Tech giants and EU in regulatory arm wrestle. Phishing rises again.
The risks of shadow AI. More data breached. Online sleuths. And stealing a Rolls Royce with a text message.
Fight
Apple is to withhold its AI features from the EU in an intriguing test of technological might versus regulatory firepower. Apple says it took the decision because the European Digital Markets Act (DMA) “could force us to compromise the integrity of our products in ways that risk user privacy and data security.” For its part, the EU’s competition chief Margrethe Vestager told a forum that Apple’s decision simply demonstrated its anti-competitive instincts. As well as Apple Intelligence, the move will also affect Phone Mirroring and SharePlay Screen Sharing, features that are expected to be included in the next versions of Apple’s operating systems.
The DMA is intended to force technology companies to make their products interoperable and stop them locking customers into their own ecosystem. Since a closed ecosystem has been central to Apple’s business model, it has been reluctant to offer any concessions to the EU. When it did, they were rejected as insufficient so Apple now appears to have replaced carrots with sticks. In reality, AI Intelligence probably won’t be ready until next year anyway but the other features were widely anticipated, so both sides will be watching the reaction of EU consumers with eagle eyes.
Meanwhile, the EU has accused Microsoft of breaching competition rules by bundling its Teams collaboration tool with Office 365 and Microsoft 365. Microsoft partially unbundled Teams in response to EU demands but the European Commission says the changes don’t go far enough. Microsoft says it “will work to find solutions to address the Commission’s remaining concerns.” We imagine it will, since the alternative is a fine worth up to 10% of its annual revenue.
Threats
Phishing: The UK’s fraud and cybercrime agency says there was a 44% rise in the number of phishing emails reported to it last year. Action Fraud says that as a result it took down 329,000 phishing sites. It’s urging people to continue reporting suspicious emails, text messages, and phone calls.
Android: Old Android devices continue to work perfectly well even though they no longer receive security updates. Check Point found a 60% success rate in attacking devices running Android 11 or earlier. Alas, once updates end so does the useful life of the device.
Extensions: The risk of installing extensions to the Chrome web browser is higher than Google has admitted, according to Stanford University researchers. Their paper appeared as Google claimed that “In 2024, less than one percent of all installs from the Chrome Web Store were found to include malware.” Extensions can be very useful but in order to work they need access to sensitive information. Install with care!
Browsing: Absolute security online doesn’t exist, as Austrian academics have just demonstrated. They managed to track online activities simply by monitoring fluctuations in the speed of the internet connection. Protections such as VPNs made no difference. TechXplore
Trackers: Not altogether surprisingly, an Australian study says tracking devices (including Apple AirTags) are widely used by organised crime groups and known perpetrators of domestic violence. The study by the New South Wales Crime Commission recommends restrictions on the sale of the devices. The Register
Ads: Information stealing software is targeting Mac users via Google adverts for the Arc browser. The same tactics were previously used to distribute a remote access tool which was aimed at Windows devices. Malwarebytes
AI
Shadow AI: It’s increasingly easy to integrate AI tools into existing technology. This week, OpenAI made ChatGPT for Mac available for everyone. Once installed, it can analyse pretty much anything on your device. Whether that’s a good idea is another question. Barracuda examines the use of unauthorised AI tools and the underlying risks and mitigations.
Ts&Cs: The New York Times rounds up the changes leading technology companies have made to their terms and conditions in order to support the development of AI. It’s a weaselly business. We highly recommend tosdr.org which analyses the terms of service that everyone else ignores.
Hate: Extremists in the US are using AI tools to spread hate speech more efficiently, recruit new members, and radicalise online supporters at an unprecedented speed and scale, according to the Middle East Media Research Institute. Examples include President Biden using racial slurs and Emma Watson reading Mein Kampf. WIRED
Flagged: Photographers are complaining that Meta is wrongly labelling their real photos as “Made by AI.” Meta says it’s evaluating its approach. TechCrunch
$365.63: That’s what 404 Media paid ($) a freelancer to replace itself with an AI-generated website. The result was a “nicely laid-out” site with neat categories and seemingly accurate articles (including one published by 404 Media itself.) The Wall Street Journal and News Guard have run similar stories. 404 Media’s conclusion; the advertising system created by Google has led to a “hollowed out internet” that incentivises pumping out endless articles with no effort.
In brief
Breaches: Data breaches galore with the first million stolen Ticketmaster records released for free and multiple companies disclosing new details, including Levi Strauss, a medical devices manufacturer and even a service that authenticates user IDs for Uber, TikTok and others.
Website security: A free open-source tool scans a website for pretty much every security issue. There are separate tools that produce the same information but this one pulls everything together in a single report. WebCheck
Open book: More viral proof that privacy is a dwindling concept today. A woman on board a flight in the US noticed a man chatting with a woman who she surmised was not his wife. So she accused him of cheating and uploaded a video to TikTok. Within two days, online sleuths had identified the man - and his wife.
OK no way: In an unfortunate turn of events, it appears that Oklahoma Department of Education hasn’t been able to log in to its own website because the person who had the password left and didn’t give it to anyone. “Previous employees would stand up additional websites…with sole access…and when they left they didn’t give us information about how to access [them],” an official said.
Rolls-Royced: A $420,000 Rally Royce Cullinan was stolen on its way to a luxury car dealer in Miami when a thief texted a change to the delivery address. NBC6
Updates
MOVEit: Researchers have identified new security issues in the troubled file transfer platform. The manufacturer has issued updates and urged customers to apply them. Last year, more than 2,000 organisations experienced data breaches as a result of flaws in the platform, resulting in the exposure of the data of at least 62 million individuals.
Firefox: Firefox fixed an issue causing problems when trying to play some YouTube videos.
Chrome: Version 126 has important security updates. Meanwhile, Google is reported to have decided to end continuous scrolling for its search results and go back to dividing them into pages.
AirPods: Apple released an important firmware update for its range of headphones. It fixes an issue that can be used to spoof a previously-connected device and allow an attacker to access the headphones.
TP-Link: Omada is a network solution aimed at small and medium-sized businesses. Cisco Talos identified multiple vulnerabilities which have now been addressed.
SecureDrop: Version 2.9.0 improves protection against network attacks.