Replacing passwords. Facebook nonsense. Identifying strangers in public in seconds.
Fraud hits one in five Britons. And a handy guide to digital security.
Passwords
We’re hesitant when it comes to including anything about passwords because everyone is so sick of the subject. But things have been changing so here goes…
Passkeys: The replacement for most passwords is now becoming increasingly widespread. Passkeys rely on a private key stored on your device and authenticated by it. That means you no longer need to worry about logins and passwords, except when you restart the device. They’re not stored anywhere else, can’t be reverse-engineered and have multi-factor authentication built-in. If one of your services hasn’t adopted them, you should complain - especially if it’s a bank, many of which continue to rely on codes sent by text message. If evidence were needed that passwords are horribly insecure, look no further than Meta. The Irish data protection regulator has just fined it €91 million for the cardinal security sin of storing hundreds of millions of Facebook and Instagram passwords in plaintext.
Rules: Though progress has been made towards replacing passwords, they haven’t been killed off altogether. For example, we still need them when starting up a computer or to access a work network. But a lot of the old rules don’t apply. Last week, the US standards body proposed the abolition of forced password resets, restricted characters, and security questions. Again, we should be complaining when we come across these rules. But some recommendations hold good; the longer the password the better, never reuse them and - above all - take advantage of a password manager. It’s the only way to mitigate the risks of an inherently lousy security solution.
In an attempt to explain all this, we’ve just updated our guide to the whole horrible business. Just let us know if you’d like a copy.
Threats
Facebook: If you’re on Facebook, you may have seen a post about preventing Meta from using personal information to train its AI models. It suggests that reposting the message will keep the data private. Put simply, despite celebrity endorsements, this is bollocks. Incidentally, we’ve seen increasing instances of people accepting friend requests from obviously fake profiles. This just makes them look more credible and better suited to conduct future scams.
Disney+: The simplest way of activating a streaming subscription on a new device is to visit a webpage and enter the code on it. Scammers are subverting this by using Google’s advertising platform to display fake pages. The address resembles the real thing but they lead to what looks like a Microsoft warning that child abuse imagery has been found on the computer. Malwarebytes
Deepfake: A Zoom call with a US Senator is the latest example of the increasing sophistication of deepfake technology. The call appeared to be with the Ukrainian Foreign Minister. Senator Ben Cardin only became suspicious when he began to be asked politically charged questions. Dark Reading
Jobs: A sophisticated campaign is targeting recruitment staff with emails that try to lure them into downloading a malicious file disguised as a resume. Trend Micro
Nudes: Criminals are using websites advertising AI nude generators to trick victims into installing malware. Silent Push
Royal Mail: Another crime group is using missed delivery messages to try to install ransomware on target computers. What makes this slightly different is the group’s use of the public contact forms on organisations’ websites to deliver their phish. proofpoint
AI
Doxxed: When Apple released its latest iPhone last month, we reported concerns that its camera and AI capability could be used to identify (or dox) someone simply by taking a picture. This month, news emerges of a couple of Harvard students who did exactly that, except their demonstration used a modified pair of Meta’s Ray-Ban branded smart glasses. Obviously, Meta has had the ability to do this for years but has never made it publicly available. Neither have the students who say they developed the system to inform the public about the implications of new technology. Their video explains how it works. It’s worth a look. 404 Media (R)
Round 2: You might remember that in May Microsoft had a disastrous attempt to roll out a feature in its new CoPilot+ PCs. ‘Recall’ was intended to be an AI-powered photographic memory that took snapshots of everything done on the devices so that it could be easily searched later. The initial design attracted so much criticism on security and privacy grounds that Microsoft was forced to withdraw it. Four months later, the company is back with a new version that seeks to address the concerns. Crucially, unlike the first effort, it will be off by default and users will have an option to remove it completely. For the moment many security experts remain to be convinced.
Interviews: A job seeker has a post on LinkedIn about his experience of being interviewed by an AI avatar. As 404 Media reports (R), it’s an increasingly common approach for early stage interviews. In this case, the job seeker was unsuccessful. But his post went viral and attracted more than 300,000 views in a couple of days.
In brief
Scale: More than one in five adults have been victims of fraud, according to a survey by the Social Media Foundation. In the UK alone, it says there have been more than 10 million victims in the last three years – each losing an average of £907. The report surveyed 28,000 people across 15 countries with the US experiencing the highest level of fraud at 31% of adults falling victim.
Pig butchers: WIRED has a long-read on the vile scam in which a target is fattened up before being “butchered.” The practice began in Southeast Asia where at least 200,000 people have been recruited, with many of them enslaved in order to run the operations. Criminals have now set up shop in the Middle East, Eastern Europe, Latin America, and West Africa. The biggest centre is in Dubai.
Blocked: XTwitter suspended an independent journalist for sharing a research dossier on Trump vice-presidential pick J.D. Vance. Ken Kippenstein posted the extraordinarily uncomplimentary vetting document following the refusal of mainstream media to publish it. The US Justice Department has charged three men with obtaining the research on behalf of Iran. Washington Post
Macs: Users are reporting problems with the display on an iMac model launched in 2021. They say horizontal lines are appearing on the screen, with no way to remove them. There have been increasing reports over the past 18 months with some customers saying Apple fixed the issue free of charge even after the standard one-year warranty had expired. MacRumors
Crime: A new dossier underlines the cosy relationship between cybercrime gangs and the Russian state. The UK’s National Crime Agency alleges that Russian intelligence officials ordered criminals to conduct cyber attacks on NATO members. The Register
Advice: We came across a tool this week that’s aimed at anyone whose relationship has just ended. It’s designed to check that any shared access to online accounts has been removed. As such it’s actually a handy guide to securing accounts all the time, not just after a break-up.
Updates
Microsoft: Defender antivirus will now warn users when they connect to an unsecured WiFi network, including public hotspots without passwords or security encryption. As part of the feature, users will have the option of activating a virtual private network which will encrypt data and route it through Microsoft’s servers.
Apple: iOS and iPad 18.0.1, and macOS Sequoia 15.0.1 address problems with their predecessors. There are also security fixes. These versions mark the point at which it’s safer to upgrade devices with Apple’s latest firmware.
Firefox: Version 131 includes security fixes and new features, including controls to set temporary permissions and tab previews. These haven’t been universally welcomed on the grounds that they’re really irritating.
Outlook: Fix for an issue affecting users with too many nested folders.
Cisco: 14 security updates to address multiple security issues. The most serious affects Nexus Dashboard Fabric Controller (NDFC).
Zimbra: A vital update to address a critical vulnerability that is already being exploited.
Draytek: Security updates for multiple models affected by 14 issues, including one that allows remote attacks. They are so serious that the company is issuing fixes even for devices that in principle are no longer supported.