Some common factors behind data breaches. Phishing more than doubles in Europe.
The lesser-known bits of Apple's big announcements. Google accused of misleading browser users. Police surveillance in Northern Ireland. And man blames Apple for his divorce.
Breached
It now appears some 165 companies are vulnerable to compromise as a result of the campaign targeting the Snowflake cloud storage platform. Google Mandiant says it told the organisations that the attackers were using credentials bought from underground markets to access their accounts and steal their data. Blackberry’s Cylance cybersecurity subsidiary and Pure Storage are among the latest victims.
There are common factors behind the successful attack - and thus some useful lessons;
-
Impacted accounts did not have multi-factor authentication.
-
Credentials had not been changed or updated. In some cases they remained valid years after being stolen.
-
Impacted accounts did not have settings that meant they could be accessed only from trusted locations.
-
In several cases, Mandiant found the initial compromise took place on contractor systems that were also used for personal activities, including gaming and downloads of pirated software.
Threats
Phishing: As we may have said before, phishing is out of control. New research from Abnormal Security, found that attacks targeting organisations in Europe increased by 112.4% in the year to April 2024. The figure for the US was 91.5%. It’s a method that works, as Ascension Healthcare can testify. It says a recent ransomware attack was caused by an employee falling for a phishing scam in which he gave up his credentials. Ascension now faces legal action as a result of the incident which caused severe disruption to its services.
Olympics: Proofpoint says it identified 338 fraudulent websites selling fake tickets for the Paris games.
Browser: A fake version of the Arc browser contains malicious software designed to target Mac devices. Intego
Airlines: Scumbags are using face XTwitter accounts to impersonate airlines and scam passengers. We’ve warned before about posting public messages in an attempt to resolve consumer issues; they’re invaluable to scammers. BBC
Android: Free apps are always something of a risk. If they’re offering a VPN service, they should be avoided. Top10vpn found extensive vulnerabilities in 11 Android apps, including a complete failure to encrypt anything.
Cyber: The US cybersecurity agency CISA is warning that criminals are impersonating it and other government agencies. Given that the scams appear to involve requests for money or gift cards, surely no-one would fall for them. Surely…
Rubbish: A medical student in the UK has helpfully demonstrated the importance of handling confidential waste securely. Sensitive patient information was thrown out with their domestic rubbish and subsequently found by a member of the public. The Register
AI
Recall: Microsoft has bowed to pressure and is delaying the preview release of its all-seeing recording feature. Once rolled out it will include changes to make it more secure. It will be off by default and users will only be able to activate it if they’ve enrolled in Windows Hello biometrics authentication. Once enrolled, data in the Recall feature will be encrypted and accessible only through Windows Hello.
Change: A leading AI researcher (and investor) says we have no idea of the extent to which AI will transform civilisation. In a 165-page analysis, he argues that we’re still treating it as if it’s a normal technology story rather than the invention of something like nuclear weapons. He’s also less worried about computers taking over the world and much more concerned that China will.
Character: Anthropic is the company behind the Claude AI model. It has just published an intriguing outline of how they helped Claude develop its character. It’s….complicated.
PDF to Podcast: A researcher has released a tool that takes pretty any text input and converts it into an audio file. via Simon Willison
Calm down: Japanese finance house SoftBank has a new AI that makes angry customers sound calm when they’re on the phone to its harassed call centre operators. Which is great…although AI is increasingly replacing humans in call centres altogether.Asahi Shimbun
Apple
This week’s big announcements from Apple were widely reported in the media, so we’ll try to pick out the bits that received less coverage. Firstly though, bear in mind that the latest features are currently only available in a test version, won’t be released officially for at least four months, and will only work on specific devices.
Control: As well as controlling iPhones with eye movement, iOS 18 will also allow users to control their phones with vocal shortcuts and sounds.
Power: A new Control Centre has a multi-page interface - and a button that turns the iPhone off. No-more pressing power and volume together.
Messages: As well as offering texts-by-satellite (though it didn’t say if it would charge for them), Apple will begin supporting Rich Messaging Service (RCS) which will mean Android users can send and receive high-quality media while chatting with their iOS friends.
AI: As you’ve doubtless heard, a big part of the announcements was the introduction of AI. Apple will provide mobile device management controls allowing administrators to turn off AI-powered features.
Keyboards: Improved multilingual support will enable typing in different languages without changing keyboards.
Calendar: There’s now a multi-day and list option that provides an improved overview of upcoming events.
All this sounds wonderful - and it pushed Apple’s share price to a new high - but as Apple made its announcements, it emerged that it took three years to fix a bug in its parental controls feature. It only acted after researchers took the issue to The Wall Street Journal.
Privacy
Google: A privacy campaigner has filed a data protection complaint accusing Google of misleading consumers over its Privacy Sandbox feature. It’s “advertised as an improvement over extremely invasive third-party tracking, the tracking is now simply done within the browser by Google itself,” the complaint alleges. Meanwhile. Google says it will start deleting historical location information stored in its Timeline feature. Users have until December 1 2024 to save any data they want to keep.
LinkedIn: Following a consumer complaint, LinkedIn will no longer allow advertisers to target users based on data harvested from their participation in LinkedIn Groups. TechCrunch
Likes: XTwitter has decided to makes Likes private, starting this week. It means it will no longer be possible to see who liked someone else’s posts but users will still be able to see this information about their own contributions.
In brief
Surveillance: Police in Northern Ireland used a dedicated laptop to monitor the phones of journalists and lawyers, according to one of its own former Assistant Chief Constables. He says the device was kept separate from other systems in order to avoid independent scrutiny. ComputerWeekly
Cellphones: UK police have arrested two people following an investigation into an SMS-based phishing campaign using an ‘unofficial’ cellphone tower. Police say the system was used to bypass mobile phone networks’ anti-phishing controls. Meanwhile, the Electronic Frontier Foundation has details of the next generation of (highly capable) cell-site simulators which are designed to intercept phone data. Among the features, they work on 5G as well as older standards, and can be hidden in an ordinary vehicle.
Disinformation: A bevy of stories illustrates the sheer extent of disinformation and the challenge in combating it. While Google took down campaigns linked to China, Indonesia, and Russia, Russian operators were back on Meta with paid adverts hours after their accounts had been closed. Stories from Russia Today continue to circulate in Europe thanks to sites like Man Stuff News. In an effort to counter Russian disinformation about Ukraine, the US and Poland haveset up a joint centre in Warsaw.
Ransomware: Attackers are adopting “progressively more brutal” tactics as law enforcement steps up efforts to shut them down. Emsisoft points to a sharp jump in publishing stolen information while some gangs have even threatened individual cancer patients to try to extort money. WIRED via Ars Technica
Help: The Global Cyber Alliance has launched a website aimed at helping 18- to 25-year olds avoid scams and cybercrimes. Cyberflex is being supported by Amazon and includes free tools, interactive guides and text alerts. As the GCA points out, far from avoiding scams and online risks, digital natives are particularly vulnerable to them.
Hopeless: A British man is suing Apple following his divorce, saying it’s responsible for his wife discovering messages he sent to prostitutes. He was careful enough to delete them from his iPhone but neglected to realise they were synced to the family iMac… The Times ($)
Updates
Amazon: The AWS cloud storage service will now support passkeys as one of the options for multi-factor authentication (MFA). It’s part of a move to make MFA mandatory and comes not a minute too soon. Passkeys require authentication on a trusted device in order to access a service and are much more secure than a one-time passcode (as Kaspersky explains).
WhatsApp: Video calls will now support screen sharing with audio (i.e. so you could watch videos on a call) and is increasing the number of participants on a video call to 32 people. It’s also improving sound quality for calls over poor quality connections.
Chrome: Version 126 of Google’s Chrome browser has security updates and new features, including the ability to extract text from PDFs.
Firefox: Version 127 of Mozilla’s browser also has security fixes. It also improves the security around website video and other media elements.
Pixel: Google has released updates for 50 security vulnerabilities and says one of them has already been exploited in targeted attacks.
Patch Tuesday: Monthly security updates from Adobe, Microsoft, SAP, Citrix, Kubernetes, JetBrains, and Zoom.