The big winner in the US election. Exploiting travel reservations.
Trying out ChatGPT's search engine. The sprawling information stealing industry. And how crowds of Dubliners ended up waiting for a non-existent Halloween parade.
Election
Elon Musk has emerged as perhaps the biggest winner from the US presidential election (apart obviously from Donald Trump). As one user tweeted, “Elon is such a dumbass. He spent $44 billion on Twitter and all he got was control of all 3 branches of the federal government.” Despite the element of hyperbole, Musk does stand to profit mightily from Trump’s win. And goodness knows he pulled out all the stops to help secure it. Analysis from the Center for Countering Digital Hate, which tracks misinformation, found that at least 87 of his posts on XTwitter were rated as false or misleading. They have generated more than two billion views.
Of course, Musk isn’t the only one to have courted Trump. Mark Zuckerberg (Meta), Tim Cook (Apple) and Sundar Pichai (Alphabet/Google) began currying favour in the run-up to polling day. And then there’s Amazon founder Jeff Bezos who owns The Washington Post and stopped it from endorsing Kamala Harris. Bezos was formerly an outspoken critic of Trump, and his ownership of the paper is reported to be partly responsible for Amazon’s failure to win a $10 billion Pentagon contract. If the president-elect actually goes ahead with his promises to crack down on immigration and introduce wide-ranging import tariffs, they may find their support and his return to power a decidedly mixed blessing.
Threats
Booking.com: Customers of the largest online travel platform will be accustomed to receiving follow-up messages once they’ve made a reservation. Fraudsters have found a way to exploit this process. Brian Krebs explains how one user received a phishing message minutes after making a hotel reservation. The message looked genuine, contained details of the booking, and asked the customer to complete a verification process. It turns out the hotel’s systems had been breached.
Gmail: Email accounts are the crown jewels for attackers, so they’re willing to put in considerable effort to access them. An ongoing technique involves using incorrect passwords to try to log in. This triggers an email alert to the user which the attackers follow up with messages requesting a security code. It’s essential to be sceptical about such requests. Cybersecurity Insiders
LastPass: Scammers are writing reviews for the password manager’s browser add-on to promote a fake number for customer support. It’s part of a campaign to trick callers into installing remote access software. Bleeping Computer
DocuSign: Attackers are exploiting the platform’s connectivity features to send waves of phishing emails that appear to be genuine. The messages purport to be invoices and notices to pay activation fees. Definitely worth checking before clicking. Wallarm
Penalties: UK forums are awash with reports of people receiving text messages saying they have a parking fine. This has been going on for a while and It’s pretty unsophisticated because many recipients say they don’t own a vehicle.
AI
Search: Paying OpenAI users can now try out ChatGPT’s AI-powered alternative to Google. We asked ChatGPT Search whether it’s better. The summary of its answer sums up things pretty well. “If you’re looking for a conversational assistant to help understand concepts, generate ideas, or engage in interactive dialogue, ChatGPT Search might be better for you. If you need to find specific web pages, access the latest news, or browse a variety of sources, Google Search would be more appropriate.” One notable difference; the absence of adverts on ChatGPT
Chatty: OpenAI has also upgraded its Mac and Windows apps to include its advanced voice feature. In other words, you can simply talk to ChatGPT as if you were having a conversation. Incidentally, Open AI has acquired the domain name chat.com at a price possibly in excess of $15 million. It redirects to the ChatGPT assistant.
Scams: Meanwhile. researchers used ChatGPT-4o real-time voice capabilities to create financial scams like bank transfers and credential theft with success rates between 20-60%. University of Illinois
Warning: One of the leading AI companies has called for targeted regulation to mitigate “catastrophic” risks. Anthropic points to the potential for chemical, biological, radiological, and nuclear, and cyber misuse.
Recruitment: The UK Information Commissioner has warned employers to make sure they’re abiding by data protection law when using AI to help with recruitment.
Recall: Microsoft has delayed launching its troubled AI feature that takes snapshots of a user’s computer screen so old activity can be searched later. It’s the third time ‘Recall’ has been held back, notably because of security concerns. The Verge
Slop: AI makes it easy to generate content - and that’s how thousands of Dubliners ended up lining the Irish capital’s streets, waiting for a Halloween parade that never happened and was never going to. It’s an example of a so-called ‘slop shop’ - a site designed to churn out any old rubbish in order to attract clicks, in this case from people searching for Halloween events. Defector explains the business model.
In brief
Info Stealers: If you need a good reason not to download pirated movies and software, look no further than 404 Media’s investigation into the huge information stealing industry. AT&T, Ticketmaster, Santander Bank, Neiman Marcus, and Electronic Arts are all examples of companies which have fallen victim to a sprawling and ever evolving ecosystem.
Surveillance: The head of the US spy satellite agency says a new network of at least 100 spacecraft will leave adversaries with no place to hide. The relatively small satellites are being built by Elon Musk’s SpaceX as part of a $1.8 billion contract. Meanwhile, Google is reported to have revealed Ukrainian military position thanks to a Google Earth update. It’s the second such incident this year.
Enslaved: More information is emerging about scam factories in Cambodia and how people are being duped into working at them. South Korean TV reports on the case of a man who was only freed after his family paid a ransom. And the Indian government has repatriated seven people who were being held against their will.
Greedy: You may have seen headlines about the data-slurping habits of air fryers. The real take-away from the investigation by Which? is the extraordinary quantity of data being harvested by internet-connected devices in general, with smart TV’s at the head of the list.
Socials: Australia is set to ban social media for children under 16, with the Prime Minister saying it’s harming kids and he’s “calling time on it.” Enforcing such a ban will require notoriously tricky age-verification measures. Meanwhile, Canada has ordered TikTok to close its business in the country but won’t block Canadians’ access to the app or their ability to publish content on it.
Updates
Apple: iPhone users are reporting problems with the Notes app. Specifically that after accepting new Terms and Conditions, all their notes disappeared. The fix seems to involve forcing the device to resync the content. 9to5Mac
Okta: The authentication company has addressed an issue that could have been used to log into customer accounts without a password. All that was needed was a username longer than 52 characters.
HP: Updates for Instant AOS-8 and AOS-10 software to address two critical vulnerabilities in Aruba Networking Access Points.
Android: November release includes patches for 51 vulnerabilities, two of which are under limited, active exploitation by cybercriminals. Current secure version is 2024-11-05 or later. The updates are available for Android 12, 12L, 13, 14, and 15, though individual vendors may take their time to issue them.
Synology: Updates to fix two previously unknown (‘zero-day’) vulnerabilities in Photos and BeePhotos for BeeStation software.