The ongoing security SNAFU at Microsoft. Advances in robotics.
Lessons from the German air force...and from "that photo". The extent of spyware use. And the app designed to catch cheating partners.
Microsoft
Microsoft says Russian state-sponsored hackers managed to access its internal systems and source code repositories in a security breach that is still continuing. Initially, Microsoft said the attackers had accessed corporate email servers and inboxes belonging to the company’s senior leadership, legal, and cybersecurity teams. Now, it says there’s evidence that the Russian hackers have been weaponising the stolen information which includes “secrets” shared between Microsoft and its customers. “As we discover them in our exfiltrated email, we have been and are reaching out to these customers to assist them in taking mitigating measures,” the company said.
We doubt this is the last we will hear about this incident. Among Microsoft’s many properties is GitHub, a public repository where software code for umpteen applications is stored. As Malwarebytes told Reuters, “That one of the largest software vendors is itself kind of learning things as they go is a little bit scary. You don’t have the reassurance that if you’re a customer, that there isn’t something bigger going on.” Previously, Microsoft had said the hackers broke in by using a “password spray” attack (using a password on multiple accounts until it works). Since the original breach, such attacks have increased as much as tenfold, Microsoft says.
Threats
Images: A survey by Ironscales found 76% of respondent organisations were compromised by image-based and QR code phishing attacks over the past 12 months.
Voices: Scumbags are stepping up the use of AI to mimic the voices of friends and relatives to try to scare people into sending them money. The scam can be surprisingly effective, leading to calls for families and friends to create a safe word to prove someones’s identity. The New Yorker
Typos: An interesting method to automate spearphishing (i.e. targeted malicious emails) involves taking advantage of mistakes in email addresses. The method harvests any misdirected emails and extracts useful information from them. SensePost
USB: Barracuda warns of an increase in the use of USB sticks to deliver malicious software.
Facebook: Yet another round of the idiot hoax that warns of a non-existent change to Facebook’s terms and conditions allowing Meta to do whatever it wants with users’ photos. Just as in previous iterations, it’s all bollocks. Snopes
Adobe: Information stealing software is masquerading as an installer for Adobe Reader. ASEC
Insiders: Meta is suing a former executive for allegedly taking documents including pay details and contracts before leaving the company. The court filing describes a common practice that it’s essential to guard against - although this case appears to have been both unusually brazen and extraordinarily incompetent.
AI
Robot: Huge advancements are being made in robotics and this week brings a good example from Figure AI. In a video, its robot - “powered by OpenAI” - talks and moves naturally, identifies objects and explains its thinking. Making the (possibly dangerous) assumption that it’s real, the video is…interesting. via techradar
Personal: Daniel Miessler is an information security professional in California. He researches AI, writes about his findings and is a fierce believer in the degree of change it will bring about. In a new article, he describes how digital assistants will soon become the principle way in which we interact with technology.
Teens: Two teenage boys from Florida have been charged with creating deepfake nude images of their classmates. Under a 2022 state law, they face third-degree felonies, the same level of crimes as grand theft auto or false imprisonment. Wired
Cheats: Oops Busted!! is a new service that claims to be able to identify users of dating apps. For a small fee, people can upload an image and some basic details. The service will then scan the most popular dating services and use facial recognition technology to see if the target has an account.
Lessons
Some key takeaways from the very nasty security breach in which Russia eavesdropped on a sensitive conversation between German air force officers.
-
Analyse the current threat; in this case a senior officer attending an international air show abroad = extreme.
-
Assume you will be targeted; seek specialist advice.
-
Adopt appropriate measures; use only most secure communications and connectivity.
In this case, it appears that a Luftwaffe general connected to a Webex call not via the platform’s secure app but by dialling in (probably on his mobile phone). He was in Singapore and so his mobile was connecting to the network using a protocol called Signalling System 7 which is known to be riddled with vulnerabilities. A researcher has an excellent XTwitter thread setting out a likely scenario for what happened.
That photo
So much has been written about the manipulated Mother’s Day photo of the Princess of Wales and her kids, that we’re tempted to ignore it…except that it does provide a useful reminder of the risks of amateur use of technology. Regardless of whether it was Kate who edited the picture (vanishingly unlikely, we’d suggest), whoever did obviously understood neither Adobe Photoshop nor the modern media environment. Altering images (as The Conversation recalls) is nothing new. But in a world in which pretty much everyone has the means to play armchair detective, and many do, altering the facts to create a preferred reality will inevitably lead to disaster. If you’re Russia - or Donald Trump - it might not matter. If you’re a member of the British Royal Family, different standards apply.
In brief
Spyware: 74 countries are using commercial spyware and it’s being used increasingly against dissidents and journalists, US intelligence chiefs told a Senate hearing. They also warned the US is struggling to combat ransomware and growing use of AI in influence operations.
Exposed: Meanwhile in the UK, a parliamentary committee has accused the government of adopting an “ostrich strategy” by ignoring the “large and imminent” national cyber threat posed by ransomware. The Record
Bounty: Google says it paid $10 million to researchers who found vulnerabilities in its products. That’s $2 million less than the previous year and is dwarfed by the sums offered by spyware companies for the same issues.
TikTok: Whether or not the US does ban TikTok (following this week’s vote in the House of Representatives), the reality is (a) people will find ways to carry on using it and (b) the threat from social media stretches far wider than its potential misuse by the Chinese government.
Library: The British Library says legacy IT systems and lack of funds to replace them are the key reasons for the severity of the recent ransomware attack. It’s a lesson for all organisations; fail to invest in IT at your peril.
Law enforcement: A public-private initiative to disrupt cybercrime across the world is entering its operational phase. The Cybercrime Atlas was launched at the World Economic Forum and aims to reduce the return on investment in cybercrime. The Register
Cables: Internet services in Africa are being disrupted by damage to at least three submarine cables. The biggest impact was in Ivory Coast, Liberia and Benin with outages also reported in South Africa. As we tell clients, if connectivity is essential, it’s always worth having a backup solution. Bloomberg
Personal: California data protection regulations have revealed that data brokers are selling information about children, reproductive healthcare and precise locations. Malwarebytes
Updates
GarageBand: Update for the Sonoma and Ventura versions of Apple’s music creation app. Alas no fix yet for reported issues that the latest version of Sonoma is causing with printing and USB hubs in monitors.
Chrome: Google has updated the way Safe Browsing works to provide real-time protection against malicious websites. It does this by checking every site against a list of bad domain names. The real time element of this is important because Google says the average life of a bad site is less than 10 minutes.
Patch Tuesday: A torrent of fixes from manufacturers in March’s monthly update release. There are at least 60 from Microsoft alone. Also QNAP, SAP and Adobe.:
SecureDrop: Version 2.8.0 improves usability and is compatible with version 6 of the Tails operating system (superseding the now discontinued 5 series).
Tor: The Onion Router project has released a connection mechanism designed to bypass censorship controls. WebTunnel mimics ordinary web (HTTPS) traffic to hide connections in plain sight.