The risks of impersonation fraud writ large. Malicious VPN apps. Free advice.
And Microsoft slammed for incompetent security.
Impersonation
One of the largest TV production companies lost $1 million in a sophisticated impersonation fraud, according to Corriere Della Serra. The newspaper says criminals convinced the CEO of Fremantle Southern Europe to transfer the funds in order to buy a company in Asia. The scam began with a message that appeared to come from his direct superior and asked him to make the transfer in order to complete the acqusition. This was followed swiftly by an email confirming the request which appeared to come from a lawyer he recognised. Shortly after authorising the transfer, the CEO realised he might have been the victim of a scam and contacted the police.
It’s tempting to think we might not fall for such tricks but long experience with clients proves that these scams work again and again, though they don’t often involve the sort of sum Fremantle lost. Employees - even senior ones - are primed to get things done, especially when it involves an order from their boss. In Fremantle’s case, the fraudsters had done their homework because it has been in the process of acquiring companies in Asia. They had also researched the CEO’s colleagues, probably by simply looking at LinkedIn.
Impersonation scams are hugely profitable. This week, the US Federal Trade Commission said they resulted in more than $1 billion in losses last year. It’s essential to have cast-iron processes in place to prevent them. Transfers should never be made without concrete confirmation - and the more urgent a request the more care should be taken. This also applies in private life when a large transaction is taking place. It didn’t take long for Fremantle’s executive to suspect he’d been conned but once funds are transferred, the fraudsters move the money to new accounts and so the likelihood of retrieving any is virtually nil.
Threats
VPN: There’s a rash of free VPN apps for Android phones that hijack the devices so they can be used to forward criminal data traffic - and shield the scumbags behind it. Our standing advice remains to avoid free VPN apps because, even if they’re genuine, they will be making money out of what users are doing. Satori Threat Intelligence
Ransomware: It’s essential to secure data backups because attackers will do their utmost to access them. A study for Sophos found that in 57% of ransomware incidents, backups were compromised along with the original data.
Simples: Sophos also says too many organisations continue to fail to do the basics. In its survey, 32% of ransomware attacks began with an unpatched vulnerability and in 43% of investigations multi-factor authentication had not been enabled. Windows Remote Desktop Protocol (RDP) remains a firm favourite among attackers, appearing as a factor in 90% of cases.
Thread hijacking: Exploiting natural human curiosity is a common tactic used by attackers. One way of doing so is compromising an email account and hijacking an existing thread to include a message with a malicious link or attachment. Brian Krebs has details of one example at a US newspaper.
Poisoning: Attackers understand how to manipulate the algorithms behind Search Engine Optimisation (SEO). The result is that malicious websites can appear high in the list of search results. ReliaQuest says it saw a significant increase in use of this tactic last year, probably in part due to new kits that simplify the process.
McAfee: Fraudsters are using text messages and phone calls to lure targets into installing a malicious version of McAfee’s Android security app. The scam begins with an SMS message warning about a fictitious large transaction and an instruction to call a number if it wasn’t authorised. Fox-IT
AI
Mimic: OpenAi has been showing off its voice cloning tool while deciding to delay making it generally available because of fears it could be misused. Voice Engine can create a copy of a voice from a 15 second sample and, while the capability isn’t unique, the examples are undeniably impressive. Meanwhile, Google has published research demonstrating that a photograph of a person can be used to create high-resolution video of them talking.
Elections: Among the reasons for delay, OpenAI cites the number of elections taking place this year. Its announcement coincided with a warning from Microsoft that deepfakes would undoubtedly be used during the electoral process. But disinformation need not be sophisticated. According to Microsoft, the most popular technique used by Russia in recent months is to post a fake picture and stick a real news organisation’s logo on it. The Register
Free…ish: Using ChatGPT no longer requires an account - though doing so means some features won’t be available. And it’s worth remembering to opt out of chats being used to train the model.
Video: OpenAI has been demonstrating its Sora video generation tool to Hollywood studios. Our view is that film and TV will inevitably use this technology in the future, though current examples suggest further development is required. Judging from this psychedelic result, music videos might be an early adopter.
Plain: The capabilities of current AI tools are remarkable but there are interesting quirks. One is the difficulty generative AI services have in creating a plain white background. As Bleeping Computer reports, in the case of DALL-E the request caused it to give up and freeze.
Free advice
The US cybersecurity agency (CISA) has released comprehensive guidance aimed at activists, journalists and similar groups who may be targeted by sophisticated attackers. “Many of these communities operate on lean budgets and cannot significantly invest in cybersecurity. As a result, they are a uniquely attractive target for cyber threat actors that leverage cyber intrusions to undermine the fundamental values and interests common to free societies,” CISA says. Its site brings together free tools as well as guides that provide simple ways of improving cybersecurity. There’s a wealth of valuable content available online and CISA’s site does an excellent job of pulling it together in one place.
In brief
Cascade effect: A “cascade of…avoidable errors” was responsible for last year’s breach of Microsoft’s Exchange Online email service, according to a US government review. Its excoriating conclusion is that the intrusion was preventable and should never have happened. The breach allowed China-linked attackers to access government and private sector accounts in the US, UK and elsewhere.
Strategy: Only a third of media and entertainment companies have a formal cybersecurity strategy spanning the entire business, according to research by Mimecast.
Incognito: In order to settle a class-action lawsuit, Google says it will delete billions of data records gathered during what users thought were private browsing sessions. A reminder that private or incognito browsing might stop a computer or phone recording what you’ve been doing but it doesn’t mean that it’s truly private. Ars Technica
AT&T: The US phone giant has admitted that a vast dump of user details is real but says the 73 million records are old. So all good then.
Trackers: Police in the US have begun using darts to attach GPS trackers to fleeing vehicles. The Drive
Outlook: ProtonMail is accusing Microsoft of turning its new Outlook app into a “surveillance tool for targeted advertising.” While ProtonMail is hardly a disinterested party, Microsoft’s so-called privacy policy makes clear the extent to which user data is shared with advertising partners. Opting out is possible but involves a laborious process.
Mobiles: The US appears to be inching towards doing something about long-standing vulnerabilities in the infrastructure underpinning mobile phone networks. The issues with the SS7 and Diameter protocols are well-known and can be used to track phones and redirect calls and messages. The FCC is asking the industry for feedback on how to address the problem.