The scale and changing face of Chinese espionage. Deepfake fraud.
A tech expert explains how he was scammed. Tackling spyware. Crap USB sticks. And smart toothbrushes reveal rubbish reporting.
China
The US and its intelligence allies say China has accessed the IT networks of multiple critical national infrastructure organisations and is preparing “disruptive or destructive cyberattacks.” The Chinese group’s “choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations,” the allies said. The “actors are pre-positioning themselves on IT networks to enable lateral movement…to disrupt functions,” they claimed.
It’s one of a rash of stories this week demonstrating the scale of Chineseespionage activities. The Dutch security service said a Chinese group breached the country’s Ministry of Defence and installed malicious software on compromised devices. In Japan, Chinese attackers managed to access a system used to exchange diplomatic communications. And in the Philippines, hackers based in China tried repeatedly to break into government websites and email systems.
Meanwhile, an investigation by The Citizen Lab has uncovered a(nother) huge network designed to spread pro-Beijing content. At least 123 websites posed as local news outlets in 30 countries across Europe, Asia and Latin America. The Citizen Lab said it “found evidence that Times Newswire regularly seeds pro-Beijing political content, including ad hominem attacks, by concealing it within large amounts of seemingly benign commercial content.” As its report says, “Beijing is increasing its aggressive activities in the spheres of influence operations (IOs), both online and offline.”
Threats
Valentine: It’s estimated some 350 million people used dating apps in 2022 - which makes a tempting target for scumbags. As Valentine’s Day looms near, eset has advice on how to avoid falling for a scam. Alas, there’s no easy answer. The bottom line is to approach with caution…and a healthy degree of scepticism. Which sucks the romance out of the process about as effectively as Valentine’s Day does.
Microsoft 365: Phishing-as-a-Service makes it easy for (almost) anyone to set up shop as a cyber criminal. Sucuri shows how the ‘Greatness’ platform works and why it’s essential for users to be on their guard.
LastPass: A fake app called “LassPass Password Manager” was found on Apple’s App Store. The app closely copies the branding and appearance of LastPass, right down to the interface. LastPass
Mac: Malwarebytes warns that attackers are targeting Mac devices more than ever. Its data also showed that Amazon was the most imitated brand last year.
QR codes: The UK cybersecurity agency is advising against installing third-party QR code scanners and instead use their devices built-in capability.
Users: Companies churn out reports on the “state of cybersecurity” – and we try to save you the trouble of reading them. One common theme worth highlighting is that the main target for attackers are almost always users, i.e. us. This week’s example comes from Fortra which has useful data, including the challenges stemming from cost constraints. Cisco Talos also has details of how attackers make use of stolen credentials - and why they’re so valuable.
Scammed: A cautionary tale from a long-time tech author who despite his accumulated expertise fell for a phone scam. In his case, the fraudster asked for the last seven digits of his credit card - rather than the normal four. Since the other nine digits were the same for all the cards issued by his bank, this was quite valuable information. As Cory Doctorow says, “The thing is, I know a lot about fraud. I’m writing an entire series of novels about this kind of scam.” Doctorow’s detailed article is well worth a read but one key takeaway is that we’re most vulnerable to this type of scam when we’re in a rush.
AI
Deepfake: Police in Hong Kong say the local branch of a multinational company lost $25 million after an employee was fooled by a video conference call in which all the other participants were AI-generated deepfakes. We’re slightly sceptical about the details but there’s no doubt a scam took place and the company in question lacked the basic processes that would have stopped the fraud.
Transcription: An extraordinarily quick audio to text tool takes less than 100 seconds to transcribe 2.5 hours of content. It’s called Insanely Fast Whisper.
News: Interesting things are happening in the world of news on the web. An impressive AI-powered website provides a concise round-up of what’s happening in the world. And Business Insider has a new site called Semafor which curates coverage of the biggest stories of the day.
Red flag: College admissions staff say certain words are appearing more frequently in entrance essays – and they’re giveaways that AI may have been used to write them. One example is “tapestry.” Forbes ($)
Spyware
The past decade has seen an abrupt increase in the number of spyware manufacturers, with Google saying it is now tracking some 40 entities that are active in the commercial surveillance market. In a report, it says such companies are responsible for most of the zero-day (i.e. previously unknown) vulnerabilities in its products. As Google points out, “If governments ever claimed to have a monopoly on the most advanced cyber capabilities, that era is over.” This week, the US announced travel restrictions on individuals (and their families) involved in the development and misuse of commercial spyware. And in London, some 35 countries produced a statement saying more needed to be done to tackle the issue. We’re confident in predicting all this will have pretty much zero effect in reducing a sprawling industry.
In brief
Jackpot: Ransomware gangs collected an estimated $1.1 billion worth of cryptocurrency last year, almost double the amount for 2022. Chainalysis says the majority of payments were over $1 million.
USB: A German data recovery firm says the quality of the memory chips in microSD and USB sticks is declining. CBL found that unbranded products (often found in giveaways) frequently used chips that had failed quality control from big name manufacturers. Among their advice; never use give-away storage for anything important.
Russia ban: Despite assurances to the contrary, a formal ban on the use of VPNs comes into force on March 1. Kommersant
France: More than 33 million people (or roughly half the country’s population) have been affected by data breaches at two companies providing payment solutions to local hospitals. CNIL
Tracking: Google is phasing out the cookies (i.e. small files) that sit on our devices and enable marketers to track what we do on the web. This presents a problem to companies like Amazon, so it’s come up with a solution. It’s done a deal with the UK’s largest publisher Reach to share “contextual” data about, for example, what articles someone reads on its sites. FT
Cache: Google’s invaluable copy of the webpages it crawls is being shut down. “It was meant for helping people access pages when way back, you often couldn’t depend on a page loading. These days, things have greatly improved. So, it was decided to retire it,” Google said.
Toothbrushes: An enticing story this week illustrates the lamentable quality of so much cybersecurity reporting. The headlines suggested a Swiss company had incurred significant losses after it was targeted by attackers using a network of compromised smart toothbrushes. Complete bollocks, as rudimentary checks would have revealed. Kevin Beaumont explains how a throwaway remark in an interview was turned into a story that was widely picked up…and is now being used by Russian propaganda groups.
Updates
Apple: macOS 14.3.1 fixes a number of issues in Sonoma, including a problem with composting messages in Mail. There are also updates for iOS and iPadOS.
AnyDesk: The widely-used remote desktop platform has urged users to change their passwords following an incident in which attackers breached its network.
Canon: Updates to address vulnerabilities in a number of Small Office Multifunction Printers and Laser Printers. The issues were identified in a recent hacking contest.
Ivanti: A vulnerability in Connect Secure and Policy Secure products is being widely exploited. Action is essential.
Cisco: Important security fixes for Cisco Expressway Series.
Fortinet: Security updates for FortiSIEM supervisor.
VMWare: Fixes to address five issues in Aria Operations for Networks (ex- vRealize Network Insight).