Chinese statecraft. "You're fired" phishing scam.
Microsoft denies using office apps to train AI models. Swiss church tries out 'AI Jesus.' The risks of a neighbouring WiFi network. And a novel approach to selling cybersecurity services.
China
Anyone who’s enjoyed the experience of engaging with Chinese state security will know that its approach tends to be ‘uncompromising.’ This week provided a number of excellent examples of what that means in practice.
Historic: “My hair is on fire,” was the reaction of the chair of the US Senate Intelligence Committee after hearing details of China’s successful breach of US telecommunication networks. Senator Mark Warner described the attack as the “worst telecom hack in our nation’s history - by far.” He confirmed that China was able to eavesdrop on key phone calls, including those of President-elect Trump. The group behind the hacks is reported to be responsible for many similar attacks in other countries.
Cables: The Wall Street Journal reports ($) that European investigators believe a Chinese commercial ship deliberately dragged its anchor for 100 miles in order to cut two communications cables in the Baltic Sea. US officials have told The New York Times that the cables were not cut on purpose. However, the latest incident follows one last year in which another Chinese ship dropped its anchor and damaged a pipeline carrying gas between Finland and Estonia.
Propaganda: Google removed hundreds of domains from its news and search index. They were operated by four Chinese-based PR firms to distribute pro-Beijing news to international audiences.
Threats
Sacked: The aim of social engineering is to overcome people’s natural caution by piquing their curiosity or giving them a fright. A current campaign takes the latter route by telling the intended victim that they’ve lost their job. Cloudflare via The Register
BA: A reminder to be careful about contacting companies over social media. Scammers are just waiting to insert themselves into the conversation, as the BBC reports and as this thread on Flyertalk illustrates. One of Twitter’s few remaining uses is as a way to spur customer support centres into action but do it privately, not publicly.
Nudes: A gang with links to Russia is using the lure of generating nude images of celebrities to persuade victims to download malicious software. Silent Push
Avast: A clever campaign exploits an old version of Avast’s protection software to disable antivirus software on targeted systems. Trellix says it’s part of a growing trend to take advantage of our trust in security software.
Cloud: Attackers are using Google Docs to deliver phishing links. If clicked, they lead to fake login pages hosted on Weebly. The use of Google Docs helps to evade security checks. EclecticIQ
Apple: No…your Apple account most probably hasn’t been suspended, despite what a convincing-looking email says. This is a popular tactic; most Apple users will have received a similar message at some time, often by text. Apple has advice on how to stay safe - but the most important thing to remember is that it will never ask you to log into a website to do anything important with your account. TechRadar
AI
Microsoft: Lots of ruffled feathers followed a claim that Microsoft is using data from apps like Word and Excel to train its AI models. The company promptly denied the claim, saying access to user documents is restricted to services like grammar suggestions and web-based resources.
Clones: An AI model can create a believable copy of someone’s personality based on a two-hour interview, according to research from Stanford University and Google. Participants were asked about their background, beliefs and attitudes with their responses recorded and used to train an AI model. The researchers say the study offers great promise for testing “a broad set of interventions and theories.” Scammers say, “Yippee!”
Writing: Meanwhile, Anthropic (the company behind Claude AI) now allows users to ask it to mimic their writing style. All it needs are some samples and a description of the style you want. Other companies offer similar features but this appears to be the most sophisticated version. The Verge
Facial: A future security camera from Apple may be able to recognise an individual even when their face isn’t visible. As with sophisticated solutions used by nation states, Apple’s system works by storing data about a person, including clothing and the way they walk. 9to5Mac
Jesus: A church in Switzerland is offering visitors the chance to have a chat with “AI Jesus.” It’s housed in what appears to be a confessional booth and features a hologram showing a traditional image of Jesus. It can speak 100 languages. Deutsche Welle tried it out and found it tended to respond to questions with questions of its own.
In brief
Neighbours: Russia appears to have upgraded its approach to hacking WiFi networks. Previously, its spies would work from a car parked outside but this has drawbacks, as memorably demonstrated when they were caught trying to access the Organisation For the Prohibition of Chemical Weapons. The new tactic involves hacking a neighbour’s WiFi and using that to break into the target network. To coin a phrase, secure networks make good neighbours. Volexity Bleeping Computer WIRED
WiFi: On the subject of WiFi, Intego has a useful article on the security of routers, i.e. the device that provides wireless connectivity and which most people tend to forget about. As Intego says, security rather than speed should be the top priority.
Utilities: The UK has amplified its warnings about the threat of a Russian attack on the country’s infrastructure, saying it could “turn off the lights for millions of people.” While cyber attacks on utilities are certainly part of Russia’s playbook, the limitations of such an approach are illustrated by Moscow’s dependency on missile attacks to damage Ukraine’s power grid.
Training: We’re deeply sceptical about the value of sending employees fake phishing emails as part of cybersecurity training. That view is supported by an eight-month academic study. It found that even when people had recently completed cybersecurity awareness training it had little impact on their likelihood of failing a phishing simulation. Far better to invest more money in tailored awareness sessions than blasting out simulated phishing messages.
SMS: Thai authorities have arrested a Chinese man for sending over a million SMS scam messages. The suspect was driving around Bangkok with a mobile radio base station that sent messages posing as the country’s biggest internet service provider. An excellent example of why authentication codes as text messages should be banned. Thai Press
Takedown: A good week for law enforcement with an international operation that resulted in the arrests of 1,006 suspected cyber criminals across 19 African countries. The operation was coordinated by Interpol but, as it points out, when it comes to organised crime, the arrests are “just the tip of the iceberg.” This week, insurers said cyber attacks had cost UK businesses £44 billion over the past five years. And even when ransomware gangs are taken down, they often quickly reappear.
Workplace: Ubiquitous surveillance is becoming a hallmark of modern offices, according to a report by an Austrian group. It’s part of an ongoing project “Surveillance and Digital Control at Work.”
Advice: A very useful introduction to digital security from Runa Sandvik, one of the widely-acknowledged experts in the field. Global Investigative Journalism Network
Fail: Breaking into a company’s network to try to sell them security advice is a pretty lousy idea. As is using a corporate email account from a current employer to make the sales pitch. A Missouri man is now helping police with their inquiries. The Register
Updates
Microsoft: After withdrawing the November 2024 security updates for Exchange Server, Microsoft says it has fixed the problems which stopped some messages being delivered.
Firefox: Version 133 includes security fixes and a bunch of new features including enhanced protection from tracking.
Zello: The communications app has told customers to reset their passwords in response to what appears to be a security breach. Bleeping Computer
QNAP: A firmware update has left some users unable to access their network attached storage devices. The update has been withdrawn and this thread has instructions on reverting to the previous version.
VMware: Fixes for high-severity vulnerabilities in Aria Operations.
Tails: Version 6.10 updates the Tor Browser and Thunderbird email client, as well as fixing a number of niggles.