Russian disinformation efforts. More warnings about QR codes. Larry Ellison's panopticon.
Anonymity online. And visitors caught out by Mexico's limits oncomputing devices.
Electioneering
Russia seems desperate for Donald Trump to be the next US President, given the stream of fake news it’s producing to try to discredit the Harris/Walz campaign. The fourth of Microsoft’s election reports details some of the “outlandish” fake videos, including one showing what appeared to be Harris supporters attacking a Trump rally attendee. Microsoft says the Russia has a strategy of denigrating the Democratic candidate in the final 90 days before polling day. It reckons this is the direct result of instructions from the Kremlin.
Russia’s efforts appear to have received a big helping hand from Elon Musk who, according to NBC News, has repeatedly amplified Russian disinformation content. Musk, who has 198 million XTwitter followers, shared Russian-aligned talking points more than 60 times. The content was produced by a company that (as reported this month) appears to be a key part of Russia’s disinformation efforts. We’re not suggesting - and neither is NBC - that Musk knew about the Russian money behind the operation.
Russia is far from alone in its meddling. Iran is also busy trying to influence the outcome of the vote, though in the opposite direction. US officials say it sent information stolen from the Trump campaign to its opponents, who seemingly ignored it. China’s approach is slightly different. A US threat assessment says its aim is to undermine US democracy as a whole.
Threats
QR: A renewed warning about scanning QR codes in UK car parks. The RAC says there have been incidents across five councils in which fake codes have been stuck on payment machines. Much safer to download an app and use that instead.
Locked: Hackers are exploiting web browsers’ ‘kiosk mode’ to lure users into entering their credentials on what appears to be Google’s login page. The mode is designed to lock down the browser so that it can be used only in a specific configuration. In this case, the idea is to frustrate the user until they enter their credentials because they can’t do anything else. The solution, obviously, is to close the browser, forcibly if necessary. 0ALABS
Cloning: In a survey of over 3,000 adults in the UK, 28% said they had experienced an AI voice cloning scam in the past year. Starling Bank says its survey also found nearly half of the respondents had never heard of the technique. To defeat it, the bank is promoting the idea of sharing a “safe phrase” with friends and family.
LinkedIn: North Korean attackers simply love LinkedIn (as do many other scumbags). Their latest ploy is to meticulously research potential targets before sending them a booby-trapped pre-employment test. Jamf
Eye-tracking: Researchers say they’ve found a way to decipher what users ‘type’ on the virtual keyboard of Apple’s Vision Pro headset. “Based on the direction of the eye movement, the hacker can determine which key the victim is now typing,” one of the researchers told Wired.
AI
Panopticon: Tech billionaire Larry Ellison has been sharing his vision for an always-on, AI-powered surveillance network that he thinks would deliver a crime-free world. It sounds rather like China’s existing system of surveillance which makes crime harder to get away with but certainly hasn’t eliminated it, particularly in the digital world.
Positive: A new study suggests that a specially designed AI chatbot can persuade users to abandon conspiracy theories.
Identification: Apple’s latest iPhone is equipped with a camera button and Visual Intelligence AI. As Rachel Tobac warns, with them comes the ability to learn someone’s identity by simply taking a picture.
Training: Meta is to resume harvesting public posts of UK Facebook and Instagram users in order to train its generative AI model. It’s the result of an agreement with the UK data protection regulator under which it’s supposed to be easier for users of the platforms to opt out.
Creativity: Researchers asked humans and AI models to come up with new research subjects. Human experts then gave their verdict on the ideas. They preferred the ones produced by AI.
In brief
Anonymity: The Tor network is good at enabling anonymity, but it’s not foolproof. An investigation has revealed how German police identified the operator of a site on the dark web that hosted child sexual abuse material. The Tor Project insists the service is secure but it’s not the first time law enforcement has identified users and, as this case illustrates, staying anonymous requires taking care over every element in its use. cybernews
Pegasus: Four human rights defenders whose devices were infected with Pegasus spyware have filed a lawsuit accusing its manufacturer of breaking the UK’s Computer Misuse Act. The four are believed to have been targeted by Saudi Arabia, Bahrain and the United Arab Emirates. The Intercept The Register
Mexico: Anyone travelling to Mexico should be aware of the country’s longstanding but - until now - seldom enforced rule that you can bring either a computer or tablet into the country, but not both. Local reports say customs officials in Cancun are now enforcing the rule enthusiastically, with passengers arriving at Cancun Airport facing fines averaging $190 if they arrive with a laptop and a tablet.
Blatant: A former Ticketmaster executive has been sentenced to a year of supervised release for hacking CrowdSurge, his previous employer and a key Ticketmaster competitor. He left CrowdSurge in 2012 and was able to use his old credentials to access its systems until 2015. While he’s clearly guilty, so is CrowdSurge for failing to put in place basic employment processes. BBC
Harm: Brian Krebs reports on “The Com,” a collection of crime-focused chat communities best known for last year’s cyber attack in Las Vegas. Many of the members are young Western cybercriminals who he says also belong to fast-growing online groups that exist solely to bully, stalk, harass and extort vulnerable teens into physically harming themselves and others.
Rethink: Microsoft says it’s rethinking the fundamentals of how to protect Windows devices following July’s CrowdStrike meltdown. The issue is how to reconcile the need for security products to access the operating system’s most basic level with the accompanying risk that this can prevent the machine working if something goes wrong. This will not be simple. The Register
Updates
Apple: With boring predictability, the latest iPhone, iPad and macOS firmware versions have been problematic. The rollout of iPadOS 18 for M4 Pro models was halted temporarily after reports that some devices wouldn’t start up after it had been installed. A problem with the revamped Messages app in iOS 18 causes it to crash. And TechCrunch reports that macOS 15 Sequoia has broken the functionality of security tools from CrowdStrike, SentinelOne, Microsoft, and others. The latest versions do include security fixes but these are also available in updates to its previous versions, including iOS and iPadOS 17.7, macOS Ventura 13.7, and macOS Sonoma 14.7.
Chrome: Google is adding new features to its web browser which it says aim to allow users “to opt out of unwanted website notifications more easily and grant select permissions to a site for one time only,”
Microsoft: Fix for a known issue that causes Microsoft 365 apps including Outlook, Word, Excel, and OneNote to crash while typing or spell-checking a text. The issue relates to language packs.
D-Link: New firmware to address high-risk vulnerabilities in three high-end WiFi routers.
SolarWinds: Update addresses two security flaws in its Access Rights Manager (ARM) software.
Atlassian: Fixes for multiple high-severity vulnerabilities in Bamboo, Bitbucket, Confluence, and Crowd.
SecureDrop: Version 2.10 fixes several issues identified in a recent security audit.