Attackers get smart while phishing remains king. Black Friday opportunities for scammers.
Critical infrastructure risks. Protecting against government surveillance. Using advertising data to track US military personnel overseas.
Cloaked
Google says scumbags are getting smarter, particularly in their use of AI. In its latest report on current scams, Google points out that many schemes are operated by “transnational crime organisations [which] operate at scale, constantly adapt their methods, and combine online and offline activity.” Increasingly realistic impersonation of public figures is just one of their tools. Perhaps most worrying is the use of “cloaking’ which involves presenting different content to Google compared to what a user sees. Examples include shopping sites that look legitimate until you try to buy something. Linked to this are malicious adverts that exploit Google’s advertising platform. Google says it’s blocked 5.5 billion of them this year but they still continue to pop up (QuickBooks and Bitwarden are brands being exploited at the moment).
But of all the scumbags’ tactics, phishing remains firmly top of the pops. Of 29 billion cybersecurity events last year, phishing was the most significant method for gaining initial access, according to a report from Comcast Business. It says (R) it detected 2.6 billion instances of phishing in 2023. One of the attackers’ main aims is to obtain user credentials for enterprise applications. Like most of these reports, Comcast Business is trying to sell a service, but its report does have useful statistics and some sensible guidance.
Threats
Shopping: Black Friday is nearly here and with it the most wonderful time of year for fraudsters. The UK’s cybersecurity centre says shoppers lost £11 million during the last festive season. In the US, the cost of fraud for the whole year was $12.5 billion. As always, anything that looks too good to be true is a scam. Security Boulevard
Graphics: There’s been a rise in the use of Scalable Vector Graphics (SVG) attachments to evade detection by security software. Approach with caution. Bleeping Computer
BlueSky: The media aren’t the only ones to have noticed the exodus from XTwitter to BlueSky. As well as an influx of new users, the platform says it’s seeing an upsurge in “spam, scam, and trolling activity.”
Jobs: DomainTools has found a bunch of fake government job portals in countries including the US, Pakistan, India, Taiwan, and the Middle East. The sites are designed either to extract a fee from applicants or to lure them into handing over personal information or downloading malicious software.
Dropbox: Abnormal Security has a detailed write-up of a scam that begins with a genuine email from Dropbox. It’s designed to lure victims (in this case corporate users) into handing over their Microsoft credentials. It’s a really good example of how sophisticated this type of attack has become.
Sad: A nasty phishing campaign uses an email titled “Sad announcement” and a message implying a friend has died. The email contains a link that leads to a fake Windows Defender site showing the device is riddled with threats. And of course the hope is that the user will take advantage of the friendly tech support scammer waiting to help. Malwarebytes
AI
Teams: Microsoft says Teams users will soon be able to clone their voices so they can speak a foreign language during meetings. Or in Microsoft marketing speak, “Imagine being able to sound just like you in a different language.” In security speak, “Imagine the opportunity for attackers…” It’s just one of the new features announced by Microsoft this week.
Books: Microsoft is reported to have done a deal with Harper Collins to use non-fiction content to train a yet-to-be announced AI model. One author said he was offered the princely sum of $2,500 per book for a three-year licensing contract.
Pimping: Want to to make some money but can’t be bothered to come up with content? Simple. Just steal someone else’s. 404 Media says what began on a small scale is now flooding Instagram with hundreds of AI-generated influencers and videos stolen from real models and adult content creators.
Pokemon: Niantic, the company behind Pokemon Go, is using data collected by its millions of players to build an AI model for mapping and visualising the world. Little did those players know how their movements would be used. Though there have been concerns… Niantic via GarbageDay-,Pok%C3%A9mon%20Go,-Will%20Power%20The)
Shaky
The modern world is wholly dependent on essential services like energy, water and transportation but the security of this critical infrastructure is ludicrously fragile. Take water for example. In the UK, The Guardian reports that the country’s largest water company has failed to update essential IT systems and is still using software dating back to 1989. (Anyone remember Lotus Notes? That’s still in use according to the paper). In the US, the Environmental Protection Agency found some 9% of public drinking water systems affected by critical vulnerabilities that could be used to compromise them. More broadly, Censys says (R) 145,000 industrial control systems are exposed to the internet. Among them are the interfaces used to manage the systems, and many of those are accessible without authentication.
Trump watch
With President-elect Trump promising to jail his enemies and deport millions of undocumented immigrants, Wired has a no-holds barred guide to protecting yourself from government surveillance. Of course, no-one knows what Trump is actually going to do but Wired’s report does have good advice for anyone anywhere seeking to reduce the amount of information about them that’s easily accessible. Though, as we frequently warn, if a nation state is determined to surveil you there really isn’t much an individual can do about it. Incidentally, The Washington Post reports that in his calls with foreign heads of state and government, the President-elect has cut out the State Department, along with its secure communications infrastructure and official interpreters. Happy days for foreign intelligence agencies.
In brief
Leaky: Easily available digital advertising data provides a cheap and reliable way to track the movements of US military and intelligence personnel overseas. An investigation by WIRED, Bayerischer Rundfunk (BR), and Netzpolitik.org analysed billions of location coordinates obtained from a US-based data broker. As WIRED’s headline puts it, “Anyone can buy data tracking US solders and spies to nuclear vaults and brothels in Germany.” The risks of this sort of data are well known - we’ve been talking about them since we opened for business in 2016.
Cellphone: Exploitation of advertising data is just one of the security vulnerabilities afflicting cellular connectivity. A small US tech company is trying to address them by offering a secure cellphone service. Cape has set itself up as a mobile virtual network operator (MVNO) so that it can better secure the way its Android handset works. It has been selling the service to the US navy. It’s now making it available to high-risk individuals. Cyberscoop and 404 Mediahave detailed reports.
Location: Meanwhile, fitness platform Strava says it’s restricting the way third-party apps can access user data. This will have radical effects on the ecosystem that has grown up around the data generated by Strava but, from a security perspective, it’s a good thing. Users still need to make sure they’re not oversharing on the platform.
Spyware: The NSO group, which is responsible for Pegasus spyware, has long insisted that it has no knowledge of how its product is used or who it’s targeting. We’ve long insisted that’s nonsense, not least because NSO provides ongoing support for the systems it sells. Now documents unsealed as part of a court case launched by WhatsApp reveal some of the inner workings of the system and the prices NSO charges (up to $6.8 million for a one-year license). Confirmation also emerged that Pegasus was used against Dubai’s Princess Haya who was seized after trying to escape the UAE. TechCrunch
Unlocked: Leaked documents show that older iPhones can be fully unlocked by ‘Graykey’ software while later models are more resistant to access. The documents portray the cat and mouse process in which security companies and Apple continually try to outwit each other. 404 Media
Testers: Ransomware gangs have begun recruiting penetration testers to help them compromise target organisations, according to Cato Networks. ‘Pen testers’ are usually hired by organisations to identify security vulnerabilities so they can be fixed. Cato also warns (R) about an increasing use of unapproved - or shadow - AI tools.
Chrome: So will the US government really force Google to sell off its Chrome web browser? Well not in the short term it won’t. And the process is so riddled with difficulties - not least who would or could buy it - that it may never happen. Spyglass has a good overview.
Ensnared: ProPublica explains how Microsoft provided the US government with free cybersecurity upgrades as a way of locking in its federal customers by making it too difficult and expensive to move to a competitor. This is a tactic with which some readers may be familiar.
Toolkits: Finally, some good news. The Global Cyber Alliance has some excellent toolkits that provide helpful cybersecurity advice. They have just racked up their two millionth visitor.
Updates
Apple: Important security updates for Macs, iPhones and iPads. Latest versions are iOS 18.1.1, iPadOS 18.1.1, macOS Sequoia 15.1.1. Apple says two vulnerabilities “may have been actively exploited on Intel-based Mac systems.” Apple also released iOS 17.7.2 and iPadOS 17.7.2 for older devices.
Palo Alto Networks: After initially saying it hadn’t seen anyone exploiting two serious security issues in its latest firewalls, Palo Alto now reckons it has observed a “limited set of exploitation activity.” By limited, we take it to mean the more than 2,000 devices that a monitoring group says have been compromised.
Microsoft: The November 2024 Exchange security updates have been withdrawn because of problems delivering messages on servers with custom rules for filtering and redirecting mail.
D-Link: In yet another warning about devices it no longer supports, users of a range of VPN routers are being warned to get rid of them immediately. There’s a critical flaw that can be easily exploited remotely. Support for the DSR-150 / DSR-150N / DSR-250 / DSR-250N devices only ended in May so most likely many are still in use.
Google: Say farewell to rubbish framing on Meet video calls. The feature will automatically position users in the middle of the screen. Until now it was only available to Google Workspace accounts.
WhatsApp: A new feature will transcribe voice messages so you don’t need to listen to people droning on endlessly when they could have sent a simple written message. It’s rolling out gradually so you may not see it immediately. To turn it on, go to Settings | Chats | Voice message transcripts.
SecureDrop: Client version 0.14.0 adds support for journalists to select and delete multiple sources simultaneously,