Watching every move we make. O2/Virgin scam. South Korea remakes Minority Report for real.
Meta's vision thing. And the problem with connected cars.
Privacy. What privacy.
Look upon the works of technology giants and despair. A slew of reports this month underlines the extent to which privacy is an illusion and personal data is simply grist to the advertising mill.
A report from the US Federal Trade Commission’s report is damning precisely because its findings are so blindingly obvious. Its investigation into social media platforms and video streaming services found that not only do they engage in “vast surveillance,” they often retain user data indefinitely, and can’t be trusted to regulate themselves. The FTC calls on Congress to pass comprehensive legislation to limit surveillance and grant consumer rights.
Facebook and LinkedIn are the worst platforms in terms of privacy, according to data removal service Icogni. The research was based on categories including data collection, and user control and consent. Among the findings; university-level literacy is required to understand the platforms’ privacy policies. Incidentally, this is self-serving research since Incogniti makes its living from removing public data acquired in part via these platfforms.
In terms of monitoring people’s behaviour on the internet, Kaspersky’s annual report found Google to be the “undisputed leader.” Its report uses data from an anti-tracking tool which it says was triggered nearly 39 billion times in the year to July 2024.
An Australian data scientist set out to explore exactly how his personal information had ended up in marketing databases. His investigation spanned multiple companies and at least eight years - taking him to a data broker that could provide no records to prove he had ever consented to his information being recorded or shared.
And one other thing. This week LG announced that it’s adding adverts to its TVs’ screensavers. Ars Technica has a recent article looking at the ways in which TV manufacturers are beginning to exploit their products, whether we like it or not.
Threats
O2: The merger between O2 and Virgin has provided crooks with an ideal opportunity to target customers (including us) with personalised phone calls. They begin by saying existing SIMs will be disabled within days but a replacement will be sent immediately. To compensate for the disruption, existing phone plans will be discounted - as long as some sensitive information is provided…
Gotcha: Fake CAPTCHAs continue to do the rounds in an effort to install information stealing software. The idea of these irritating puzzles is to prevent automated exploits of websites but Swiss researchers say they’re no longer effective because AI can now solve them just as easily as humans.
Shopping: Yet another example of scumbags exploiting Google’s advertising search ads. This time it targets Walmart customers in the US by displaying a fake phone number. As we’ve said before, it’s really important to be sceptical about the adverts surrounding search results. Malwarebytes
Content: Scammers are exploiting content collaboration platforms to send emails that appear to come from a trusted domain but which contain phishing links. Cisco Talos has a detailed report looking at the wider use of this technique.
Pirating: Disney is the latest streaming service to crack down on password sharing. This will almost inevitably result in people returning to the use of unofficial sites and downloads. While understandable, it’s also (obviously) illegal and risky. There’s no doubt scammers will be seeking to exploit a golden opportunity.
Curiosity: Posters have been popping up in the north of England with a QR code and the message; “If your name is Emily and your boyfriend went out last night HE CHEATED. Here’s the video for proof.” It’s hard to imagine anyone falling for this, even if their name is Emily. But then again…
AI
Prediction: South Korean researchers have come up with a system that uses AI to analyse CCTV footage and predict (and ideally prevent) crimes before they happen. It works by comparing and measuring current situations to identify similarities with previous criminal incidents. A similar approach was taken by a Canadian study, but in a hospital setting. It found that unexpected deaths could be reduced by 26% by examining patient data for potential complications before they became critical.
Elections: Just to follow up on the issue of disinformation that we covered last week, the US says China, Russia and Iran have increased their use of AI-generated content, but encouragingly they haven’t managed to deploy it effectively. Yet.
LinkedIn: The voracious employment platform has given into regulators in Europe and says it won’t use the data of EU, UK, and Swiss users to train its AI model.
Meta: Facebook and Instagram can now use AI to answer questions about users’ photos - and edit them as well. They’re part of a raft of new features powered by Meta’s AI chatbot. Engadget (More on Meta below.)
Dining: Restaurants are beginning to adopt AI-powered voice assistants, to cut costs - and reduce the number of stupid questions which could be answered by consulting their flipping website. WIRED via Ars Technica
Vision
It was Meta’s big developers’ event this week. Most of the attention focussed on augmented reality “glasses” which Mark Zuckerberg thinks will replace smartphones. Given that most of us are still using decades-old inventions to interact with computers, a revolution in the field is obviously long overdue. Meta demonstrated an impressive-looking pair of glasses called Orion which does offer a glimpse of the future. One problem; you can’t buy them because currently they’re too expensive to manufacture. You can buy a pair of much simpler Ray-Ban branded glasses, starting at £329, and a new mass-market headset with prices from £290/$300. Future human-computer interaction doubtless lies in some form of eye interface, but clearly we’re not there yet.
In brief
Cars: WIRED reports on yet another example of the pitiful lack of security afflicting modern connected cars. In this case it affects Kia, which had a flawed web portal that allowed researchers to track millions of cars, unlock doors, and start engines at will. US government figures show that software fixes are now responsible for 1 in 5 automotive recalls in the country. This week the US banned Chinese and Russian technology from use in smart and connected cars. That may be missing the real problem.
WiFi: The hack affecting public WiFi networks at 20 of the UK’s biggest railway stations demonstrates why it’s best to avoid them if you can (that’s the networks, not the stations). In this case, the attacker (seemingly a malicious insider) simply displayed anti-Islamic propaganda but the same technique could be easily used to show a fake login page and harvest personal information. The WiFi is operated by a company called Telent which doubled its profits this year.
Passwords: The US federal standards body NIST has proposed killing off some of the ridiculous password requirements that continue to plague users. It says forcing password resets, restricting or requiring specific characters and (useless) security questions should all be taken out and shot. NIST’s key concern is that they just drive users into adopting bad habits out of sheer frustration.
OSINT: Open source experts Bellingcat have released an Online Investigations Toolkit designed to help researchers find the tools to explore satellite imagery, maps, and social media.
Jobs: Dozens of major US companies have unwittingly hired North Korean IT workers, according to Google’s Mandiant unit. “North Korean IT workers often have multiple jobs with different organizations concurrently, often [with] elevated access to production systems,” it said.
Strava: The fitness tracker (aka privacy menace) Strava is making it easier to check it’s configured to maximise safety and security. The settings already exist but Quick Edit provides a quick way to make sure.
Maps: Google appears to have begun making an effort to crack down on fake reviews in its Maps app. techradar
Out of date: A new take on the problem of outdated hardware. 404 Media reports on a paralysed jockey who learned to walk again with the help of an exoskeleton. After ten years of use, it stopped working this month because of a trivial issue. The manufacturer refused to fix it, saying the device, which cost $100,000, was too old to be serviced. Once publicised, it took 4 days for volunteers to get it working.
Updates
Apple: It’s two and a half weeks since Apple released iOS 18 and with it a bunch of irritating bugs. Apple watchers report that an update is on its way shortly. 9TO5Mac
Kaspersky: This week, Kaspersky abruptly deleted its anti-virus software from customers’ computers in the US and automatically replaced it with another solution. It followed the US government’s decision to ban Kaspersky which comes into force on Sunday. Customers are not happy.
Google Security Advisor: A new security feature for the Workspace platform is designed to help small businesses ensure that appropriate features have been configured correctly.
ESET: New versions to fix serious vulnerabilities in Windows and macOS products.
Cisco: Updates to address seven high-severity vulnerabilities affecting products running IOS and IOS XE software.
Privacy: In a significant development, two leading players in the world of privacy are merging. The Tor Project focusses on network privacy and anonymity while Tails does so at an operating system level. Pooling their resources looks like a wise move.