TikTok hoist with its own petard. Oasis scams flood social media.
XTwitter will sell user data, like it or not. 23andMe and personal data. And abusive robotic vacuumcleaners.
Socials
TikTok is furious that NPR has published details revealing that its executives and employees understand perfectly how addictive its platform is. The information came to light as part of a lawsuit by 14 US states that alleges TikTok was designed with the express intention of addicting young people. In Kentucky, the attorney general’s office had blacked out sensitive portions of the emails but copying and pasting the redactions revealed the original content. It’s not surprising TikTok is unhappy because the documents paint a picture of a company aware of the potential harms of its platform and completely unconcerned by them. According to the lawsuit, TikTok’s own research found that “compulsive usage correlates with a slew of negative mental health effects like loss of analytical skills, memory formation, contextual thinking, conversational depth, empathy, and increased anxiety.”
Over at Instagram, Meta is rolling out new settings in an attempt to combat sextortion, in which intimate sexual content is used to blackmail (mostly teenage) victims. It’s a vile crime which has lead to some youngsters killing themselves. The new features include detecting and blocking suspicious accounts, highlighting safety notices, and hiding teens’ follower lists from potential blackmailers. Meta says there has been a sharp rise in sextortion incidents, with some organised crime groups cooperating to pressure teenagers into sharing nude photos.
Threats
Oasis: Unsurprisingly, online forums are overrun at the moment with offers of fake Oasis tickets. Nextdoor seems to be particularly popular with fraudsters who are creating laughable profiles to post the offers.
Gmail: A reminder about the highly believable scam that is currently doing the rounds. It exploits the process for recovering access to a Gmail account and we know of at least one person who has fallen for it. The scam begins with an email which the fraudsters follow up with a phone call.
Meet: Another scam is exploiting Google’s Meet platform to install information stealing software. It uses a pop-up alert warning that a webpage or document can’t be displayed correctly unless a “Fix It” button is pressed. That sets off a set of steps that culminates in the malicious software being installed. Sekoia
Android: Devious malware employs a highly deceptive unlock screen that looks exactly like the real Android prompt to open the device. Once the attackers have the PIN or pattern, they try to install other software with the aim of compromising banking apps. It’s being spread by phishing messages, and Google Play Protect should provide protection. Zimperium
Starbucks: There’s a vibrant campaign using the coffee chain as a lure to try to steal financial details. The phishing emails contain a malicious link promising a free Starbucks Coffee Lovers Box. Action Fraud
ID: Rachel Tobac makes a habit of live hacking accounts to demonstrate how vulnerable they are. Her latest effort involves one of the panel from Canada’s Dragon’s Den. Tobac used breached passwords, social media posts, an AI voice clone, and just one picture to create a deepfake live video call.
AI
XTwitter: A new privacy policy allows the company to sell user data to third parties in order to train their AI models. The new policy suggests that it’s possible to opt out but TechCrunch can’t see how to do so and neither can we.
Flaws: While OpenAI and Google have been talking about the next big advances in their AI models, research from Apple suggests their grasp of mathematics is less firm than it might appear. The study supports previous findings that the models don’t really understand the concepts behind mathematics but simply try to replicate the steps in the data used to train them. That means the models appear to struggle to provide correct answers to questions that don’t match the training data.
Shaping reality: A prototype app called Impact describes itself as an “AI-powered infrastructure for shaping and managing narratives in the modern world.” In practice, that means bringing sufficient numbers of supporters to share AI-generated talking points to influence the content displayed by social media algorithms. Or, more succinctly, to shape online reality. 404 Media ($)
Voices: A new extension for the Chrome browser claims to be able to reliably detect AI-generated voices. The Hiya Deepfake Voice Detector “listens” to voices played in video or audio streams and assigns an authenticity score to them. Engadget has tried it out with encouraging results.
In brief
23andMe: Last week, we suggested doubts over the future of the DNA testing company meant users should consider deleting their accounts to safeguard their personal data. But another look at 23andMe’s privacy policy reveals that it will retain genetic information, date of birth and sex even if a user deletes their account. As Malwarebytes reports, it’s another reminder that once information has been handed over, it may be impossible to get it back.
Smoke and mirrors: The Chinese government has had another go at persuading the world that reports of its rampant cyber espionage are nothing but a US attempt to smear its impeccable reputation. It’s a clever tactic that involves publishing reports that accuse the US of trying to divert attention from its own activities. Beijing then ensures the reports are republished by friendly outlets. We’re not about to believe everything we read about China, but Beijing’s complaints would be a lot more credible if there wasn’t so much independent evidence of its cyber wickedness.
WeChat: The Chinese social media platform has over 1.2 billion users and it’s hard to do much in China without it. The Citizen Lab has just tested its encryption protocol and found it wanting, to say the least.
Pixel: Cybernews has been testing Google’s flagship Pixel 9 Pro XL smartphone. It found that the device sends data packets to Google every 15 minutes, including location, email, and phone number. When GPS is turned off, Cybernews says it simply uses WiFi to calculate the location. Google’s response is that all smartphones do the same thing, which is sort of true. The real issue here is how transparent Google is about the information the phones transmit.
Archive: The Internet Archive’s Wayback Machine is back in action after an attack by a pro-Russia group and the leak of some 31 million users’ data. While it’s now possible to search the archive, new pages can’t be saved to it.
Abuse: A security flaw meant that attackers were able to hijack Chinese-made robotic vacuum cleaners and use them to hurl abuse at anyone within earshot. The Ecovacs Deebot X2 has developed a reputation as being easy to hack, as demonstrated by ABC News Australia which managed to take full control of a device, including its camera and microphone.
Updates
Browsers: Updates for all the main web browsers, as reports emerge of a North Korean attack that exploited previously unknown vulnerabilities in Internet Explorer to infect targets with malicious software. This was a clever campaign that exploited the alerts (often adverts) that pop up in free utility programs. Microsoft released an update as soon as it was told about the vulnerability. This week, it’s the turn of Firefox and the Tor Browser to be under attack via an issue which Mozilla has now addressed. The latest version of the Chrome browser also fixes 17 vulnerabilities.
Apple: Social media is full of reports from iPhone users that their batteries are draining quickly after installing iOS 18. This is because the new operating system version requires all sorts of internal housekeeping, and the issue usually goes away with a week or so. If it doesn’t, something else might be wrong - either with the device or with iOS 18.
Oracle: Another massive dump of 334 new security patches, including 186 fixes for vulnerabilities that can be exploited remotely without authentication.
F5: October 2024 quarterly security notification includes fixes for two vulnerabilities in BIG-IP and BIG-IQ enterprise products.