23andMe on the ropes. Exploiting natural disasters. Using AI to apply for jobs at scale.
The dangers of government backdoors. A framework to check data protection compliance. And Holland to replace its traffic lights.
23andMe
Last year the genetic testing company had a disastrous data breach, its future is now in doubt. And if it’s sold, the data it holds will be part of the deal. The company says it remains committed to the privacy of its customers and it will continue to ask permission before using customer data for commercial or research purposes. Unfortunately, that provision doesn’t necessarily extend to a new owner - or to future purchasers. It’s a mess and there’s general agreement that anyone who has used 23andMe should close their account and demand their data be deleted. Given the inability of companies to protect the data they hold, we remain sceptical about the wisdom of entrusting them with highly sensitive information such as genetic data.
Threats
Hurricane: Criminals like nothing more than a natural disaster to try to scam people out of money. Hurricanes Helene and Milton have provided rich pickings, with scumbags impersonating the US emergency management agency and other disaster relief organisations in order to trick people into donating money. Social media is also crawling with disinformation, including an AI-generated image of a girl clutching a puppy.
Accommodation: A sophisticated campaign is targeting users of travel platforms including Airbnb and Booking.com. The attacks are highly targeted and the fake pages are hard to distinguish from the real thing. ESET
Hosting: Microsoft examines the renewed enthusiasm with which phishing groups are using file hosting services to store resources for their phishing pages. It’s a clever tactic because it exploits the trust that we tend to have in platforms like SharePoint, OneDrive, and Dropbox.
Russia: The US and UK have warned that hackers linked to Russia’s foreign intelligence service are attacking Zimbra and TeamCity servers “at a mass scale to target victims worldwide across a variety of sectors.”
AI
China: OpenAI says it blocked attempts by a China-based group to infect employees through both their personal and corporate email addresses. In its latest report on “Influence and cyber operations,” the maker of ChatGPT also says it “disrupted more than 20 operations and deceptive networks from around the world that attempted to use [its] models.”
Girlfriends: Muah.ai allows users to create AI-generated ‘companions’. One of its databases has been hacked and 404 Mediareports (R) that among the contents are numerous attempts by users to generate child sexual abuse material. Troy Hunt (who runs the havibeenpwned website) has more details. They’re not pleasant.
Zoom: Why bother with a video call when you can send an avatar instead. Zoom is tiptoeing towards this by announcing that users will soon be able to create an avatar which can be used to send brief messages to a group. What could possibly go wrong. The Verge
Advice: Cisco has launched a portal to gather together its resources on deploying and using AI securely. No registration needed.
Movies: Meta has announced a media-focused AI model that is designed to generate realistic video and audio clips. MovieGen isn’t available yet but Meta’s blog about it provides a pretty clear picture of the future.
Jobs: 404 Media’s Jason Koehler used an AI bot to apply for 2,843 vacancies, all while working a shift at a restaurant. AI Hawk’s Telegram community has 4,700 members with possibly genuine stories of how the bot helped secure them interviews without them writing anything.
In brief
Backdoors: It appears Chinese hackers managed to break into key US internet service providers by exploiting the backdoors installed to provide access for law enforcement. The Wall Street Journal says “the widespread compromise is considered a potentially catastrophic security breach.” Worth bearing in mind the next time governments demand access to end-to-end encrypted messages.
Archive: A pro-Russia group has hacked the Internet Archive’s “Wayback Machine” and leaked the data of 31 million users, including usernames and email addresses. Bleeping Computer
Insiders: Two former RAC employees have received suspended prison sentences for stealing information relating to people involved in road accidents. They were caught after the RAC installed new security monitoring software.
Data Protection: The UK regulator has launched a new framework to help organisations comply with data protection laws. It covers everything from cybersecurity to business continuity and includes useful checklists to track what’s going on inside an organisation.
Nudity: Researchers have found that Twitter removes copyright infringement images almost immediately while non-consensual nudity stays on the platform for weeks. The obvious solution to get nude photos removed is to report them as a copyright infringement.
Air gap: The most secure computer is one isolated or “air-gapped” from the outside world. Of course, attackers know this so they try to infect the USB devices that are used to upload data to the isolated computer. ESET has found two sophisticated toolsets used in this type of attack, with signs that they might be linked to Russia. Ars Technica
Traffic: The Netherlands is to replace tens of thousands of traffic lights because of a vulnerability that could allow an attacker to take control of them. RTL Nieuws
Updates
Microsoft: This month’s set of updates include nearly 120 fixes, some for issues that are already being exploited. Of most interest this week for Word users is a patch for a known problem that was causing some documents to be deleted instead of saved.
Firefox: There’s an emergency update for Mozilla’s web browser. The issue it addresses is already being used to attack users.
Facebook: Meta is giving Facebook a new look in a probably fruitless effort to woo younger users. It will put greater emphasis on local community information, videos, and Facebook Groups. Pew Research data from last year found daily use of Facebook among teenagers had slumped to 19%. We suspect it’s even lower now.
Patch Tuesday: Security updates from Adobe, Ivanti, Fortinet, Intel, SAP, and Zoom.
Tails: Version 6.8.1 includes an option to repair Persistent Storage when its file system has errors.