US election. Fake shopping sites. Healthcare and AI.
Over half of UK adults affected by databreaches. And Lily Allen's pretty profitable feet.
Election
By any standards, this has been an extraordinary US election year but we suspect we ain’t seen nothing yet. The ground has been prepared for claims of fraud and there have been concerted efforts to undermine confidence in the democratic process. This is just some of the stuff that we’ve noticed over the past few days.
Fake: Elon Musk’s Political Action Committee has expanded a campaign that targets registered Republicans with adverts suggesting a Harris administration would introduce mandatory programs to buy back firearms and extend the vote to undocumented immigrants. 404 Media
Votes: The FBI says Russia is behind a fake video showing mail-in ballots for ex-President Trump being destroyed in Pennsylvania. This is just one of a series of attempts to sow distrust about the validity of the election process.
Meta: Despite assurances that it would crack down on harmful content, Facebook and Instagram failed to remove some 160,000 deceptive political adverts which have been seen nearly 900 million times. Most of the adverts originate from lead generation companies which gather and sell personal information. ProPublica
Phones: China-linked attackers were able to hack telecommunication systems and access information belonging to Trump family members and Biden administration officials. The New York Times ($)
Fraud: And, least surprising, the FBI is warning that scammers are exploiting the election to perpetrate multiple frauds.
Threats
Shopping: A long-running campaign compromised over 1,000 legitimate online stores to promote fake listings for hard-to-find products. If it looks too good to be true, step briskly away. Satori
Strava: Bodyguards protecting the French, US and Russian Presidents have joined the list of security failures caused by fitness tracking apps. Le Monde reports ($) that members of the security teams all shared details of their workouts on Strava, enabling the paper to track their principals’ movements.
CAPTCHA: A reminder to be alert to fake prompts asking you to prove you’re human. The campaign is aimed at Windows users and they’re easy to spot because they come with instructions asking the user to open a ‘Run’ prompt and paste something into it. Kaspersky
Eventbrite: There’s been a sharp rise in the use of the event management and ticketing platform to deliver phishing emails. The technique exploits the way Eventbrite allows anyone to set up an account and create an event. This means the messages look real but are actually impersonating a well-known organisation. Perception Point
Deepfake: The CEO of cloud security company Wiz says his voice was used in an attempt to fool employees into handing over network credentials. The attack failed because the attackers used audio from a conference speech to create the fake. The result didn’t sound convincing; apparently because the CEO has anxiety about speaking in public. 75% of organisations responding to a survey by Ironscales said they had experienced a deepfake attack in the last year.
AI
Mimic: Attackers have been impersonating OpenAI to target organisations with well-crafted emails requesting updated payment information. Barracuda
Healthcare: New York State’s largest healthcare provider is encouraging doctors to use AI for everything from writing emails to summarising clinical evaluations and “diagnosing pancreatic cancer,” according to data obtained by 404 Media. This coincides with a report that found an AI-powered transcription tool used in hospitals invents things no one ever said.
Coding: “More than a quarter of all new code at Google is generated by AI, then reviewed and accepted by engineers,” CEO Sundar Pichai told investors.
Anchors: The head of Russia propaganda outfit Russia Today says many of its presenters (and their social media accounts) are generated entirely by AI. Margaret Simonyan also predicts the disappearance of journalism and most other professions…
LinkedIn: The recruitment platform has released a new tool designed to automate much of the process of hiring people. It says Hiring Assistant can turn notes into job descriptions, find candidates and engage with them.
Fluff: The Linux creator Linus Torvalds says AI is going to change the world but there’s so much hype about it that he’s decided to “basically ignore it.”
In brief
Breaches: The UK data protection regulator says 55% of the country’s adults have experienced a data breach, and has called on organisations to do more to help those affected. ICO
Vodafone: The Dutch government has fined the phone giant €2.25 million for failing to secure its phone wiretapping system. Among the issues, staff weren’t screened, didn’t sign confidentiality agreements, and logical and physical security systems weren’t implemented.
TfL: Almost two months after Transport for London’s systems were hacked, disruption is continuing and experts claim (not altogether surprisingly) that much of its software was outdated. London Centric
Italy: Quite a story from Italy. Private investigators hired hackers to access a government database. They then sold the resulting information to private clients who allegedly used it to blackmail and intimidate politicians and entrepreneurs. Politico
Google: The BBC has the story of the couple who took on Google in an anti-competition case that left the tech giant with a record €2.4 billion fine. The EU agreed with their claim that Google had effectively “disappeared” their price comparison site. While they won their 15-year legal battle, the couple’s site was indeed disappeared; it closed in 2015.
Tootsies: Lily Allen says pictures of her feet on OnlyFans earn her more than her Spotify streams. She began posting the pictures at the suggestion of her pedicurist and now has 1,000 subscribers, bringing in $10,000 a month. Variety
Updates
Apple: As scheduled, Apple released a slew of updates for iPhones, iPads and Macs, as well as many of its other products. iOS 18.1 and macOS Sequoia 15.1 introduce Apple Intelligence for compatible devices. Initial reports suggest problems are restricted to an impact on battery life (which should be temporary). If you haven’t upgraded to the latest releases, there are also updates for previous versions and these are definitely worth installing. ThreatFabric has details of malicious software designed to target older versions.
Browsers: Important updates for Chrome, Firefox, Opera and the Tor browser.
Tails: Version 6.9 updates the Tor Browser and Thunderbird email client.
QNAP: Security updates for critical vulnerability in QNAP’s SMB Service.