Russia's reckless cyber attacks. Romance scammers adopt face swaps.
The wave of "pink slime" propaganda. And the annual cost of cybercrime estimated to reach $9.2 trillion this year.
Water borne
A group with links to Russian military intelligence says it was responsible for attacks against US and European water utilities. In posts on Telegram, the group published videos that showed it disrupting controls at facilities in the US, Poland and France. Google’s Mandiant security team says it hasn’t been able to verify the claims but it notes that the affected US utilities later publicly acknowledged incidents had taken place. In one case, the intrusion led to a water tank overflowing.
Mandiant says the group “continues to present one of the widest and highest severity cyber threats globally…and is responsible for a long list of firsts that have set precedents for future cyber attack activity.” It adds that “patterns of historical activity, such as efforts to influence elections or retaliate against international sporting bodies, suggests there is no limit to the nationalist impulses that may fuel the group’s operations in the future.” John Hulquist, who leads Mandiant’s threat intelligence efforts, told Wired that the group seems “more reckless” than any Russian operator seen targeting the US. This is a horribly slippery slope.
Threats
Deepfakes: Romance scammers have started using face-swaps to make their attacks more convincing. Wired saw the scumbags at work and describes a setup that involved two phones, one of them used to call the target, the other running a face-swapping app. By pointing the first phone at the output of the second, the fraudsters were able to create new personalities at will. As Wired reports, the technology used to be glitchy and flawed but is now much more reliable. And it will soon be good enough to create copies of real people in real time - which is already happening with audio. This week saw someone sending multiple WhatsApp messages which purported to come from the CEO of security company, Recorded Future.
LastPass: Persistent attackers have been sending emails, text messages and have been phoning LastPass customers in an effort to persuade them to divulge the master passwords for their accounts. It’s a clever - and extremely convincing - scam that used a fake copy of LastPass’s website that pretended to be part of a process to reset compromised credentials. LastPass
Images: Criminals are hiding malicious code in images to exploit a seven-year old vulnerability in Microsoft Office. Despite its age, there are plenty of old versions still being used - many of them in Latin America. Old software = big risk. Positive Technologies
VPNs: A widespread campaign is targeting VPN devices from multiple companies, including Cisco, Fortinet, Check Point, SonicWall, Mikrotik, Draytek, and Ubiquiti. Cisco Talos says the attackers are using generic credentials as well as usernames valid for specific organisations.
Tolls: The FBI is warning about a wave of phishing messages about unpaid road tolls. At the moment, the campaign appears to be focused on three US states. We don’t doubt fraudsters elsewhere will soon follow suit.
AI
Disinformation: The US says Russia, China, and Iran are deploying propaganda campaigns backed by generative AI in an effort to erode public confidence in elections and exacerbate partisan tensions among voters. In particular, it points to the use of local news sites set up to channel Russian disinformation (see also “pink slime” below).
Simple: The Wall Street Journal describes how a reporter “built an AI-powered, self-running propaganda machine for $105.” Some reports suggest there are now roughly as many malign so-called “pink-slime” sites as there are genuine journalism ones in the US. These sites copy the look of local news outlets but the content is highly partisan and funding often comes from obscure sources or extreme lobbying groups.
Guidance: The ‘Five Eyes’ security alliance has published recommendations on the safe deployment of AI systems. One of the most basic is ensuring users, administrators, and developers understand and apply security best practices.
Work: Leading Wall Street banks are testing generative AI services (e.g. ChatGPT) to see whether they can replace the work of analysts. Such solutions could “essentially nullify the need to hire thousands of new college graduates,” according to reporting by The New York Times. Meanwhile in the UK, the Society of Authors says 4 in 10 translators have lost work to AI services.
Marked: Snap says it will start adding watermarks to AI-generated content that is saved or exported.
Stop! Thief!: PaintCam combines facial recognition, tear gas and a paintball gun to create a thoroughly 21st century security solution. In what appears to be a genuine crowdfunding project, buyers are promised “ultimate peace of mind.” At the time of writing, the project has 1,477 followers.
In brief
Vast: The annual cost of cyberattacks will reach $9.2 trillion this year, according to estimates by Statista Market Insights. Just for context, US GDP last year was $27.3 trillion…
Takedown: One group that won’t be contributing to the cost of cybercrime is LabHost which has been disrupted in a multinational law enforcement operation. For monthly fees from $179, the platform provided a service that enabled pretty much anyone to set themselves up as a cyber crook. Europe says it had more than 10,000 registered users; many of whom have now been hearing from police.
Scraped: Spy Pet is a service that harvests data from users of the Discord social platform, puts it in a searchable database and sells it for as little as $5. It markets itself to law enforcement, AI platforms and anyone who’s curious about “what their friends are up to.” 404 Media (R)
IoT: In a rare example of common sense, the UK is introducing new regulations aimed at addressing the lamentable security ofconsumer smart devicesconnected to the internet (aka the ‘Internet of Things’). The law aims to help people choose safe devices. Among its measures, it bans default passwords and requires manufacturers to provide a contact point for reporting security issues. Whether and how this will be enforced is another matter.
Russia: Following the Crocus City Hall terror attack, Russia is preparing regulations to require foreigners to register their biometrics in order to buy SIM cards. Vedemosti
SIMs: Criminals are offering $300 to employees of US cellphone networks who are willing to perform SIM swaps. These involve taking over a mobile phone number so that it can be used on the attacker’s device. Bleeping Computer
Privacy: The EU has rejected a cunning proposal from Meta to circumvent data privacy plans by offering users the option of paying (up to €12.99 per month) to protect their privacy. Regulators said the alternative - allowing Meta to use their data for targeted advertising - didn’t amount to much of a choice and didn’t comply with the EU’s General Data Protection Regulation.
MGM: The casino and resort giant is suing the US Federal Trade Commission in a bid to stop an investigation into a calamitous security breach. The FTC is asking for too much data apparently. Bloomberg
Updates
Apple: Users of macOS Ventura have been reporting problems after installing the latest update (13.6.6). Ventura is the predecessor to the latest macOS version (Sonoma) and is the only one supported by many older Macs. The reported issues range from WiFi connectivity to display problems and a noticeable lag in responsiveness. No comment so far from Apple. TechRadar
Firefox: Mozilla has released Firefox 125 with security fixes and new features, including support for the AV1 video codec.
Oracle: Even by its exacting standards, this month brings a vast number of updates across Oracle’s products; 441 to be precise.
Telegram: Update to addrees a previously unknown (‘zero-day’) vulnerability in the Windows desktop application that could be used to bypass security warnings. Bleeping Computer
Ivanti: Update for Avalanche mobile device management (MDM) with fixes for 27 vulnerabilities, including two rated critical.
Palo Alto Networks: PAN-OS firewalls appear to be vulnerable to attacks despite suggested ways to mitigating a critical vulnerability. Help New Security