Failing to learn lessons from failure. A security company hires a North Korean spy.
The US investigates surveillance pricing. Using advertising data to track a would-be assassin.
Crowdstruck
A week after a medium-sized security company caused the biggest cyber incident the world has seen two things are clear; there are fundamental lessons to be learned and precious little chance they will be. We’ve long argued that the technology on which we depend is inherently flawed because manufacturers are not incentivised to fix their products properly. The result is that the CrowdStrike incident shouldn’t be seen as an isolated incident but as a reminder that such catastrophic failures are inevitable. The real lesson from this is that the entire ecosystem needs fixing and, since it won’t be, effective contingency plans are essential.
We’re not along in our despair at the state of the technology on which modern society depends. Internet veteran Bruce Schneier points to the incident as a perfect illustration of the “brittleness” of modern society in general and technology in particular. “The market rewards short-term profit-maximizing systems, and doesn’t sufficiently penalize such companies for the impact their mistakes can have,” he argues. Schneier has a powerful metaphor for this. Imagine a house built from components made by companies that need continuous access to them and in which a single failure would cause the building to collapse. As he says, you’d never set foot in it but that’s how software systems are built.
For its part, CrowdStrike belatedly apologised and said it would improve the way it tests and rolls out updates to stop anything similar happening again. Given the scale of the impact (an estimated $5.4 billion to Fortune 500 companies), you might have expected they were already adopting that sort of approach. Except…..see above. Meanwhile, TechCrunch reports that CrowdStrike is offering a $10 Uber Eats gift card to some of its customers affected by the incident. So that will make everything better.
Threats
CrowdStrike: One other note on CrowdStrike; it took less than a day for scumbags to begin trying to exploit the incident with a variety of phishing emails. They come in various guises including thousands of malicious lookalike domains and even a fake repair manual.
Insider: US security outfit KnowBe4 says it hired a software engineer who turned out to be a North Korean spy. The interloper used a stolen identity and an AI-manipulated picture to pass background checks. The remote worker was caught after trying to install software on the workstation they had been sent in an apparent effort to harvest information from company web browsers. Although KnowBe4 says it followed up the North Korean’s references, it admits this process could be improved. It has some other excellent suggestions on how to prevent this sort of attack which remote working has made easier to mount (and which is a particular favourite of North Korea).
Credentials: Despite constant reminders about the importance of managing credentials effectively, they remain a key way in which organisations are compromised. The latest edition of Google’s Threat Horizons Report says weak or no credentials were responsible for almost half the initial intrusions that it tracked in the first half of this year. The next biggest cause was misconfiguration or, as Google puts it, failing to ensure best practices.
Dating: Popular dating apps remain a significant risk to personal security, according to a study by Dutch academics. As well as obvious issues like sharing sensitive personal information, the researchers found some apps leaked data because of vulnerabilities in their APIs (which make data available to other programs).
Browsers: Beware of fake updates! Huntress warns about an ongoing campaign which typically begins with a visit to a compromised website, and a prompt asking the user to update their browser.
AI
Surveillance pricing: Eight companies, including Mastercard, are facing a US investigation into their use of “surveillance pricing” to maximise profits. The practice (with which we’re sure you’re familiar) involves using personal data to set individualised prices for the same goods or services. FTC
Reddit: If you want to use a search engine to find things in Reddit, you’ll need Google or Brave. That’s because Bing, Duck Duck Go et al. haven’t agreed to Reddit’s requirements over AI training.
Meta: The future of generative AI should be open source, according to Mark Zuckerberg. In a looong Facebook post, he argues a world of proprietary models would stifle innovation and hand an advantage to countries like China. His post came as Meta released the latest version of its open source model (known as Llama). It’s one of the biggest open-source models yet seen and initial reports suggest it’s competitive with the offerings from OpenAI and Anthropic. TechCrunch
Biometrics: University of Bradford academics have called for protections against what it describes as the harvesting of biometric data. The publication of their article coincided with an English school being reprimanded for using facial recognition without obtaining students’ permission.
In brief
Tracking: A conservative think tank in the US says it used mobile advertising location data to track the movements of Donald Trump’s would-be assassin. The claims from The Heritage Foundation illustrate the power of such information - and its wide availability. 404 Media (R)
Disney: It appears a vast data breach at Disney was caused by an employee who was using a popular driving simulator and unwittingly downloaded a booby-trapped add-on for it. The software development manager had Disney’s Slack channels open on the same computer. Given his position, he should have known better - but we can’t say we’re surprised he didn’t. The Drive
Battlefield: Following reports of record losses in its war against Ukraine, Russia has increased the penalty for personal use of internet devices by soldiers on the frontline. Ukraine has had notable successes in using the information revealed by such devices to locate Russian units and eliminate them. Given this, the actual penalty for using smartphones on the battlefield is often death, but this doesn’t seem to have acted as much of a deterrent. Politico
Takedown: In a vivid illustration of the extraordinary scale of sextortion, Meta has taken down 63,000 Nigerian-based Instagram accounts, 2,500 of which were being used to target adult men in the US. Meta says the accounts are linked to an organised crime group called the Yahoo Boys.
Cold: Dragos has revealed how Russian hackers succeeded in cutting off heating and hot water to over more than 100,000 people in 600 apartment buildings in the Ukrainian city of Lviv. It was a well-planned attack that used malicious software designed to attack industrial control systems.
Cookies: Google is finally abandoning its plan to get rid of third-party cookies from its Chrome browser, a move which would have made it harder to track users’ online activity. Instead, Chrome will offer users an option to reject them “across their web browsing.” And Google will continue work on its ‘Privacy Sandbox’ which supports tracking without tying data so closely to a specific individual. NiemanLab has a good explanation of the issues involved, which go to the heart of the online advertising industry and the tech giants that dominate it.
Updates
Chrome: Google is introducing new measures to protect users from dangerous downloads, including more detailed warnings and the ability to scan password-protected archives such as .zip files. In order to do that, Google will request the password, which may come as something of a surprise - and require some re-education about when to enter passwords in browser popup windows.
Firefox: In an interesting move for a privacy-focussed company, Mozilla has introduced a new feature that tracks advertising clicks, albeit in a “privacy-preserving” way. Users were unimpressed, particularly as the feature was enabled by default. You might want to turn it off. We have.
Safari: Apple has improved the privacy protections in Private Browsing mode, though it’s still important to remember that this doesn’t mean a user’s activity is truly hidden or anonymous. As Apple admits, there’s also a risk that the more controls it introduces to protect user privacy, the more likely it is that a website won’t work as intended.
Goo.gl: Google has long talked about retiring its goo.gl URL shortening service - but said the links would carry on working. Now it says they won’t. The drop dead date is August 25 2025.
Windows: Microsoft has warned that some devices are exhibiting BitLocker problems after installing the July 2024 Windows security updates. Any machines affected by the issue will require their recovery key to clear the problem.
Telegram: A new version fixes a previously unknown (‘zero-day’) vulnerability in the Android app. The issue enabled malicious content to be disguised as video files. ESET