The threat to the critical infrastructure on which countries depend.
Ransomware on the rampage. An expert witness shoots Google in the foot. Facebook changes its rules on US election information. And an EV manufacturer falls victim to the fat finger of fate.
Critical
The UK’s National Cyber Security Centre says the number of reports it received over the past year reached an all time high and the resilience of the country’s critical national infrastructure isn’t where it should be. In its annual review, the NCSC said nation states and groups aligned with them were key threats and it singled out Russia, China, Iran and North Korea for particular mention. Of the 2,005 reports submitted last year, 62 were rated to be nationally significant. Four were “among the most severe incidents the NCSC has had to manage.”
This week also saw the release of an equivalent report by the Australian Signals Directorate. It came as a cyber attack brought the country’s major ports to a standstill. DP World says it hasn’t received any ransom demand and after restoring its systems is now trying to clear a backlog of some 20,000 containers. In its report, the ASD said it was essential to address critical vulnerabilities within 48 hours and if that isn’t possible internet-facing services should be disabled.
Meanwhile, Denmark says Russia hacked 22 critical infrastructure companies in “the most extensive cyber-related attack experienced to date.” SektorCERT said the consequences for the supply of electricity and heat in Denmark could have been serious if the intrusions hadn’t been discovered and stopped in time. SektorCERT tentatively attributed the attacks to Sandworm, a cyber unit of Russia’s GRU military intelligence service. It says initial access exploited vulnerabilities in Zyxel firewalls about which multiple warnings had been provided.
Threats
Google forms: Cisco Talos explains how Google Forms are being used for scams. The technique involves abusing the ‘Release Scores’ feature. It’s clever. The scammers create a quiz, use a victim’s email address to respond and then exploit the scores feature which kindly delivers their spam to the target.
Skype: A fake version of the messaging app is being used to steal cryptocurrency. Cointelegraph
Seniors: Anyone with friends or family over the age of 75 should expect them to be relentlessly targeted by scammers, most often over the phone. Re-engage and the University of Portsmouth found a fifth of the people it surveyed experienced weekly attempts to defraud them.
Juniors: And at the other end of the age scale, a multinational survey by the Global Cybersecurity Alliance and Amazon suggests young adults are particularly susceptible to online scams. In response, an online safety page tries to provide “concise and actionable information” for 18-25 year olds.
Black Friday: We’re sure you know this…but just in case. This week sees the online shopping sales begin. As always, it also marks peak season for scumbags and means we should all be on our guard. FBI
Privacy: Every year Mozilla produces a report looking at the privacy and security of the most popular connected products. This year’s makes for depressing reading. It includes warnings about devices from Sonos, Bose and Google. “Bad guys who keep getting worse” include Amazon, Samsung, Microsoft and Wyze. Privacy Not Included
Passwords: For the fifth year, NordVPN has produced a list of the most common passwords. To no-one’s surprise, top of the pile is ‘123456’ with variations on the same theme close behind. The results for streaming services were even worse, possibly because they are often entered on a TV set. ZDNet
AI
ChatGPT: Attackers linked to Russia said they were responsible for periodic disruptions that took the AI chatbot offline. Bloomberg
Porn: Leading venture capital outfit, Andreessen Horowitz, is reported to have invested in a company that provides a platform for sharing AI-made images including non-consensual sexual material picturing real people. 404 Media (R)
Confused: A study found that people think AI-generated faces (created with three-year old technology) are more authentic than real ones. The issue applies particularly to white faces because they comprise most of the material used to train AI models.
Poison: Online news site, Tortoise, asked Google “What is an African country beginning with K?”. The top result was followed by a text snippet saying there weren’t any (despite, er, Kenya). The incorrect statement was generated by ChatGPT, posted online and was then picked up Google in another example of the way in which AI ‘hallucinations’ can poison search results.
Propaganda: Tech Against Terrorism details how extremist groups are using generative AI to create and spread propaganda. It says it’s tracking some 5,000 such pieces per week, including images from Hezbollah and Hamas aimed at influencing the Gaza war narrative. Wired
Tables: Reservation platforms like Resy are trying to find ways to combat people who use automated ‘bots’ to vacuum up sought after restaurant reservations and then resell them for substantial sums. Bloomberg
Jobs: An unemployed programmer used an AI-powered app to submit almost 1,000 job applications in a single night. In total, he applied for 5,000 posts and obtained 20 interviews, one of which resulted in an offer. Wired
Ransomware
Many organisations are failing to ensure they retain adequate logs, making it difficult to respond effectively to information security incidents. Sophos says 42% of the cases it analysed over an 18-month period lacked the data, often because attackers had managed to delete the records. The importance of such information is underlined by the latest high-profile ransomware attacks. In the latest incidents claimed by the Lockbit gang, the US broker-dealer branch of Chinese banking giant ICBC came close to collapse and disrupted the $26 trillion market in US Treasuries. In another, one of the world’s largest law firms, Allen & Overy, admitted that its operations had been disrupted. Given the cyber capabilities of the Chinese government, Lockbit’s decision to attack part of the country’s largest bank is decidedly punchy.
Money
Some extraordinary details from the US Department of Justice’s antitrust case against Google which accuses the tech behemoth of abusing its power to dominate the search engine business. This week, it emerged that Apple receives 36% of the revenue from search advertising on the Safari browser in return for making Google the default search engine. The information came courtesy of Google’s own expert witness who apparently revealed it accidentally. Both Apple and Google had tried to keep the details secret and Google’s lead lawyer “visibly cringed” when it emerged. Among other tidbits, the case also provided a rare look at the search terms that make Google most money (although the list is five years old.) A verdict in the trial is not expected until next year.
In brief
Anti-social: Adverts on Facebook and Instagram will be allowed to question the legitimacy of the 2020 US presidential election. The Wall Street Journal reports on a number of similar decisions by social platforms, including YouTube.
Phones: The US Federal Communications Commission has adopted new rules to make it more difficult to hijack cellphone accounts. The measures include strengthened authentication procedures and requirements to notify customers whenever changes to their accounts are requested.
Tracking: The Irish Council for Civil Liberties says browsing data is being sold in greater detail than previously thought. It warns about a trade in data about European and US political and leaders which allows details to flow to Russia and China. Meanwhile, The Register reports that a marketing industry group is taking Google to court in the UK over its plan to prevent Chrome users being tracked across different websites.
Surveillance: An EU parliamentary committee has voted against mass scanning of private and encrypted communications as part of legislation aimed at identifying child sexual abuse material.
Spyware: Israel is reported to be using Pegasus spyware in the Gaza war. Axios says it’s part of efforts to find those kidnapped by Hamas. The NSO group, which makes Pegasus, is trying to persuade the US to remove trade restrictions on its sale and distribution.
Greece: Tovima newspaper says the country’s EYP intelligence agency used Predator spyware to spy on its own employees, including high-ranking officers.
Threads: Meta has decided to allow users to delete their Threads account without having to leave Instagram. After an initial surge in sign-ups, the number of Threads users has stabilised at around 140 million (though that’s an estimate because in July Meta stopped disclosing the actual figure).
TikTok: The Nepalese government has banned the social media app saying it disrupts social harmony.
Disinformation: South Korea has identified a network of websites posing as fake Korean news agencies. The 38 sites published pro-Chinese and anti-US articles targeting Korean-speaking audiences.
Sources: The latest from Pew Research; 30% of US adults regularly get their news from Facebook, 26% from YouTube, 16% from Instagram, 14% TikTok, 12% X, 8% Reddit, and 5% Nextdoor and LinkedIn. The figure for WhatsApp; 3%.
Samsung: The UK division of the South Korean tech giant appears to have suffered a year-long data breach.
Rivian: The electric vehicle manufacturer has blamed a “fat finger” for a disastrous over the air software update that ‘bricked’ infotainment systems (and in some cases entire displays).
Updates
Patch Tuesday: The November set of security updates include fixes fromAdobe, Microsoft, SAP, Citrix, Fortinet, Kubernetes, AMD, and Intel. Many of these are being actively exploited.
Microsoft: There’s been a long-running issue causing delays for Outlook Desktop users. A fix is being slowly rolled out. Bleeping Computer
WhatsApp: A new privacy feature will enable iOS and Android users to hide their location during calls. It’s also introducing a new feature providing voice chat for large groups.
VMware: A critical and unpatched security flaw in Cloud Director could be used to circumvent authentication protections.
Security keys: Google has launched two new models to replace its current line-up of USB-A and USB-C Titan keys. As well as USB ports, both models support NFC connectivity. Google says it will give away 100,000 of the new devices to high-risk users, including campaign workers, activists, and journalists. Security keys are by far the safest authentication method, albeit also the most labour intensive one.
Tails: An emergency update to address a security vulnerability in Tor.