How to easy track people if you're a nation state.
Why multi-factor authentication is so important. Microsoft's all-seeing AI tool. Disinformation at work. And Google shakes our confidence.
Tracking
When we’re working with people at risk of nation state surveillance, we emphasise the limit to which the risk can be reduced. This week brings multiple reports to support that warning.
First, an official at the US cybersecurity agency confirmed that the SS7 protocol used to route global cellular communications has been routinely abused to track people’s physical location. He told the Federal Communications Commission that such abuse is increasing and masks even more widespread exploits. This is a longstanding issue that we warn about but it’s the first time a US official has recognised it in public.
Next, The Intercept has details of another risk that we warn about; this time affecting WhatsApp and similar services. While it’s true that it’s difficult to intercept the content of end-to-end encrypted messages, it’s far easier to access the metadata associated with them - particularly if you’re a nation state. This is another example of ‘traffic analysis’ - a time-honoured concept in intelligence gathering that doesn’t bother with content but focuses on who is talking to whom. As a former US intelligence chief once said, “We kill people based on metadata.”
And we take scant comfort from laws that are supposed to protect personal privacy. This week, documents obtained by The Washington Post showed that police in San Francisco and Austin, where they’re banned from using facial recognition, simply asked neighbouring forces to run the searches for them.
Threats
Unused: Attackers are increasing their use of zero-day (i.e. previously unknown) vulnerabilities and supply chains are being compromised more often. There’s no reason to suppose this trend will change because technology is fundamentally insecure. So the only answer is to improve defences. And yet multi-factor authentication remains underutilised. Failing to take basic precautions paints a target on your back. A report from Rapid7 says more than 40% of incidents it investigated last year resulted from missing or inconsistent use of MFA.
Surfing: Working on sensitive material in public will end in tears, as British MP Johnny Mercer has just demonstrated. He was in a first class train carriage typing a memo criticising his boss (i.e. the prime minister) which was visible for all to see. Someone photographed the screen and the story ended up on the front page of The Times. A privacy screen mitigates this risk (though it wouldn’t have helped hide the MP’s apparent predilection for taking his shoes and socks off when travelling).
Deepfake: Design and engineering firm Arup is the latest big name to reveal a deepfake incident. It says it lost $25 million after an employee in Hong Kong was tricked into sending funds to the wrong bank account. CNN reports the employee had doubts about the email that started the fraud but discounted them after a video call involving deepfake versions of his colleagues and Arup’s Chief Financial Officer. Research has found a rising percentage of consumers believe they can spot deepfakes…
Docusign: Criminals are selling customisable templates designed to enable attackers to steal credentials for phishing and business email compromise (BEC) scams. Abnormal Security
macOS: Examples of malicious software designed to target Mac devices continue to emerge. SentinelOne has been tracking the top 10. Protection involves basic precautions including installing anti-virus, taking updates, enabling firewall and disk encryption, and (ideally) only using an account with administrator privileges when you need to.
AI
Last week it was OpenAI and Google, this week it was Microsoft’s turn to announce its latest AI developments - and they’re important. Key is the (limited) introduction of a new category of Windows PCs designed for AI. The snappily named “Copilot+ PC” will use AI to record everything a user does on the computer so that it can be easily searched later. For the moment, this will require specific computers fitted with suitable hardware but it’s pretty clear the intention is to release it more widely. At its launch event, there were assurances that the data recorded will stay on the machine and won’t be used to train Microsoft’s AI models. Experts remain sceptical and even the UK’s data privacy regulator is demanding clarification about how the feature will work. Given Microsoft’s lamentable security record, a feature that records everything that happens on a device (even if you have to opt into it) sounds like it requires a gigantic leap of faith. The Register Bleeping Computer
Slack: New terms of service allow the service to use customers’ files, private workspaces, and DMs to train an AI model. This is on by default. Opting out requires contacting the Customer Experience team at a suspiciously generic email address used for feedback.
Truecaller: The caller ID company is partnering with Microsoft to enable users to create an AI voice that can answer calls. This sounds like a recipe for pranks at best and fraud at worst. Microsoft says it has a code of conduct that prohibits impersonation. So all good then.
Big data: A cheering use of AI comes in the form of a property owner who used the latest version of ChatGPT to take on their homeowners’ association. It’s an instructive example of how AI can make sense of vast quantities of data. Less cheerily, Malwarebytes rounds up how credit card companies are planning to use AI to further exploit the information they gather about us.
Under the bonnet: If you’d like a glimpse into what’s actually happening when you interact with models like ChatGPT, Anthropic has a partial explanation. It’s pretty wild! Ars Technica
Pirates: OpenAI asked Scarlett Johansson for the rights to use her voice. She said no. They used an actor who sounded like her instead. And now they say they never intended to copy her voice. As The Atlantic puts it, “the Scarlett Johansson debacle is a microcosm of AI’s raw deal: It’s happening, and you can’t stop it.”
Disinformation
For a real-world example of how disinformation campaigns work, take last week’s assassination attempt on Slovakian PM Robert Fico. WIRED reports that within minutes, Russia had launched a coordinated campaign to blame the attack on Ukraine. Currently, Russia is also blaming the US for protests in Georgia and is seeking to portray France and President Macron as anti-semitic. The Washington Post examines an ISIS-affiliated media program called News Harvest that uses AI-generated news anchors “to disseminate extremist propaganda quickly and cheaply.” Meanwhile, in New Hampshire prosecutors have indicted the political consultant who created a robocall that impersonated President Biden.
In brief
Backups: We have a high degree of confidence in Google’s cloud services - but that’s been a little shaken by a series of unfortunate incidents. First, it managed to delete the entire account of a large Australian pension fund. Then scheduled maintenance resulted in the unscheduled shutdown of crucial services without which widely used platforms ceased to function. Having a completely separate backup is looking like a sensible precaution.
Advice: Business Email Compromise is a menace, particularly for medium-sized organisations that are big enough to be a tempting target but often too small to afford dedicated cybersecurity resources. The UK’s cybersecurity agency has good advice that’s really worth reading.
Hotels: TechCrunch reports that a consumer-grade spyware app has been found on the check-in systems of at least three Wyndham hotels in the US. A security flaw in the spyware means screenshots taken by the spyware are available to anyone on the internet, not just its intended users.
China: A long read from the BBC examines the cyber threat from China and its particular emphasis on commercial espionage, designed primarily to fuel the country’s economy and political stability.
Eventbrite: An investigation by Wired reveals how easy it is to find escorts and illegal drugs on the ticketing website. It even targeted addiction recovery events with listings for illegal sales of prescription drugs like oxycodone.
Laundry: A couple of students in California discovered vulnerabilities in laundromats that allowed users to do their laundry without paying. They told the (multi-national) company that operates them but it ignored them completely…until TechCrunch published a report on the issue. Free laundry has an obvious upside but, as the students pointed out, connecting heavy-duty appliances to the internet and leaving them vulnerable to attacks is a pretty poor idea.
Updates
Photos: Apple has released iOS 17.5.1 to stop deleted photos returning from the grave. Apple says the issue was caused by database corruption - but the underlying reality is that, as with most systems, deleting a file marks the memory it occupies as available for use rather than erasing it completely. As we said last week, it’s a dangerous assumption to think deleting any digital content means it has been removed completely.
Word for Mac: The past few months have seen regular complaints that Word is freezing or working sluggishly on Macs. It now appears Microsoft has recognised there’s a problem and is working on a fix. Meanwhile, workarounds include using an earlier version or using the web version of Microsoft 365.
Microsoft: Emergency updates for Azure Monitor Agent and Windows Server 2019.
Chrome: Yet another emergency update from Google. The issue it fixes is being exploited. Please do keep that browser updated.
Google: Password Manager now allows limited sharing between family members. We continue to prefer a standalone password manager.
Ivanti: Updates for several products, including fixes for critical vulnerabilities in Endpoint Manager (EPM).
QNAP: Researchers have criticised QNAP for failing to fix a series of vulnerabilities despite have been told about them months earlier. The issues were found in QNAP’s QTS, QuTSCLoud, and QTS hero operating systems. The Register