Spyware out of control in Europe. The evolving risk of QR codes. AI not crap, says Google.
Reports of a vast data breach at Ticketmaster. And a scam call centre exposed.
Spyware
Journalists and activists in Europe have been targeted with Pegasus spyware in further evidence that use of such tools is out of control. Access Now and Citizen Lab say the targets were Russian, Belarusian, Latvian and Israeli journalists and activists, most living in Europe in exile. The victims included “some of the most effective and respected independent media and voices critical of the Russian and Belarussian regimes,” as Citizen Lab researcher John Scott-Railton put it. “I’ve watched European inaction on mercenary spyware with puzzled wonderment,” he told Cyberscoop. “Given the number of scandals and revelations of human rights abuses and national security breaches, Europe is fast becoming a leader in spyware crises.”
The widespread use of spyware means anyone whose activities put them at risk should take precautions and seek advice. Access Now runs a helpline designed for journalists, activists and dissidents, but there are also basic measures to prevent attacks. iPhone users can enable Lockdown Mode which protects against advanced threats (although it reduces the device’s functionality). Citizen Lab hasn’t found any cases where spyware such as Pegasus has successfully infected a device which had this mode switched on. There’s no equivalent for Android devices though Google does have an Advanced Protection Programme which offers greater account security in general.
Threats
QR codes: We don’t like these codes because it’s not clear where they’ll take us if we scan one. Now there’s an added wrinkle. A new tactic involves creating what looks like a QR code but is actually made up of ASCII (i.e. text) characters. The aim is to bypass security solutions. Harmony via Avanan
Stack Overflow: Technology goes wrong (a lot) so when it does many people’s first reaction is to try to find a solution online. Stack Overflow is a great resource for this so, naturally, scumbags have been infiltrating it to answer questions and suggest people install an app that’s designed to steal information from Windows devices. Bleeping Computer
Antivirus: It’s standard advice to install a reputable antivirus product on devices (apart from iPhones). Criminals are exploiting this by disguising malicious software as security software. Android users are a particular target at the moment. Cybersecurity Insiders
Marketplace: Kaspersky explains in detail how scammers defraud people who are buying and selling items online. It’s a highly organised fraud and so it’s vital to take basic precautions; above all, double-check that the site you’re on is genuine and never move communications to another platform.
Software: An ongoing campaign is distributing malicious software disguised as pirated copies of Microsoft Office. The lure is convincing. ASEC
WhatsApp: You may remember that in 2021 Meta kindly allowed users to use their account on desktop and web apps as well as on their primary mobile device. While undoubtedly convenenient, a researcher has shown this introduces potential security issues. The key one is that it could allow different versions of a message to be sent to different devices. While not overly dangerous, the issue does underline the reality that more convenience = less security. ZenGo
AI
Wrong: Just because Google’s AI has been suggesting adding glue to pizzas to stop the cheese sliding off doesn’t mean its tool is crap, it’s just the way AI works - or at least that’s Google’s story. There have been plenty of examples of ludicrous answers since Google added AI to its search tool. Google says most of them are the products of deliberate attempts to mess with its ‘AI Overviews.’ Business Insider
Earnings: AI tools may result in some idiocies but there are plenty of things at which they excel, including analysing corporate financial results and predicting future earnings. The University of Chicago found they rivalled and sometimes surpassed the accuracy of professional analysts.
Law: The EU is set to introduce the world’s “first AI law” following approval by the Council of Ministers. Pinsent Mason lawyers say “it brings significant new regulatory requirements for businesses that provide, deploy, import, or distribute AI systems.” Non-compliance could result in fines up to 7% of worldwide turnover.
Training: A veteran software developer examines concerns that information entered when using models like ChatGPT could end up as part of the data used to train such tools. This isn’t a theoretical worry because, as Samsung discovered, it’s happened. But, as Simon Willison, explains such models don’t “directly learn from and memorize everything…you say to them” because that’s not how they’re structured. Alas, as with most things AI, it’s not quite that simple and it doesn’t mean ChatGPT et al are a safe place to share sensitive or confidential information. We continue to advise caution.
Favourites: It turns out that, like humans, AI models are very bad at picking random numbers. Researchers asked major chatbots to pick one between 1 and 100. They all had a favourite, seemingly determined by the frequency with which the number appeared in the data used to train them. TechCrunch
In brief
Breaches: Yet more high-profile data breaches, including one involving the details of more than half a billion Ticketmaster/Live Nation customers. While it still has to be confirmed, it looks increasingly likely reports of the breach are correct. The exposed data is said to include names, email and physical addresses. phone numbers, obfuscated credit card details and all the user’s transactions. Among other breaches; the BBC’s pension scheme and Santander’s operations in Chile, Spain and Uruguay.
Takedown: A global law enforcement operation has seized the infrastructure used by six of the most popular platforms for delivering malicious software. A jaunty-looking website has the details and warns “Operation Endgame does not end today.” It’s the biggest such takedown yet seen and marks a significant evolution in trans-national efforts to combat cybercrime.
High risk: The US cybersecurity agency CISA has gathered a collection of invaluable online resources aimed at high-risk communities. It provides an ideal overview of what’s available. Highly recommended.
Holidays: As the US enters peak holiday season, CISA also has security advice for travellers. While much of the tips apply all the time, the increased risk of loss or theft means it’s particularly important to make sure devices are backed up.
Testing: We have always been sceptical about the value of using fake phishing emails to test employees’ cybersecurity awareness. The head of Google’s security response and incident management division agrees, saying they do little to improve security but do make everyone hate the IT department. Matt Linton says the emphasis should be on engineering effective defences. “You can’t “fix” people, but you can fix the tools,” he says.
Biter bit: A hacker managed to access a scammer’s call center, steal the source code for its tools, and email its victims to tell them they had been scammed. ‘Waredot’ allegedly tried to persuade victims to buy expensive and completely useless security software. There are plenty of examples of this type of vigilante action and we never get tired of them. 404 Media ($)
Updates
Fortinet: Researchers have detailed a potential way of exploiting a serious vulnerability in Fortinet’s security information and event management (SIEM) solution. A fix was released in February and it’s essential to ensure it has been installed. Vulnerabilities in Fortinet products are frequently targeted in ransomware and espionage attacks.
Check Point: Emergency updates for a range of VPN products to fix a previously unknown vulnerability which is being exploited to gain remote access to firewalls and access corporate networks.
Citrix: Security update to address a vulnerability in its Workspace app for Mac.
Asus: Firmware update to fix a security issue in multiple router models.