Progresstowards improving software quality.
Information stealers and what to do about them. An AI assistant that can control your computer - just not very reliably. The USelection and disinformation; you ain't seen nothing yet. And the sprawling market in mobile surveillance.
Liability
The EU has taken a big step towards making companies liable for security flaws in their products. The EU Directive on Liability for Defective Products will mean consumers can hold companies liable in court if they sell faulty goods. And for the first time it will cover software, making manufacturers responsible for any damages caused by defects or security vulnerabilities. The EU even classifies lack of a software update mechanism as a defect, and companies will face penalties if they try to artificially limit the lifespan of a product. Alas, it will be two years before the new directive comes into force.
We’ve frequently argued that one of the key reasons for the endless series of software and hardware vulnerabilities is the lack of any meaningful penalties for them. For an example, look no further than SolarWinds which in 2020 was responsible for one of the most consequential data breaches yet seen. As a result of a fundamental flaw in one of its widely used products, Russia was able to steal a slew of sensitive information from public and private organisations. Four years later, the US cybersecurity agency is warning of a critical (and very basic) flaw in one of SolarWinds’ other products.
Threats
Stealers: Information stealers are a popular entry route into cybercrime because of a plethora of kits that make them simple to deploy. They’re used to harvest credentials which are then sold on the dark web, often for small amounts of money. It’s relatively easy to protect against this type of attack by adopting good password practices, using multi-factor authentication, and taking care to download software from authentic/official sites. Kaspersky
Jobs: The rise of the gig economy and side hustles provides a perfect opportunity for scumbag fraudsters. Cybersecurity Insiders explains a scam involving what appeared to be a marketing firm offering easy money for writing reviews of movies and products.
Call: On the same theme, scammers are pretending to be employers with a vacancy which they’d like to discuss with the victim. They insist on using platforms like Brave Talk or WeChat for the call and they provide a link which, if clicked, downloads malicious software. Brave
Callbacks: And a reminder about one of the most effective phishing approaches around at the moment. It begins with a message that could appear to come from a variety of well-known companies (e.g. PayPal, YouTube, Intuit) about a fake payment or invoice. The victim is urged to call a number to resolve the issue. It’s an approach that has proved surprisingly effective. Trustwave
macOS: Last month’s Sequoia updates included a fix for a nasty vulnerability that could allow an attacker to take over a device’s camera and microphone. Microsoft
Wood: This is a new one for us. Group-IB spotted a campaign targeting French users with websites advertising firewood.
AI
Assistant: The latest version of Anthropic’s Claude 3.5 Sonnet model can understand and interact with any desktop app. In other words, it can control keystrokes and mouse movements just as a human would if they were sitting in front of the computer. There are lots of more targeted solutions around but Anthropic is aiming to provide a fully functioning AI assistant. Unfortunately, it admits that for the moment, Claude remains “slow and error-prone.” TechCrunch
Facial: Meta is testing the use of facial recognition as part of its account recovery process - and to combat ads that use fake celebrity videos to scam users. Meta
Walking: EU member states are to trial a program that uses gait recognition to identify people crossing the union’s external borders. The technology is designed to allow law enforcement and border authorities to work at a distance of up to 200 metres. The Record
Deepfakes: The US Department of Defence is looking for technology capable of creating believable online personas that are indistinguishable from real people. Procurement documents seen by The Intercept say the personas must be sufficiently credible to pass online identity checks and fool social media algorithms.
Bras: Someone used an AI tool to change the photo of a conference speaker because it needed to taller. The conference speaker was surprised when she saw the result; to make the photo bigger, the AI tool had decided to unbutton her shirt and show a bit of bra which didn’t appear in the original. Elizabeth Laraki
Election
While the US election campaign has been filled with disinformation, this is likely to be just a side show compared to what comes after polling day. It’s clear that the Trump campaign and its surrogates have been preparing the ground in case of a loss by claiming the only way they could be defeated is through fraud. US intelligence officials have warned that Russia is prepared to pounce on the period between election day and the inauguration in January. In the latest example of pre-election disinformation, WIRED reports on a coordinated online effort to claim vice-presidential candidate Tim Walz sexually assaulted one of his students. The Washington Post says the rumour was started by a former Florida police officer now living in Moscow where he runs a Russian propaganda firm.
Tracking
A new report underlines the “global surveillance free-for-all” in mobile advertising data. Atlas Data Privacy Corp is a US firm specialising in the removal of personal details from companies that buy and sell them. Atlas was able to trial a product designed to track mobile devices in a specific location. It does this by exploiting the unique digital ID generated by all Android and Apple mobile devices. This type of capability used to be restricted to nation states. Now, the availability of mobile advertising data means we can all create a surveillance mechanism to track the movements of anyone with a smartphone. There are limits to how far it’s possible to evade this surveillance, unless you go off-grid completely. But you can restrict the use of location-based services on your phone by going through the settings for each app. Ars Technica has a good overview.
In brief
Passwords: We hate passwords but we dislike “magic links” even more. Magic links involve receiving an email with a link that allows you to access content behind a paywall. It may be simpler for the content producer (because they don’t need to bother with passwords), but for users It’s slow, cumbersome and a hugely retrograde step.
Data: The UK government has begun the process of enacting new data protection legislation designed to align with the EU’s GDPR framework. The government says it will help boost economic growth and public sector efficiency. Critics say it will undermine current privacy protections.
Encryption: Reports that Chinese researchers used a quantum computer to decrypt a widely-used encryption scheme turned out to be largely exaggerated. While they did managed to break an encryption key, it wasn’t a very complex one and a quantum computer wasn’t even involved.
Cyber Essentials: A survey to mark the tenth anniversary of the UK information security scheme suggests it’s broadly achieving its aim of raising awareness among small and medium-sized businesses. Cyber Essentials is a great foundation for cyber security, as long as it’s not seen as a box-ticking exercise. Computer Weekly
Internet Archive: The poor old Wayback Machine is having a torrid time trying to recover from a data breach. It restored a limited service only for the hackers to demonstrate forcefully that they were still lurking inside its systems.
Fines: The Irish data protection regulator has fined LinkedIn €310 million for exploiting its users’ personal information illegally. The regulator also reprimanded the Microsoft-owned platform for a serious violation of the right to data protection in the EU. LinkedIn had used the data for advertising purposes.
Second-hand: A talk at the Def Con cybersecurity conference explains what happens to IT assets that go walkabout. By IT assets we mean corporate laptops, secret hardware prototypes, classified government devices; that sort of thing. They end up being sold, in the open, on public marketplaces like eBay. Matthew Bryant’s talk is illuminating.
Updates
Apple: A new iPhone software version is due out next week. iOS 18.1 brings a ton of new features and some important fixes for irritating issues but, despite that, we suggest waiting a while before installing it. Many of the changes are fundamental and our flabber would be truly gasted if the roll-out were to be entirely free of problems. And bear in mind that while iOS 18.1 introduces the much heralded AI-powered Apple Intelligence, it will only work on the latest high-end models (iPhone 15 Pro and up). 9TO5Mac MacRumors
WhatsApp: Meta is adding a new feature that allows contacts to be added from any linked device. It uses a bespoke protocol to encrypt the contacts so they can only be accessed through WhatsApp. Fine - but where’s the WhatsApp iPad app?
Samsung: Attackers have been exploiting a previously unknown (‘zero-day’) vulnerability in Samsung’s mobile processors. The issue was fixed in this month’s security updates.
Google Messages: Updated privacy features include better controls to filter spam, block potentially dangerous links, and blur nude images.
Fortinet: A vulnerability in FortiManager API has been used to steal sensitive files containing configurations, IP addresses, and credentials for managed devices. It appears the issue was exploited for months before anyone did anything about it. Bleeping Computer
Cisco: 36 security updates for products including ASA and FTD firewalls, and the Cisco firewall management centre.
Tor Browser: Version 14 drops support for Windows 7 and older macOS versions.
SecureDrop: Version 2.10.1 updates translation capabilities for multiple languages.