The problem with VPNs. Hijacking kids' phone numbers. Wide use of AI but little training.
Slop is the new spam. Surveilling journalists in Northern Ireland.
Privacy
There appears to be a pretty fundamental problem with virtual private network (VPN) applications. Put simply, if someone wants to intercept the traffic supposedly protected by them, theycan (and probably have). The method exploits the protocol that governs how data is routed and could enable an attacker to redirect traffic so that it’s invisibly diverted from the VPN’s encrypted tunnel. The issue, identified by Leviathan Security, affects the sort of retail VPN solutions offered by companies like NordVPN and has existed since at least 2002. It doesn’t affect enterprise VPN platforms used to access private networks via the internet.
All this sounds pretty scary but in fact it reinforces our standard advice which is to avoid networks that you don’t trust. This is because to make the attack work, you would have to have administrative access to the network on which the VPN is being used. In most cases, this would be somewhere like a coffee shop, public transit hub or hotel. Anyone at risk of attack shouldn’t be using WiFi networks in those sorts of locations. Much, much safer to rely on cellular data. Or you could use an Android device which is immune to the problem. There are also other, more convoluted mitigations, as security journalist Brian Krebs explains.
Threats
Kids: Scumbags are now hijacking children’s mobile phone numbers so they can use them to call their parents and make threats to coerce them into paying a ‘ransom’. Cybersecurity Insiders
Shein: A campaign is impersonating the Shein fashion brand to try to harvest users’ login credentials. The scam begins with an email carrying the subject line, ‘Order Verification SHEIN.’ Check Point
Journalists: Iranian state-backed hackers are posing as journalists to gain access to the networks and cloud environments of Western and Middle Eastern NGOs, media organizations, academia, legal services and activists. Mandiant
Van Gogh: A copy of the Van Gogh museum’s website fooled at least 50 people, not least because it managed to appear at the top of Google’s search results. It’s an unfortunate reality that it really isn’t safe to trust the output of Google’s search engine because it’s too easy to game the system. Parool ($)
Webshops: A network of 75,000 fake online shops tricked more than 850,000 people in the US and Europe into making purchases, allowing the criminals to steal credit card information and attempt to process an estimated $50 million in fake orders. SRLabs
Gift cards: Following up on earlier research by Microsoft, the FBI is warning about fraudsters who are targeting the gift card departments of retail companies in the US. Their technique is to use phishing messages to break into the companies’ internal networks so they can create what appear to be genuine cards.
Swifties: A reminder that people are continuing to fall for scams that promote fake tickets for Taylor Swift concerts, often through compromised Facebook accounts. Malwarebytes
AI
Untrained: Nearly three quarters of European organisations are using AI tools at work, but 40% of them don’t provide any training. And only 17% have a formal policy on use of AI. To put it mildly, these numbers are not good. ISACA
Digital twins: AI companies are creating digital copies of real people so that they can be used in tasks ranging from modelling clothes to clinical trials. Wall Street Journal
Fakes: OpenAI says it’s developing new methods to identify AI-generated images, including a tamper-resistant ‘watermark.’ But, in a masterful understatement, it adds that “effectively enabling content authenticity in practice will require collective action.”
Location: Geospy is an online tool that uses AI to identify the location of photos that are uploaded to it. In our experience, it’s excellent at identifying US and European locations, good at Asia, and less so when it comes to South America - possibly because of the availability of material used to train it.
Dogs: The US Marine Corps is evaluating a new generation of robotic “dogs” which could be equipped with gun systems. This isn’t entirely new. The Marines have previously tested a similar setup with rocket launchers. The War Zone
Slop: First there was spam. Now comes ‘slop.’ It’s being proposed as the name to describe the useless AI-generated content that’s permeating the internet. As an example, take Microsoft’s Ottawa travel guide which listed the Ottawa Food Bank in its list of what visitors shouldn’t miss. Simon Wilson
Limits
Platforms like Proton undertake to protect the identity of their users but there are limits, as a recent case in Spain illustrates. Following pro-independence protests in Catalonia, the Guardia Civil made formal legal requests to Proton for information linked to an account. As TechCrunch reports, Proton responded by providing the recovery email associated with the account (which turned out to be an iCloud address). The Guardia Civil then turned to Apple which provided a full name, two home addresses and a linked Gmail account. Proton points out that the user didn’t have to provide the recovery email but, by doing so, they left Proton no option but to reveal the information when confronted with a legal request for it.
In brief
Surveillance: Police in Northern Ireland operated a rolling program to monitor the telephone records of “trouble-making journalists” and identify the source of leaks, according to evidence to a tribunal. The tribunal is investigating claims that three journalists were unlawfully placed under surveillance by the Police Service of Northern Ireland, Durham Police and the Metropolitan Police. Computer Weekly
Yahoo Boys: WIRED has a profile of the brazen Nigerian gang described as being among “the web’s most prolific—and increasingly dangerous—scammers.” WIRED found thousands of Yahoo Boy members across dozens of groups on Facebook, WhatsApp, and Telegram. They openly share scripts detailing how to blackmail people and run sextortion scams. via Ars Technica
Germany: Another security snafu from the German Armed Forces which managed to misconfigure their Cisco Webex system so that it leaked details of meetings, both past and planned. Die Zeit found links to thousands of meetings on sensitive topics.
Telegram: The messaging platform has a setting called “Find People Nearby.” 404 Media has found a tool that exploits the setting to identify the location of any user anywhere in the world who has it turned on. By default, the setting is supposed to be turned off and it would an excellent idea to leave it that way.
Signal: Meanwhile, Elon Musk took to XTwitter to claim he knew of vulnerabilities in the Signal messaging platform that it was failing to address. Two lines. No details. No credibility.
Ransomware: Analysis from Chainanalysis says the total number of ransomware victims rose by 70% last year, but the proportion that paid a ransom fell by 46%. It suggests it’s becoming easier to deploy ransomware but harder to make money from it.
1234: The UK’s National Cyber Security Agency regularly warns against the use of simple passwords and passcodes. It is now trying to explain why it was using ‘1234’ as the code to given to people visiting its London offices. The code provided access to doors leading to inner parts of the building. Cybersecurity Insiders
Updates
Google: Setting up two-factor authentication (or in Google speak, two-step verification) is changing and will no longer require a phone number. There are also changes for anyone using hardware security keys.
WhatsApp: A “refreshed” design is being rolled out for both iOS and Android apps.
F5: Users of Next Central Manager should make sure they’re running version 20.2.0. It addresses two security vulnerabilities that could allow an attacker to take control of the devices and create hidden administrator accounts. Eclypsium
Apple: New more powerful iPad models coincide with changes to Final Cut Pro. Final Cut Pro for iPad 2 will now support multi-camera recording - and control - while also enabling projects to be edited on external media.
Jitsi: The latest version fixes an issue that could expose passwords for private meetings.