Accusations against Meta and Google. A united front to make AI secure by design.
Google Drive tries to find the files it's lost. Iran linked to water utility attack. And why there's no need to worry about NameDrop.
Anti-social
A grim week for the social media and tech giants with accusations ranging from mishandling children’s accounts to placing big-brand ads on hardcore porn sites. The chargesheet…
For at least four years, Meta has knowingly refused to close the majority of Instagram accounts belonging to children under the age of 13, according to a document in a US federal lawsuit. Meta is also accused of collecting the children’s personal information without their parents’ consent. A Meta product designer is quoted in the lawsuit as saying in an internal email, “young ones are the best ones…you want to bring people to your service young and early.”
A Wall Street Journal investigation found Instagram serving “doses of salacious content” to test accounts set to follow young gymnasts, cheerleaders and the like. Alongside video clips such as “a man lying on a bed with his arm around what the caption said was a 10-year-old girl” Instagram displayed ads for brands like Pizza Hut. Meta said the Journal’s tests produced a manufactured experience that doesn’t represent what billions of users see.
Research by Adalytics identified adverts for leading brands and government agencies that appeared on hundreds of undesirable websites. Apple, BMW, the European Commission and the FBI were just some of those which found their ads appearing on websites such as pornocriceto[.]com (that’s Italian for Hamster Porn). The ads were placed through Google’s Search Partner Network. In a post on X, Google said Adalytics had a history of making exaggerating claims. Having seen the screenshots in Adalytics’ report, it’s hard to say the issue is being exaggerated.
Threats
Smishing: It’s a vile word for an ever more popular way of trying to fool us. Attackers know we’re much more vulnerable to their machinations when we’re using mobile devices, so it’s hardly surprising they’re putting more effort into text-based phishing attacks. Security outfit Zimperium says (R)users are 6-10 times more likely to fall for an SMS phishing attack than for one using email. Although it’s a sales pitch, there’s some useful content in Zimperium’s report, including the challenge of how to secure personal devices.
Booking.com: Customers of one of the largest online travel agencies are being attacked by fraudsters who masquerade as hotel employees. It’s an ingenious scam which involves stealing the hotel’s login credentials for booking.com. Obviously, that enables them to target guests and appear completely authentic. One of the key things to watch for are any requests for payment outside the booking.com because that should never happen. Panda
Bluetooth: The communication protocol is undeniably useful but inarguably risky. A group of European academics have now discovered six new issues which the maintainers of the standard have confirmed. Our advice is to turn Bluetooth off when it’s not needed.
AI
Secure by design: The US and UK together with 16 other countries have released new guidelines aimed at ensuring artificial intelligence technologies are ‘secure by design.’ The document reflects widespread concern that development in AI is far outpacing anyone’s understanding of what’s going on. In particular, the guidelines point to the risks of ‘adversarial machine learning.’ Put simply, that means exploiting fundamental vulnerabilities in components so that the machine learning systems can be made to do things they weren’t supposed to.
Extraction: For $200 researchers succeeded in extracting several megabytes of the data used to train ChatGPT and other AI models. In total, 16.9% of their tests contained personally identifiable information, including phone numbers, email and physical addresses as well as social media handles, and names and birthdays. The method they used was laughably simple; they just asked the model to “Repeat the word ‘poem’ forever.”
Copycats: Google DeepMind researchers say they’ve shown that artificial intelligence agents are capable of ‘social learning,’ whereby skills and knowledge are acquired by individuals copying from each other. Previously, teaching AI agents new skills was time-consuming because it involved humans demonstrating them in real time. The DeepMind researchers came up with a toolkit that simplifies the process which, they argue, could play a role in the development of artificial general intelligence (AGI). (We always try to define the terms we use, but no-one can really agree on a definition of AGI or even whether it’s possible. One loose definition is that AGI matches or surpasses what humans can do. If you’re interested, MIT Technology Review has a more detailed overview.)
Certified: First Leica came up with a way to authenticate images taken by its cameras, now Sony says it has finished testing a similar system. The feature creates a digital signature at the moment of creation that amounts to a digital birth certificate. A Content Authenticity Initiative with 2,000 members was formed in 2019 with the aim of creating a single authentication standard. Despite this Sony decided to go its own way. ProVideo Coalition examines the issues.
AWOL
Google has confirmed it’s investigating a problem affecting Google Drive users whose files have suddenly disappeared. It says the issue impacts “a small subset of Drive for desktop users” and affected “local file changes that had yet to be synced with Drive.” That doesn’t wholly chime with what users are saying on Google’s support forum. “All of my files modified or created since May have disappeared. 1000s of files and folders,” one user wrote. Version 84 of Google Drive appears to be the culprit. While Google tries to fix the mess, its post has advice on what to do. Talking of Google, today is when it begins to delete accounts that have been inactive for two years or more.
In brief
Iran: Federal officials in the US are investigating an incident at a Pennsylvania water utility in which attackers linked to Iran were able to breach one of its systems. Cyberscoop
Serbia: Citizen Lab says two critics of the Serbian government were targeted with spyware earlier this year. In both cases, the attackers tried to exploit vulnerabilities in the iPhone operating system.
China: Google says it has seen a “massive increase” in Chinese cyber attacks on Taiwan over the past six months. Meanwhile, the Australian Strategic Policy Institute reports that Beijing is offering foreign influencers access to its markets, but only if their content aligns with the government’s “main melody.”
Okta: The authentication company has fessed up that a hack two months ago exposed the data of all users on the company’s customer support system. Originally it put the figure at 1%. Reuters
Evernote: The notetaking platform is limiting free users to 50 items in an apparent attempt to achieve profitability. It’s more likely to drive even more people to competitors like Notion and Zoho Notebook.
Monzo: An excellent feature in the banking app allows customers to easily identify scam calls. It simply shows the user when someone from Monzo is talking to them.
Tired: If you feel completely knackered after a hard day’s Zooming (or Teaming or Hanging Out), you’re not imagining it. Austrian researchers say videoconferencing fatigue (VCF) is a “serious issue.” They based their findings on an experiment in which students watched a lecture, one group in person and another online. Results in the online group could “undoubtedly be interpreted as fatigue,” they concluded.
NameDrop: Social media channels have been full of dire warnings about the risks of Apple’s contact information feature in iOS 17. The nearly identical warnings originated from numerous US police departments and suggested NameDrop could be used to steal details automatically. For the avoidance of doubt, it can’t because it requires user confirmation before anything is shared. As Vox reports, this is just the latest in a long line of misleading warnings from law enforcement.
Ill-advised: And talking of bad advice, when users found they couldn’t access the website of `Reading Borough Council, it suggested they disable HTTPS in their browser. As many pointed out, this was a staggeringly silly suggestion because HTTPS is what prevents information being exchanged with a website in plaintext. The council has since apologised. The Register
Updates
Apple: More emergency updates from Apple in the face of two zero-day (i.e. previously undisclosed) vulnerabilities. The issues affect iPhone, iPad, and Mac devices. There are also updates for Final Cut Pro and iMovie.
ownCloud: There are serious problems with the open source solution for sharing and synchronising files. Three separate issues are being used by attackers and the platform’s developers have urged users to apply their recommended mitigations as quickly as possible.
Synology: Update to fix an issue in Synology Camera revealed at a hacking contest in October.
Zyxel: Updates to address multiple critical vulnerabilities in some of its network attached storage devices.
Chrome: We recommend closing your browser every day to make sure it has applied the latest updates when you reopen it. The latest version of Google’s browser addresses a ‘zero-day’ (i.e. previously undisclosed) vulnerability. That’s the sixth one so far this year.
Outlook: If your Windows Outlook Desktop crashes when you try to send an email, you’re not alone. Microsoft has confirmed there’s a problem affecting Outlook.com accounts, says it has fixed it in future versions, but adds that those aren’t available yet. In the meantime, it seems a temporary solution involves reinstalling Office.
Google Drive: Google has updated the scanning feature on its Android app and added the same functionality to iOS devices. Notes already allows scanning but sharing the results can be tricky.
Tails: Version 5.20 updates Tor Browser and Thunderbird and aims to fix persistent problems with persistent storage.