Undermining democracy with disinformation. Scumbags target online daters.
The extraordinary capabilities of voice cloning. Human error and data breaches. And the Finnish fraudster who targeted patients at a psychotherapy clinic.
Elections
The EU is seriously worried about the impact of Russian disinformation on this year’s parliamentary elections in the Union - and it thinks Meta is failing to do enough to combat it. The European Commission is now investigating the issue, saying Meta may have violated rules on deceptive advertising, content, and election monitoring. It’s particularly concerned that Meta shut down a tool that enabled real-time monitoring of election-related content without creating a suitable replacement. Meta says it has “a well established process for identifying and mitigating risks” on its platforms. It will be hoping it can persuade the EU that’s the case. If not, it faces fines of up to 6% of global revenue.
It may be a difficult case to make since there’s ample research to show the extent to which Meta’s platforms are being exploited to disseminate Russian disinformation. One study, from non-profit research organisation AI Forensics and cited by the EU, lists systemic failures to moderate political adverts. It says less than 5% of undeclared political ads are caught by Meta’s moderation system and 60% of adverts that are moderated don’t adhere to its own guidelines concerning political advertising. It points to one pro-Russian propaganda campaign that reached over 38 million users in France and Germany, with only a fifth of its adverts flagged as political in nature.
On a broader scale, French security firm Sekoia has a 30-page report looking at disinformation campaigns in the context of the elections taking place around the world this year. It doesn’t make for comfortable reading. Sekoia believes the key targets will be the US presidential election, European Parliament election, Moldovan presidential election (with a referendum on joining the EU), and Indian parliamentary election. While in the past, “hack and leak” operations were the key issue, Sekoia concludes that “information and cyber influence campaigns” now constitute the more likely threat to the electoral process…and to democracy.
Threats
Dating: As if online dating wasn’t fraught enough already, scumbags have started exploiting it by trying to persuade people to download fake ‘verification’ apps. As with most of these scams, the tell is a request to move a conversation off the original app. The FBI says the fraudsters’ aim is to get victims to take out a (recurring) subscription to the app…and steal their personal and financial information.
Mimics: Phishing emails contain malicious attachments (often PDF files) that have to be downloaded to be viewed. They appear to be hosted by Microsoft Azure or Cloudflare in an effort to make them look more genuine. Bleeping Computer
Email: The US is urging organisations to secure email servers with correct DMARC policies to prevent abuse by North Korean hackers. Misconfigured policies have been exploited to spoof genuine domains as part of social engineering operations.
Credentials: Okta is warning about an upsurge in ‘credential stuffing’ attacks which take advantage of usernames and passwords that have been exposed in previous incidents. At the risk of repeating ourselves, it really is crucial not to reuse passwords.
Tactics: “The Com” (short for The Community) is a notorious group with a high success rate. It’s worth knowing its tactics - which remain pretty constant. It likes targeted text messages which try to get the recipient to click on a link. It impersonates Okta’s authentication platform. And it makes calls that appear to come from IT staff. Intel471
Android: Malicious software is disguising itself as popular social media and messaging apps, including Instagram and WhatsApp. SonicWall
Graduates: As students graduate and look for jobs, The Wall Street Journal reports on the fraudsters targeting them with sophisticated employment scams. The technique involves personalised emails that may mention academic staff known to the student who appear to encourage them to apply for a vacancy.
AI
Voices: Voice-cloning technologies are now so good they can mimic tone and emotion. Take OpenVoice for example which “enables granular control over voice styles, such as emotion and accent, as well as other style parameters including rhythm, pauses, and intonation.” It’s multi-lingual and free, even for commercial use.
Greedy: Meta’s AI-powered advertising tools are supposed to make life easier for businesses. In reality, The Verge reports they’ve resulted in skyrocketing costs and crap results. Meta hasn’t admitted there’s a problem, though it told The Verge it had fixed some “technical issues” with its ad platforms in general.
Sentient documents: This is a new term for us, though perhaps it’s not for you. As Computer Weekly explains, it describes documents and digital content with “levels of interactive responsiveness and competence that will make them appear super-intelligent.” In practical terms, this might mean documents that appear automatically in the recipient’s native language, or legal contracts that allow the reader to query them about their content.
Robots: Amazon is again illuminating what the future of work will look like. Its robotic workforce has risen to 750,000 from 200,000 in 2019. And while it still employs 1.5 million people, that’s 100,000 less than in 2021. Benzinga
Politics: Stanford University researchers have shown that AI can predict someone’s political orientation from a scan of their face. Apparently, conservatives tend to have bigger faces and liberals smaller ones.
Breach report
Human error was responsible for 68% of digital security breaches last year, according Verizon’s annual report. The findings are based on analysis of more than 30,000 security incidents and the report is considered to be one of the most cybersecurity authoritative surveys available. Verizon says the median time for users to fall for phishing emails, including opening a message and entering data on a malicious site, is less than 60 seconds. AI is enabling phishing messages to be extraordinarily convincing, so it’s essential to be cautious with any communication asking for information. Verizon also found that it took organisations up to 55 days to address 50% of critical vulnerabilities after patches became available. It urged defenders to respond faster, saying the number of incidents and confirmed breaches had doubled compared to the previous year.
Buckets
AWS Simple Storage Service (aka S3) is a highly flexible cloud platform but it comes with risks, as a software engineer in Poland discovered. S3 storage instances are called buckets and he was using one to test a product. To do this, he left it open which meant anyone could make PUT requests to add data to it. After two days, this resulted in a $1,300 bill because an open source backup tool inadvertently pointed to his bucket. The Register has more details, but the lesson is to be aware of how S3 works and the inherent risks.
In brief
WhatsApp: Some good news from Spain where police arrested more than 100 people on charges of stealing €850,000 by using WhatsApp to call people and pretend a family member needed urgent (financial) help. Police say the sums involved ranged from €800 to €55,000.
Hopeless: Ransomware attackers broke into Change Healthcare’s network by accessing its Citrix remote access service. The attackers had stolen an employee’s credentials and the service did not have multi factor authentication enabled. Bleeping Computer
Sharing: US healthcare giant Kaiser Permanente says personal data of 13.4 million people was probably passed to third parties including Google and Microsoft. It appears to be the result of using tracking tools on its websites and apps. This is a ubiquitous and highly questionable practice, particularly when it involves healthcare services. The Register
Breached: Dropbox has revealed a security breach at its eSignature platform Dropbox Sign. It says attackers “accessed data related to all users of Dropbox Sign, such as emails and usernames, in addition to general account settings.” Dropbox adds that there’s no evidence that documents themselves were accessed. But third parties “who received or signed a document through Dropbox Sign, but never created an account” did have email addresses and names exposed.
Indonesia: Amnesty International says the Jakarta government is an enthusiastic spyware customer, with purchases from the NSO Group, Candiru, FinFisher, Wintego, and Intellexa.
Snoops: Nearly 200,000 people have signed a petition against what it describes as the UK government’s “mass bank spying powers.” The government has said the provisions will enable it to better identify welfare fraud by accessing the bank records of welfare recipients. City A.M.
Drones: After moving forward with the possible ban on TikTok, the US is now making noises about banning drones made by the Chinese company DJI, citing risks to national security. Tom’s Hardware
TikTok: Ofcom, the UK media regulator, says its research suggests 30% of 5-7 year olds are now using TikTok. BBC
Scum: There are scumbags and there’s the creature in Finland who stole tens of thousands of healthcare records from a psychotherapy clinic and used them to blackmail their owners. A court has sentenced Aleksanteri Kivimäki to 6 years and three months in jail. Not long enough. YLE
Updates
Windows: Microsoft has confirmed that the April 2024 Windows security updates are causing problems with VPN connections. It says it’s investigating and there’s no immediate fix or workaround.
Passkeys: Microsoft has begun rolling out passkey support for all consumer accounts after enabling them in Windows 11 last year. As we described last week, passkeys provide a much more secure alternative to passwords, enabling the use of a device to authenticate access to a service. This week, Google announced that passkeys had been adopted by more than 400 million accounts.
OneDrive: Microsoft is adding an offline mode to OneDrive on the web, but only for work and school users.
Alarm: If your iPhone alarm failed to wake you up recently, you’re not alone. Apple says it’s aware that the Alarm app is intermittently failing to play sounds and is working on a fix. 9to5Mac
Aruba: Updates to address critical vulnerabilities in ArubaOS 8.x. A temporary workaround is available while the updates are applied.