The real-world impact of XTwitter. China cracks AirDrop. Celebrity fakes.
Should ransomware payments be banned. And surviving a three-mile drop test.
XTwitter
Elon Musk’s disastrous stewardship of the platform is fast becoming a problem not just for his finances but also for the increasing spread of disinformation. Vice reports that during the recent earthquake in Japan, misinformation proliferated while an account providing accurate content was prevented from posting because of limits imposed on free accounts. The issue of misinformation has been compounded by Musk’s decision to force users to pay for verification. His rationale was that this would help eliminate automated accounts (aka ‘bots’). In fact, as TechCrunch explains, it appears to have done nothing of the sort. And it has emerged that a third of the trust and safety team has been fired since Musk’s acquisition.
XTwitter’s ability to create real-world impacts was also illustrated byhackers who took overthe US Securities and Exchange Commission’s account. They promptly posted that the SEC had approved a Bitcoin-based fund, leading to fluctuating prices and some $90 million in losses for investors. (A UK politician’s account was hijacked this week in one of many similar attacks.) Meanwhile, Musk says 2024 will be “transformational” for the site and promises the launch of peer-to-peer payments and “the power of living more of your life in one place.” In a year of vitally important elections, Musk might be better advised to try to prevent his toy being misused to undermine the foundations of democratic society.
Meanwhile. Google’s Mandiant division has revealed that its XTwitter account was probably hijacked as a result of a “brute-force password attack.” This is a technique in which attackers try multiple passwords until they find one that works. “Normally, 2FA would have mitigated this, but due to some team transitions and a change in X’s 2FA policy, we were not adequately protected,” Mandiant says. As Bleeping Computer reports, there’s been a “massive wave” of account breaches which have particularly affected organisations with verified status. It’s vital to ensure these accounts are properly protected.
Threats
AirDrop: It’s a pretty firm rule that the more convenient a feature, the less secure it is. That appears to be the case with Apple’s file transfer feature which it turns out China was able to crack and thus detain a number of suspected anti-government activists. We’re not saying don’t use AirDrop. We are saying be aware of the potential risks. Bloomberg Apple Insider
Turkey: Government-linked attackers are conducting cyber espionage operations across the Middle East and Europe, according to Hunt & Hackett and PwC . Targets include governments and communications providers as well as NGOs and the media and entertainment sector.
YouTube: There’s another wave of videos promoting pirated software in an attempt to lure users into installing an information stealing tool. Fortinet
Customer support: It’s tempting to use XTwitter to try to spur a company’s customer support into action - but fraudsters know this and are hijacking the conversations to steal sensitive information. A British Airways customer explains their experience.
Messaging: Clones and modified versions of messaging apps like WhatsApp, Signal and Telegram are widely promoted and a really significant security risk. We strongly advise against using them. ESET explains the risks.
AI
Celebrity: Scumbags are using low quality AI clones of celebrities to flog healthcare scams in the US. Despite millions of views, YouTube doesn’t seem able to deal with the problem. Maybe Google needs to talk to McAfee which has released a tool designed to combat deepfake audio. 404 Media
Verification: Experts demonstrate how AI makes it simpler and cheaper to impersonate someone’s likeness and takeover accounts to steal money and data.
(In)Secure: The US National Institute of Standards and Technology has a new report setting out how cyber attacks can manipulate AI systems. It has suggested mitigations but emphasises there’s no way to protect AI from “misdirection” and says anyone claiming otherwise is a darn liar.
Copyright: As AI companies face charges of stealing copyrighted material to train their models, Meta has admitted using a vast unofficial book repository to develop its Llama model. TorrentFreak
Robot: A glimpse into the future, courtesy of some Stanford researchers. Their video shows a Heath Robinson robot built from off the shelf parts with quite remarkable capabilities.
Instructions: While continuing to warn about the potential security risks of AI, we know how widely it’s being used so you might as well make the most of it. This paper explains how to tell a chatbot what to do so that you get the results you want.
In brief
Ransomware: “The only viable mechanism by which governments can quickly reduce ransomware volumes is to ban ransom payments,” says Emsisoft in its annual State of Ransomware report. Not everyone agrees, but what is beyond doubt is that ransomware is completely out of control.
Risky: The UK Ministry of Defence has by far the worst protected IT systems of any government department, with 11 “red-rated” systems (meaning they’re at a “critical” level of risk). Computing (R)
Smart TVs: We’ve long been concerned about the potential security threat posed by connected TV sets. Reclaim The Net has a detailed report on the current state of play, including the insatiable hunger of marketers for information about us and the questionable state of the devices’ security.
First Aid: Searching YouTube for advice on heart attacks or other health emergencies will now highlight authoritative sources providing advice on what to do. The Verge
WiFi: The new WiFi standard was officially launched this week, bringing much faster throughput and more stable connections. WiFi 7 represents a significant improvement but it will take several months before it’s widely available. Wired
Stuxnet: 23 years after the cyber attack that crippled a key part of Iran’s nuclear program, Dutch journalists have confirmed the name of the person who deployed the virus responsible. Erik van Sabben was an engineer who installed water pumps in Iran’s uranium enrichment facility. He died in a motorbike accident two weeks after competing the work. De Volkrsant Security Week
Piracy: There were an estimated 141 billion visits to video piracy sites last year. Given the ever increasing price of streaming services, we’re confident that number is only going to go up. That makes it more important than ever to be aware of the risks of trying to steal TV and movie content - and to discuss this with family and friends.
HP: Hewlett Packard is facing yet another lawsuit accusing it of crippling printers when cheaper third-party ink cartridges are installed.
Closures: A couple of farewells to notable apps. Amazon has closed encrypted messaging app Wickr and Microsoft is phasing out venerable word processor WordPad. Less notable is Authy’s decision to close the desktop version of its authenticator (which was always a bad idea).
Drop test: Fair play to Apple. An iPhone (in a protective case) survived a 16,000 feet/4,800 metre fall in the Alaska Airlines 737 Max incident. It’s not the first time it’s passed an extreme drop test, though the previous height was only 14,000 feet. Washington Post
Updates
Patch Tuesday: Monthly updates include fixes from Microsoft, Cisco, Google, SAP, Fortinet, Zoom, Joomla, Firefox.
Windows 11: Some users have reported problems when trying to install the latest update for Windows 11. The update is important because it addresses a vulnerability in Bitlocker encryption. Microsoft’s advice is here.
Ivanti: Attackers, thought to be Chinese, are targeting two critical vulnerabilities in the company’s VPN device. The issues allow them to bypass two-factor authentication and execute malicious code inside affected networks. Users are being urged to follow Ivanti’s advice to protect their devices.
Bitwarden: If evidence were needed of the importance of installing updates, step forward the password management company. It’s emerged that last year it addressed a thoroughly nasty issue that could have been used remotely to access a user’s password vault without any authentication. At all. Red Team Pentesting