How to guard against cyber attacks by China...or anyone else.
Defeating multi-factor authentication. Deepfakes and stolen identities. Tracking Jeffrey Epstein's visitors through advertising data. And another rescue thanks to Apple's emergency satellite feature.
Nation states
Western nations have been stepping up their attacks on China for what they describe as increasingly aggressive cyber operations. in New York, federal prosecutors alleged that a group of seven Chinese nationals took part in a wide-ranging operation aimed at accessing personal devices belonging to government officials, commercial organisations and dissidents based in the US. The group is also accused of targeting email accounts belonging to EU and UK parliamentarians perceived as being hostile to Beijing. In coordinated announcements, the EU, UK, Australia and New Zealand all provided details of Chinese cyber attacks.
None of this is particularly surprising, but it is worth noting that the US indictment highlights attacks that targeted not only high-ranking government officials but also their spouses. As we emphasise in our awareness work, when considering a threat it’s essential to include family and friends in the assessment. Following this week’s announcements, the UK’s cybersecurity agency, the NCSC, urged organisations and individuals to follow its advice to bolster their safety.
While designed for individuals at high risk, much of the NCSC’s guidance applies to everyone. It includes simple measures including installing updates, replacing old devices, and protecting accounts with strong passwords and multi-factor authentication. As the NCSC points out, it’s essential to improve the security of personal accounts and devices which attackers may consider to be an easy target.
Threats
MFA: Analysis of a service to defeat multi-factor authentication demonstrates the sophistication of tools that have been developed for cyber criminals. Tycoon2FA has been offered through private Telegram channels and works by stealing ‘session cookies’ (which are small files used to make authentication easier). Passkeys are an excellent defence against this type of attack and they’re becoming increasingly widely used. Google’s guide to them is here.
Apple: On the same theme, veteran security reporter Brian Krebs has a valuable article examining an elaborate campaign designed to hijack Apple accounts. It involves repeated (i.e. hundreds of) Reset Password prompts that stop a device being used until there’s a response. The attackers’ aim appears to be to trigger an Apple ID reset code which they try to persuade the user to divulge (by phoning them up). As Krebs explains, defence is possible but far from straightforward. One thing worth remembering is that Apple will never call you unless you’ve asked them to.
Chips: We’ve had some questions about reports of a vulnerability in Apple’s M-series processors. The issue is that researchers have come up with a way to extract secret keys from the chips. The problem is real but it’s not yet clear how much of a threat it presents. What is clear is that there’s nothing a user can do about it at the moment. The Register
Asus: A reminder that when support ends for a device, the only thing to do is dispose of it (securely). Black Lotus Labs says it saw more than 6,000 end-of-life Asus routers being targeted with malware in less than 72 hours this month. Bleeping Computer
Gaming: TechCrunch reports that Activision is investigating a campaign aimed at stealing gamers’ credentials. Details are unclear but the company says it may be connected to downloading or using unauthorised software.
Mail: The UK’s Royal Mail has warned about an increase in scams involving fake missed deliveries. Fraudsters are using text messages, emails, and physical cards with QR codes that lead to phishing sites.
AI
Fakes: Like most cybersecurity companies, we now highlight the threat from deepfakes. It’s so simple to create realistic audio and video replicas of real people that it would be hard to overstate the risk they represent. As security researcher Rachel Tobac says, this is the most common request when clients ask her to test their defences.
Stolen: The same technology is also being used to exploit online videos to create fake personas. Business Insider reports on a US university student who found herself being used to promote pro-Russian propaganda in China. Video was taken from her YouTube channel and manipulated to speak fluent Mandarin. It appears this type of activity is increasingly common.
UN: The General Assembly has unanimously adopted a resolution that aims to establish international standards for the development of AI. The resolution excludes military use and has no enforcement mechanism.
Search: Google is reported to be expanding use of its AI-powered ‘Search Generative Experience’ which means you may see it even if you haven’t asked to. The tool provides AI-generated responses to search queries - although you can scroll past it to see traditional results as well. Researchers have found the AI’s performance to be…questionable.
Reach: 43% of adults in the US under 30 have used ChatGPT, according to a survey by Pew Research Center. It also found that the figure for all adults has risen to 23% from 18% last July.
In brief
Location: An investigation by Wired reveals the extraordinary precision with which users can be tracked by data brokers. In this case those tracked were visitors to the island owned by the convicted - and now deceased - sex offender, Jeffrey Epstein. As Wired explains, the location information was obtained through the data transmitted by devices as part of the online advertising industry.
Apple Journal: Social media posts have suggested that Apple’s diary app is sharing users’ names and locations with everyone around them. This isn’t actually the case, though by default the app does use Bluetooth to detect whether anyone in your contacts is nearby. It uses this information to make suggestions about what you might want to record in your journal. 9to5Mac
Fined: Poland has imposed an $8 million fine on Amazon for misleading consumers. As well as using deceptive design elements (otherwise known as ‘dark patterns’), the country’s competition watchdog found Amazon was presenting false information about product availability. TechCrunch
Violations: Google says the number of advertisers it blocked or removed due to policy violations nearly doubled compared to the previous year. The numbers are vast; 12.7 million advertiser accounts blocked and 5.5 billion adverts removed. Search Engine Land
Meta: Newly unsealed court documents reveal more details about a Facebook project to spy on its competitors by analysing how its users were interacting with them. The documents were released by a court in California as part of a class action lawsuit against Facebook’s parent. It accuses Mark Zuckerberg of personally requesting the the project.
Unsupported: There are some 17,000 Microsoft Exchange servers in Germany that are unsupported or out of date, according to the federal information security office. “Cybersecurity must finally be high on the agenda. There is an urgent need for action,” it said.
Rescue: Another success for Apple’s Emergency SOS via satellite feature. This time, it resulted in the rescue of a family stranded in Oregon’s Mount Hood National Forest.
Updates
Apple: Apple has released an update to fix recent problems with the latest version of its operating system for Mac devices. Sonoma 14.4.1 aims to address issues with USB hubs, Java, and music app connectivity. There’s also an update for Ventura (13.6.6.) and the Safari browser.
Browsers: Urgent updates for Firefox and Chrome following the publication of vulnerabilities at the Pwn2Own hacking contest.
Windows Server: Microsoft has issued an emergency (’out-of-band”) update to fix an issue that has been causing Windows domain controllers to crash after the installation of March 2024 security updates.
Cisco: Updates for multiple IOS and IOS XE software vulnerabilities.
Tails: Version 6.1 of the security-focussed operating system updates the Tor Browser and Thunderbird email client, and fixes a number of irritating problems.