The rotten state of information security. The vile crime of sextortion.
AI's impact on work. Spyware manufacturer says high-ranking officials are legitimate targets. And the US bans Kaspersky.
Rotten
The state of information security is not a happy one, as evidenced by another round of security failures. In the UK, gym chain Total Fitness exposed nearly 500,000 images of members and staff through an unprotected database. A researcher told The Register the content included identity documents, as well as bank and payment card information. The chain says there’s no evidence the database was accessed by anyone other than the researcher who found it, but it illustrates the chronic lack of care with which information is treated.
The impact can be enormous, as in the breach of a US federal law enforcement database. Two defendants have pleaded guilty to accessing the information in it and using details to extort victims, including by threatening violence against family members. In the UK, two health trusts in London remain disrupted by a ransomware attack. When asked if it knew a healthcare crisis would ensue, the gang responsible told The Register, “That was our goal.” It has now published what it says are blood test data accessed in the attack.
The gang claims to have used a previously unknown, ‘zero-day’, vulnerability to breach a company providing pathology services to the trusts. Such issues are worryingly common, partly as a result of the sheer complexity of modern software and systems. But wilful incompetence is also a factor. Based on the testimony of a whistleblower, ProPublica explains how Microsoft dismissed warnings about a critical flaw in the application used to protect access to cloud-based apps. Russian hackers later used the flaw to access multiple US government agencies. According to the whistleblower, Microsoft didn’t address the issue because of concerns about its potential impact on government contracts it was hoping to secure.
Threats
Sextortion: There have been frequent warnings about the growing threat from criminals who extort money from children by luring them into sharing compromising images. It’s a horrible crime which has led to numerous suicides among children terrified at the threat of the material being made public. Many of the attackers are in Nigeria and it’s become such a problem that the head of the FBI has been visiting the country to discuss how to combat it. This is an ongoing threat to young people and it’s really important to discuss it with them. NPR has a heart-breaking case-study.
Help desk: Google Mandiant reports on the highly believable techniques used by attackers to fool help desks into giving them access to accounts with administration rights. Cast-iron checking processes are essential.
Windows search: Doubtless you know to be cautious about popup boxes asking for permission to open a particular app. The latest example of this is a devious technique that brings up a prompt in Chrome browsers to open the search tool in Windows Explorer. Beware! Trustwave
Error: Another devious tactic involves displaying an error message when trying to open an email attachment or a link to a webpage. The aim is to persuade the user to copy and paste a script which, if run, would install malicious software. proofpoint
Teams: A current campaign is using a fake website purporting to offeri the latest version of Microsoft Teams. It’s being promoted through online advertisements on Google and Bing (that they should really be able to stop). Rapid7
Free: There ain’t no such thing on the internet. Trellix explains why free or pirated versions of commercial software should be a red flag. In this case, the lure is a booby-trapped version of Cisco’s Webex Meetings app.
BEC: Barracuda’s latest report on email threats found 40% of attacks involved business email compromise (in which attackers seek to exploit normal commercial processes such as payments and invoices). And it also found one in 10 social engineering attacks including a shortened URL used bit.ly
AI
Work: More examples of how generative AI is changing the way we work - and the work we can expect to do. Copywriters tell the BBC that AI took their jobs and now they’re being paid far less to make the results sound more human. A UK firm is providing AI receptionists for doctors’ surgeries. Google’s DeepMind can now automatically generate soundtracks and soundscapes for AI-generated videos, making it much easier to create complete movie scenes. In the world of finance, the FT says it’s less about replacing people and more about enhancing productivity. We somehow doubt it’s a binary choice.
Useful: OpenAI rival Anthropic has a new version of its Claude model. It claims better performance than ChatGPT but the most interesting feature is a workspace that allows users to interact directly with the content generated by the model.
Emotion: Thousands of rail passengers in the UK probably had their faces scanned by Amazon software as part of widespread artificial intelligence trials, according to documents obtained by Big Brother Watch. The system was used to predict ages, gender, and even emotions, apparently with the aim of exploring potential uses for advertising.
Ratings: Daniel MIessler is something of an AI evangelist. Even he seems slightly worried about what he thinks is the inevitable use of AI to rate us in every aspect of our lives. And he really means every aspect from employment to dating.
Counterpoint: Nikhil Suresh is a (former) data scientist in Australia with forthright views on technology and AI. While not denying the potential of AI, he has some concerns. “…some absolute son of a bitch created ChatGPT, and now look at us. Look at us, resplendent in our pauper’s robes, stitched from corpulent greed and breathless credulity, spending half of the planet’s engineering efforts to add chatbot support to every application under the sun when half of the industry hasn’t worked out how to test database backups regularly.” This is part of a much longer - and more nuanced - post containing a quite remarkable number of expletives but which we reckon is worth a few minutes of your time.
Kaspersky
The Biden administration is to ban the sale of Kaspersky antivirus software in the US, saying the company’s Russian connections mean it poses an “undue or unacceptable risk to national security.” “Russia has shown it has the capacity and… the intent to exploit Russian companies like Kaspersky to collect and weaponise the personal information of Americans,” the US Commerce Secretary told reporters. The ban is due to come into force on September 29 and comes after long-running discussions in the US about a possible ban. It’s true that Kaspersky and its eponymous CEO are based in Russia and therefore subject to Russian law. It’s also true that Kaspersky’s security products are widely used and highly regarded. And Kaspersky produces respected research (that we often quote). However, for some time, we have advised that there are perfectly good alternative security products which on balance are preferred options.
In brief
Spyware: Those charming people behind Pegasus have told a court that it’s fine for its clients to target any high-ranking official because their jobs make them “legitimate intelligence targets.” That’s despite previous assurances that its spyware would only be used to prevent acts of terrorism and serious crime. The Record
Firefox: Not for the first time, users of Mozilla’s web browser may have been experiencing problems playing YouTube videos. It’s caused by an issue with the way they’re being presented to Firefox. A fix is due soon. ghacks.net
Vetting: Silicon Valley companies are stepping up security vetting of staff and potential recruits amid concerns about the threat of Chinese espionage. FT
Mouse movers: A US bank fired “more than a dozen employees” for faking activity on their computers to appear busy, according to disclosures to US regulators. The remote workers were part of Wells Fargo’s “wealth- and investment-management unit.” Bloomberg via The Verge
Health warning: The US Surgeon General says social media platforms should carry a tobacco-style health warning. Meanwhile, in Canada a proposed Online Harms Act includes penalties including life imprisonment for advocating genocide and preemptive measures to stop possible future hate crimes.
Passwords: Advances in computer capabilities mean we should be using longer, more complex passwords otherwise, as Kaspersky shows, it’s far too easy to simply use multiple attempts to crack them. Bottom line, minimum length should be 10 characters made up of uppercase/lowercase letters, digits and special characters.
Disinformation: We constantly report instances of Chinese disinformation efforts but obviously it’s not a one-way traffic. Reuters reports on a US anti-vaccination campaign to undermine China during the pandemic.
Sharing: In a survey by Malwarebytes, 43% of people in a committed relationship said they had felt pressured by their partners to share logins, passcodes, and/or locations. 7% said ‘pressure’ included threats of physical or emotional violence, or of ending the relationship.
Updates
Microsoft: A reminder to make sure Windows devices are up-to-date to combat a nasty vulnerability which could be exploited on public WiFi networks.
Outlook: Big changes on the way for Microsoft’s personal Outlook services. From September, it will stop supporting basic authentication, i.e. username and password. Mail and Calendar apps on Windows, and Outlook Light won’t be supported, and neither will access via Gmail. Bleeping Computer
Routers: Updates from D-Link and Asus to address serious vulnerabilities in a wide range of routers. With apologies for repetition, it’s essential to keep routers up-to-date.
FCP: Version 10.8 includes a new slow motion mode, improved automatic colour correction, and the ability to rename effects and drag them directly between clips. ProVideo Coalition
VMware: Fixes for critical vulnerabilities in vCenter Server, including remote code execution and local privilege escalation flaws.
Atlassian: Updates to multiple high-severity vulnerabilities in Confluence, Crucible, and Jira.
Tails: Version 6.4 includes a strengthened cryptographic technique, as well as updates to the Tor Browser and Thunderbird email client.