Dangerous misconceptions. Fake ads for Google Authenticator.
Surging use of AI to compose phishing emails. Social media and violence in the UK. And exploiting kids online.
Misconceptions
New research has provided a handy tour of the many misguided beliefs afflicting users of digital technology. Among thefindingsof the global survey of 10,000 18-40 year olds carried out for Kaspersky;
-
39% believe it’s perfectly safe to log onto public WiFi hotspots.
-
40% think browsing in ‘incognito mode’ makes their activity completely invisible.
-
22% are sure that iOS-based products are immune to all attempts to hack them.
-
35% forward messages to family and friends to avoid “breaking the chain.”
-
24% believe using messenger services like WhatsApp make web links safe to use,
-
44% take funny tests or play mini-games on social media and post the results.
That’s an awful lot of dangerous misconceptions. They underline how important it is to talk about these issues and banish misunderstandings, hopefully before they have the chance to cause harm.
Threats
Authenticator: Some enterprising fraudsters managed to use Google’s ad system to peddle a fake copy of Google Authenticator. The scam was designed to target anyone using Google to search for the multi-factor authentication tool. As Malwarebytes explains, the moral of the story is to avoid clicking on adverts to install software - or to do anything important for that matter. Jamf has a separate analysis examining the risks of fake iPhone updates.
Targeting: A site impersonating a legitimate networking tool is being used to target IT professionals. The fake is a close copy of AngryIP’s genuine site. Quorum Cyber
Brands: Microsoft was used in 57% of phishing attacks in the second quarter of this year. Apple and LinkedIn were the next most popular, according to Check Point.
For sale: A Russian cyber-espionage group has been using car adverts to target diplomats across the EU. This type of lure is a long-time favourite of Russian threat actors. UNIT 42
ScreenConnect: Proofpoint says it has seen a rise in malicious use of the remote access and management program. Attackers are exploiting it to access infected systems since it’s not usually detected as malware.
Laser: A hacker has demonstrated how to use an invisible laser beam to detect what a MacBook user is typing, from a distance, through a window, without being able to see the keyboard. The approach relies on analysing vibrations from keystrokes. WIRED
AI
BEC: AI tools are being used to compose 40% of business email compromise messages, according to a study by Vipre security. The giveaway is that emails written with the help of AI have better spelling and fewer grammatical errors. (Business email compromise or BEC is a scam that targets senior executives at high-value organisations),
Rubbish: 404 Media’s latest investigation reveals (R) why there is so much bizarre AI-generated spam on Facebook. The bottom line is that grotesque images (a skeletal man being eaten by insects, for example) attract clicks. And clicks mean cash.
Watermarking: OpenAI has a system to denote text created by ChatGPT but can’t decide whether to release it. The Wall Street Journal says there’s concern the watermarking technology could be circumvented. And then there’s the small matter that people have said they might reduce their use of ChatGPT if it was implemented. The Verge
Insghts: Users are revealing significant amounts of personal information in their conversations with chatbots, according to an academic study. Data included users’ full names, employer names as well as detailed sexual preferences.
Interface: OpenAI has begun rolling out a new ChatGPT Voice feature which is designed to support real-time conversations, complete with emotion detection. It’s initially available to a small group of ChatGPT Plus users, with wider availability later this year.
In brief
Violence: XTwitter and Telegram have emerged as key elements in the violence that has spread across the UK since the killing last week of three young girls. Use of Telegram surged following the murders, with an anti-terrorism group accusing it of contributing to the violence because of “inadequate moderation of extremist channels.” The UK government’s disinformation unit has been compiling examples of posts it believes are spreading disinformation and inciting violence, with XTwitter accused of being slow to respond to requests to remove material deemed a threat to national security. FT
Election: Meanwhile, the nonprofit Center for Countering Digital Hate says Elon Musk’s misleading claims about the US election have accrued 1.2 billion views on XTwitter. None of Musk’s posts carried a “Community Note” to correct his claims or add context to them. NBC
Turkey: A week after banning Instagram, the government has blocked access to 27 VPN services - apparently in an attempt to prevent users circumventing the ban. Proton, NordVPN, and Surfshark are among those affected. IFOD
Stung: Pig butchering is the vile term for a vile practice in which victims are fattened up to maximise the amount of money extracted from them. The BBC’s cyber reporter played along with an Instagram scammer posing as an attractive woman in her 30s. His report reveals the highly effective psychological tricks used to overcome people’s suspicions.
Extensions: The popular ad blocker uBlock Origin will soon cease to work in Google’s Chrome as a result of fundamental changes to the browser. Ad blockers are a good thing, so it’s worth installing an alternative such as AdBlock Plus which has a good reputation.
Disinformation: A Ukrainian news outlet linked more than 2,000 TikTok accounts to a Russian operation aimed at creating fear and division around Ukraine’s latest mobilisation efforts. The accounts produced more than 41,000 posts in a week and received over 10 million views.
Kids: More evidence of how far companies will go to harvest data about children and pepper them with ads. The US Justice Department is suing TikTok for collecting personal information from children under 13 without obtaining their parents’ consent. And the Financial Times reports that Google and Meta made a secret deal to target teenagers with ads for Instagram on YouTube, skirting the search company’s own rules for how minors are treated online.
Ad spend: After telling advertisers to “go fxxx themselves,” Elon Musk is now suing them for not advertising on XTwitter. The complaint alleges the advertisers unlawfully colluded in a (possibly understandable) decision to spend their money elsewhere. The lawsuit has already resulted in a global trade group closing a watchdog cited in the claim. The Register
Updates
Apple: iOS 17.6.1 and macOS Sonoma 14.6.1 include bug fixes and security updates. Apple also released iOS 16.7.10 for older iPhone models.
Android: This month’s security updates address 46 vulnerabilities, including a high-severity remote code execution (RCE) exploited in targeted attacks.
1Password: Mac users with versions before 8.10.36 should update the app immediately because of a serious vulnerability.
Sonos: Details have emerged of vulnerabilities in the company’s smart speakers, including one that could have been exploited to eavesdrop on users. The issues were fixed last year but Sonos only revealed them last week.