A surveilled world. A signal from the OpenAI saga. Cyber crime as big business.
China's intimidation tactics. And Italy introduces smartphone controls to protect kids.
Targeted
Several stories this week demonstrate the extent to which targeted hacking and mass surveillance have becomecommonplace. In the US, an Israeli private investigator was jailed for 80 months after being found guilty of running “an international hacking-for-hire spearphishing campaign.” Clients hired his company to carry out “intelligence gathering efforts” which in reality were hacking campaigns directed at specific groups including opponents of big oil companies and critics of a German payment processing company. The contracts generated more than $4.8 million.
Meanwhile, Reuters examines how an educational startup in India grew into a hacking operation that “stole secrets from executives, politicians, military officials and wealthy elites around the globe.” An independent report commissioned by Reuters confirms the operation was involved in targeted attacks and surveillance. Clients included private investigators, government agencies, corporate clients, and organisations engaged in major litigation battles. They were drawn from countries including the US, UK, Israel, India, and Switzerland. Targets ranged from a Native American tribe trying to close a casino deal to the Norwegian telco, Telenor.
And in the US, Senator Ron Wyden is asking the Justice Department to release information about a surveillance program that tracks more than a trillion domestic phone records every year. As Wired reports, the program uses a technique known as “chain analysis” that targets not only those in direct phone contact with a criminal suspect but anyone with whom those individuals have been in contact. Senator Wyden points out that despite receiving federal funding, the ‘Hemisphere Project’ receives the money through a process that allows it “to skip an otherwise mandatory privacy review.”
Threats
Rulebreakers: 26% of all cyber incidents in the past two years were caused by employees intentionally violating information security policies, according to a comprehensive survey by Kaspersky.
QR code: The BBC has a good example of the risks of QR codes. It tells the sorry tale of £13,000 scam that began with a fake code that had been stuck on top of the real one in a railway station car park. We loathe these wretched things and urge people to avoid using them to make payments in places like car parks.
Evolution: Protection rackets are a time honoured tool in the criminal’s arsenal - and cyber scumbags have now got in on the act. For a monthly fee, they’ll promise not to attack a company and protect it from other gangs. In a variation on the theme, another group has started threatening to report victims to regulators if they fail to pay up. Barracuda
Mac: An information stealer designed to target Mac devices is being distributed via a fake browser update. Malwarebytes
Hijacked: Cofense has a detailed report on how hijacked email threads are used to trick targets into visiting a malicious web address.
North Korea: DPRK hackers have long exploited the recruitment space to earn much-needed foreign currency and support its espionage campaigns. Palo Alto Networks explains how they pose as both recruiters and job seekers.
Black Friday: Following our warning about online shopping, we were asked about the most common scams. There are numerous variations but the main themes are; fake promotions, failed transaction alerts, parcel tracking messages and booby-trapped coupon codes.
AI
OpenAI: A brief note about the drama surrounding off/on CEO Sam Altman. Much of the detail remains hidden but the outlines of what went on are more or less clear. Just as in the early days of the world wide web, there was a tussle over how the technology should be exploited. On one side there was a focus on safety, transparency and public good. On the other, a belief that it should be developed as quickly as possible and monetised to the max. And no surprise, just as with the web, the latter emerged the clear winner. This is a thesis supported by a report in The Information. It says recent breakthroughs at OpenAI have been so impressive that employees expressed concern the company “didn’t have proper safeguards in place to commercialize such advanced AI models.”
ChatGPT: Amid all the drama, OpenAI made ChatGPT Voice available to all iOS and Android users, even those who don’t pay anything for the service. It’s impressive.
Science: AI ‘hallucinations’ (i.e. the crap that large language models are prone to come up with) represent a direct threat to science and scientific truth, researchers at the Oxford Internet Institute warn.
Voices: Eset’s Jake Moore warns that “AI-driven voice cloning can make things far too easy for scammers.” He knows whereof he speaks because his voice was recently ‘stolen.’ He set out to scam a small business (with its permission) and describes how easy it was.
Attenborough: On the same theme, a developer combined voice and image tools to create an (unauthorised) AI version of David Attenborough that narrated what he was doing, à la Planet Earth. Ars Technica
Argentina: The New York Times reports on the use of AI in the recent presidential election campaign and what this portends for the future of the democratic process.
Movies: Microsoft has changed its AI-powered image generator tool in the face of a viral social media trend in which users created posters of Disney films featuring their pets. FT
Upskilling
As an example of just how sophisticated the cyber crime game is, we present to you…AlphaLock. The new Russian hacking group has come up with a model that aims to create an end to end pipeline to generate revenue. In practical terms, that means a sleek user interface, online training and an affiliate operation that enables newly minted hackers to go out and make money. The group presents itself as a company providing above-board penetration tests to assess organisations’ security but it’s a paper thin disguise. As Bleeping Computer reports, AlphaLock illustrates the extent to which cyber crime groups are investing resources in trying to build a brand identity in a crowded market. As we’ve long warned, such groups are creating an environment which allows anyone to dabble in online crime.
In brief
China: Runa Sandvik explores how Beijing uses cyber capabilities and intimidation tactics to target civil society outside the country.
Passwords: Three of the world’s four most popular websites are putting tens of millions of users and their data at risk by failing to meet the minimum
standards for safe passwords. Georgia Institute of Technology
Shoulder surfing: Apple has filed two patents for solutions designed to improve the privacy of screens by making it harder for anyone other than the user to see what’s on display. Appleinsider
Cookies: The UK data protection regulator has told the country’s most popular websites to give visitors an easy way to reject all advertising cookies or face punishment.
Nuclear: A huge US nuclear research lab says hacktivists breached its systems and stole personnel data. The Idaho National Laboratory houses 50 experimental nuclear reactors, among other things. The attackers may describe themselves as “gay furry hackers” but they number NATO among their past victims. Cyberscoop
Addiction: A family in Arkansas is suing Microsoft and Epic Games for knowingly creating products designed to cause addiction in children. Insider Gaming
Italy: A law has come into force which aims to stop minors from viewing pornography and other potentially harmful content on their smartphones. La Stampa
Updates
Firefox: Version 120 includes important security updates and introduces new privacy controls including an option to strip tracking parameters from copied links. There are also updates for the Thunderbird email client.
Microsoft: Fixes are rolling out to address sign in errors that have been resulting in ‘Something Went Wrong [1001]’ messages.
YouTube: Google loathes tools designed to block adverts on websites and, if you use one, you may have found YouTube videos taking longer to start playing. This is no accident. “Ads are a vital lifeline for our creators that helps them run and grow their businesses,” a Google spokesperson told The Register. “In the past week, users using ad blockers may have experienced delays in loading, regardless of the browser they are using.”
Meet: Google’s web app can now recognise when you raise your hand and will trigger the corresponding indicator. Google recommends you keep your hand “away from your face and body.” We predict glorious confusion.
WhatsApp: Meta is (gradually) introducing a feature to the iOS app that allows users to associate their account with an email address, providing an alternative verification method. WABetaInfo
Citrix: There are renewed warnings about ongoing attacks that exploit a now fixed vulnerability in NetScaler Gateway appliances. One security researcher described what’s going on as “organised crime gangs with digital bazookas.” As Citrix explains, simply installing its updates are not enough. Any existing sessions also have to be terminated.
Kubernetes: Security update to fix a privilege escalation on Container-Optimized OS and Ubuntu nodes.