Looking ahead to next year. The ongoing threat from phishing. Spyware in India.
And (very) private cameras hacked in Vietnam.
2024
As usual, the festive season has gifted us millions of words about what the wonderful world of technology will throw up next year. To save you from wading through them, here are the main themes.
AI will continue to dominate headlines and pose increasingly complex challenges to organisations, individuals and democracies. Custom chatbots will enable highly convincing social engineering attacks (see Phishing below). AI will almost certainly be used to automate the process of finding vulnerabilities in online systems.
AI will also play an ever greater role in internationalespionage, with China in particular exploiting its capabilities as it seeks to topple the US as the world’s pre-eminent economic and military power. This week, both The New York Times and The Wall Street Journal have long reads on what China is up to.
We will carry on seeing vulnerabilities that illustrate the fundamentally flawed nature of the technology we depend on. The latest example of this is a four-year campaign to compromise iPhones in Russia, described by Kaspersky as “the most sophisticated” ever. Kaspersky says still unknown attackers exploited a vulnerability in an undocumented hardware feature.
More than ever, it will be crucial to make sure employees are aware of and understand the importance of keeping information secure. The use of unapproved technologies has always created a risk but this has been exacerbated by AI services like ChatGPT (as Samsung among others demonstrated this year).
All of this underlines the impossibility of guaranteeing information security. That means preparation for an incident is essential. It’s not enough simply to make backups; testing response and recovery plans is equally important. Ensuring users and systems can only access the data they need is hard but vital. Eliminating risk may be impossible, but focussing on fundamental controls will definitely mitigate it.
Threats
Phishing: There’s one pretty safe prediction for 2024 which is that we’ll see even more communications designed to fool us into giving away passwords or handing over sensitive information. The huge (1,256%) increase in phishing emails over the past year has in large part been driven by the use of AI. Malicious messages are much harder to spot now that chatbots have eliminated grammatical nonsense. Harnessing technology to weed out threats and making sure people are aware of the risks are more important than ever. Malwarebytes
iCloud: Fake Apple messages warn that “Your iCloud storage might be full” and try to convince the recipient to upgrade to a 50 GB plan. The e-mail contains links to potentially dangerous sites. Intego
Facebook: Wired describes how scammers are ruining Facebook Marketplace. Their reporter tried to sell a futon. Most of the replies were scammers who gave themselves away by offering to pay the asking price straight away.
Android: Malicious software is being distributed via pages that masquerade as legitimate applications. The software can bypass biometric authentication, is designed to steal banking information, and has extended its zone of interest to include the UK. Security Week
In brief
India: Amnesty International has published new details about what it says is the repeated use of Pegasus spyware to target prominent journalists in India. Meanwhile, The Washington Post reports that after Apple warned the journalists about the possible use of spyware against them, the Indian government questioned the company’s security and demanded it “soften the political impact of the warnings.”
Licences: The UK government is reported to be moving ahead with legislation that would enable police to run facial recognition searches on the country’s driving licence database. It contains photographs of 50 million driving licence holders who were never told their images would be used in this way. The Guardian
Sued: The New York Times is suing OpenAI and Microsoft for allegedly using millions of its articles to train its chatbots. “Defendants seek to free-ride on The Times’s massive investment in its journalism,” the complaint says. It accuses OpenAI and Microsoft of “using The Times’s content without payment to create products that substitute for The Times and steal audiences away from it.”
Jammed: Very widespread interference has affected GPS in the southern Baltic. The cause remains unknown - but Russia has very extensive capabilities in jamming satellite signals.
Censorship: The Israeli military has banned the country’s media from reporting on a range of subjects including cyberattacks, security cabinet leaks, and stories about the hostages being held by Hamas. The Intercept
Kids: Social media companies earned more than $11 billion in US advertising revenue from children last year, according to researchers at Harvard. YouTube headed the list, taking in nearly $1 billion from users aged 12 and under. AP
On view: A private Telegram group in Vietnam is offering to sell videos stolen from cameras in bedrooms, changing rooms, toilets, and massage parlours. One of its administrators said “its software constantly scans localities across the country.” VNExpress
Updates
Chrome: The desktop version of Google’s web browser will now scan for compromised passwords that have been saved in the app (though we recommend using a standalone password manager). Google also says it’s “extending Safety Check to revoke sites’ permissions — like access to your location or microphone — if you haven’t visited them in a long time. And Safety Check will now flag if you’re getting a lot of notifications from sites you don’t engage with that much, so you can easily disable them.”
Barracuda: The network and email security firm says it remotely updated all active Email Security Gateway (ESG) appliances on December 21 to address a zero-day (previously unknown) issue exploited by Chinese hackers.
Thanks for reading. We wish you and yours all the very best for 2024.