The power and perils of advertising surveillance. Attacking web browsers.
The unstoppable flood of AI-generated porn.Russia hacks Microsoft. Tech giants kneel before EU regulators. And lessons from a British student's ill-judged joke.
Patternz
More details on the extraordinary degree to which billions of phone profiles can be tracked though the advertising industry. An investigation by 404 Media found (R) a YouTube video in which the CEO of a company called Patternz boasted of being able to analyse the behaviour “of over 600,000 applications.” One slide in the video says “the mobile phone becomes the de-facto tracking bracelet,” and suggests tracking can be achieved through “virtually any app that has ads.” The video also includes the sort of information gathered about a particular device and its owner, including GPS coordinates with accuracy of up to a meter.
The investigation builds on research published last year that warned of the security risks of the platform. It suggested online advertising systems (including real-time bidding) are allowing foreign states and non-state actors to obtain compromising sensitive personal data about key European personnel and leaders. A co-author of the research told 404 Media that “the pervasive surveillance machine developed for digital advertising now directly enables government mass surveillance.” For individuals in high-risk environments, there is an obvious danger that mundane use of smartphones could reveal compromising details about their activities and location.
On the same theme, Mysk says numerous iOS apps are using background processes triggered by push notifications to collect user data about devices. This practice enables the creation of a ‘fingerprint’ that can be used to track an individual’s online activity. Mysk says the apps are deliberately bypassing Apple’s restrictions and tests showed that the practice is more common than expected. “The frequency at which many apps send device information after being triggered by a notification is mind-blowing,” the researchers said.
Threats
Browsers: 75% of enterprise employees now spend the majority of their ‘device time’ using web browsers, according to Menlo Security. It warns of what it calls Highly Evasive Adaptive Threats that are designed to evade common security controls with tactics including hijacking trusted domains so that a malicious page looks completely genuine.
Search: Veteran security journalist Brian Krebs warns of the risk of using Google to search for software. He examines the growing number of fake ads for real apps, including a recent one for FreeCAD.
Facebook: A scam offering work from home jobs is actually capturing victims’ identity details, accessing their Facebook accounts, and committing fraud**.** Qualys
Facebook 2: A widespread phishing campaign uses the headline, “I can’t believe he is gone. I’m gonna miss him so much.” lt links to a website designed to steal the victim’s Facebook credentials. Bleeping Computer
Relatives: AI is being used to fake the voices of friends and relatives. The San Francisco Chronicle has the story of a family targeted by their son’s voice telling them he’d been in a car accident and hurt a pregnant woman.
Bluetooth: It’s vital to keep mobile devices updated, as illustrated in a demonstration that exploits newly revealed Bluetooth vulnerabilities.
macOS: Researchers have found a new strain of malware hidden in some commonly pirated macOS applications. Jamf
AI
Porn: XTwitter has been flooded with AI-generated pornographic images of Taylor Swift, with one example attracting 45 million views. It was online for 17 hours before being taken down. The Verge Motherboard
Scams: Meanwhile, Taylor Swift was among the celebrities cloned in a campaign to push scams on YouTube. It says it’s working on better ways to identify deepfakes. 404 Media (R)
Election: As New Hampshire voters received calls from a fake Joe Biden, OpenAI suspended a developer over a chatbot that impersonated a US presidential election candidate.
Post-truth: As we suggested last week, all of this makes it unfortunate that social media giants are increasingly reluctant to identify false information. As Bloomberg reports, this is happening just as AI tools offer highly accessible ways to “supercharge” the spread of false information.
Customer service: As companies eagerly replace humans with chatbots, the experience of DPD might give them pause for thought. One DPD customer decided to have fun with its chatbot. As well as making it write a poem analysing its uselessness, he also persuaded it to engage in humour. “What do you call a fish with no eyes? Fsh!” was its contribution. The Register
Russia
Microsoft has a pretty lamentable security record and, in its latest embarrassment, Russia’s foreign intelligence service managed to steal emails from its senior management. It appears Moscow was trying to find out what Microsoft knew about the activities of its hackers. Interestingly, Microsoft says the attackers used a pretty basic technique to break into its systems. This involved trying multiple passwords until they found one that worked. That gave them access to a test account from which they then reached the accounts of senior executives. Microsoft says the Russian hackers behind the attack are now targeting other organisations and it’s beginning to notify them. On Thursday, Hewlett Packard Enterprise (HPE) says it was breached by Russian attackers. It appears they may have had access to a range of email accounts for up to six months.
Change
Meta is bowing to regulatory pressure and will allow users in the EU, EEA and Switzerland to unlink its services from one another. The decision is in response to the Digital Markets Act which will be enforced from March. To date, Meta has been fined $2.8 billion for breaches of the EU’s General Data Protection Regulation. Apple is also making significant changes as a result of the legislation. They include the introduction of third-party app stores, third-party browsers and web engines, and a new commission structure for developers. Apple says it’s not doing the same elsewhere because it’s “not the safest system for our users.” To some extent we agree, especially when it comes to third-party stores where you can download apps.
Hoax
A British student has appeared in court in Spain for joking on Snapchat that he was going to blow up a plane he was travelling on. It was suggested in court that the message was intercepted because he sent it over Gatwick Airport’s WiFi network. We’re sceptical that this is what actually happened but the case does have interesting angles. First, if you have to use public WiFi in places like airports then definitely use a VPN. Second, while Snapchat encrypts data while it’s being transmitted, not all of its content is protected so that only the sender and recipient can read it. Third, and most obviously, we should assume that anything we say online - even if it’s sent with the most secure solutions - could be screengrabbed and shared.
In brief
Location: ENEA has an in-depth report examining how mobile phones can be tracked on the modern battlefield. It looks at the issue in the context of the Ukrainian conflict and offers suggested mitigations.
Disabled: The US Securities and Exchange Commission says this month’s hack of its XTwitter account was caused by a SIM swap attack that was used to reset its password. It had disabled 2FA because of account access issues. CNBC
Ransomware: A thoughtful article by the former head of the UK’s National Cyber Security Centre examines the ongoing ransomware saga at the British Library, why it illustrates the country’s vulnerability to such threats and the need to ensure organisations can recover more quickly. The University of Kent has research on the toll ransomware incidents take on individuals.
23andMe: The genetic testing company has confirmed that hackers stole health and wellness reports, raw genotype data of customers affected by a data breach that went unnoticed for five months.
Ink: HP says disabling printers with third-party cartridges protects users from possible viruses. We say this is mostly theoretical and probably bollocks.
Russia: Service outages were reported on several messaging apps, including Telegram, WhatsApp, and Viber. The disruption was attributed to “preventative work” by the federal censor. Meduza
Swatting: The director of the US Cybersecurity and Infrastructure Security Agency is the latest victim of the vile practice of sending false alerts to police so they raid someone’s house. No harm resulted - which is not always the case. The Record
Intrusion: The French privacy regulator has Amazon €32 million for using “an excessively intrusive system for monitoring employee activity and performance” at its warehouses across the country.
Updates
Apple: iOS 17.3 and macOS 14.3 include important security fixes and new features, most important of which isStolen Device Protection mode for iPhone users. It’s designed to defeat street theft by requiring Face ID or Touch ID with no passcode fallback in order to perform sensitive actions. Other supported iOS and macOS versions also get security fixes.
Brave: We like the privacy-focussed browser but always warn that it’s liable to break some websites. Now, its makers are removing the option that provides strict protection against fingerprinting (i.e. tracking) for precisely that reason.
Firefox: Version 122 has several improvements, including enhanced translation (which takes place on your device rather than in the cloud, as with Google Translate).
Microsoft: An issue with update KB5032278 for Windows 10 could cause a system preparation tool error. The problem only occurs when running sysprep[.]exe in audit mode, which allows admins to add drivers and applications to Windows, and check the installation is valid.
GoAnywhere: Fix for a critical security issue in Fortra’s GoAnywhere Managed File Transfer software that could be abused to create a new administrator user.
Pixel: Users say they can’t access data in internal storage after installing the January 2024 Google Play system update. Google says it’s looking into it. 9to5Mac
Cisco: Updates for a critical-severity vulnerability in multiple Unified Communications and Contact Center Solutions products.