Defeating iPhone security. Turning ChatGPT into your personal assistant.
European court rules encryption is a human right. And an adult toy user discovers nothing on the web is private.
iPhones
In what appears to be the first example of its kind, criminals are targeting iPhone users with malicious software that steals Face ID scans to access their bank accounts. Group-IB says the Chinese-speaking attackers trick victims into carrying out biometric verification checks that they later use to bypass the same controls. The criminals also go after Android users but Group-IB says the iOS variant is the first to collect victims’ biometric data, ID documents and intercept SMS messages. At the moment, the focus of their campaign is Thailand and Vietnam but we doubt this technique will remain confined to Southeast Asia.
The techniques used against iPhone users are ingenious. At first, they involved a fake copy of the Thai government’s official pensions app which the group tried to persuade people to install from Apple’s TestFlight platform (used to distribute trial versions of apps). When that avenue was closed, the criminals switched to social engineering with the aim of getting users to enrol their devices in a Mobile Device Management (MDM) solution.
There are some worthwhile lessons here. First, iPhones are safe…but not invulnerable. Second, be very very suspicious if you ever see an invitation to download an app from the TestFlight store – and if you’re not expecting the request then ignore it. And third, MDM solutions give the operator powerful controls over your device. Again, exercise extreme caution before agreeing to install one.
Threats
Record: Victims of fraud in the US lost a record $10 billion last year, up 14% from 2022. Investment scams were the main cause; they were up 21% on the previous year. FTC
Remote: A phishing campaign is trying to trick users into downloading remote monitoring and management software including AnyDesk, Atera, and Splashtop. Malwarebytes
C-suite: An ongoing campaign is targeting Microsoft Azure accounts, particularly those belonging to senior executives. The attackers are combining tailored messages with shared documents. Proofpoint
Phone numbers : The practice of recycling old mobile numbers is a longstanding menace. Meta has acknowledged it can be exploited to take over accounts but says it’s up to telecom companies to fix the problem. In the meantime, it’s essential to keep account details up to date - and ensure multi-factor authentication (that doesn’t involve a phone number) is enabled. The Register
Facebook: Some 200,000 records containing mobile phone numbers, email addresses, and other personal information of Facebook Marketplace users have been published on a hacker forum. Bleeping Computer was able to verify some of the data as genuine.
macOS: New malicious software is targeting Mac devices by masquerading as an update for Visual Studio for Mac. Bitdefender
WIFI: Police in Minnesota have warned that thieves may be using WiFi jammers to block the signals from home security systems and security cameras. KARE11
Socials: A report from Bellingcat and the Texas Observer illustrates how social media can be used to identify people, even when they go to the trouble of blurring their faces. In this case, the leader of a white nationalist group in the US tried to hide his identity but failed to hide a distinctive tattoo.
AI
Memory: OpenAI is testing a new feature which allows users to tell ChatGPT to remember or forget specific details in their interactions with it. It’s a potentially big change that could turn the AI into a personalised assistant. At the same time, Google has released a new privacy notice for its Gemini app which sets out the information collected when a user interacts with it. ZDNet examines what this means in practice. Its conclusion; “never include sensitive information in your Gemini interactions. Ever.” And there you have it; the conflict between usefulness and privacy that will likely define the evolution of our relationship with artificial intelligence.
Nation states: Microsoft says groups linked to the governments of China, Iran, North Korea and Russia are seeking to exploit AI services such as ChatGPT, but their current use of them is pretty basic. At the moment, they’re mainly trawling open-source information, drafting phishing emails and translating content. As a massive investor in OpenAI, the company behind ChatGPT, Microsoft has an obvious interest in trying to prevent the technology being used by malicious actors.
Shadow AI: The use of unapproved apps at work is a significant threat - and now, so is similar use of AI. The UK’s National Cyber Security Centre has a new guide looking at how AI can be deployed safely inside organisations.
Automation : OpenAI’s next big thing is to create the capability for AI agents to automate complex tasks by effectively operating a user’s device for them. This would enable the agent to perform tasks that require interaction with a computer keyboard and interface. The Information ($)
Transport : London is one of the world’s most surveilled cities and now it has emerged that the city’s public transport operator experimented with adding a layer of AI to its cameras. Documents obtained by WIRED show that Transport for London (TfL) tested a system that analysed movements, behaviour and body language to detect crime or unsafe situations. TfL is due to expand its use of similar technology to detect fare dodging. techdirt
Lawyers: A study compared large language models (LLMs) and traditional legal contract reviewers. AI matched or exceeded humans for accuracy and completed the work in seconds. “The era of LLM dominance in legal contract review is upon us,” the study concludes.
Fake: A site called OnlyFake says it’s using AI to produce high-quality fake IDs. 404 Media tested the service and found it produced a near-instant fake Californian driving licence.
Personality test: 404 Media reports ($) on the AI-based personality test used by some big employers to decide who to employ in customer facing roles. The idea of such tests may not be new - but this version definitely breaks new - and pretty bizarre - ground.
In brief
Encryption: The European Court of Human Rights has ruled that encryption is a right in a democratic society. The court argued that it provides a range of protections to individuals and companies, including against hacking, fraud and data theft. Weakening encryption and retaining extensive data are therefore illegal, the court decided.
Abortion: US Senator Ron Wyden has called for an investigation into a data broker which gathered location data about visitors to abortion clinics and then sold it to an anti-abortion group. It used the details to send “targeted misinformation.”
Misinformation: Meta has cut payments to organisations that fact-check content on WhatsApp. It has also slashed its Facebook election team from 300 to 60. The Information ($) Washington Post
Search: A new feature from the Arc web browser called ‘Browse for Me’ changes the way search works by creating a custom-built web page from the results of a query. The feature automatically blocks ads and tracking tools. Unsurprisingly, there has been a backlash – and a focus on how the web is monetised. Engadget
Stalkerware: Consumer-grade spyware is not only an ongoing disgrace but horribly insecure into the bargain. TechCrunch reports on how researchers were able to exploit a glaring vulnerability in TheTruthSpy app to access data stolen from victims’ mobile phones.
Juveniles: The UK’s National Crime Agency says one in five British kids is involved in some sort of cybercrime online. The figure for gamers is one in four.
Russia : Moscow is creating a list of Russian bloggers who are active on YouTube but not on Russian social networks. Officials said the aim is to encourage them to move to domestic platforms. TASS
Tibet : The Chinese authorities are mandating the installation of an app that can access call and SMS logs, read browser histories, and see what other apps are installed on a device. Tibet Watch
Poland : The new prime minister says he has documents proving that the previous government used Pegasus spyware illegally and targeted a “very long” list of targets. AP
Sex toys: A woman is suing an adult toy retailer for allegedly selling details about what she was looking for on its website. In the interests of public decency (and to avoid falling foul of email filters) we’ll resist sharing those details. Suffice to say, we can see why she might be annoyed - and why we should all remember nothing is private on the web. 404 Media
Updates
Patch Tuesday: A flood of updates, notably from Microsoft which has addressed more than 70 security issues this month. Some of these are ‘zero-day’ (i.e. previously unknown) and so the fixes are important, particularly those affecting Exchange Office. There are also urgent updates from Adobe, SAP and QNAP.0
Windows 11 : If you’re running the latest version of Microsoft’s operating system on an old computer, it’s worth being aware the next major release might not work because of system requirements. Ars Technica explains.
Exchange: Microsoft has enabled Extended Protection on Exchange email servers by default. The feature is meant to defeat a technique in which attackers insert themselves between a user and the server, i.e. a man-in-the-middle (MiTM) attack.
Edge: Microsoft has fixed a bug/feature which meant its browser was automatically importing data and tabs from Chrome without consent.
Zoom: It’s always worth checking whether there are any updates for Zoom when you open the app. This week, there’s a particularly important one for the Windows version.
Pixel: Google is re-releasing its January update after (apparently) managing to fix an issue that locked some users out of their phone’s local storage.
Ivanti: There have been so many security issues with Ivanti’s products that it’s hard to keep track of them. The key is to ensure the latest updates have been installed and this week there are yet more of them to process.