Lessons from Microsoft's embarrassment. The ongoing shame of deepfake porn.
The risks of old routers. Spyware in Jordan. US surveillance. And winning at online poker by shoulder surfing through a window.
Microsoft
As so often, it’s the simple stuff that ends up causing the biggest disasters. In the case of the breach at Microsoft that emerged last week, the issues really were simple. First, the compromised corporate account at the root of the attack wasn’t protected with multi-factor authentication. Second, the account (an old test one) had administrative privileges. And third, attackers were able to create a malicious app which took advantage of the OAuth authentication protocol (explained below).
That chain of events allowed Russian government hackers to steal internal emails and files from Microsoft executives and staff. (It appears Moscow was trying to find out what Microsoft knew about its hacking activities.) They disguised their activity by routing it through residential broadband networks so that it looked like legitimate traffic from people working from home.
Admittedly, Microsoft is a vast business and that makes security difficult - but basic processes should have prevented this incident (which appears to have affected other companies as well). Those processes are appropriate whatever the size of the outfit and they’re a basic element in the reviews we do for our clients. One other key lesson for Microsoft organisations; as Erica Zelic explains on Twitter, it’s really worth turning off the feature that allows users to create permissions for OAuth applications. These are third-party applications that, once authorised, use an individual’s Microsoft credentials to access their organisation’s data. It’s enormously powerful and it’s enabled by default.
Threats
Mobile: Lookout has an overview of the mobile threat landscape. The headlines; a record number of previously undisclosed (‘zero-day’) vulnerabilties in iOS, risky data collection practices in popular apps, including TikTok, and the effectiveness of mobile phishing.
Couriers: The FBI is warning that scumbags are using courier services to collect money and valuables from victims of tech support and government impersonation scams. This has been a growing problem in the UK as well.
Messaging: Chinese-speaking users are being targeted by fake Google adverts for messaging apps like Telegram. It appears to be part of a campaign that has already targeted Hong Kong users looking for WhatsApp and Telegram. Malwarebytes
Voicemail: Avanan says voicemails are increasingly being used as a lure to steal credentials. It has seen 1,000 such attacks in the past couple of weeks.
macOS: Pirated software is a perennial threat and it’s being used in a mass campaign targeting macOS users. The apps involved include a range of business-focused and productivity tools. Kaspersky
Office: A booby-trapped Office document contains a fake update for the AVG antivirus app. It’s a sophisticated way to infect a targeted machine with ransomware. Fortinet
Teams: Group chat requests are being used to deliver malicious attachments by abusing a default feature that allows users to receive messages from people outside their organisation. AT&T
AI
Deepfakes: After it emerged that pornographic deepfake images of Taylor Swift had gone viral on Twitter, Microsoft lumbered into action and made changes to stop abuse of its Designer app. This was after the images had been viewed some 50 million times on Twitter. But of course the problem is that Designer is not the only app used to create the content and Taylor Swift is far from the only person affected. We’ve been writing about the issue for years. In 2018, Scarlett Johansson spoke to The Washington Post about the videos of her circulating on the internet, calling it “a vast wormhole of darkness.”
Writing: Latest use of AI technology is to create a tool that can mimic someone’s handwriting from a few paragraphs of content. Even the researchers, from Abu Dhabi, acknowledge the risk of abuse.
Italy: Regulators have ruled that OpenAI’s ChatGPT violates the EU’s General Data Protection Regulation. They missed a temporary ban last year on the grounds that it involved collecting user data unlawfully. Open AI has 30 days to appeal.
Google: There’s an AI upgrade on the way for Google Messages but Forbes warns that there’s a potential privacy risk because it may ask to read and analyse content. As the author puts it, Google’s Bard AI assistant “isn’t a chat with a friend. It’s a UI [user interface] sitting across the world’s most powerful and valuable advertising and tracking machine.”
Disinformation: We had some feedback questioning our analysis of the impact of AI on dis and misinformation. We agree such issues are hardly new but we do think AI adds a new dimension to the problem. The Electronic Privacy Information Center explores the issue in more detail.
Synthesis: A student demonstrates how to use AI to enhance the notes they take from lectures. It’s an interesting workflow - and it makes a change to report something positive from the world of AI.
Lazy: We’ve reported previously that some users found ChatGPT wasn’t completing some tasks. OpenAI has acknowledged the problem and says it’s made some changes to address it (as well as a bunch of other updates as well).
China
The FBI sent commands to hundreds of infected small office and home office routers to remove malicious software being used by China to infiltrate critical infrastructure in the US. The devices were mainly Cisco and Netgear products that had reached their end of life meaning they were no longer receiving updates. The US Justice Department said the Chinese hackers had turned them into a network (or ‘botnet’) they could control and use to connect to critical infrastructure organisations and “pre-position” themselves for future attacks. Proof positive that once routers reach end of life, the only place they should be is in a (recycling) bin. (After any useful information has been deleted from them).
Jordan
Pegasus spyware has been used to attack at least 35 people, including journalists, lawyers, human rights and political activists, according to analysis by Access Now and other organisations. The hacking continued for almost three years and the targets included Human Rights Watch’s deputy director for the region. The attacks used malicious links - often in WhatsApp messages - though in many cases the spyware was installed without the victim doing anything . Access Now says it believes “this is just the tip of the iceberg when it comes to the use of Pegasus spyware in Jordan, and that the true number of victims is likely much higher.”
In brief
Surveillance: The US National Security Agency has confirmed it is buying details of Americans’ internet usage without a court order, while details of its attempts to conceal the practice have also emerged.
Mind reading: Pen Test Partners describes how it used open source intelligence to help a Channel 5 documentary appear to read the minds of members of the public. The team had as little as 90 seconds to gather details from social media and other online sources and pass them to the reporter.
Emails: Google and Yahoo are introducing new rules to govern the sending of bulk emails. They come into force this month and aim to give recipients “the validation that a sender is who they claim to be.” Computer Weekly explains what needs to be done to ensure emails are delivered.
Law: Apple says proposed UK legislation could enable the country to try “to secretly veto new user protections globally”, preventing Apple from releasing them to customers. BBC
Ransomware: The threat from ransomware is growing, according to a report by Delinea, while the number of ransomware victims who chose to pay a ransom fell to an all-time low at the end of last year.
Vision Pro: The first reviews are in for Apple’s new headset. There’s a consensus that it’s superb but its price is ridiculously high - even if you can pre-order one at the retail price of $3,500 rather than on eBay where it rises to over $7,000. TechRadar
Poker: A novel illustration of the shoulder-surfing problem. Someone on Reddit claims to have been winning thousands of dollars by playing a neighbour at online poker. His secret; his opponent’s monitor was visible through his window. It’s probably not true, but it does beg the question; could someone see your monitor through the window?
Updates
iOS: The latest iPhone operating system update introduces Stolen Device Protection which is intended to make it harder for thieves to access sensitive settings if they grab it while it’s unlocked. But there’s a fatal flaw; if you’re using it in what Apple deems to be a Significant Location then the protection won’t apply. We don’t like Significant Locations anyway and 9to5Mac, which spotted the problem, explains how to turn the feature off.
Edge: Those naughty folk at Microsoft appear to have made a change to Windows which means their web browser launches automatically when you start up your device…and imports any tabs you had been using in Chrome. At the same time, Mozilla (i.e. the maker of Firefox) accused Microsoft of using ‘dark patterns’ to force people to use its browser. Dark patterns are a wicked technique that enables the designer to push users towards a particular choice. The Verge The Register
Ivanti: There’s a series of serious issues affecting the company’s Connect Secure VPN and Policy Secure devices. They’re being exploited and anyone with these systems should read Ivanti’s advisory and apply all available mitigations. In the US, the Cybersecurity and Infrastructure Agency has told federal agencies with the appliances to disconnect them by tomorrow.
Tails: Version 5.22 updates Tor Browser and Thunderbird as well as introducing new save and upload features for the browser.