Why multi-factor authentication should be mandatory. The extent of social engineering.
A cautionary tale about trusting AI. An unlikely source of mass disinformation. And what happens when you give Starlink to an isolated tribe in Brazil.
Breached
Denials, misinformation and threats of legal action accompanied Ticketmaster’s confirmation that it was the victim of a security breach which may have exposed the data of some 560 million customers. The stolen database was hosted on Snowflake, a cloud platform widely used by large organisations. Initial reports suggested a Snowflake employee’s credentials were used to gain access but this seems to be the result of deliberate disinformation by the attackers (hence the threat of legal action). Instead, the platform said the incident “appears to be a targeted campaign directed at users with single-factor authentication.”
It’s hard to believe a customer as big as Ticketmaster would have failed to enable multi-factor authentication (and it hasn’t admitted it did) but such idiocies continue to occur on a regular basis. It’s obviously essential to ensure cloud services are properly secured, using a solution capable of withstanding attacks that defeat simple multi-factor authentication. Given the absurd number of stolen credentials available for purchase, we find it absurd that vendors like Snowflake don’t mandate the use of such solutions.
Threats
Overview: Nearly 90% of threats blocked by Avast in the first quarter of this year involved social engineering, according to its latest report. Avast says it saw a particular rise in the use of deepfakes and hijacked YouTube channels.
Misbehaving: People do silly things - even if they’re a senior crewmember on a US warship. Despite the obvious security risks, Navy Times reports that a Senior Chief has been court-martialled for setting up an unauthorised WiFi network on board her ship (seemingly to make liberal use of a Starlink satellite connection). We include this as a threat because it’s the type of behaviour we see worryingly often. In many cases, users will install unapproved software simply to make their jobs easier. It’s essential they understand why they shouldn’t.
Invoice: Cisco Talos has an example of a current campaign targeting banking users in Brazil. It begins with an email containing a Word document that appears to be an invoice. It contains a link to a website from which the invoice can be downloaded. Clicking the link executes the next stage of the attack. Fake invoices are a very popular lure at the moment and we should be on our guard for them.
Signal: Attackers are targeting Ukrainian users with messages that try to persuade them to install malicious Windows apps. Ukrainian officials say instant messaged are increasingly being preferred over email for such attacks.
AI
Scammed: A Canadian user needed help with his Facebook account so he searched for a customer support number and, when he found one, asked Meta’s AI chatbot if it was genuine. “Indeed it is,”, came the reply. Alas it wasn’t, so the user ended up talking to a scammer. As a computer science professor told CBC, “You absolutely should not trust AI. It is a very powerful tool that makes mistakes.” Alternatively, one might say, “Trust but verify.”
Free: Privacy-focused search engine DuckDuckGo has launched an anonymous way to access popular AI chatbots. They’re not the most advanced models but DuckDuckGo says it’s already working on improvements.
Fake: A popular free news app in the US has been publishing fictitious stories written by AI since 2021, according to Reuters. Newsbreak claims to have over 50 million monthly users. Its primary backers in California and Beijing.
Twins: If Zoom’s CEO is to be believed, the future of meetings involves sending our digital twin to attend in our place. Eric Yuan told The Verge that this was probably five or six years away and it couldn’t replace all human interaction, but AI could “help for maybe 90 percent of the work.”
Recall: Microsoft’s controversial search tool has kicked off an animated debate over user privacy and future uses of AI. Windows Recall takes regular screen shots and stores them so they can be easily searched later on (and it only works on a new class of Windows computers). Leaving aside whether it’s actually using AI, some researchers say it’s a ludicrous security risk, while others argue that “in10 years, almost everyone will think computers without this functionality are worthless.” Windows Central
Value: Whatever the future of AI, it’s certainly had a huge impact on the value of chip manufacturer Nvidia. This week, it became the second most valuable company in the world with a market capitalisation of $3.01 billion. That’s off the back of a $14 billion profit for the first quarter of this year…
In brief
Disinformation: While countries like Russia appear to be behind widespread disinformation campaigns (Including one targeting the Paris OIympics), a less likely culprit has been fingered for the vast majority of fake news shared on Twitter during the 2020 US presidential election. Researchers say most of these “supersharers” were “disproportionately Republican, middle-aged White women residing in three conservative states, Arizona, Florida, and Texas.” They came from areas with low education levels but relatively high income, and they retweeted the misinformation manually.
TikTok: A previously unknown (‘zero-day’) vulnerability appears to have been used to hijack CNN’s account on the video platform. Forbes says ($) it resulted from opening a direct message. A number of other high profile accounts were also targeted, apparently unsuccessfully. 9to5Mac
Supply chain: A ransomware attack was responsible for this week’s severe disruption at London hospitals, according to the company at the centre of the incident. Synnovis is a pathology partnership between two NHS trusts and SYNLAB, Europe’s largest provider of medical testing and diagnostics. It’s less than two months since Synlab Italia suffered a similar attack. It was claimed by the Black Basta ransomware group.
On/Off: In our awareness sessions, we advise people to turn their smartphones off and on once a week. The US National Security Agency agrees. It has produced an information sheet which explains simple steps to improve security - and improve the phone’s performance.
Brazil: Give an isolated tribe in Brazil an internet connection and nine months later the results are…discouraging. The New York Times reports that
after being given a Starlink dish, the Marubo people are seeing “teenagers glued to phones; group chats full of gossip; addictive social networks; online strangers; violent video games; scams; misinformation; and minors watching pornography.”
Updates
Apple: There’s been another update for iPadOS 17.5.1, this one intended to fix an issue affecting only the iPad 10 model. Apple hasn’t explained what that issue is.
iOS: Meanwhile, it has emerged that Apple’s latest iPhone is guaranteed to receive only five years of security updates. It launched the iPhone 15 last September so official support for it will end in 2028. Google and Samsung provide seven years of security updates for their flagship models.
Bartender: The popular app that allows users to customise the macOS menu bar has been acquired by a new developer. The original owner assures users that the future is bright. The new proprietor is reported to have a less than stellar reputation. Care is advised.
Graphene: The mobile operating system is adding a feature to wipe a device if forced to open it under duress. It involves entering a duress password which, once entered, initiates the deletion process.
Check Point: A reminder that a range of the company’s VPN appliances are vulnerable to remote attack. It’s urging users to apply an update that was released last week.
Cisco: Updates for Webex after it emerged that details of German government meetings had been exposed. In March, Russia published an audio recording of a Webex meeting between senior German military officers. It’s not clear whether the two incidents are connected.
SolarWinds: Security updates to fix four vulnerabilities.