The "biggest cyber incident ever." A calamitous data breach at AT&T. Impersonating HR.
Dark Pattterns. Unlocking a shooter's phone. And phasing out one-time passcodes.
Friday blues
Initial reports suggest a single update to a security product succeeded in bringing much of the world’s digital infrastructure to a grinding halt. Crowdstrike’s Falcon platform has a range of products and it appears a change to a key element (a “channel file” in IT speak) interfered with the Windows startup process. This has resulted in “blue screens of death” on Windows machines around the world, taking broadcasters off air, grounding airlines and causing extraordinarily widespread disruption.
Crowdstrike’s CEO took to XTwitter to explain that the issue only affected Windows machines and wasn’t the result of a security incident or a cyber attack. There is a workaround (which involves deleting a single file) but because machines won’t start up, it can’t be applied remotely. Notably, the CEO failed to provide any sort of apology, resulting in an understandably furious reaction from aggrieved customers.
A respected security researcher says “this will turn out to be the biggest ‘cyber’ incident ever in terms of impact.” The question is whether any learnings will be taken from it. Of course, it shouldn’t be possible for an update to a single product to cause so much disruption but the nature of security products mean that they do have to interact at basic levels with the host system. In this case, it appears Crowdstrike’s update was horribly mangled and so the immediate challenge is to ensure there’s a more robust system to check changes before they get anywhere near to being released.
Mega breach
While a security company managed to bring much of the world to a standstill, US telco giant AT&T lost data about “nearly all” of its wireless customers. That’s around 110 million people. It says an attacker managed to access a cloud storage account and steal details of phone calls and text messages, though not the actual content of messages. WIRED reports that AT&T paid some $370,000 for the information to be deleted. A US citizen is said to have been arrested in Turkey in connection with the attack and is awaiting extradition. The storage platform involved is called Snowflake; the same outfit involved in other breaches including Ticketmaster and Santander Bank. Mandiant believes affected customers hadn’t enabled multi-factor authentication on their accounts, although AT&T hasn’t said whether this was the case with its storage. At the time of the attacks, Snowflake had not mandated the use of multi-factor authentication in all cases. It has now changed its policy.
Threats
HR: Impersonating an organisation’s human resources department is a favoured phishing strategy - and use of it is on the rise. Cofense dissects a recent example - and how the subject line in an email was used to demand action, in this case reviewing the company’s handbook.
McAfee: Fake order confirmations for security apps are doing the rounds. ZDNet has details of one which suggests the recipient paid $715 for a 5-year subscription to McAfee Total Protection. The aim is to lure the recipient into calling a number to ‘cancel’. That’s the start of a type of financial scam aimed squarely at less sophisticated users. The aim is to take over their bank account (and the scam even forms part of the plot of a Jason Statham movie on Amazon).
Facebook: A widespread campaign is using Facebook ads for fake Windows themes and free games to distribute information stealing software. Trustwave
Android: A sophisticated scam used copies of Android apps in a massive advertising fraud operation. The details are complex but involved hijacking the original apps by compromising a software development kit inside them. From a user perspective, the important thing is to avoid apps unless you’re sure of their provenance, and you absolutely need them. HUMAN
AI
Tinder: The dating app has launched a feature that uses AI to help users select the best photos for their dating profiles.
Doctors: Scammers are increasingly using deepfake versions of well-known TV doctors to sell scam products across social media. BMJ
Sports news: GB News says it’s introducing AI-generated sports news bulletins to its radio station. They will be presented by the virtual voice of one of its human presenters. The Independent
Dark patterns
The EU has accused XTwitter of using ‘dark patterns’ to manipulate user behaviour, and of withholding information from independent researchers. The European Commission pointed specifically to the use of so-called ‘verified status’ that boosts the visibility of an account’s posts but doesn’t actually verify its identity. Dark patterns are a well known design approach that influences how we interact with online services, for example by using colours to make us more likely to accept a default option. In the US, the Federal Trade Commission found hundreds of websites and apps using such practices to manipulate users into buying unwanted services and relinquishing control over their personal data.
In brief
Unlocked: The FBI used Cellebrite software to access the phone of the man who narrowly missed assassinating Donald Trump. Initial attempts failed but Bloomberg reports (R) that after Cellebrite provided advice and some unreleased software, it took just 40 minutes to unlock the phone. As documents obtained by 404 Media show, Cellebrite’s capabilities depend on a cat and mouse contest with the phone manufacturers.
Crime: Despite increasing success in global efforts to take down cybercrime operators, the organisations continue to prosper. A particularly long-lived example is the Russian group FIN7. It was first spotted in 2012, has seen numerous of its members arrested, and is still going strong. As SentinelOne reports, it’s now using pseudonyms to sell its solution for neutralising security software - at prices between $4,000 and $15,000.
Faces: 404 Media reports on a thriving industry selling videos and photos of real people that are designed to defeat verification checks for online services. The videos and photos show people holding blank pieces of paper on which documentation can be superimposed.
Banks: Singapore has told retail banks in the country to phase out the use of one-time passcodes within the next three months. Authentication will now require digital tokens on mobile devices.
Updates
Chrome: Security updates for 10 issues, most of them related to memory management.
Thunderbird: Version 128 has been released for Windows, macOS and Linux. Among changes are changes to how it looks and enhanced encryption.
Cisco: Update to address maximum severity vulnerability in on-premises Smart Software Manager.
Oracle: July Critical Patch update includes 386 security patches.
Netgear: Updates for several WiFi 6 router models.
Atlassian: Security updates for Bamboo, Confluence and Jira products.
Tails: Version 6.5 updates the Tor Browser and Debian.