More US moves against spyware vendors. Poisoning Reddit. A passkey primer.
The problem with cybersecurity tools. And trying in vain to get Telegram to remove stuff that really shouldn't be there.
Spyware sanctions
The US is renewing its war on spyware manufacturers with the announcement of visa bans on 13 individuals and their families. The State Department didn’t release their names but those affected are likely to be connected to companies previously sanctioned by Washington. “These individuals have facilitated or derived financial benefit from the misuse of this technology, which has targeted journalists, academics, human rights defenders, dissidents and other perceived critics, and US Government personnel,” the State Department said.
Spyware vendors repeatedly claim they only sell their products to support national security and criminal investigations. As the US announcement underlines, that’s complete nonsense. If more evidence of this were needed, in Poland it has emerged that female soldiers who reported sexual harassment by their superiors were promptly placed under surveillance with Pegasus spyware. According to the country’s prosecutor general, they were among 578 people against whom Pegasus was used between 2017 and 2022. Such tools provide complete access to devices on which they’re installed, giving the spyware operator as much control as the actual user.
Threats
Android: Newly discovered malware is designed to target banking apps and is delivered through a fake Google Chrome page which offers to update the browser. Defending against such threats is relatively easy; avoid downloading apps or updates from outside the Play Store and make sure Play Protect is enabled. ThreatFabric
Nespresso: Beware of a Nespresso domain that is being misused to redirect visitors to a site designed to steal Microsoft credentials. Frustratingly, this sort of attack is only possible because of basic security failures by the owner of the domain though, frankly, you’d have to be half asleep to fall for this one. Perception Point
Search: A similar technique involves malicious adverts that appear high in Google search results. This type of scam is known as malvertising and there’s a good explanation on TikTok of how it works. As it says, “don’t trust promoted links on Google.”
Keyboard: Citizen Lab is urging users of cloud-based Chinese Pinyin keyboard apps to install the latest updates after finding multiple vulnerabilities that could reveal what they are typing.
eScan: Distributing updates over an insecure network connection is a really bad idea, as demonstrated by the Indian antivirus manufacturer. Avast says an attacker - likely from North Korea - was able to hijack the process to deliver malicious software.
Tickets: Ticket scams are the latest money spinner for fraudsters. Lloyds Bank estimates they’ve cost Taylor Swift fans £1 million ahead of the UK leg of her Eras tour. With restaurant reservations the new hot ticket, we confidently predict they will be the next target.
AI
Reddit: As the quality of Google searches has declined, it’s become increasingly common to use Reddit to try to improve them (by adding ‘Reddit’ to the search term). As 404 Media ($) reports, this has resulted in the emergence of services that “poison Reddit threads with AI-generated posts designed to promote products.”
Nude: Also from 404 Media, a report on how Instagram is earning money from adverts inviting users to create nonconsensual nude images with AI image generation (aka ‘nudity’) apps.
Toxicity: Microsoft released a new open-source AI model this week, only to remove it within hours after realising “toxicity testing” hadn’t taken place. Despite the removal, copies are reported to be circulating - courtesy of users who downloaded the model before it was withdrawn. Teiss
Profits: Mark Zuckerberg says tens of millions of people have tried out the Meta AI assistant since its launch last week, but he expects it to take years to turn a profit. Meta AI is now integrated in the search boxes of Instagram, Facebook, WhatsApp, and Messenger, and there’s also a standalone site. Initial reviews are favourable.
Voices: Advances in voice-cloning technology have resulted in 91% of US banks reconsidering their use of voice verification for major customers. BioCatch
Overwhelmed: The US CyberTipline needs more funding in the face of a flood of AI-generated Child Sexual Abuse Material (CSAM), according to the Stanford Internet Observatory
Passkeys
WhatsApp is rolling out support for passkeys to iPhone users, so we thought it was time for a brief reminder about what they are and how they work. Simply put, passkeys do away with traditional passwords by enabling users to log into services by using facial recognition or biometrics on a registered device. They’re far more secure than passwords and, where available, it’s worth using them. Services like password managers and iCloud keychain allow passkeys to be synchronised across accounts. And there are ways to recover passkeys even if you were to lose all your devices. Apple has a guide here. You can turn on passkeys in WhatsApp by going to Settings | Account (they’re being rolled out gradually, so you may not see the option immediately).
In brief
Missed signals: For small and medium-sized businesses, cybersecurity tools can cause as many problems as they solve, according to a survey by Coro. Respondents said they spent an average of nearly five hours managing such systems. 73% of them said they missed, ignored or failed to act on critical security alerts; they gave lack of staff and time as the top two reasons.
Driving record: A New York Times reporter explains how General Motors “tricked millions of drivers into being spied on (including her).” The result was that data brokers - and the insurance industry - were receiving detailed data about driving behaviour, leading in some cases to higher insurance premiums.
Grindr: UK users are suing the dating site for allegedly sharing highly sensitive information - including their HIV status - with advertising companies without their consent. In 2021, Grindr was fined for similar behaviour.
Apple China: Apple has removed WhatsApp, Telegram, Signal, and Threads from its App Store in China at the request of the Chinese government. WSJ
China cyber force: Beijing has recreated a dedicated digital warfare division, nine years after disbanding it. The size of the new Information Security Support Force is unknown but before the previous reorganisation it was estimated to have at least 78,500 personnel - or more than the entire regular British army.
Russia VPNs: The Russian communications regulator has confirmed a crackdown on popular VPN services, with about 150 now blocked. TASS
Conflict materials: The Democratic Republic of Congo has told Apple to demonstrate that its supply chain doesn’t involve materials linked to militia groups. Bloomberg ($)
Banga: For those lucky to be unfamiliar with the term, Banga lists are files containing personal details, images, and videos of female students. They’re being distributed on Telegram and Dutch officials have been trying to get the platform to remove them. So far, the response from Telegram has been silence. NOS
Updates
Microsoft: Emergency fixes to address issues affecting Exchange servers following installation of the March 2024 security update. Among the problems were failed downloads when using the Outlook Web Access (OWA) client. Meanwhile, the latest update for Windows 11 shows how Microsoft plans to implement its promise to decorate the Start menu with adverts. At the moment, it’s still a trial version so it can be turned off - a capability that won’t exist in the final release.
Apple: A new version of XProtect anti-malware includes 74 rules that take specific aim at the Adload adware virus. Adload is an infuriating tool that hijacks browsers and forces them to visit malicious sites. The number of rules has led to speculation that Apple has been using AI to help write them.
Firefox: Mozilla has disabled a security feature that was designed to block downloads from potentiation untrustworthy sources. It turned out the feature was blocking some downloads.
Google: An update for Google Meet allows calls to be transferred between devices “without hanging up and rejoining.”
Cisco: Critical security updates to address multiple vulnerabilities in Adaptive Security Appliance (ASA) devices and Firepower Threat Defense (FTD) software. The update comes shortly after Cisco revealed a previously unknown nation-state succeeded in compromising its firewalls as early as November 2023.
Asus: Security update for a significant number of routers and access points.
CrushFTP: Update to fix previously unknown (‘zero-day’) vulnerability in the enterprise file transfer platform. At the time of writing, there were some 1,400 unpatched servers, according to the Shadowserver threat monitoring platform
Tails: Version 6.2 updates Tor browser and client, as well as fixing a number of problems affecting WiFi and storage.