The extraordinary scandal of data breaches. Google fails to keep its house in order.
Security teamsoverwhelmed by AI-powered threats. Not so smart keycards. And faking death to evade child support payments.
Data
More details on the breach at National Public Data (NPD) that we covered last week - and they’re pretty gruesome. NPD has now admitted that a database 2.9 billion lines long was stolen last year. The information in it encompassed email and physical addresses, US social security numbers and phones numbers for more than 272 million people in the US, Canada and the UK. But that’s not the worst of it. Veteran security journalist Brian Krebs reports that a sister service to NPD was found to be hosting files giving access to the same information as those in the stolen database. And those files were completely unprotected.
So what about NPD - the company that harvested all this data from publicly available sources on the internet and then failed to protect it. NPD was founded and run by Salvatore “Sal” Verinian, an actor and ex-sheriff’s deputy from Florida. Perhaps not the ideal custodian for all this information. Meanwhile, the popular flight-tracking platform FlightAware has admitted exposing a wide range of user data including passwords, billing addresses, credit card details, birth years and, of course, US social security numbers. It says the exposure began on January 1 2021 and wasn’t detected until July 25 this year.
A glance at the list of breaches reported to California’s state government illustrates the scale of the data breach problem. So far this month, there have already been nearly 40 reports involving sectors ranging from education to law to healthcare. It’s extraordinary that this situation is allowed to continue unchecked, with virtually no mention of the problem from either US presidential campaign.
Threats
Search: Google continues to make vast profits from its search business while failing dismally to deal with fraudsters gaming the system. The situation is so bad that it’s vital to be sceptical about the authenticity of any adverts that appear alongside searches for software… and even for Google’s own services.
Smartphones: ESET is warning of a new tactic being used against banking customers on iOS and Android. It asks users to install ‘Progressive Web Applications’ which are websites that look like standalone apps. It’s ingenious and wickedly convincing.
AnyDesk: A data extortion group is targeting AnyDesk users and using a fake Windows update screen to distract them while they steal data from their devices. Sophos says the attack begins with an unsolicited AnyDesk connection request.
Privileged: Reliaquest has a useful article on the risks of service accounts which it says are frequently given too many privileges and too little security.
iPhone: Alternative app stores are now available in the EU, thanks to increased competition under the Digital Markets Act. More competition may be good in theory but we’re nervous about the potential implications for security. TechCrunch has more details of the new alternatives. We advise treading very carefully when venturing outside the official app store.
AI
Overwhelmed: A survey of UK Chief Information Security Officers (CISOs) found that 54% of respondents believed their security team to be unprepared for evolving AI-powered threats. Absolute Security
Iran: OpenAI banned several accounts that were part of a “covert Iranian influence operation.” It says they created content related to a variety of issues, including the US presidential elections.
Fake: This week saw the release of tools from McAfee and Grammarly which are designed (respectively) to identify audio and text generated by AI bots. We’re not the only ones to be sceptical about how well these will work.
Swift: It didn’t need a sophisticated tool to spot the problem with the AI-generated photo of Taylor Swift which appeared to show her endorsing former President Donald Trump. A less likely scenario is hard to imagine.CNN
Sacked: An Australian magazine replaced its freelance contributors with a custom-built AI tool. To add insult to injury, it appears it used their past contributions to train their replacement. The Register
Takedown: San Francisco’s city attorney is suing to shut down 16 of the most popular “undressing” websites that enable users to create nude deepfakes of women and girls without their consent.
In brief
Unlocked: A researcher says he found a secret backdoor in the chips used in smart key cards and fobs to control access to buildings including hotels, banks, government offices and factories. The backdoors can be used to create a copy within minutes. The cards are manufactured by a Shanghai-based company and the chips have been on the market since 1994.
M&A: “Some of the past year’s most devastating cyber incidents involved heavily interconnected systems or recently acquired companies.” That’s one of the key findings from a report by Resilience, a leading cyber insurance company.
Management: “Senior-level employees are nearly twice as likely to fall for phishing attempts compared to their entry-level colleagues,” according to a UK survey by a compliance training company. Skillcast
Privacy: The UK data protection regulator has launched an online tool designed to enable small businesses and sole traders to create a bespoke privacy notice. EU and UK data protection law requires every organisation that holds people’s information to explain what it has, why it has it and what it does with it. The tool is easy to use - and should prove invaluable.
Location: Bellingcat is an extraordinarily capable open source intelligence company. It’s just released a geolocation tool that helps to narrow down where an image was taken by analysing the shadows in it.
AirTagged: A California woman had so many items stolen from her mail box that she set out to catch the thieves by sending herself a package with an Apple AirTag inside it. It was duly taken and enabled police to nab the thief and their accomplices. Los Angeles Times
TV: A detailed article from Ars Technica examines how modern TV sets have become part of the digital advertising ecosystem. “Companies are increasingly seeing viewers, not TV sets, as their most lucrative asset,” it argues.
Crash: A researcher found you can crash an iPhone by typing “”:: in the search bar, although it turns out “”: plus any other character will do the trick. Happily, this bug appears a lot less serious than previous similar issues. TechCrunch
Alive: A Kentucky man has been sentenced to up to seven years in prison for hacking into state registries to fake his own death in a bid to evade some $116,000 in child support payments. ars technica
Updates
Google: Important update for Chrome browser to address a vulnerability that is being actively exploited. Google is also making it easier to access passwords saved in Chrome across different devices. It may be convenient but we continue to advise using a standalone password manager.
Microsoft: In a bid to make Azure more secure, from October multi-factor authentication will be required for all users.
F5: Quarterly security update has fixes for nine vulnerabilities, including critical issues affecting BIG-IP and NGINX Plus.
Cisco: Updates for multiple issues, including a high-severity vulnerability in its enterprise collaboration solutions.
Atlassian: August updates address nine serious vulnerabilities in its Bamboo, Confluence, Crowd, and Jira products.
Zoom: You can now have a webinar with up to 1 million attendees. Or, as TechCrunch puts it, “Now a million people can watch you fumble Zoom’s screen-share settings” at the same time.