the previous year.
Spear phishing: A separate report says precisely targeted attacks were the most common technique in the third quarter of this year. It really is vital to ensure basic measures are in place to mitigate this threat. Reliaquest
Roblox: Cisco Tales rounds up the current ways in which players of the popular online game are being scammed.
macOS: Newly discovered malicious software serves as a reminder that even Mac devices can be vulnerable to malicious software. Keeping machines updated and being careful when installing apps are essential mitigations. Jamf Threat Labs
On sale: Sensitive personal information belonging to US military personnel and their families can be bought for as little as $0.12 per record, according to US academics. This is hardly surprising and the risk is obvious, but it does underscore the extent to which data about all of us is available. Duke University
Discord: The communications platform is to introduce temporary file links to try to stop attackers from using its network to host and deliver malicious software. Discord’s servers have long been regarded as a safe space for malicious hacking activity. Bleeping Computer
Find My: Concerns over the security of Apple’s tracking solution have resurfaced, two years after their first appearance. We’re not clear why a rash of articles has suddenly popped up all linking to the previous coverage. Suffice to say, there is a theoretical risk with FindMy. We reckon it’s more important to remember that FindMy means an Apple device is always on, even if it appears the battery is dead.
LinkedIn: And one piece of good news. You might have seen reports of a data breach at LinkedIn. They were based on claims that have been shown to be bollocks (though please do lock down your public LinkedIn profile if you have one). Troy Hunt
AI
ChatGPT: Almost a year after its launch, OpenAI has confirmed radical updates, including the ability to create custom AI assistants as well as a marketplace that’s effectively an App Store for the platform. Many of the new features require a paid subscription. We’ve previewed some of the new capabilities in previous weeks. Their impact is likely to will be revolutionary.
Grok: Meanwhile, Elon Musk has unveiled his AI model to test users in the US. It uses dynamic data from X/Twitter and is billed as channelling the Hitchhiker’s Guide to the Galaxy. We haven’t had access to it but one of those who have summed it up as “cringe AF.”
Deepfakes: There’s a well documented boom in AI-generated fake nudes. The Washington Post reports on how they’re ruining teens’ lives.
Detector: Meanwhile, ahead of crucial elections across the world next year, Microsoft has announced an initiative to combat deepfakes and disinformation.
AGI: Artificial General Intelligence is (more or less) defined as the ability of an AI agent to accomplish intellectual tasks as well as a human. The co-founder of Google’s DeepMind artificial intelligence lab reckons there’s a 50% chance this will be achieved by 2028.
Linked: Fusus turns any camera in the US into part of a unified surveillance system. Police departments are already using it. 404 Media
Myspace: The founders of Myspace have reemerged with a free text-to-video generator that allows users to add their own likeness to their creations. TechCrunch
Regulation
Noteworthy developments as governments around the world grapple with the extent of the internet, the reach of the services it enables and the power of the companies that control them.
-
In the UK, the Financial Times says the technology industry is calling on the government to clarify proposed powers it believes could block the rollout of new privacy features on messaging platforms.
-
Guidelines on complying with the newly minted UK Online Safety Act run to more than 1,500 pages.
-
Mozilla says proposed EU legislation on electronic transactions*“*radically expand the capability of EU governments to surveil their citizens.”
-
The Washington Post examines how the Indian government has been largely successful in exerting control over US social media companies, most notably X Twitter, thereby setting “ a global standard for online censorship.”
China
Regular readers will know we write frequently about the growing sophistication of China’s cyber operations. This week, a report pulls together what’s been happening - and the extent of the resultingthreat. Recorded Future says Chinese activities have shifted from “broad intellectual property theft” to a much more targeted approach designed to support specific strategic goals, such as the Belt and Road Initiative and critical technologies. The report puts particular emphasis on China’s exploitation of ‘zero-day’ (i.e. previously undisclosed) vulnerabilities, an approach supported by legislation that requires organisations to disclose such issues to the government before updates are released to address them. It’s a long report and we’ve only scratched the surface here. The whole thing is well worth a read. (Also this week, Palo Alto Networks says China has deeply compromised Cambodia’s government networks.)
Journalists
Attempts were made to install Pegasus spyware on the iPhone of an Indian journalist working for the Organized Crime and Corruption Reporting Project (OCCRP), the organisation says. According to the OCCRP, the attack occurred within hours of sending questions to the Adani group, one of India’s largest companies, about allegations of stock market manipulation. Pegasus is sold exclusively to governments and India is known to have been a customer in the past, although it is reported to have been looking for an alternative. Indian journalists have repeatedly been targets for spyware and the journalist working for the OCCRP was among recipients of infiltration alerts that we reported last week. This week, Apple is warning of similar attacks in Armenia.
In brief
Influencers: The US State Department says Russia is using three “influence-for-hire” companies to spread propaganda across Latin America. It says articles are written in Russia, translated to Spanish or Portuguese, and then sent to the companies for promotion across local news outlets.
Russia: Russia has widened its efforts to control the use of virtual private networks (VPNs). TorrentFreak reports that 167 services have been blocked together with more than 200 email services.
Meta: Mark Zuckerberg repeatedly thwarted initiatives to improve the well-being of teens on Facebook and Instagram, according to internal communications revealed in a court case in Massachusetts. CNN
Privacy: Apple described Android as a “massive tracking device,” according to documents released in a US Justice Department competition case against Google. The description didn’t stop Apple doing a deal to make Google the default search engine on its portable devices (earning Apple up to $20 billion a year).
Signal: A longstanding concern about the secure messaging platform is that it requires the use of phone numbers. Now, Signal is testing usernames that would allow phone numbers to be hidden.
Silence: An 18-year old suspect in a phishing case in Belgium is refusing to disclose his passwords, citing his right to remain silent. Prosecutors have responded by requesting a fine of €5,000 a day until he coughs them up. NieuwsBlad
AirTags: Residents in some parts of Washington DC will be given free tracking tiles in a bid to get a grip on spiralling car thefts.
Murder for hire: A 34-year old woman from New Orleans has been jailed for 18 months after visiting a parody website - Rentahitman.com - in an effort to have a love rival killed. The purported assassin, named ‘Ace’, turned out to be an FBI agent. Depressingly, this isn’t the first time this has happened - with the exact same website.
Updates
Apple: Updates for a wide selection of devices, though there are sparse details of what issues they address. The new versions include Ventura 13.6.2 and Sonoma 14.1.1. iOS 17.1.1 fixes wireless charging problems.
Water: A new feature in macOS Sonoma is designed to detect when a machine has been exposed to liquids. A “Liquid Detection and Corrosion Mitigation Daemon” runs in the background and inspects the machine’s USB-C ports. It’s believed the aim is to cut down on warranty claims. A similar scheme focussed on iPhones did not end well for Apple. 9TO5Mac
Google: Android VPN apps which have been independently audited will be distinguished in the Play Store by a safety mark. App Defense Alliance
Atlassian: A critical vulnerability in Confluence server is under “mass exploitation.” There’s a fix. If it isn’t installed, expect problems.
QNAP: Four security updates for network attached storage devices.
Oracle: Multi-factor authentication is now enabled by default for all Oracle Cloud customers (new and existing). The change follows Amazon’s decision to mandate MFA for new AWS root accounts.
WhatsApp: A new native WhatsApp app for macOS is now available from the Mac App Store. It has a bunch of improvements…but do note that desktop versions of messaging apps like WhatsApp and Signal are inherently less secure than their smartphone equivalents.
Chrome: Wonder which websites are hogging your memory. Hovering over a tab in Google’s web browser will reveal the memory hogs.
SecureDrop: Version 2.7.0 changes the encryption protocol and should automatically migrate existing keys.