The state of stalkerware. Recruitment phish. Deep fakes and Telegram.
The US case against Apple. Another warning about China's threat to critical infrastructure.
Stalked
Last year saw another rise in the use ofstalkerware, according to the latest edition of Kaspersky’s annual survey. It found 31,031 instances of software being used to spy on people, up 6% on the previous year. While that may not justify Kaspersky’s use of “pandemic” to describe what’s happening, it’s clear that stalkerware is a growing problem with real-world impacts. In one example, Refuge, which supports women and children experiencing domestic violence, recounts the story of a woman who committed suicide because every attempt she made to leave an abusive relationship was thwarted by her partner. “He was monitoring everything, So every time she contacted an agency and made a plan to leave, he would interrupt her,” the organisation told The Register.
Despite most people agreeing they wouldn’t want stalkerware to be used against them, Kaspersky says a significant number of respondents endorsed the idea of monitoring a partner without their knowledge. That figure has been growing in recent years, from 30% in 2021 to 46% in 2023 and many analysts believe it’s likely to rise further as the use of tracking technology is normalised. And the way younger generations share passwords and devices makes it easy to install an app on a phone without the owner’s knowledge. A Coalition Against Stalkerware was formed in 2019 and it offers advice for anyone worried they might have spyware on their phone. But it’s telling that while the use of stalkerware grows, the Coalition’s website hasn’t published any news for almost a year.
Threats
Recruitment: Employment platform Dice is warning about an increase in fake recruitment messages offering non-existent job opportunities.
Files: Websites that request access to local files might be able to bypass antivirus software and carry out ransomware attacks, according to research by Florida International University. Examples of such sites include free photo editors and similar online apps.
Publishing: Attackers have been using digital document publishing sites to host phishing lures. The sites allow users to upload and share PDF files in an interactive format; this is being abused to create multiple accounts and publish booby-trapped documents. Cisco Talos
Venmo: The popular payment app (one in five US consumers uses it) is being exploited by fraudsters. The aim is to lure recipients into calling a number to cancel a non-existent payment. Avanan
Overheard: This week’s exotic threat comes from researchers at Augusta University. They’ve found that analysing the sounds from a keyboard can be used to deduce what was being typed, even in noisy conditions.
AI
Telegram: Checkpoint found more than 400 channels promoting deep fake services on the Telegram Messenger app, ranging from individuals offering bespoke services to automated bots designed to help people create the fakes themselves. Computer Weekly
Journalism: A journalist with The Markup used ChatGPT as a reporting assistant. His verdict; “It didn’t go well.” The AI tool ignored instructions and made up facts, though he says it did prove helpful in writing programming code to create maps.
Fined: French regulators have fined Google €250 million for failing to tell news publishers that it was using their (copyrighted) content to train its generative AI model.
Forecast: An AI tool can predict a patient’s future health by using their health records to create a digital twin. When applied to US data, the tool identified a patient’s next condition with 88% accuracy. Results from British data were slightly lower. Lancet Digital Health via TNW
Apple
The US Department of Justice is suing Apple for allegedly using its power in the smartphone market to limit competition from rivals and reduce consumer choice. Pointing out that “its net income exceeds the GDP of over 100 countries,” the US Attorney General said Apple had stayed ahead of the competition not through innovation but by abusing antitrust law. The complaint alleges that “Apple has repeatedly responded to competitive threats…by making it harder or more expensive for its users and developers to leave than by making it more attractive for them to stay.” Apple will fight the case vigorously and prosecuting it will take years (a similar antitrust case against Microsoft took three years to settle.) Analysts have also pointed out that parts of the lawsuit are tendentious to say the least.
China
The US and its intelligence allies have issued another warning about the risk of Chinese attacks on critical infrastructure. The joint alert urges owners and operators to protect their facilities from “the urgent risk posed by People’s Republic of China (PRC) state-sponsored cyber actors.” Meanwhile, Google Mandiant says it found a Chinese state-sponsored attacker exploiting vulnerabilities in F5 BIG-IP and ScreenConnect in an aggressive campaign in North America, the UK, South-East Asia and Hong Kong. Targets included research and education institutions, businesses, NGOs and government organisations.
In brief
Locks: There are some three million Saflok keycard locks in 13,000 hotels around the world. Hackers found a vulnerability that can be used to open them in seconds. The manufacturer is working on a fix but so far it’s only been applied to around a third of the affected locks. Wired
Revealed: In case proof were needed that anonymity on the web is an illusion, users say Glassdoor has begun identifying them without their consent. For those who haven’t come across it, Glassdoor is a site where employees can review their employers (or ex-employers). Comments are frequently unflattering. Users are understandably unhappy. Ars Technica
OpenVPN: US academics have found three ways to identify connections using the OpenVPN protocol. They claim an 85% accuracy rate using details including the size of data packets and server responses. OpenVPN is often used to circumvent government controls and the ‘fingerprints’ could allow such connections to be blocked “with little collateral damage.”
Small business: Sophos says small businesses accounted for more than 75% of incident response cases it handled last year. Among the specific issues, it points to the risk from unprotected devices including unmanaged computers without security software and systems running out of support software.
People search: You may have been tempted to use one of the many websites offering to provide information about a specific person. Security reporter Brian Krebs has been investigating a network of ‘people-search’ websites which is based in China and whose principal owners appear to be completely fabricated.
Response: The UK’s cybersecurity agency has published guidance to help chief executives manage a cyber incident. The advice is straightforward but it should really be read in conjunction with the agency’s toolkit for boards which emphasises the importance of having a comprehensive incident response plan.
Wireless jammers: The US Federal Communication Commission is investigating Amazon and other online retailers over the alleged sale of devices that jam wireless signals. The devices, which are illegal in the US, have been linked repeatedly to home burglaries where they’ve been used to disable security cameras.
Updates
macOS: Users have reported numerous problems with the latest version of Apple’s operating system for Mac devices. The problems with Sonoma 14.4 include issues with printers, USB hubs and disappearing iCloud files. It’s also been found to kill Java processes leading Oracle to advise against taking the update. Macworld’s report on the issue is titled, “How badly did Apple screw up the macOS Sonoma 14.4 update?” The article includes advice on dealing with the iCloud bug. Sonoma 14.4 includes 60 security fixes, so Apple’s failure to say anything about the problems is particularly galling.
iOS: Apple has released iOS 17.4.1 and iPadOS 17.4.1 together with iOS 16.7.7.
AirTag: Apple has begun rolling out new firmware for its tracker devices. The new version (2.0.73 build number 2A73) is being released gradually, so it may be some time before it’s generally available. The update is automatic and takes place when a tag is within bluetooth range of the iPhone to which it is linked.
Apple: Good news if you’ve ever found yourself searching for product manuals and guides. Apple has gathered them altogether in one place to make them easier to find.
Browsers: Both Google and Mozilla have released important updates for Chrome and Firefox. Meanwhile, Microsoft has again been spotted injecting popup windows into Chrome in an attempt to get people to switch to its Edge browser.
Windows Server: Microsoft has confirmed that a bug in its March 2024 Windows Server security updates is responsible for widespread problems with Windows domain controllers. Bleeping Computer has more details.
SecureDrop: SecureDrop Client 0.10.1 is a hotfix for a bug that prevented the printing of source conversation transcripts.