"It's True. Your Devices Are Listening To You.
" The need to control cyber mercenaries and digital repression. ChatGPT and winter depression. Disinformation. Push notifications. The scale of data breaches. And advice on BCC.
Listening in
It often feels like marketers are using technology to spy on us so they can target us with adverts. Now comes news of a US company that claims it’s doing exactly that. Cox Media Group (CMG) claims it can listen to ambient conversations through phones, smart TVs, and other devices. Called “Active Listening,” CMG says it has the capability to identify potential customers “based on casual conversations in real time.” The extraordinary story comes courtesy of 404 Media which quotes details from CMG Local Solutions’ webpage headlined, “It’s True. Your Devices Are Listening To You.” Since 404 published its story, that page is no longer reachable but, courtesy of the Wayback Machine, here it is.
For years we have been explaining that while companies could theoretically listen in to our text and audio conversations the burden of processing so much data would make it impractical. What has changed is the capability of artificial intelligence. CMG specifically refers to the use of AI to “detect pertinent conversations” and carry out “a 360 analysis on past behaviours of each potential customer.” And CMG seeks to allay any privacy concerns its potential users might have, “Is this legal? YES,” it says (their capitals). “It is totally legal for phones and devices to listen to you. That’s because consumers usually give content when accepting terms and conditions software updates or app downloads.”
This story is frankly so bizarre that it’s difficult to believe it’s true. That a marketing company would blithely publicise such a service beggars belief. Cox Media Group and its Local Solutions team have so far not responded to requests for comment. The fact that they’ve redirected the webpage about Active Listening rather speaks for itself. From a security perspective, there is a clear message that internet-connected devices really cannot be trusted until proven otherwise.
Cyber mercenaries
Cybercrime gangs and spyware manufacturers should be regarded as cyber mercenaries and controlled as such, according to a report from the Delhi-based Observer Research Foundation. The report says citizens should demand accountability from governments and businesses in order to protect individual rights to privacy and free speech. But the paper also points out that the cyber mercenary sector is estimated to be worth well over $12 billion a year in what increasingly resembles an online arms race. Even in areas like the EU with its strong data privacy protections, multiple member states are known to have used spyware products.
Separately, the University of Toronto’s Citizen Lab examines what it calls transnational digital repression and also demands an international treaty to control it. The paper, published in International and Comparative Law, provides details on the range of techniques used to suppress or silence dissent from spyware to targeted phishing (‘spearphishing’). It demands that states place human rights at the centre of every conversation.
Unhappily, the likelihood of any meaningful progress towards such international cooperation is so small as to be non-existent. As both papers admit, nation states are wedded to cyber mercenaries and digital repression both because they provide plausible deniability and because they are unquestionably effective. Combine that with the failure of organisations to protect our data and to manufacture technology that is free from vulnerabilities and you have the perfect conditions for an ever-expanding market.
Threats
Voice: Investment company Charles Schwab has a voice ID service. It allows users to access their accounts by saying “At Schwab, my voice is my password.” This is a stupendously bad idea. As researcher Rachel Tobac says, “voice cloning takes me less than 2 minutes to complete to fool these systems and steal money. Friends don’t let friends use voice ID.”
Google Forms: Another example of scumbags exploiting the features of Google’s service to make their phishing campaigns look more authentic. A favourite tactic is to use Forms as part of fake subscription notices. Abnormal Security
Macs: Downloading pirated software is obviously a dreadful idea but that doesn’t stop people doing it. If another reason were needed to resist the temptation, Kaspersky says booby-trapped apps are being used to infect Mac devices with malicious software.
Data leak: A malicious file is being delivered in targeted attacks that pretend to inform the recipient that their personal data has been leaked. AhnLab
Keyboards: TestFlight is Apple’s platform for trialling iPhone apps before their official launch. Extreme care should be taken when downloading such apps because the process for reviewing them is pretty much non-existent. Attackers have been using TestFlight to distribute custom keyboards which, once installed, log every keystroke on the device. Certo
PDF: A weaponised PDF file with fake hotel booking information is being used to infect Windows machines with an information stealer that downloads credentials, system information and web browser sessions. It’s pretty easy to stop this type of attack. Just don’t click on dialogue boxes that appear when you open a PDF file. Fortinet
QR: With apologies for repeating ourselves, do be careful with QR codes. As we’ve said before, they’re routinely abused – so much so that the US Federal Trade Commission has just added its voice to warnings that the codes can take you to sites that look real but aren’t.
AI
SAD: Weird times at AI High. At the end of last month, some users noticed ChatGPT appeared to be getting “lazy” by providing simplified results or refusing to carry out tasks at all. They hypothesised that this might be due to seasonal affective disorder which strikes during the darker days of winter. ChatGPT’s masters said they’d heard the feedback, adding that “model behavior can be unpredictable, and we’re looking into fixing it.”
Predictions: Forrester reckons 60% of workers will use AI for their jobs next year which means effective governance will be increasingly important. Another of Forrester’s predictions is that “the number of fines related to GDPR violations for AI cases will double.”
Undressed: Depressingly, there’s been an upsurge in the popularity of apps and websites that use AI to undress women in photos. Graphika says AI-generated ‘undressing’ has moved from being a niche interest to a scaled and monetised online business.
Dropbox: The cloud storage platform has started sending some users’ files to OpenAI “to generate useful and accurate content.” This is turned on by default for users and teams taking part in ‘Dropbox AI Alpha’ - otherwise it’s disabled. Dropbox says no data will be used to train the AI models. Despite this, we think it’s a lousy idea and if you’re a Dropbox user it would be worth going into your settings and making sure it’s turned off.
Regulation: The EU has hailed agreement on AI legislation as a ‘landmark.’ In reality, it’s the starting point for weeks of hard labour on the technical details of how it will actually work in practice. Probably the most important area of the legislation surrounds controls over the foundation models that underpin services like ChatGPT and Bard.
Fail: The Turing Test is supposed to determine whether a machine’s behaviour is indistinguishable from that of a human. In experiments, Hungarian researchers found, “almost half of our participants (42%) decided that their conversational partner (that was in every case a human being) was a computer program.”
Disinformation watch
A three-year campaign has sought to portray US-based critics of the Indian Prime Minister as part of a conspiracy to undermine the country, according to reporting by The WashingtonPost. The paper says the efforts by an organisation called Disinfo Lab follow concerted use of online networks to promote the ruling Bharatiya Janata Party’s foreign policy positions. The Post adds that Disinformation Lab is run by an Indian intelligence officer. Meanwhile, France TV examines (R) the use of TikTok to influence young voters in Taiwan and move them away from support for independence to closer relations with China.
In brief
Warrants: Apple has responded to last week’s revelations about push notifications by saying it will now require a court order or a search warrant before handing over any details. Previously, law enforcement agencies only needed to present a subpoena which they could obtain without any judicial oversight.
Scale: There were more data breaches in the US in the first three quarters of 2023 than in any previous year, according to a study commissioned by Apple. The statistics in the paper paint a depressing picture of an online world in which our personal data is plundered daily, often because the organisations that vacuum it up either cannot or will not protect it properly. Apple uses the study to promote its Advanced Data Protection which does what it says on the tin. It’s worth using it.
Warning: The UK faces a “high risk of catastrophic ransomware attack at any moment” because it has failed to address the threat properly. A joint parliamentary committee lambasts outdated regulatory frameworks and condemns the former Home Secretary Suella Braverman for showing “no interest” in the issue.
Call centres: Interpol has arrested hundreds of suspected criminals in a crackdown on human trafficking which is used to staff the call centres behind cyber scams. In many cases, victims are lured with promises of well paid jobs but on arrival are forced to work in the call centres and not allowed to leave.
BCC: You may have seen the £350,000 fine levied on the UK’s Ministry of Defence for a calamitous BCC (i.e. blind copy) email blunder that exposed the details of interpreters trapped in Afghanistan. Such errors are so common that we advise putting in technical controls to reduce the risk - or turning off the facility altogether.
Updates
Apple: iOS 17.2 and macOS 14.2 include important security updates. Among the features in the new iOS version is a Journal app which is designed to be a personal diary where you can record every detail of your daily life. This week, Apple also released its official diagnostics tool which can be used to help anyone brave enough to try some DIY on their iPhone. At the moment, it’s only available in the US. Europe is due to follow next year.
Google Maps: Changes to the app will give users more control over their information, including reducing the default time activity is retained from 18 to three months. The location history (or ‘Timeline’) will also be stored on the device rather than in the cloud which could mean that law enforcement will no longer be able to use warrants to obtain the data. All this is due to roll out over the next few months.
Patch Tuesday: Monthly security security updates from Adobe, Microsoft,Chrome, SAP, Fortinet, Sophos, Zoom.
Avira: An update is supposed to have fixed a problem that causes some Windows computers to freeze.
Threads: Meta has finally managed to launch its XTwitter competitor in Europe - only five months after it went live elsewhere. It will be interesting to see whether the new territory will improve its somewhat lacklustre engagement figures.