Shaky foundations. Plane hack. AI's environmental impact.
China introduces border checks for electronic devices. And exploiting teenage insecurity.
Fragile
This week provided yet more evidence that much of the technology we depend on is a house built with faulty concrete perched atop a major earthquake zone. Among this week’s evidence;
-
Remote access service TeamViewer said Russian spies accessed its corporate network.
-
A utility used to provide secure access to widely-used Linux systems has been vulnerable to attack since 2020.
-
Almost every Apple device has been at risk for years because of open-source software used in iOS and Mac apps.
-
Some 100,000 websites potentially redirected visitors to dodgy destinations because of third-party software code used to add functionality to older browsers.
And that’s only a (very) partial list.
As is often the case, TeamViewer tried to reassure everyone by sayingthe issue only affected its corporate network and was “tied to credentials of a standard employee account.” Frankly, we don’t find that particularly reassuring, especially as the company has been less than forthcoming with answers to perfectly reasonable questions. And the fact that the compromise of a single employee account allowed access to TeamViewer’s corporate network simply means its authentication processes were inadequate.
In some ways, the other cases are more worrying because at least TeamViewer could improve its authentication measures (for example by adopting phishing-resistant multi-factor verification). Where vulnerabilities result from issues with third-party software, the problem lies in the foundations of digital technologies. These may rely on open-source software which is often maintained by volunteers or on commercial projects which can be bought and ruthlessly exploited. A fragile foundation indeed.
Threats
Evil twin: Australian police have charged a man with setting up a WiFi network on at least one commercial flight and using it to harvest passengers’ credentials. The technique is known as an “evil-twin” attack and it’s one of the reasons we warn about the risks of public WiFi networks. It involves setting up a network with a name almost identical to the real one and requiring social media credentials in order to use it. The Register
Authy: Users of Twilio’s authentication app should be on their guard for phishing messages following a security breach that resulted in the theft of 33 million phone numbers along with other user information. Twilio
MFA: On the subject of authentication, simple one-time passcodes are no longer sufficient protection against attack. They’re better than nothing but attackers are getting increasingly good at bypassing them. The Hacker News has a good primer on the issue.
Targets: Sophisticated phishing campaigns are targeting senior executive at some of the world’s biggest companies, according to Menlo Security. Three groups are impersonating legal firms and using a toolkit designed to bypass multi-factor authentication.
AI
Greedy: We’re failing dismally to recognise the environmental impact of the headlong rush to develop AI - let alone to do anything about it. A research consultancy estimates ($) that adding AI-generated answers to all Google searches could easily consume as much electricity as the country of Ireland. Ongoing use of fossil fuels and a severe drain on water resources are among the impacts of the new data centres required to support AI operations. Jacobin
Ukraine: The New York Times reports on Ukraine’s use of openly available AI code to turn consumer technology into weapons including autonomous drones and machine guns.
Narrator: ElevenLabs has launched an iOS app that uses AI to convert text to audio. What differentiates it is the quality of the narration which is remarkably natural and can handle any text you upload - providing it’s in English. Among the available voices are deceased actors including Judy Garland, Burt Reynolds and Laurence Olivier. It does require an ElevenLabs account. VentureBeat
Consultancy: There’s no question that big consultancies are the ones making money out of AI at the moment. McKinsey forecasts generative AI will comprise about 40% of its business this year while IBM expects to bill $1 billion in AI-related sales. MORNING BREW
In brief
China: New rules have come into effect giving Chinese border officials the authority to search the electronic devices of foreigners entering the country. We’ve always advised considering carefully whether to take normal devices to China. Now it’s even more important to do so. Kyodo
Overview: An interesting albeit worrying read-out from the recent Oxford Cyber Forum by The Economist’s (excellent) Defence Editor. “Bottom line is that cyber landscape reflects darkening mood in wider security.”
Anti-social: Meta is the latest technology giant to fall foul of EU competition rules. Regulators say Meta has breached the new Digital Markets Act by forcing Facebook and Instagram users to choose between seeing ads or paying to avoid them. Meanwhile, a Norwegian court has ordered dating app Grindr to pay €5.65 million for handing details about its users’ dating activities to advertisers.
Healthcare: A sacked employee at an IT provider resulted in a data breach at a US healthcare system in Pennsylvania. The former employee accessed the personal details of patients two days after he was fired. Geisnger
Doctors: The British Medical Association has advised GPs to turn off part of the functionality in their networked IT systems. The feature can be used to update patient records remotely.
D-Link: Support for DIR-859 WiFi routers ended in 2020 but many are still in use. They shouldn’t be because they’re a serious security risk – and D-Link has just warned about a vulnerability that could allow an attacker to access them and copy account information, including passwords.
Looksmaxxing: The social media trend capitalises on (mostly male) teenage insecurity and advises them how to become more attractive. At their mildest, ‘looksmax’ creators advise on face-washing. At their most extreme, they recommend steroids and jaw-pummelling to induce micro fractures. Fortune
Updates
Entrust: Google is withdrawing support for website security certificates issued by Entrust, saying its record falls short of expectations. The decision affects Transport Layer Security certificates issued after October 31 2024. Entrust is one of the many certificate authorities (CA) that underpin the system used to verify the trustworthiness of websites.
Juniper: Emergency updates for Smart Session Router, Session Smart Conductor management platform to address a maximum severity issue.
Cisco: Fix for previously unknown (‘zero-day’) vulnerability in NX-OS software affecting multiple switches.
Proton: The Switzerland-based privacy outfit is further expanding its list of services with a web-based document editing and collaboration tool. This could be a valuable alternative to Google Docs but we note that it’s one of several new services which Proton has added in recent months. We hope it has the resources to support them.