The reality of Chinese espionage. Winter fuel payment scam.
The impact of AI-generated content on the US election. The problem with poor software design. And refusing health insurance because of genetic data.
Hacked
The US has confirmed that Chinese hackers were responsible for a “broad and significant cyber espionage campaign” against multiple US telecommunications companies. The attackers stole call records data and compromised the “private communications of a limited number of individuals…primarily involved in government or political activity.” They also accessed information obtained by US law enforcement agencies as a result of court orders.
The official confirmation follows media reports, notably in The Wall Street Journal which said the hackers had access to the companies’ networks “for eight months or longer.” Although the attack meant they could collect internet traffic from millions of customers, the paper reports that they “limited their targets to several dozen select, high-value political and national-security figures.” The WSJ says the US investigation has fuelled “concerns that China’s mastery of cyber-espionage is dangerously advanced.”
Threats
Copyright: A campaign is using “copyright infringement” warnings to try to install information stealing software on target machines. The emails are sent from a range of Gmail accounts and include a password-protected ZIP file. Check Point
ZIP: On the subject of ZIP files, ingenious scumbags have begun adopting a ‘Russian doll’ approach to defeat security scanners. It involves merging multiple archives into a new one; it works because the scanners only analyse the main archive and not the nested ones. Perception Point
Winter: Police in the UK say scammers are posing as government agencies to send texts that promise new heating subsidies. Bleeping Computer
Banknotes: There’s also a warning about a UK scam in which a caller claims (falsely) that banknotes featuring the late Queen are no longer legal tender.
Snail mail: Switzerland’s cybersecurity agency says attackers are using physical letters to send malicious QR codes to Swiss citizens. The letters appear to come from the country’s meteorology agency and urge users to install its new weather app.
Exchange: Microsoft has added a setting to Exchange Server as a result of a vulnerability that enables attackers to forge the identity of legitimate senders. The issue is caused by the way in which some email headers are handled, and the new default setting should detect fraudulent messages and display a warning about them.
Passwords: For the umpteenth consecutive year, rubbish passwords continue to feature in data breaches. Top of the worldwide list are 123456 and 123456789. In the UK, password and qwerty123 take the top spot. NordVPN
AI
US Election: Research suggests AI-generated content did little to change political affiliations but instead eroded people’s faith in reality. The Institute for Strategic Dialogue (ISD) found that users frequently claimed authentic content was AI-generated and justified their assessments with flawed strategies or unreliable online tools. President-elect Trump has said he’ll repeal a Biden administration executive order on AI which aimed to create safeguards in the absence of congressional action. Meanwhile, Facebook is bulging with absurd AI-generated ‘slop’ about how Elon Musk will fix the US.
Translator: The online translation bot (now valued at $2 billion) has added audio to text translation to its capabilities. Currently, it can handle English, German, Japanese, Korean, Swedish, Dutch, French, Turkish, Polish, Portuguese, Russian, Spanish, and Italian. TechCrunch
Gotcha: Researchers have shown that AI-powered image recognition models can now solve 100% of those irritating picture puzzles designed to tell whether or not a user is human. Ars Technica
Music: The Verge explains why there’s a wave of fake music being uploaded to artist pages on Spotify. It’s an ingenious technique that exploits the way streaming royalties are paid - and, although individual payments are tiny, if done at scale it can add up to significant amounts.
Scams: Google is testing a feature for Pixel phones that’s designed to identify scam calls while they’re happening. And UK telco O2 Virgin Media has created an “AI granny” that’s designed to trap scammers in meandering conversations and waste as much of their time as possible. It was set up in conjunction with a well-known scam investigator who runs the YouTube channel Tech Support Scams.
In brief
Zero-day: There’s been a surge in the use of previously undisclosed vulnerabilities to attack organisations, according to the ‘Five Eyes’ intelligence alliance. The technique means it’s essential to install updates as soon as they’re available although, as the alliance points out, the real problem is that software is fundamentally insecure.
Tibet: A favoured Chinese tactic is to compromise legitimate websites so that visitors are infected with malicious software. Record Future says this has happened again with two Tibetan websites. The technique displays what appears to be a security warning.
Police: The FBI says there’s been a rise in hacked police email addresses being used to send fake subpoenas and emergency data requests to US tech companies. KrebsonSecurity
Journalist: The experience of a Washington Post journalist in India underlines why it’s important to protect mobile phone numbers and other personal information. The Committee to Protect Journalists says Rana Ayyub’s number was leaked online and during a reporting trip in India she was followed and repeatedly questioned by local intelligence personnel.
Socials: A startup is offering to take the pain out of ensuring we don’t overshare information on social media. ‘Block Party’ works as a browser extension and once installed analyses social media sites as you visit them. It then checks security settings and automatically changes them where necessary. It costs $20 per year but currently is available only in the US. Washington Post
Genes: US health insurance providers are using DNA data to deny coverage or charge higher premiums. The Atlantic has the story of a healthy 60-year-old who was denied long-term-care insurance after revealing a genetic mutation linked to ALS (amyotrophic lateral sclerosis), despite not having the disease.
Updates
Apple: Some interesting changes include;
-
A new iPhone setting is designed to prevent access to the device if it has been idle for three days. US law enforcement officers noticed the change when iPhones in their custody started rebooting themselves automatically. The change means the device is in a more secure mode and makes it next to impossible to extract data from it without a passcode.
-
The next iPhone operating system version (expected next month) will include an option to share AirTag location data with 15 airlines.
-
The latest version of FinalCutPro (FCP 11) includes support for spatial video, AI-assisted caption transcription and enhanced masking.
D-Link: There’s a serious vulnerability in a range of network attached storage devices. They reached end-of-life as long ago as 2009 and so the issue won’t be fixed. D-Link has told users to “retire” the devices.
**Signal: ‘**Call Links’ allows multiple users to join a secure group video call just by clicking a link. Previously, only group members could initiate a call. We’re not entirely convinced this is a good idea because of potential security risks. We suggest using the option to require admin approval before people can join a call.
Snapchat: A new feature will allow parents to request their kids’ real-time location.The Verge
Patch Tuesday: Monthly security updates from Adobe, Microsoft, Ivanti, security updates from Adobe, Microsoft, Chrome, Ivanti, Citrix, Fortinet, SAP, Intel, AMD, Zyxel, and Zoom.