US senator shatters surveillance secrecy. How AI will enable mass spying.
Pegasus trial begins in Mexico. Russia's cyber espionage. Signal rejects French claims of security flaws. And Ofcom returns to the vexed question of ageverification.
Mobile surveillance
That ping when you receive a message. That breaking news notification. Turns out Apple and Google are providing information about them to governments to surveil us. In a letter to the US Justice Department, Senator Ron Wyden said the US and foreign governments had “secretly compelled” the technology giants to hand over over the metadata around ‘push notifications’ and, in some cases, the content itself. None of this was public knowledge until now because the US government had ordered Apple and Google not to say anything about it.
Thanks to Senator Wyden, we now know what has been going on - although the identity of the governments involved (the US apart) remains unknown. We’re pretty sure that to say the practice is widespread would be an understatement. By the same token, it would be hard to overstate the value of the information involved. In particular, it could be used to help connect the anonymous users of messaging apps to specific Apple or Google accounts. For more details, 404 Media has unearthed a search warrant showing precisely how the process works and why it’s so valuable. Earlier this year, a French developer analysed push notifications, calling them “a nightmare in terms of data protection.”
All this serves to underline our warnings about the risks of smartphones for people working on sensitive content or travelling to high risk environments. There is almost no limit to the ways in which the devices can be used to track their users. We can now add another item to the long list.
Threats
Disney+: Fake invoices inform targets of a pending charge for a subscription to the streaming service and invites them to call a “support team” if they think there’s been a mistake. The phishing emails are personalised and quite convincing at first glance. Abnormal Security
WordPress: An attacker is posing as the WordPress security team to try to lure site owners into installing an update for a non-existent vulnerability. Doing so places malicious software providing remote access to the victim’s site. Wordfence
Android: ESET identified 18 malicious loan apps which have been downloaded more than 12 million times from Google’s Play Store. They’re designed to steal information including contacts, location data and text messages.
Exchange: Microsoft says Russia is exploiting a vulnerability in Outlook to hijack Exchange accounts. The issue was fixed in March but some systems still haven’t been updated.
Browsers: Attackers love browsers because we spend so much time using them. And they particularly love the extensions that we add to them because they provide rich opportunity for installing malicious software. LayerX examines (R) the issue and has good advice on mitigating the risk.
Passwords: A warning about password manager apps on Android phones. Researchers found that the devices’ autofill functionality might lead to credentials being inadvertently revealed. A key protection is to resist the temptation to log in to a service via a third party like Google or Facebook.
iPhones: Jamf explains how Lockdown Mode could be used to fool a user into thinking their device has extra protection when it doesn’t. It’s worth being aware of but it does require the phone to have already been compromised – and the technique hasn’t been seen in use anywhere.
AI
Spying: The internet enabled mass surveillance. AI will enable mass spying. That warning comes from venerable technologist, Bruce Schneier, who argues that AI will remove human limitations on sifting through data for useful information. We could limit this, he says. “But we haven’t done anything to limit mass surveillance. Why would spying be any different?”
Confidence: The UK Information Commissioner has warned that 2024 could be the year people lose trust in AI, while calling for developers to embed privacy into their products from the outset.
Insider trading: A group of researchers demonstrated that ChatGPT could be made to engage in insider trading even though the AI model had been told it was wrong. Their paper is entitled, “Technical Report: Large Language Models can Strategically Deceive their Users when Put Under Pressure.”
Repetition: Last week, researchers showed that ChatGPT could be induced to reveal sensitive information by asking it to repeat a word “forever.” Doing so now constitutes a violation of its terms of service. 404 Media
Ads: Meta has announced a global ban on AI-generated political advertising. The decision affects anything related to elections, housing, employment, credit, social issues, health, pharmaceuticals, and financial services. ZDNet
Gemini: There’s been widespread coverage of Google’s new generative AI model which it says is its “most capable model ever.” Just one fly in its ointment (apart from some lukewarm reviews and suggestions its most impressive demo was faked); data protection regulations mean it’s not yet available in the UK or Europe.
Spyware
A court in Mexico has begun hearing a case that accuses successive presidential administrations of deploying Pegasus spyware against thousands of targets including prominent journalists and the billionaire, Carlos Slim. The alleged scope of the scandal is vast and encompasses not just the targets but their families, including in one case the teenage son of an investigative journalist. The University of Toronto’s Citizen Lab has tracked the scandal in forensic detail since 2017. Use of spyware in Mexico has been so widespread that Citizen Lab titled its analysis ’Reckless.” In one case, it was even deployed against supporters of a tax on sugary drinks. El Pais Aristegui Noticias
Russia
Least surprising news of the week was the UK government’s accusations that Moscow has engaged in sustained attempts to interfere in politics around the world. More surprising is the assertion that Russia’s efforts have been “unsuccessful” when all the evidence points to precisely the opposite conclusion. Microsoft has a useful accompanying report that analyses Russia’s tactics, particularly its use of email marketing platforms (to disguise its phishing messages) and password-protected PDF lures or links to file-sharing services where the PDFs are hosted. We’d also highlight the practice of targeting the contacts of a person of interest in order to obtain sensitive information, as described by the former head of the UK’s MI6 intelligence service.
In brief
Signal: The head of the messaging platform has rejected French claims of security flaws as “dangerously misleading.” The French government banned official use of WhatsApp, Telegram and Signal saying they weren’t “devoid of security flaws” but has provided no evidence to support its assertions about Signal.
Takedown: Reuters says it “temporarily removed” an investigation into a hacker-for-hire investigation in response to an Indian court order. The report was entitled “How an Indian startup hacked the world.” Unsurprisingly, it remains widely available. 404 Media
Children: Meta is making changes aimed at preventing child exploitation in the wake of a series of damning Wall Street Journal reports. The latest sets out the extraordinary scale of the problem. The Verge
Influence: Harvard has closed a project examining disinformation campaigns on Facebook. A whistleblower says the decision came shortly after Mark Zuckerberg donated $500 million to the university.
23andMe: First the genetic testing company said a security breach affected 0.1% of its customers. In reality, the number turns outto be about half its 14 million users. That’s because the attackers were able to take advantage of a feature called DNA Relatives. And the data accessed probably contains health-related information. 23andMe has now updated its Terms of Service so that it can’t be sued by its users. TechCrunch
Support: Microsoft says all Windows 10 customers (including home users) will be able to pay for three extra years of security updates through the company’s Extended Security Updates (ESU) programme once regular support ends in October 2025.
Warfare: Foreign Affairs takes an in-depth look at the “globe-spanning information conflict” surrounding the Israel-Hamas war. A key lesson in these fights, it says, is that “virality can trump veracity.”
Verification: The UK’s communications regulator has returned to the thorny issue of age verification as part of efforts to stop children accessing porn online. The measures it suggests include “facial age estimation” which Ofcom itself admits isn’t “capable of being highly effective.”
Updates
Google Drive: The good news; Google has come up with a way to recover files that mysteriously disappeared from some users’ accounts. The bad news; it’s unlikely to work for everyone. Frankly, this whole episode is extraordinary and Google still hasn’t explained what went wrong.
Zoom: We highly recommend checking for updates every time you open Zoom. New versions are not always installed automatically and vulnerabilities are constantly emerging. One of the latest involves a way to abuse the Rooms feature to access confidential information. AppOmni
Microsoft: Update for Outlook fixes an issue that caused Desktop clients to crash when sending emails from Outlook.com accounts. The update can be applied by selecting ’Update Now
Gmail: Google has released a new tool to combat spam and malicious emails. It claims it boosts the detection rate by 38% and also reduces the number of false positives.
Windows: Microsoft has confirmed a weird issue is causing all printers on some Windows systems to be renamed ‘HP LaserJet M101-M106.’ That then causes the HP Smart app to install itself automatically. Microsoft says this shouldn’t stop the printers working.
iOS: iPhone 17 users say the app switcher periodically appears while they’re typing. There’s a sort of fix which involves turning off the Reachability feature. MacRumors
Atlassian: Yet more updates for Companion App for Mac, Assets Discovery and Jira.
Chrome: Version 120 off Google’s browser has important security updates as well as new features including a “new proactive safety check” tool.
Messenger: After years of promises, Meta is rolling out end-to-end encryption as a the default setting for private chats and messages on Facebook and Messenger.