Renewed Apple security warnings. Russia disinformation network taken down.
10 billion stolen passwords. And TikTok kids torment teachers.
Apple warning
Apple has issued a new round of threat notifications to iPhone users, warning about what it calls potential ‘mercenary spyware attacks.’ In the advisory to users in 98 countries, Apple says, it has “detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple ID.” TechCrunch says users in India are among those to have received the warning which follows a similar round of notifications in April. Apple advises the affected users that they are probably being targeted because of who they are or what they do.
Apple used to refer to these types of attacks as ‘state-sponsored’ but adopted the term ‘mercenary spyware’ following pressure from the Indian government. Opposition politicians, journalists and activists in India have repeatedly accused Prime Minister Modi’s government of targeting them with spyware. Whatever it’s called, Apple’s latest warnings underline the reality that commercial spyware is an ongoing threat to anyone whose position or work makes them an object of interest.
iPhones have an optional mode that makes it harder for spyware to infect them. Otherwise, protections involve ensuring phones are updated with the latest software version, and being alert to any unusual behaviour including poor battery performance. Unfortunately though, sophisticated spyware like NSO’s Pegasus product exploit ‘zero-day’ flaws in Apple’s technology which by their nature have never been seen before and against which there is no guarantee of protection. For people at extreme risk, the only defence is to seek specialist advice…and reduce use of digital technology.
Threats
SMS: Apple has also released updated guidance for its customers on how to recognise and avoid social engineering cams like phishing messages and fake support calls. It follows reports of SMS-based attacks targeting Apple ID accounts.
eBooks: The cost of living in many parts of the world has seen renewed interest in pirated video and books. While understandable, this is a horrible security risk. ‘Torrents’ are a key mechanism for distributing illegal material and at the moment there are malicious examples that purport to offer popular eBooks but actually contain malicious software. Trellix
Jobs: In our awareness sessions, we always highlight the use of fake job ads. They’re very effective as a way to target employers and would be employees. KnowBe4 explains what to watch out for.
LNK: LNK-files are shortcuts that are designed to launch a program or run a script. As such, they’re an ideal way to hide a malicious payload, and a recent campaign has been using them to target organisations in the Philippines. As often happens, the shortcuts arrive in what appear to be official government advisories. If run, they install a backdoor that provides attackers with access to the device.
Double scam: Scumbags are targeting Australian victims of previous scams with schemes that offer to recover their losses in return for an up-front fee. People over the age of 65 are the most common target. ACCC
Home: Chinese state-sponsored attackers are increasingly looking for end-of-life home and small office routers that they can hijack and use as part of their operational infrastructure. It’s another reminder that once support for a device ends, the only thing to do is dispose of it (securely). The warning is part of an international advisory examining Chinese cyber tradecraft.
Celebrity: A quite extraordinary tale from the US where a Department of Energy contractor lost his security clearance following a ‘catfishing’ scam in which he sent $3,800 to someone he thought was a famous actress. He had stolen the money from a non-profit organisation where he was a board member. When his family found out, he ended up in a physical fight with his sons. At a hearing, the contractor said he still wasn’t sure who he had been talking to online and he continued to believe it could have been the actress. The Department of Energy is in charge of nuclear facilities in the US.
AI
Copyright: YouTube says a new tool will remove unauthorised audio from videos rather than taking down the entire upload. It’s aimed at satisfying copyright owners while ensuring videos remain online - and continue to earn money for their creators and for YouTube.
Audio: Yet another new feature from ElevenLabs removes unwanted ambient noise from audio. This is something you can do manually, but ‘AI Voice Isolator’ automates it. It’s impressive!
Scraping: Cloudflare has a new, free tool to prevent website data being harvested to train AI models. “Customers don’t want AI bots visiting their websites, and especially those that do so dishonestly,” the cloud service provider says. “We fear that some AI companies intent on circumventing rules to access content will persistently adapt to evade bot detection.”
Takedown
The US has taken down a huge Russian disinformation operation that used XTwitter to spread Kremlin propaganda around the world. According to court documents, the network of automated bots comprised at least 968 accounts and was run from the Moscow headquarters of Russia Today. The operation was set up in 2022, shortly after Russia’s invasion of Ukraine with the aim of spreading disinformation and favourable Russian narratives about the war. Leading researcher John Scott-Railton breaks down some of the sleuthing involved in taking down the network. As he says, “Russia is one of many countries now swamping XTwitter with AI-driven bots to shape perceptions. Even smaller countries’ operations flourish and aren’t taken down after being identified.”
In brief
Passwords: Hackers have released the biggest compilation of stolen passwords yet seen; all 9.9 billion of them. Importantly, this doesn’t mean they’re new - in fact, most of them aren’t. But a comprehensive collection like this does make it easier for attackers to try to exploit them. So time for a reminder to adopt a password manager and multi-factor authentication, to never reuse passwords…and to use passkeys wherever they’re available.
Signal: This week saw a renewed flurry of concern over the security of the secure messaging platform, prompted by long-standing worries about Signal’s desktop app. After initial dismissals, Signal did move to address some of the concerns. We’ve had several people ask whether Signal is safe. Bottom line; it is as safe as your devices are. In other words, if someone can access your phone or computer, then most likely they can also see your messages. And, as we’ve often said, the desktop app is by its nature less secure than the smartphone version.
Ticketmaster: Hackers have released data that they say can be used to create tickets for sought-after shows including Bruce Springsteen, Olivia Rodrigo and the Hamilton musical. They claim the data enables someone to create and print a ticket already sold to someone else. 404 Media
Printers: If you have a multi-function printer, protect it! That’s the advice from a veteran penetration tester whose first port of call on an engagement is to find a printer and see if it has ‘scan-to-email’ set up. If it does and the settings can be changed, it opens the door to all sorts of mischief.
Russia: Apple has removed 25 VPN apps from the Russian version of its App Store following a request from the country’s communications regulator. Russia has been trying and failing to block VPN protocols at the network level for almost two years. Reuters
TikTok torment: Pupils at a middle school in a “wealthy Philadelphia suburb” targeted teachers with a campaign of extreme online harassment. The New York Times described it as “the first known group TikTok attack of its kind by middle schoolers” in the US. The 12-and 13-year olds set up fake accounts with their teachers’ names and portrayed them sharing “pedophilia innuendo, racist memes,” and homophobic posts.
Updates
Patch Tuesday: Monthly security updates from Microsoft (a bumper edition), Adobe, Cisco, Fortinet, and Zoom.
Microsoft: As well as its security updates, two other Microsoft announcements. It’s adding spellcheck and autocorrect to Notepad (not without complaints from some users) and there are important changes to the way Teams handles external data feeds.
Firefox: Version 128 includes new translation capabilities as well as a unified approach to deleting user data. The new version requires Windows 10 or newer, and macOS 10.15 Catalina or newer.
Advanced Protection: ’Passkeys” are the simplest secure authentication method. Google is adding them to its Advanced Protection Programme. Definitely worth adopting.
Dark web: Google is also about to make its dark web reports available to anyone with a Google account. The aim is to provide details about any stolen information, including phone numbers and physical addresses. It will be part of the Results about you page.