Crypto fraud and the third age. Sextortion again.
Meta harvests Instagram and Facebook posts. UK crime fighting "on its knees." And more gory details on the US navy crew and their secret Starlink dish.
Growth sector
Losses in the US from cryptocurrency-related frauds and scams reached more than $5.6 billion last year, a 45% increase on the figure for 2022, according to the FBI. More than two-thirds of the losses were connected to investment scams and most of those involved people over the age of 60. Typical schemes involve promises of improbably huge returns on funds invested in fake currency and property “opportunities.” The scams often begin by persuading their victims to invest a small initial amount and paying them the return. That process could continue for a while before the scumbags move in for the kill. It’s vital to discuss this scam with elderly friends and relatives, particularly those who have funds to invest.
Threats
Sextortion: It seems every week brings new variation on this scam. The latest targets people by saying their partner is cheating on them, with links to the supposed proof. It’s a vile but highly profitable business. This week, four US residents were charged for their role in a sextortion scheme that targeted thousands of victims in the US, UK and Canada. Between them they handed over at least $1.9 million to the scammers..
Sneaky: A particularly devious attack deceives victims by exploiting the (legitimate) ability of webpages to refresh themselves automatically. The method begins with an email containing a link to a webpage. That page has another link embedded in its response header. That means it automatically redirects visitors to a malicious site without them noticing. The final destination is a login page that mimics various widely-used services in order to steal the user’s passwords. Unit 42
Tax: Sophisticated attackers have been masquerading as government tax agencies in what Proofpoint believes is an espionage campaign. It’s designed to steal information from Windows devices, with a significant number of organisations targeted in the media sector.
AppleCare+: A malicious advertising campaign is using Google Ads to promote GitHub pages which list fake AppleCare+ support services and phone numbers. Malwarebytes
PDF: Russia appears to be using booby-trapped PDF files in attacks against NGOs in the region. The files arrive as locked attachments to an email with a link that supposedly allows them to be opened. In fact, the link just leads to a page designed to obtain credentials. The Register
AI
Fodder: Meta has admitted that it has used all public Facebook and Instagram posts since 2007 to train its generative AI model. The admission was made during an investigation in Australia into Meta’s approach to privacy (or lack thereof). The company has suggested only the posts of adults were involved, though its assurances appear far from convincing. Users in the EU and UK have been able to opt out of having their posts harvested but no such option exists elsewhere. ABC
Treaty: Countries including the US, UK, and members of the EU have signed an AI safety treaty focused on protecting human rights, democracy and the rule of law. It won’t surprise you that many areas are excluded from its remit, not least anything related to “the protection of…national security interests.”
HR: With the EU’s AI Act now in force, organisations are being advised to consider the impact on HR practices. BH Consulting warns that the act could apply when AI is used to target job advertisments, analyse and filter applications, and assess candidates. The act doesn’t apply to UK organisations unless their operations extend to the EU.
Entrapped: Police in the US are using AI to create child images as part of their efforts to catch adult predators. The New Mexico Department of Justice said it set up a fake Snapchat account for 14-year old girl. It was quickly exchanging messages with accounts, including ones named “child.rape” and “pedo_lover10.”
Trainers: Amazon has announced that it’s recruiting voice actors to train its AI model so that it can generate new recordings of audiobooks. TechCrunch
In brief
Broken: The UK’s National Crime Agency is “on its knees,” according to a report from Spotlight on Corruption. The agency leads the UK’s fight against organised crime, including cyber crime, but the report says it’s losing nearly a fifth of its cyber capability annually.
TfL: As London’s public transport system continues to wrestle with the fallout from last week’s cyber attack, it emerged that a 17-year-old male had been arrested in connection with the incident. Some systems are still offline and The Register reports that all 30,000 employees will have to turn up in person to have their passwords reset.
Predator: Spyware never dies, it just hunkers down and re-emerges with new capabilities. Latest exhibit is Predator which disappeared in response to US sanctions but which Recorded Future says has now re-emerged in countries including the Democratic Republic of the Congo and Angola.
Autos: Ford Motors has applied for a new patent. It’s for technology designed to target in-car advertising based on what people are talking about in the vehicle. Last year, Ford dumped another patent application. That one related to a system that would commandeer vehicles whose owners had outstanding payments on the vehicle. The Record
Avis: A particularly bad data breach at the car rental outfit has affected at least 299,000 customers. What makes it serious is that not only were names, physical addresses and driving licence details stolen but the company also managed to lose full credit card numbers and their expiration dates. Companies are not supposed to store complete numbers in a usable format and Avis hasn’t explained why it was doing so. Security Week
Forgetful: An Australian tech expert says he sees many people use the ‘Forgotten Password’ option as their default way of logging into sites. In other words, they never bother with remembering passwords or using something to manage them. This isn’t necessarily unsafe, though it does open up some interesting options for attackers. Ruben Schade suggests it does mean maybe there are better ways to design systems in the first place.
ISPs: Chinese government-backed attackers have been penetrating US internet service providers to spy on users, the Washington Post reports. The attacks are described as unusually aggressive and sophisticated, targeting at least two major providers with millions of customers as well as several smaller ones. There are measures to protect against this type of attack, including using a VPN and changing DNS settings.
Nicked: We’re often asked what happens to smartphones when they’re stolen. The answer, as one victim told the BBC, is that many of them end up in China. As a previous investigation found, their precise destination is a specific building in Huafa South Road, in Shenzhen.
In the navy: We reported previously on the US warship whose crew chiefs conspired to create their own internet access by installing a Starlink dish on the vessel. More details have now emerged about their bespoke WiFi network (named “STINKY”) and the lengths they went to hide it and deceive the ship’s officers. There is an important lesson; even people in trusted positions will do dumb things to make their lives better - or easier. And they’ll do it even at the expense of their own safety.
Updates
Apple: Lots of excitement as Apple revealed its new iPhone models this week (marginal improvements in our view). More important is the imminent release of iOS and iPad18, and macOS 15.1. They’re due on September 16 and we suggest waiting before installing the iPhone and iPad versions. Major changes have a nasty habit of harbouring bugs and, in any case, these versions won’t contain the AI and machine learning features that Apple has been promising. Those are due later in the year.
Patch Tuesday: A flood of monthly updates including fixes for four previously unknown (‘zero-day’) issues affecting Microsoft products. Also announcements from Adobe, Intel, Citrix, and Zoom.
Google: As part of a new partnership, search results will not include now include links to versions of webpages from the Internet Archive’s Wayback Machine. This follows Google’s decision earlier in the year to remove its (very useful) cached links.
Tails: Version 6.7 of the security focussed operating system updates Tor browser, Thunderbird and OnionShare.