The impact of disinformation. Defeating a deep-fake scam.
How the online job market was broken. CrowdStrike faces legal action. And judge rules on US border checks.
Disinformation
A single post on XTwitter appears to have fuelled violent protests in the UK following a stabbing attack that killed three young children. The ludicrously unbelievable tweet (now deleted) included a screenshot of a LinkedIn post purportedly from a man who claimed to be the father of two children present at the attack. In it, he (falsely) named the attacker as “Ali al-Shakati”, said he was a “migrant” and demanded the complete closure of the UK’s borders. The tweet was picked up by a self-styled news site and then reposted across the web.
The false narrative was lent support by a variety of public figures and online influencers, including Nigel Farage who questioned whether “the truth was being withheld.” But, as the Institute for Strategic Dialogue explains, key to the narrative’s viral spread was the way in which it was promoted by algorithms on social media platforms. On XTwitter, the false name of the attacker featured as a ‘Trending in the UK’ topic, while on TikTok search results for “Southport” recommended “Ali al-Shakati arrested in Southport” as a suggested query that “Others searched for.”
All this led to widespread anti-Muslim protests organised by extreme right-wing groups which have left at least 50 police officers injured. There have been suggestions that nation states - notably Russia - have been involved in spreading the disinformation; Russia Today certainly picked up the early false reports. But the underlying causes of viral disinformation are lack of effective content moderation, social media algorithms, and the endless search for click-driven revenue.
Threats
Trends: Multiple reports this week underline the scale of online crime. Among the findings;
-
Nearly 7% of internet traffic is malicious, according to infrastructure giant Cloudflare.
-
IBM says the average cost of a data breach reached $4.88 million, up 10% compared to the previous 12 months.
-
The number of ransomware attacks rose by 18% year on year, according to Zscaler.
Email: Attackers exploited an issue in Proofpoint’s email protection platform to spoof well-known brands, including Disney and CoCa-Cola. Guardio Labs says the problem lay in an email routing feature that by default was insecure. At its peak, the spammers were sending up to 14 million emails per day.
Chat: A new campaign is using online chat on its fake payment pages in an effort to make its scam more convincing. Perception Point says current targets are marketplaces like Etsy.
Travel: Bitdefender says its analysis suggests half of all travel-themed spam messages are scams. Many of them target people seeking rentals on Airbnb or Booking.com. A favoured tactic is to falsely claim an account has been suspended.
Android: A new iteration of a sophisticated Android spyware has been found in five Google Play Store apps which remained undetected for two years. The malicious apps were; AirFS, Amber, Astro Explorer, Brain Matrix, and CryptoPulsing. Kaspersky
AI
Ferrari: An executive at the car company defeated a sophisticated deepfake by asking a question the scammer couldn’t answer. The fraudster used voice cloning technology to conduct a live conversation in a pitch perfect imitation of Ferrari’s real CEO. The executive was suspicious and asked the scammer what book the CEO had recommended a few days earlier. With that, the call came to an abrupt halt. Fortune
Training: XTwitter is facing regulatory questions over its decision to harvest users’ data to train its AI model without first obtaining their permission. Ireland’s Data Protection Commission told TechCrunch it was “surprised” by the move. Meanwhile, Texas has ordered Meta to pay $1.4 billion in a settlement to “stop the company’s practice of capturing and using the personal biometric data of millions of Texans without the authorization required by law.”
Pals: Various start-ups have been trying to find a way to use AI to create a truly personal companion. The latest idea is called Friend, a pendant worn round your neck which links to your iPhone and responds to what you say with text messages. There’s an excruciating video demonstrating Friend interacting with users in ever more dystopian situations.
Chrome: Google is adding AI-powered features to the Mac version of its web browser, including a new option to search using Google Lens and the ability to use conversational language to find items in the browsing history.
Jobs
The online job market has been ruined by automated listings and generalised malpractice, according to a trenchant analysis on Salon. Among the problems are “ghost jobs” which involves companies posting listings that either don’t exist or have already been filled. The issue is compounded by job listing sites that harvest vacancies and leave them online indefinitely, resulting in vast numbers of out of date or inaccurate posts. And of course, as we frequently report, fake job adverts are a favoured tactic of scammers and nation state attackers.
In brief
CrowdStrike: More fallout from last month’s Windows outage with CrowdStrike facing legal action from shareholders. They argue that the company touted the efficacy of its platform while failing to implement sufficiently rigorous testing protocols. Delta Airlines says it lost up to $500 million as a result of the incident and is also considering legal action. Estimates of total global losses have reached as much as $15 billion.
US border: A federal judge in New York has ruled that US border agents must obtain a warrant to search travellers’ phones and electronic devices. The order covers both citizens and foreigners but only in New York state.
Passwords: More evidence that many people are wildly over-confident in how they use passwords. Keeper Security found that 85% of survey respondents believed their passwords were secure while over half admitted they shared their passwords with other people. For as long as passwords are around, the only way to use them securely is with the help of a password manager.
Hijacker: 404 Media reports on a scammer who claims to have been earning $600,000 a month from taking over Instagram accounts and demanding payments to unlock them.
Reprimand: The UK’s Information Commissioner’s Office has reprimanded the country’s Electoral Commission for a security breach in which hackers accessed servers containing the personal information of some 40 million people. The ICO said the Commission had failed to update its Microsoft Exchange Server against known vulnerabilities. In March, the UK’s National Cyber Security Centre attributed the attack to a Chinese state-backed attacker.
Piracy: A US court has jailed three individuals behind a massive fraud involving the sale of software licences for Avaya business phone systems worth more than $88 million. Meanwhile, a routine traffic stop in Alabama uncovered a sophisticated operation in which fraudsters created counterfeit copies of genuine Apple products and returned the fakes for a refund.
Updates
Apple: A slew of updates including macOS 14.6 and iOS 17.6, as well. The new versions are mainly focussed on addressing security issues, though the macOS release reportedly adds support for multiple monitors to M3 MacBook Pro devices.
Chrome: Google has apologised for a previous update that disabled its password manager for millions of Windows users.
Acronis: Customers are being urged to install an update to address a critical security flaw in Acronis Cyber Infrastructure (ACI).
VMware: Ransomware gangs are actively exploiting a vulnerability in VMware ESXi to obtain full administrative privileges. A fix was released in June. Microsoft
Cisco: Updates for multiple products affected by a critical vulnerability in the RADIUS protocol.