Following up on claims of listening in. AI and geolocation.
Taking down a notorious ransomware gang. And how Meta sucks up ourinformation.
Listening in
We’ve been following up last week’s claims from a US marketing company that it could use smart devices to target advertising by analysing conversations in real time. We found these claims (from Cox Media Group) hard to believe and some coverage has discounted them completely. Our conclusion is that it’s highly unlikely that marketers are eavesdropping on conversations in real time - and it’s definitely not possible on devices such as Apple iPhones - but, that said, there is something going on here that deserves further investitgation.
The claims were originally reported by a cybersecurity website called 404 Media which has broken a number of stories since it was set up by ex-Motherboard journalists earlier this year. Since publishing its original story, the website has unearthed a small New Hampshire company called MindSift that made similar claims. Like Cox Media Group, MindSift appears to have been busily trying to erase any evidence of its remarks. And, like Cox, it has provided a handy reminder that once something’s online, you can’t get rid of it.
So to cut to the chase, do we believe our internet-connected devices are being used to monitor our conversations for marketing purposes? We continue to find it hard to believe this is being done as a standard practice and it’s certainly not happening on some devices (because we would see it taking place). But we would not exclude the possibility that there are some situations in which voice data from some devices might be exploited. For a long time we’ve warned about the risks of smart TVs which are notoriously insecure. For example, there’s a vibrant web forum devoted to hacking Samsung TVs (though this has become harder in recent years). And the fact remains that we give up so much information through our use of technology that advertisers don’t really need to listen to what we’re saying as well.
Threats
Malvertising: Google search ads for popular apps including Zoom are being used to distribute malicious software. Malwarebytes
Links: Researchers have discovered a little known mobile messaging feature can be used to divert phone calls. It involves links containing “tel://”. This is followed by a code that diverts calls to a new number controlled by the attacker. To be fooled, a user would have to ignore pop-ups warning that calls are about to be diverted. AFR
Offboarding: An issue in Google’s OAuth protocol could allow employees to retain their access to corporate apps even if they’ve been removed from their employer’s Google organisation. Truffle Security explains what to do about it.
Networking: German academics have demonstrated potential vulnerabilities in a ubiquitous encryption protocol that enables computers to communicate safely over insecure networks. The issues affect the Secure Shell Protocol (SSH) and they’re complex (both to explain and exploit). Suffice to say, anyone using SSH to secure an app should take a look at the researcher’s paper. Ars Technica
Codes: There’s an increasing number of unprompted one-time passcodes that turn up in an email or a text message. Bleeping Computer explains how these are generated and what to do about them.
Copyright: Phishing emails warning about copyright infringements are a hardy annual which keep on being used because they work. The latest variant seeks to steal the backup codes for Instagram accounts which enables attackers to bypass two-factor authentication. Trustwave
AI
Geolocation: So not to worry you or anything but…some students at Stanford University have developed a couple of AI models designed to identify where a photo was taken. The results are good - scarily good. As the students say, their “approach can pave the way for highly accurate, planet-scale image geolocalization systems.”
Fake news: There’s been a huge rise in the number of websites hosting false news created by AI. Newsguard, which tracks disinformation, says since May it’s increased from 49 to more than 600.
Memes: A campaign linked to the Chinese Communist Party is using AI-generated memes to create anti-American sentiment. The memes focus on President Biden’s support for Israel’s ongoing war in Gaza. Institute for Strategic Dialogue
Facebook: Fake images are running riot on the site, with stolen AI-generated content crowding out reality. 404 Media looks at a phenomenon that was widely predicted but is still fooling vast numbers of people.
Anchors: A Los Angeles news channel is due to launch next year with AI presenters. PetaPixel
Bing: Researchers found Microsoft’s chatbot provided false and misleading information about elections in Switzerland and Germany. Algorithm Watch
China: TikTok’s parent, ByteDance, appears to have been secretly using OpenAI’s technology to develop its own competing large language model (or LLM). This is both stupendously unsurprising and a direct contravention of OpenAI’s terms of service. The Verge
Freebie: This week has brought several demonstrations that it’s trivially easy to persuade Chevrolet’s online chatbot to sell you a vehicle for $1. Alas, it may not be quite so easy to persuade Chevrolet to honour the deal.
In brief
Takedown: The FBI has taken down a notorious ransomware outfit, seized its website, and released a tool to unlock any content encrypted by the gang. It appears a “confidential source” persuaded the AlphV/Blackcat gang to sign him up as an affiliate. The Record
XTwitter: The EU has begun investigating the ailing platform for “the dissemination and amplification of illegal content and disinformation.” The announcement follows reports in an Irish newspaper that Elon Musk intentionally crippled the platform’s ability to remove disinformation, child sexual abuse material and other illegal content.
Apple Watch: Sales in the US are about to be halted over a patent dispute involving the algorithms on the device that are used to monitor blood oxygen levels. MacRumors
Terms of Service: A Mastodon user highlights the reality of the conditions governing use of Threads, Meta’s XTwitter competitor. In short, if you interact with a piece of Threads content on another site, Meta will harvest your data and track your activity.
Updates
Apple: Updates for macOS Sonoma (14.2.1) and for Safari in Monterey and Ventura. In Sonoma, Apple says it fixed an issue in which “a user who shares their screen may unintentionally share the incorrect content.” Also security updates for iOS (17.2.1 and 16.7.4).
Microsoft: A fix has emerged for the weirdness surrounding printers on Windows systems. The problem involves renaming any printer connected as a specific HP LaserJet model and downloading an HP app. The fix requires a troubleshooting tool which you have to manually install.
Firefox: Version 121 of Mozilla’s web browser brings significant changes, including support for voice commands on macOS systems.
Chrome: There’s a new version of Google’s web browser that fixes a particularly nasty zero-day (i.e. previously unknown) vulnerability - the eighth this year. It’s so nasty Google rushed the update within a day of being told about it.
Tails: 5.21 Fixes a bunch of annoyances and also updates the Tor browser and client.
Thanks for reading. We wish you and yours all the very best for the festive season.