What's going on with ransomware. Identity theft. Airbnb scams. On sale to AI.

And vending machines with non-consensual facial recognition.

Ransomware

Headline statistics suggest that ransomware is out of control and a growing threat to organisations of all sizes - but the reality may be more complex and the outlook somewhat less negative. Taken at face value, the figures suggest a growing threat. One of the latest surveys, of 1,008 enterprise IT professionals, found that in the past two years every respondent had suffered a security breach. And Cybereason’s survey also confirmed other reports that paying a ransom is no guarantee that stolen data will be returned. 84% of respondents paid up but only half saw their data returned and services restarted without corruption. To add insult to injury, within a year 78% of respondents experienced another ransomware incident.

Meanwhile, a notorious ransomware gang claims to be back at work just a week after an international law enforcement operation took down much of its operation. ‘LockBit’ said it had restored its infrastructure and launched a new leak site with details of hundreds of victim organisations. In reality, RedSense argues (based on a three-year investigation) that LockBit’s claims are nonsense. It says the existing ransomware ecosystem is collapsing in upon itself and points to exaggerated victim numbers and false claims of successful attacks. 2024, it says, is hopefully the year which will see the end of organisations offering a service designed to allow almost anyone to set themselves up as a ransomware operator. This doesn’t mean no more ransomware attacks but it does mark a reduction in the overall threat.

Threats

Identity: Germany’s federal Information Security agency says the number one threat in the country is identity theft. Its annual report paints a bleak picture “marked by the continued expansion of a cybercriminal black market economy.” In common with similar reports, it also warns that criminals are increasingly targeting small and medium-sized organisations.

Airbnb: A great example from Malwarebytes emphasises why it’s essential to never leave an accommodation platform to make a booking. In this case, an Airbnb listing itself asked renters to contact the host by email. The scam then involved a fake Tripadvisor site and an attempt to steal credit card details.

Brands: Some clever fraudsters have been hijacking domain names belonging to some of the world’s best known organisations, including UNICEF, MSN and eBay. Most are ‘subdomains’ (i.e. a child of the main brand identity) that the organisation has forgotten about. Guard.io

Calendly: Fraudsters are exploiting the popular appointment scheduler by adding a link to the target’s calendar. The request for a video conference contains a link that, if clicked, will install malicious software on macOS devices. Krebs on Security

Romance: “Fake love” scams are remarkably effective. In one example, a 37-year old technology professional lost $450,000 in a fraud that involved deepfake videos and sophisticated scripts. A key red flag is a request to move a conversations from the platform on which it started (in this case from Tinder to WhatsApp). TechXplore

macOS: Bitdefender has details of a nasty threat targeting macOS devices. It’s designed to steal key information and begins by obtaining the user’s password by displaying a fake operating system dialogue. Requests for passwords or to install apps should always be treated with caution.

Routers: The FBI and partners from 10 other countries are urging owners of Ubiquiti EdgeRouters to check their devices in case they’ve been compromised by Russian state hackers. Among the recommended actions are a factory reset, installation of the latest firmware and ensuring remote management access is disabled.

Cloud: The US and its ‘Five Eyes’ security allies are also warning that Russia is increasingly targeting cloud services. In particular, they point to the exploitation of dormant accounts belonging to former employees.

AI

On sale: First Reddit agreed to sell content to Google to help train its AI model. Now, 404 Media says ($) the parent company of WordPress and Tumblr is about to follow suit. Users will be opted into the scheme automatically. Basically, it’s pretty safe to assume anything that has ever been posted online will soon have been ingested by one AI model or another.

Elections: Meta has created a dedicated team to combat disinformation campaigns targeting this year’s elections for the EU parliament.

Diversity: From Google comes an explanation for the “embarrassing and wrong” images produced by its Gemini AI tool (aka bizarre “racially diverse” Nazi soldiers). The problem, it said, lay in attempts to ensure the tool displayed a range of people. These attempts had not taken into account “the cases that should clearly not show a range.”

Studios: A Hollywood filmmaker has halted a $800 million investment in new studios after seeing the capabilities of OpenAI’s tool to generate video from text prompts. Tyler Perry said watching Sora’s capabilities was “mind-blowing.” The Hollywood Reporter

Detective: Researchers have developed a new technique for identifying deepfake images. They say it achieved 99.05% accuracy, better than anything seen before.

Robot: A startup seeking to develop a humanoid robot has raised $2.6 billion from investors, including Jeff Bezos, Microsoft and Nvidia. Based on its work so far, we’d say “humanoidish.” CNBC

In brief

Risky: 40% of mobile users are running a device with known vulnerabilities, according to mobile device management company, Jamf. Its annual security report also has some pretty shocking statistics for machines running macOS. FileVault (which protects data) was turned off on 36% of devices. And Firewall (which protects against incoming connections) was disabled on 55% of machines. These are figures that, unfortunately, bear out our own experience when examining devices.

Email: Cofense says it detected a record number of malicious emails and phishing campaigns last year. Its annual report describes “the escalating sophistication of cyber threats,” with email remaining the primary attack vector.

Shamed: The US Federal Trade Commission has fined scumbag security outfit Avast $16.5 million to settle charges that it sold its customers’ browsing data to companies (including Google and Microsoft). Frankly, that doesn’t seem much of a penalty given that Avast billed its products as a protection against exactly what it was caught doing.

Framework: Following two years of work, the US National Institute of Standards and Security has updated its Cybersecurity Framework. The framework provides an excellent mechanism for managing cybersecurity and the new version includes quick start guides for organisations of all sizes.

Location: Forbes reports ($) that a startup is selling access to data designed to locate people at military bases and diplomatic offices. Bazze claims to be a trusted partner of US and UK defence agencies and says its marketplace can be used to enable “real-time” mobile device location.

Acemagic: After malicious software was found on some of its mini-PCs, the Chinese manufacturer says it was the result of changes it made to Microsoft’s source code in an effort to enhance their performance. Caveat emptor. The Register

Faces: A university in Canada is removing M&M-branded vending machines from its campus after it emerged they were covertly collecting facial-recognition data without the user’s consent. An investigation by students found sales brochures for the machines contained claims they could collect the estimated ages and genders of anyone using them. Ars Technica

Updates

Windows: Users have been experiencing failed downloads when trying to install the Windows 11 February update on 22H2 and 23H2 systems. While Microsoft sorts itself out, there’s a fix that involves deleting a hidden folder.

Invanti: A new version of its firmware integrity-checking tool has been released after it emerged that attackers had managed to hide their presence on compromised SecureConnect VPNs. The US cybersecurity agency is not convinced the new version provides sufficient assurance that devices are safe and has issued advice for administrators.

Zyxel: Updates to address multiple vulnerabilities in firewalls and access points.

Cisco: FXOS and NX-OS security update includes fixes for two high-severity flaws in NX-OS software.

Zimbra: Updates for Zimbra Daffodil 10.0.7 and Zimbra 9.0.0 Kepler Patch-39. Includes usability improvements and security fixes.

Tails: Version 6.0 is a major revamp of the security-focused OS. It’s based on a different version of Linux and includes significant security improvements.

← Back to all editions