All pervasive AI. How fraudsters are using banking apps in their scams.
iPhones bring deleted photos back from the grave. And an ingenious approach to tracking vehicles.
AI
This week’s big announcements in the world of artificial intelligence illustrated how all pervasive the technology is about to become. Just in case anyone doubted this, OpenAI has called its latest model ChatGPT-4o; with the “o” standing for “omni.” The thrust of OpenAI’s launch event was to demonstrate how ChatGPT can act as an omnipresent digital assistant which is able to interact more or less naturally with the world around it. But perhaps the most important part of OpenAI’s announcement is that you won’t have to pay to access ChatGPT4o’s capabilities. Until now, the price for the latest version of ChatGPT was $20 a month. Min Choi has an XTwitter thread that shows some of the things the new model can do (though they haven’t been fully rolled out yet).
For its part, Google devoted its entire technology update to its Gemini large language model – and the changes it’s introducing will probably have the most significant impact for most people. That’s because Google is upgrading its search engine so that it produces detailed responses generated with the help of AI. It’s being rolled out at the moment to US users, with the aim of reaching a billion people by the end of the year. Other changes to search will allow videos to be uploaded so that, for example, you can film a faulty product, describe the problem and AI will tell you how to fix it. At least that’s the idea. How well it performs in reality will become clear as it’s exposed to more users.
AI is also coming to Android, with a new feature that will involve it listening to phone calls to identify potential scams. To demonstrate, Google used a common fraud in which a caller claims suspicious activity has been happening and suggests moving funds to a new account to secure them. After hearing the request, the phone app generated a warning: “Likely scam. Banks will never ask you to move your money to keep it safe.” The analysis takes place on the device but some security experts believe it’s a slippery slope. “From detecting ‘scams’ it’s a short step to detecting patterns commonly associated with seeking reproductive care or…providing LGBTQ resources…or associated with tech worker whistleblowing,” the president of secure messaging platform Signal wrote.
Threats
Banking: There are some really sophisticated financial frauds doing the rounds at the moment. One particularly nefarious one is designed to exploit the push notifications produced by banking apps. It begins with a call that appears to come from your bank. If you say you don’t believe the call is genuine, the caller says they’ll send a push notification through your banking app. The notification then appears. That’s because while you’re on the phone, the fraudster has called your bank and pretended to be you thus provoking the app notification. If you didn’t initiate the call, don’t engage - hang up. Terence Eden
Deepfake: An elaborate scam targeted advertising giant WPP with deepfakes of the company’s CEO and another executive. In order to set up a Teams meeting, the fraudsters used a publicly available photo of the CEO to create a fake WhatsApp account. Once in the meeting, they used the chat function to impersonate the CEO and try to persuade an executive to reveal financial details. The attempted fraud was unsuccessful. As WPP’s CEO wrote to colleagues in an email, “Just because the account has my photo doesn’t mean it’s me.” The Guardian
Helpdesk: A ransomware gang is targeting companies by posing as their IT helpdesk and flooding the email inboxes of employees with offers of assistance. It’s one of a number of similar tactics designed to persuade users to download remote monitoring and management software like AnyDesk. Rapid7
WhatsApp: UK police say there’s been an upsurge in attempts to hijack accounts by scammers pretending to be a member of a WhatsApp group. The scam begins with an audio call from the fraudster in which they say they’re sending a one-time passcode for an upcoming group video call. In fact, it’s a registration code which enables the victim’s account to be set up on a new device. Stopping this scam is easy, just make sure two-step verification is enabled in Settings | Account.
Photos
Some users who have taken the latest iPhone software update report that previously deleted photos have begun reappearing on their devices. “I have four pics from 2010 that keep reappearing as the latest pics uploaded to iCloud. I have deleted them repeatedly,” one user said on Reddit. One theory is that, as with most digital filing systems, when you delete a photo on an iPhone, it removes the reference to it but doesn’t remove the actual content. Then, when you take a major software update, the device reindexes everything on it - hence the image returning from the grave. Either that or Apple is retaining images even if a user deletes them. Either way, it’s a reminder that deleting something in the digital world doesn’t mean it’s really gone.
In brief
Cars: Forbes reports on a new tool designed to track drivers and passengers by scanning for anything that emits a signal from a car. Such items range from phones to pet trackers and library books, and are used to create a unique ‘fingerprint.’
Telegram: We reported last week that Elon Musk was seeking to undermine confidence in the secure messaging platform Signal. It now appears this is part of a campaign designed to convince people that Telegram is a more secure alternative. It’s not, as a leading cryptographer explains.
Russia: Moscow is mounting a concerted operation to destroy evidence of war crimes by hacking organisations inside and outside Ukraine. The Ukrainian Prosecutor General’s Office and the International Criminal Court in The Hague are among the targets. The Texas National Security Review examines a new frontline in digital warfare. War On The Rocks
Disinformation: WIRED reports that Russia is using XTwitter to spread fake news about student protests to try to deepen divisions in the US.
Shutdowns: 2023 saw a record number of internet shutdowns, according to data from Access Now. It says authorities deliberately interrupted the internet at least 283 times in 39 countries with the aim of “concealing, enabling, and exacerbating violence, war crimes, attacks on democracy, and other atrocities.”
Journalism: Newspaper publishers in the UK have warned that Apple’s ‘Web Eraser’ threatens the financial stability of journalism. The privacy feature is part of Apple’s upcoming iOS 18 software update and is designed to remove ads or other unwanted website content. FT ($)
News: NiemanLab reports on the tactics used by companies to manipulate news coverage to protect their interests. They include an example from a Californian city where a news site is wholly owned by Chevron. “There are no full-time journalists on staff; a PR firm in San Francisco oversees the publication’s operations,” an investigation by NPR and Floodlight found. Chevron owns a controversial refinery in the city.
Updates
Trackers: Apple and Google have released a cross-platform feature designed to detect unwanted location trackers. The anti-stalking feature alerts a user when a Bluetooth tracker not owned by them is in the vicinity. It works on iPhones running iOS 17.5 or above, and Android devices with Android 6.0 or above.
Apple: iOS 17.5, macOS Sonoma 14.5 and iPadOS 17.5 updates include multiple security fixes (as well as the anti-stalking feature above). There are also updates for older versions of iOS, macOS and iPadOS software.
Chrome: Yet another emergency security update for Google’s web browser; the third in a week (and the latest also affects Microsoft’s Edge browser). These are issues that are being actively exploited, so it’s essential to make sure you keep your browser updated.
Patch Tuesday: This week’s monthly security updates includes releases from Adobe, Microsoft, SAP, VMware, Fortinet, Firefox, and Zoom.
Tor Browser: Version 13.0.15 includes security fixes and updates the version of Firefox browser it uses.
Tails: Version 6.3 updates the Tor Browser and temporarily disables the PDF browser in Thunderbird because of a security vulnerability.