Data robbers. Phishing for credentials. Trump's AI election gameplan.
What to do about software defects. And Safari privacy.
Out there
This week saw headlineslike “Massive data leak may include the personal data of every person in the US, UK, and Canada.” For a small word, “may” is doing some very heavy lifting here. The facts are that in April a hacker group tried to sell 2.9 billion records containing personal data on what it said was everyone in the US, UK and Canada. The data appears to have been obtained from a company called National Public Data, a ‘data aggregator’ which creates profiles for individuals by harvesting publicly available information from the web and other sources. This week, much of the leaked data appeared on a hacker forum, albeit without the email addresses and phone numbers seen in previous partial leaks.
The latest data dump includes names, mailing addresses, and US social security numbers. In some cases records contain additional information, such as other names linked to the individual. This is all so convoluted that the respected security researcher Troy Hunt has written a long blogpost trying to untangle it. Hunt runs the HaveIbeenpwned website which allows you to see whether your email addresses have appeared in a data breach. Unfortunately, as Hunt explains, in this case the lack of email addresses means his site can’t tell you whether you’re affected.
Our take is that the sheer number of data breaches means there is a vast range of data about us available to anyone who wants it. It’s the result of the pitiful failure of organisations to protect our personal information, made worse by the fact that in many cases we never explicitly gave our permission for them to hold the details in the first place. And, as veteran security reporter Brian Krebs points out, while the situation is bad in general, it’s even worse in the US due to the lack of data protection legislation. So the normal rules apply; be vigilant and don’t accept any electronic communication at face value. And of course, take cybersecurity headlines with a pinch of salt.
Threats
Golden oldie: One of the most consequential phishing emails ever sent was that received by John Podesta. He was the chair of Hillary Clinton’s election campaign and it resulted in Russian hackers accessing his Gmail account (as well as all his other information). The email was a simple message that appeared to come from Google warning that someone had been trying to access his account and urging him to change his password. He clicked on the link in the email and thereby handed his credentials to the attackers. Exactly the same method was used this week to hijack the XTwitter account of Linus Tech Tips. Attackers continue to use this method because it works. The lesson; never click on a link in a message to do anything important like change a password.
Bombed: A sophisticated campaign begins with a deluge of spam emails (an ‘email bomb’). Attackers follow them up with a phone call urging the recipient to download AnyDesk (a legitimate remote access tool). Once installed, they take control of the target computer. Broadcom
Supply chain: Netflix has provided another example of why third-party security is so important. It confirmed that several episodes of upcoming shows were leaked, apparently because of a breach at a subtitling and content distribution company.
PDFs: With apologies for repeating ourselves, PDFs are such a common threat that an alarm bell should sound whenever one is received, even if you’re expecting it. And any PDF containing a link that you’re urged to click should be given a particularly wide berth. A research paper examines the problem in detail and warns that protections have limited effectiveness.
SaaS: Fraudsters are exploiting ‘Software-as-a-Service’ platforms (e.g. Hubspot, Trello, Asana etc.) to generate highly convincing spoof emails. Avanan says they’re so similar to the real thing that they’re extremely hard to spot. The aim is to engage the recipient in a communication and steal credentials or cash.
Hotels: The US National Cyber Security Center has a video outlining how to stay safe when travelling. It’s unintentionally hilarious (with echoes of public information films of the 1950s) but it does make sensible points - like thinking about what electronic equipment you take with you. And not relying on hotel room safes which are definitely among the world’s least safe contraptions.
Gracie: You might have seen reports of the apparent Facebook scam involving a “missing” Texas teenager. Indeed a post about Gracie Mae Thompson may have turned up in your Facebook feed, and some may include potentially dangerous links. As with all these exploitative posts, it’s best to simply ignore them. Malwaretips
AI
Election: Former President Trump accused the Harris campaign of using AI to doctor the size of the crowd at a rally in Michigan. The claim was ludicrous but Senator Bernie Sanders warned that it’s part of a plan to enable Trump to reject the results of November’s vote if he were to lose.
Risks: MIT has put together an “AI risk repository.” In their words, “an attempt to rigorously curate and analyze AI risks into a publicly accessible, comprehensive, extensible and categorized risk database that anyone can copy and use.”
Guardrails: XTwitter’s AI Grok chatbot is happily allowing users to create images including Barack Obama taking cocaine and Mickey Mouse enjoying a beer and a cigarette (while sporting a MAGA cap). Clearly another example of Elon Musk’s devotion to free speech. The Verge
Google: The much-mocked AI overviews are being rolled outto six new countries (UK, India, Japan, Indonesia, Mexico, and Brazil). Google is also changing the way the AI-generated summaries display the source of their information.
Hack: A journalist in Wyoming has been dismissed after using AI to write his stories and invent quotes (to the extent of putting words in the mouth of the state’s governor). His antics were uncovered by a reporter from a rival publication. HuffPost
Feelings: The latest version of OpenAI’s ChatGPT is designed to be more lifelike. This has led the company to worry publicly that users are developing feelings for it. “Extended interaction with the model might influence social norms,” it says. OPenAI also admitted that ChatGPt’s new Voice Mode might suddenly clone your voice without warning.
Meddling
Google’s cybersecurity researchers say Iranian attackers are behind ongoing phishing campaigns against President Biden, Vice President Harris, and ex-President Trump in a bid to influence the US presidential elections. Google’s report comes shortly after the US media received leaked documents from the Trump campaign (details of which were not published, unlike similar information stolen from Hillary Clinton’s campaign in 2016). Iran is assiduous in its efforts to break into its targets’ accounts, masquerading as legitimate think tanks and registering web domains that are almost identical to the real ones. In particular, Google warns that Iran is particularly focussed on identifying personal email addresses which are likely to be less well protected than official ones. That’s a warning that applies more widely because it’s a tactic adopted by many attackers.
In brief
Broken: We often complain about the lamentable quality of much of the software we use. It’s a complaint echoed by the head of the US cybersecurity agency who told the Black Hat security conference in Las Vegas that software ‘vulnerabilities’ are product defects, and it’s about time they were treated as such. “Other industries are obsessed with driving down risk but somehow this doesn’t apply to software. We’ve fallen prey to the myth of techno-exceptionalism.” Jen Easterly said. InsideAIpolicy
Treaty: A UN committee has unanimously accepted a proposed reform of the organisation’s Cybercrime Convention. It will now move to the General Assembly, where it’s also expected to pass. The treaty’s draft was proposed by Russia. The Electronic Frontier Foundation described it as “an extensive surveillance pact.”
Signal: Venezuela and Russia have blocked the messaging platform. For anyone affected, Signal recommends trying its built-in censorship circumvention feature: Signal Settings > Privacy > Advanced > Censorship circumvention (on).
Safari: Apple has been spending a fortune on adverts hailing the privacy capabilities of its web browser (the exploding camera ones). Intego examines the claims and points out that while Safari might be better than Chrome, the implied claims in the adverts might be a tad overstated. Or more simply, online privacy ain’t a thing.
Updates
Microsoft: Multiple updates from Microsoft as well as its monthly set of security fixes (which this time include patches for 10 previously unknown ‘zero-day’ vulnerabilities). In particular, there are important updates for Windows 10, and a workaround for Gmail problems in Outlook
Patch Tuesday: Other companies releasing monthly updates include; Adobe, Ivanti, Fortinet, Intel, AMD, SAP, and Zoom.
SolarWinds: Emergency update to address critical vulnerability in Web Help Desk.
Proton: A VPN browser extension which was previously only available to paying subscribers is now free for all users. Engadget
Tails: Version 6.6 of the privacy focussed operating system updates the Tor Browser, Thunderbird and “many” firmware packages.