Improving Signal. Chinese cyber tactics revealed. ChatGPT goes bonkers.
Takeaways from the LockBit takedown. And Apple says don't use rice to dry a wet device.
Signal
There’s general agreement that Signal is the most secure mass market solution for communication. But there’s been a longstanding problem; using it has required revealing a phone number. That’s finally changing with the launch of “phone number privacy.” The new features give users the ability to hide their phone number and share a username instead. They also allow users to prevent anyone who does have your phone number from seeing that you’re on Signal at all.
The features are being launched as a beta (i.e. trial) but Signal says they’re being rolled out to everyone over the next few weeks and will be enabled by default. It also emphasises that usernames won’t work as they do on social media platforms. There’s no central directory that can be searched, meaning that you’ll need to know someone’s exact username in order to communicate with them.
There’s one other change in the world of secure messaging. You may have seen news that Apple has introduced changes to protect content on iMessage from ‘post-quantum computing.’ The changes are required because the mathematical problems that underpin most current encryption are (for practical purposes) impossible for conventional computers to solve. The design of quantum computers allows them to calculate the solutions in hours. This means messages sent today could be decrypted easily once quantum computers become sufficiently powerful, something scientists say is growing ever closer. Apple’s announcement comes five months after Signal made similar changes.
Threats
Iran: State-backed attackers are targeting Middle East policy experts with a new campaign which uses a fake webinar portal. Volexity
Credential stuffing: The mass exploitation of stolen account details is an ongoing menace. Cybersecurity Insiders has useful advice on how to protect against the technique, including implementing multi-factor authentication and limiting the number of login attempts.
Crypto: A fake cryptocurrency wallet is the latest malicious entrant into Apple’s App Store. Users say the fake Rabby Wallet & Crypto Solution has already cost them thousands of dollars. Rabby
EU: “Highly targeted and personalised campaigns” used “meticulously crafted” emails to deceive specific individuals within organisations, according to the EU’s Computer Emergency Response Team.
Insiders: A former employee of Stratford-on-Avon District Council copied 79,000 email addresses to help develop his own business. He escaped with a warning after making a “sincere” apology. This is something we keep on coming across, making training and monitoring vital. The Register
Wireless: Two exotic threats this week. The first involves an attack that can exploit consumer wireless chargers to damage a mobile device. As Bleeping Computer explains, the technique takes advantage of “security flaws in the hardware design of wireless charging systems and the protocols governing their communication.”
Fingerprints: Second exotic threat of the week involves an unlikely sounding technique to help steal a user’s fingerprint. US and Chinese researchers demonstrated that details of our fingerprints can be recreated from the sounds made when swiping on a touchscreen.
AI
Video: We’ve been trying out Sora, OpenAI’s new tool which generates photo-realistic video from a text prompt. It’s really worth being aware of its capabilities because of the potential for extraordinarily convincing fakes. This XTwitter thread shows what it can do.
Compliance: Organisations are facing increased requirements to comply with regulations on the development and deployment of AI systems. The Register has a useful report on the issue. The verdict of experts on organisations in the UK; comply with EU rules and you should be fine.
Bonkers: ChatGPT had a moment this week when it appeared to have lost its marbles. Users on Reddit described various weird responses to simple questions, including a surreal answer to the question, “What is a computer?” “A mouse of science,” was among its responses. OpenAI says it identified and fixed the problem.
On hold: Meanwhile, Google has acknowledged a problem with the image generation feature of its AI model. It said it was aware Gemini was offering what it called “inaccuracies in some historical image generation depictions.” That’s a polite way of saying Gemini was unable to depict races accurately. Bloomberg
China
Beijing is investigating the online publication of documents that reveal details of its cyber espionage activities. The source appears to be a private security contractor with close ties to the Ministry of Public Security Among the details revealed by the documents are tools for identifying the identity of XTwitter users and devices disguised as power strips and batteries that can be used to compromise Wi-Fi networks. Recorded Future told the Associated Press that it was “the most significant leak ever linked to a company suspected of providing cyber espionage and targeted intrusion services for the Chinese security services.”
In brief
Takedown: The successful dismantling of the LockBit ransomware operation revealed what many have long suspected; paying a ransom doesn’t guarantee stolen data will be deleted. The takedown appears to have been possible because LockBit failed to keep its systems up to date. NCA
Surveillance: The EU is reported to have agreed a two-year extension of the mass scanning of private content on platforms including Facebook, Instagram, Gmail, and Xbox. Patrick Breyer
Wyze: The home security camera manufacturer has admitted that a security issue could have allowed 13,000 users to have viewed strangers’ camera feeds. This is the second similar incident in less than six months. The Register
Telegram: Guard.io examines the anarchic world of Telegram which it describes as “a bustling hub where seasoned cybercriminals and newcomers alike exchange illicit tools and insights creating a dark and well-oiled supply chain of tools and victims’ data.”
Brain power: Mark Zuckerberg says Meta is “close” to selling a device that can be controlled by brain signals. TechRadar
Off course: Attackers tried to divert two El Al passenger flights by issuing changes to their set route. The pilots were apparently suspicious of the radio communications and ignored them. Jerusalem Post
Rice: It’s official. If your iPhone gets wet, don’t use rice to extract the moisture. Apple says small particles could get into the phone and that would make everything worse. Its advice is here.
Adult: Malwarebytes has the story of a vibrator that tried to infect its owners computer with malicious software. The issue arose when the device was connected in order to charge it. No words.
Updates
Google: If you’re logging into Google (or signing up), you’ll notice a new design. It’s mostly the same as before but sufficiently different for some people to think it might be fake. Google’s blog has the details.
Chrome: Version 122 of Google’s web browsers fixes critical security issues but also introduces new features that make it harder for attackers to exploit vulnerabilities.
Firefox: Version 122 of Mozilla’s browser also has security fixes and includes a ‘Web Compatibility Reporting Tool’ that can be used to report websites that work in other browsers but not in Firefox.
VMware: An urgent advisory is telling administrators to remove the out of date Enhanced Authentication Plugin (EAP).
SolarWinds: Updates for Access Rights Manager (ARM) and (Orion) Platform to address security vulnerabilities.
Tinder: The dating app is launching a verification service that will allow users to verify their account with a document, such as an ID, driver’s license, or passport. The feature was tested in Australia and New Zealand and is being expanded to the US, UK, Brazil, and Mexico.
ScreenConnect: Update to address critical vulnerability that researchers have described as “trivial and embarrassingly easy” to exploit.
Joomla: Important updates to fix five vulnerabilities in the content management system that could be used to execute arbitrary code on vulnerable websites.