The threat of false information. The impact of AI on phishing lures.
LinkedIn as the new Tinder. Harvesting our information. And the devolution of search results.
Disinformation
Misinformation and disinformation are the top global threats over the next two years, according to the World Economic Forum’s Global Risk Report. The report includes comforting findings such as “the majority of respondents (54%) anticipate some instability and a moderate risk of global catastrophes” over that time frame. This year and next, nearly three billion people are expected to take part in elections around the world, including in the US, UK, India, Indonesia and Pakistan. The report warns that false information “could undermine the legitimacy of newly elected governments with resulting unrest ranging from violent protests and hate crimes to civil confrontation and terrorism.”
OpenAI (the maker of ChatGPT) is fully aware of the risks and says it’s taking steps to prevent the misuse of its AI technologies during the upcoming elections. The measures include new usage policies and a tool to report potential abuses. “For years, we’ve been iterating on tools to improve factual accuracy, reduce bias, and decline certain requests,” the company said. We don’t doubt that OpenAI will try its best to avoid damage to its reputation but how effective its efforts will be is another matter. It’s now trivially easy to create fake video and audio. At the Forum’s meeting in Davos, an MIT professor was creating fake video copies of real people from 15 second clips while this paper demonstrates how to clone voices from tiny samples.
Threats
Iran: A group with known links to Iran’s military intelligence has been impersonating a prominent journalist and other well-known figures in highly targeted attacks against high profile individuals working on Middle Eastern affairs. Microsoft
Russia: Independent journalists are being targeted in a campaign designed to obtain their email login credentials. The attackers pose as journalists from other Russian outlets and claim the target has stolen one of their articles. Meanwhile, regulators are forcing Russian internet providers to share the locations of their users in an effort to draw a ‘digital border’ around the country.
Spotify: Users should be on the lookout for emails that appear to warn them about a payment problem on their account. Broadcom
Tactics: US court documents show how scumbags used fake antivirus renewal emails to scam victims. The emails said the recipient was about to be charged to renew a subscription and they should call a number to avoid being charged…which a remarkably large number of people did.
AppleCoin: XTwitter has been full of ads for ‘AppleCoin’ which of course doesn’t exist. The ads use picture of Apple AirTags in a bid to fool users and, naturally, they’re promoted by “verified” accounts - which, demonstrably, any old criminal can get. 9to5Mac
Credit: TV host Andy Cohen explains how he had his bank accounts plundered. It began when he lost his debit card and received what appeared to be an email from his bank’s fraud department. The link in the email took him to a fake login page. Once he had logged in, the fraudsters told him to sign into his Apple account. Oops. It’s a great example of one of the most basic scams that continues to work again and again. NBC
AI
Phishing: Abnormal Security shows how AI is being used to improve the quality and credibility of phishing emails. It’s becoming extremely difficult to spot them so it’s really important to exercise a high degree of scepticism - even if a message looks genuine.
Deception: Researchers at AI startup Anthropic found they could successfully train AI models to deceive, for example by sabotaging otherwise secure computer code. TechCrunch
War: OpenAI has changed its usage policies to remove a ban on using its technology for military purposes. The Intercept
Jobs: Google is sacking hundreds of people in its ad sales division and replacing them with AI tools, according to a memo obtained by Business Insider. Meanwhile, PwC says 45% of the CEOs it surveyed believed AI might destroy their business models within ten years.
Rubbish: Research from Amazon has found that a “shocking” amount of what we read on the web is machine-translated garbage. The study warns of the risks this creates for large language models that are trained with the rubbish. via Vice
Vacuums
A couple of reports reveal the extraordinary amount of information about us that is being harvested and exploited. A three-year study by Consumer Reports and The Markup concluded that for the average Facebook user, 2,230 companies (and in some cases more than 7,000) will hand over information about them to Facebook. And those details aren’t just about what you do online, it also includes where you’ve been and what you did when you were there. Meanwhile, Proton accuses Microsoft of turning its new Outlook for Windows app into “a surveillance tool for targeted advertising.” Proton is hardly a disinterested party - after all it wants us to use its privacy focussed Proton Mail service. Nevertheless, its report is pretty convincing - and begins by pointing out that Microsoft itself states that it shares users’ information with 772 third parties.
In brief
LinkedIn: As ideas go, using LinkedIn for dating is up there with trying to extinguish a cooking oil fire by chucking water on it. Scammers already adore LinkedIn. They’ll love it even more if people start using it to look for love. Business Insider
Passwords: Nearly 71 million unique credentials for sites including Facebook, Roblox, eBay, and Yahoo have been up for sale for at least four months. Troy Hunt, who runs the HaveIbeenpwned website, says nearly 25 million of the passwords haven’t been seen before.
YouTube: If videos are taking longer than expected to load and you have an ad blocker, it’s no coincidence. It’s because the platform is deliberately punishing people who don’t want to see adverts. Reddit
Spyware: Kaspersky has released a lightweight tool designed to detect signs of infection from sophisticated iOS spyware including the NSO Group’s Pegasus. It works by analysing log files that record unexpected shutdowns.
Mobile security: The Australian Cyber Security Center has published aguide for business leaders on keeping their devices secure. The recommendations include turning devices on and off every day.
Sacked: A senior director at the UK National Crimes Agency lost her job after sending sensitive information over personal email and WhatsApp. Computer Weekly
Disimproved: If you think the quality of Google search results has deterioriated, you’re not wrong. A year-long study by German researchers found “higher-ranked pages are on average more optimized, more monetized with affiliate marketing, and they show signs of lower text quality.”
Help: The CyberPeace Institute sets out the cyberattacks it has experienced over the past two years. It says it will offer free cybersecurity assistance and expertise to any other NGO that needs it.
Updates
Unpatched: This week brings a couple of great examples that illustrate why installing updates (or ‘patching’) devices is so important. Windows 11 users who failed to install a patch in November are falling victim to a vulnerability that allows attackers to infect their machines with information stealing software. In the case of Ivanti, there isn’t a fix for a vulnerability in its Connect Secure VPN product, but there is a way of mitigating the threat. Microsoft says that if Ivanti’s advice wasn’t followed immediately, the likelihood is that the device has been infected.
Chrome: As Google updated its browser to address yet another previously unknown (‘zero-day’) vulnerability, it’s also changing the advisory message applied to Incognito Mode. The update makes clear that while Incognito means the user’s device won’t track what happens, Google and other websites absolutely will. The change comes after Google settled a lawsuit for tracking users while using the feature. Ars Technica
VMware: There’s a critical issue in versions of Aria Automation earlier than 8.16.
Atlassian: There’s a critical vulnerability in out-of-date Confluence Data Center and Server versions that could enable an attacker to access the devices remotely.
Oracle: As usual, a vast dump of updates; this time 389 to address 200 vulnerabilities.