Voice cloning in spite of controls. Record losses from online crime.
Seeking stolen ChatGPT credentials. Spyware platform taken down, again.
Disinformation
The good news; Super Tuesday passed off without incident, according to the US cybersecurity agency, CISA. The bad news; political deepfakes are rife and measures to control them don’t work. After its technology was used to clone President Biden’s voice, ElevenLabs, introduced a policy prohibiting the cloning of voices belonging to politicians running for office (and those of some high-profile celebrities). Despite that, 404 Media found ($) it was easy to bypass the controls, apparently simply by adding some silence to the voice sample used to create the clone.
TheOrganisation for Economic Cooperation and Development is the latest body to examine the threat of disinformation. In a report, it warns of the risk of exacerbating polarisation, distorting public policy debates, and further damaging trust in government. It recommends “a comprehensive approach, tailored to country contexts, that emphasises the need to create an environment for reliable information to thrive.” The problem is how to achieve that while retaining the freedom of speech that the OECD says it supports. Meanwhile, this week the BBC reported on the use of fake images in the US election campaign. In one example, a conservative radio show host said he created a picture to accompany a report about black voters supporting Donald Trump. it showed the former president smiling with his arms around a group of black women at a party.
And remember the hysteria over the bedbug infestation in France? A French government minister says it was created by a Russian disinformation campaign. Yes, there was a problem but “the issue of bedbugs was artificially amplified on social networks by accounts that have been established to be of Russian inspiration or origin,” France’s European Affairs Minister said. “They even created a false link between the arrival of Ukrainian refuges and the spread of bedbugs,” he added.
Threats
Lost: A record $12.5 billion was lost in 2023 as a result of internet crime, according to the FBI’s latest figures. That’s a 22% rise compared to the previous year. The FBI says it saw increases in tech support scams and extortion, while there were slight reductions in phishing, personal data breaches, and non-payment/non-delivery scams. The biggest losses were caused by investment scams. For the first time, most of them were related to cryptocurrency rather than business email compromise (BEC).
WordPress: Attackers are trying to compromise WordPress sites so they can use visitors’ browsers to hack other sites. Sucuri explains the method and what to do about it.
WhatsApp: Panda has a handy round-up of how scumbags are exploiting the messaging platform. They range from impersonation and investment scams to a fake ‘Oro’ or gold version of WhatsApp.
Doorbells: An investigation by Consumer Reports found a huge range of ‘smart’ doorbells with “terrible” security. Despite this, they’re sold by Amazon and other big-name retailers.
Government: Attackers have been impersonating US government agencies to try to lure their targets into opening files with links to fake procurement processes. proofpoint
AI
Crime: Group-IB says attackers are seeking stolen ChatGPT credentials and are willing to pay substantial sums for them. Its annual Hi-Tech Crime Trends report examines criminal attempts to bypass ChatGPT’s security controls as well as the development of AI-powered tools.
Open: OpenAI has responded to a lawsuit filed by Elon Musk by saying he supported a move away from an open source approach at the company. Musk is accusing OpenAI management of prioritising profit instead of making its technology freely available. Selected emails released by OpenAI imply that the end result of its research into artificial general intelligence should be open to everyone but that some processes should remain secret to prevent unscrupulous exploitation of the technology. Ars Technica
Legislation
The EU’s Digital Market Act came into full force this week, with accompanying squeals of protest from the technology behemoths affected by it. Alphabet/Google, Amazon, Apple, ByteDance, Meta, and Microsoft have been designated as ‘gatekeepers’ and must adhere to rules designed to prevent unfair business practices that could limit consumer choice in core platform services. A key change is greater interoperability between services although Apple, for example, has complained this will come at the expense of user security. This week, the EU fined Apple over €1.8 billion for abusing its dominant position in the market for music streaming apps.
In brief
Spyware: The Predator spyware platform was taken down this week after its infrastructure was revealed by researchers. It’s the second time the operators of the platform have been forced to dismantle their server network in a ‘whack-a-mole’ contest between the companies and researchers. CyberScoop
Mexico: The Committee to Protect Journalists and Amnesty International have found “systemic flaws” in Mexican government measures intended to protect journalists. The report calls for strengthened policies in “the most dangerous country for the press in the Western Hemisphere.”
Tinder: Israeli soldiers are updating their profiles with pictures from the war in Gaza. Many show them brandishing weapons and munitions. “There is moments in this app that I miss Gaza,” one user posted. 404 Media ($)
Zero-trust: The US National Security Agency has published guidance on how to adopt ‘zero-trust’ principles. A zero-trust model assumes that networks will be breached and therefore enforces strict segmentation so that when an incident happens, the damage is limited.
Content farm: Bleeping Computer has found a network of websites impersonating leading media outlets including the BBC, CNN, Reuters and The Guardian. They repost content without attribution, apparently in an effort to sell expensive advertising slots.
China: A federal grand jury in California has indicted a Chinese citizen for allegedly stealing trade secrets related to Google’s AI technology. Linwei Ding was working for Google as an engineer at the time of the alleged theft.
Updates
Apple: Updates for iOS and iPadOS operating systems address four newly disclosed flaws, two of which are ‘zero-day’ vulnerabilities and are already being exploited. There are also significant changes designed to combat future threats from quantum computing (which will render current encryption methods ineffective).
macOS: Apple also released updates for its Mac devices with fixes for over 50 security issues. New versions are 14.4, 13.6.5 and 12.7.4.
VMware: There are urgent updates for critical-severity flaws in the ESXi, Workstation, Fusion and Cloud Foundation products.
TeamCity: Attackers are already exploiting a vulnerability in TeamCity On-Premises which allows them to bypass authentication. Hundreds of instances have not been updated.
Cisco: Updates to address serious vulnerabilities in SecureConnect VPN. The issue affects instances in which the VPN headend is configured with the SAML External Browser feature.
XTwitter: The platform’s new voice calling feature highlights a potential security issue with messaging services. The feature, which is enabled by default, could allow a caller to identify someone’s location by revealing their IP address. This is not confined to Twitter, it affects pretty much every service with voice calling, including Signal. The easiest solution is to use a VPN. Intego explains in more detail.