Apple warns about "mercenary spyware" while prices for vulnerabilities skyrocket.
AI and disinformation. No place to hide in an online world. And the hapless hacker who met his match in Ohio.
Spyware; warnings and bounties
Apple has been sending warnings to users in 92 countries that they may have been targeted in “mercenary spyware” attacks. In a notification email published by Bleeping Computer, Apple tells the recipient that an attempt is being made to remotely compromise their iPhone because of who they are or what they do. Apple has changed the wording of the warning by dropping a reference to “state-sponsored” attacks. Reuters reports that Apple made the change “after it repeatedly faced pressure from the Indian government on linking such breaches to state actors.”
Apple provides advice to the targets of spyware attacks, including making sure devices are kept up to date and ensuring Apple IDs are protected with strong passwords and two-factor authentication. Those at high risk should also consider enabling Lockdown Mode which reduces the chances of being infected with spyware but also severely limits the phone’s usability. Apple also recommends the digital helpline operated by Access Now which offers emergency assistance to civil society groups and activists, media organisations, journalists and bloggers, and human rights defenders. Access Now also has useful digital safety resources.
In order to infect devices, ‘mercenary spyware’ depends on unpublicised (and therefore) unpatched ‘zero-day’ vulnerabilities. It appears the prices for these issues are skyrocketing with one company offering up to $7 million dollars for ways to compromise an iPhone; that’s more than double the previous figure. Analysts told TechCrunch the increases are because it’s getting harder to exploit vulnerabilities and the amounts offered privately are likely to be even higher.
Threats
Sisense: The US cybersecurity agency has told customers of the leading business analytics company to reset any credentials associated with the service. The warning has caused concern because, in order to gather the data it analyses, Sisense has access to its customers’ infrastructure. That means by breaching Sisense, its customers could also be compromised.
Online ads: Spyware manufacturer Intellexa has been selling a product capable of infecting both Android and iOS devices using online adverts, according to Israeli newspaper Haaretz. Another reason to use an ad blocker.
AI: Hijacked Facebook pages are being used to distribute fake AI services that are designed to steal data. Midjourney, Sora AI, DALL-E 3, Evoto and ChatGPT 5 are among the lures. Bitdefender
LinkedIn: Attackers are leveraging compromised profiles to lure targets into clicking a “secure” OneDrive link. This leads to a “Sales Proposal” Word document with another link that leads eventually to a page designed to harvest user Microsoft 365 credentials. Perception Point
Graphics: A phishing campaign is using Scalable Vector Graphics (SVG) files to execute malicious JavaScript code. The campaign begins with an email masquerading as a notification for a new voice message. Binary Defense
Phone diverts: As you probably know, entering specific strings of numbers can make your smartphone do all sorts of things…including diverting and forwarding calls. 404 Media has details of a scam that exploits this by sending a link which if clicked can allow attackers to intercept calls and some two-factor authentication codes.
AI
Disinformation: There’s more evidence of the increasing adoption of AI tools to drive the distribution of misleading information. Microsoft says China is stepping up its use of AI-generated content as part of its geopolitical strategy, including meddling in the US presidential election. Meanwhile, Bloomberg has obtained documents showing how the US has failed to combat Russian disinformation campaigns focussed on Ukraine.
Nudes: In an effort to prevent sextortion, Meta says Instagram will begin using machine learning to blur nude images in direct messages. This will take place on devices rather than in the cloud and will be turned on by default for any user under 18.
Influencers: 404 Media reports on the extraordinary (and extraordinarily lucrative) world of Instagram influencers. While many of these profiles belong to real people, others are generated by AI. To make the fake ones look more realistic, their (human) creators steal pictures of real people’s bodies and superimpose the artificial faces of their AI-generated money makers.
Training: AI platforms like ChatGPT only work because of the data used to train them. The New York Times says “OpenAI, Google and Meta ignored corporate policies, altered their own rules and discussed skirting copyright law as they sought online information to train their newest artificial intelligence systems.” Israeli tech news site CTech also examines the issue and the “hidden trade in everything from long forgotten personal photos from faded social media apps to images from freelance photographers in Gaza.”
Crowdsourced
We don’t usually include tabloid stories but the tale of a runaway chef and his ‘ghosted’ wife proves that there’s no place to hide in a hyper-connected world. In a post on Facebook’s ‘Are We Dating The Same Guy?’ group, Ashley McGuire appealed for help in finding her errant husband. In less than a day, he was tracked down (to Texas, where he’s apparently working for a famous TV producer) and publicly shamed (for alleged fraud during the collapse of a restaurant). There are plenty of examples like this, driven by an army of internet sleuths who have amassed hundreds of thousands of followers. This week, even the highly secretive head of Israel’s cyber warfare unit was identified through a book he wrote under a pen name. Beginning with an electronic version on Amazon, The Guardian followed “a digital trail to a private Google account created in his name.”
In brief
Footprint: Malwarebytes has launched a Digital Footprint Portal which aims to provide an overview of information about an individual that is available online. The website is similar to other services but does include passwords in plain text, as well advice about how to improve security.
Incident response: The US National Institute of Standards and Technology has published recommendations for responding to cybersecurity incidents. The update is designed to accompany the latest version of the Institute’s Cybersecurity Framework.
Fail: Another security failure at Microsoft. This time, it managed to leave a server unsecured. On it were passwords, keys, and source code that could have been used to access other internal systems. After being told about the issue, Microsoft then took a month to fix it. TechCrunch
Small business: In a survey by the US Chamber of Commerce, 60% of small businesses were concerned about cybersecurity threats but only 48% of respondents said they had provided cybersecurity training in the last year.
Transparency: From this week, home Internet and mobile broadband providers in the US must display consumer labels with information on prices, speeds, and data allowances. An excellent idea that should be adopted elsewhere.
Costs: The IMF says that in the past 20 years organisations in the financial sector have lost more than $12 billion as a result of cyber attacks. “The risk of extreme losses from cyber incidents is increasing,” it warns.
Defeated: Best story of the week comes from TechCrunch which reports on a ransomware attacker who tried to extort an Ohio company by phoning them up. After eventually being put through to Beth in HR, a conversation ensued in which an increasingly frustrated hacker was lectured on Ohio’s privacy laws and told politely but firmly that negotiations were out of the question. Beth then ended the call by wishing the attacker a good day.
Updates
Patch Tuesday: April’s raft of security updates saw Microsoft setting a new record for the number of vulnerabilities it is trying to fix. Among the 150 issues are two ‘zero-day’ (i.e. previously unknown) vulnerabilities that are being actively exploited. There were also updates from Adobe, SAP, Zoom and Fortinet.
LG TVs: Updates to address four vulnerabilities that could be used to hijack some LG smart TVs. Bitdefender says it found more than 91,000 devices connected to the internet which needed to be updated. Whatever the brand, it’s a good idea to make sure its software is up to date.
Discontinued: Both Cisco and D-Link have warned about the risks of continuing to use devices after support for them ends. Cisco’s RV series of small business routers and older D-Link network attached storage drives are at serious risk, they say.
Find My Device: Google has launched a service designed to track Android devices. Using crowdsourced data, it can also find Bluetooth tracker tags. The service is initially available in the US and Canada.
Workspace: Google is improving the security of its enterprise platform by requiring approval from multiple administrators in order for changes to be made to an organisation’s sensitive settings.
Apple Watch: Some users have been reporting a recurring problem in which the device responds as if it’s being touched when it’s not. Apple recommends a forced restart to fix the issue.
Repairs: Apple says it’s relaxing its policy on what parts can be used to repair some of its iPhones. Later this year, customers and independent shops will be allowed to take advantage of genuine used parts, providing they pass a check to make sure they haven’t been stolen. The announcement comes two weeks after a bill outlawing Apple’s previous restrictionsbecame law in Oregon.