The problems with digital wallets. AI's contribution to the growth of digital fraud.
Why Telegram is a lousy messaging solution. The bank CEO and a $47 million scam. And the Pentagon turns to Tinder.
Wallets
An academic study brings more news about the fragility of the world’s digitalinfrastructure. The research explains how vulnerabilities in today’s financial ecosystem can be exploited to add stolen cards to digital wallet apps and use stolen funds without being detected. There’s a list of problems including ineffective or non-existent use of multi-factor authentication and a poorly-designed process for replacing stolen cards. The paper, by researchers at the University of Massachusetts Amherst and Pennsylvania State University, amounts to a handy guide for anyone looking to subvert the digital payments system. Despite this, the academics say there’s been a patchy response from the organisations and services they examined. When they presented the paper at last week’s USENIX security conference, they said they were still waiting for a response from AMEX, Bank of America, US Bank, Apple, and PayPal.
Threats
BEC: Business Email Compromise is perhaps the most significant risk for most organisations. If you haven’t been targeted yet, it’s only a matter of time before an email turns up trying to persuade you to transfer funds to what appears to be a genuine account. VIPRE’s latest Email Threat Trends Report says AI is compounding the problem and is being used to generate some 40% of all BEC emails.
Support: Technical support scams are some of the oldest online frauds but they continue to be used because they work. Malwarebytes has two examples that might fool even the savviest. Both exploit Google search ads and Microsoft’s learning portal. They look and feel worryingly real. As we frequently say, the results of Google searches simply can’t be trusted.
Sway: Microsoft Sway is a cloud-based tool for creating newsletters, presentations, and documentation, making it an ideal vehicle for digital scumbags. Netskope has details of a new campaign that serves up QR codes on Sway. If scanned, they redirect users to phishing websites.
Mac: Beware of information stealing software masquerading as genuine apps, including CleanMyMac, Grand Theft Auto IV, and Adobe GenP. In order to be infected, you would have to agree to install an unsigned file which, needless to say, is a pretty dreadful idea. The Hacker News
Funerals: Malwarebytes is warning about a new variation on the theme of preying on bereaved people. The Facebook scam aims to steal money and/or financial details by using stolen images and creating links that appear to lead to live streams of funeral services.
Tolls: The US has seen a rise in the number of highway toll text scams, according to Symantec. Fraudsters are targeting people across multiple states with SMS messages demanding payment for fictitious charges. The Record
AI
Police: Law enforcement has been one of the most enthusiastic adopters of AI technology. The latest example comes from Texas where the Department of Public Safety has signed a five-year contract for an AI surveillance tool designed to track cell phone movements. The Texas Observer says Tangles can exploit data from online advertisers and data brokers for which a court order is not required.
Meet:Google has begun rolling out its latest AI-powered feature. It’s similar to the existing transcription tool in Meet but adds the ability to summarise what was said during a session.
Pin: The latest standalone AI-powered device is a wearable tag designed to record and transcribe conversations. Plaud claims to be able to translate 59 languages and summarise what has been said. Engadget
Hiding: Journalists in Venezuela are using AI-generated avatars to disguise their identities as they report on the political situation in the country amid a fierce crackdown on independent media. The Guardian
Telegram
As France continues its investigation into Telegram boss Pavel Durov, there are a couple of things we would point out. Firstly, Telegram is a cesspit of crime and filth so this is a fascinating test to see whether a nation state can do anything about it. Secondly, Telegram is widely used by people who believe it can protect their identities because their conversations are secret. In reality, while Telegram can encrypt the content of messages, the feature isn’t enabled by default (and doesn’t work for group chats). And, in any case, the content of messages is stored on Telegram’s servers where they can be accessed. Our standing advice is that the platform is useful as a research tool but not for anything else. For more details, respected cryptographer Matthew Green has adetailed analysis.
In brief
Butchered: A court in Kansas has sentenced a banker to 24 years in prison for a $47 million fraud using money from the bank he was running. It’s one of the most extreme examples we’ve seen of a ‘pig-butchering’ scam in which a victim is contacted on social media, lured into a relationship, sold a seemingly attractive investment opportunity, fattened up, and finally metaphorically slaughtered for the money. NBC News
Russia: Google says it has evidence that Russian government attackers are using exploits that are “identical or strikingly similar” to those previously used by spyware manufacturers Intellexa and NSO Group. Google’s Threat Analysis Group points out, as we frequently do, that despite the manufacturers’ assurances that they only sell their products to legitimate buyers, that doesn’t mean they don’t end up in the hands of others.
Phones: Dutch cabinet ministers have been instructed to leave their phones, tablets and smartwatches in a secure vault during meetings. The Prime Minister (who used to run Dutch intelligence) described electronic devices, smartphones, iPads as “microphones.” Politico
Eavesdropping: In the same vein, 404 Media has followed up its earlier reporting about a service that claimed to target adverts based on what smartphones and other devices overheard. It has obtained a ‘pitch deck’ from Cox Media Group which provides details - and prices - for its service. As we said last December, we’re not convinced about the company’s claims, not least because our smartphones provide so much information about us that analysing conversations isn’t actually necessary.
Vote: Thousands of US election-related websites are being used for phishing, scams, and spreading voter misinformation. BforeAI says the sites redirect voters to phishing sites which try to collect donations or seek to suppress voter turnout by providing incorrect data on voting requirements, dates, and locations.
Camera: Attackers are exploiting a vulnerability in a widely-used surveillance camera made by Taiwan-based manufacturer AVTECH. Akamai says the AVM1203 is no longer sold or supported so the issue won’t be fixed.
Sextortion: An Australian man has been sentenced to 17 years in prison for orchestrating what police described as “one of the worst sextortion cases in history.” The 29-year-old pretended to be a famous teenage YouTuber and blackmailed hundreds of victims across 20 countries, most of them children, many under 16. Police said he was motivated by “his own sadistic pleasure.” BBC
Tinder: In an interesting insight into where the US thinks potential attackers might be hanging out, the Pentagon has been advertising on Tinder. The ads warn people in the Middle East against taking up arms against the US and its allies. They show US aircraft flying around the region. Washington Post
Updates
Microsoft: A fix has been implemented to address a problem in which Microsoft 365 was incorrectly flagging some email messages as malicious.
SonicWall: Important updates for Gen 5, Gen 6 and Gen 7 firewalls. If left unpatched, the vulnerability could result in unauthorised access or crash the device.
Cisco: Updates to address multiple NX-OS software vulnerabilities.
Fortra: Important updates for FileCatalyst Workflow.
SecureDrop: Client 0.13.1 includes improved printing support and user-friendly error reporting.