US security officials tell Americans to use encrypted messaging.
HR dominates phishing lures. Harvesting Bluesky posts for machine learning. Law enforcement celebrates a good week in fight against cybercrime. And the risks of errant voice notes.
Encryption
An unprecedented attack on US telecommunication giants has provoked security officials to urge Americans to use encrypted messaging apps to protect themselves from foreign hackers. Officials told journalists on Tuesday that the scope of the attack was so significant, that it was “impossible…to predict a time frame on when we’ll have full eviction.” A US official also admitted that a large number of Americans’ cellphone metadata had been stolen in the espionage campaign, which has been ascribed to a Chinese hacking group. When asked if every American’s cellphone records might have been compromised, the official was less than reassuring. “We do not believe it’s every cellphone in the country, but we believe it’s potentially a large number of individuals that the Chinese government was focused on,” he said.
The US is not the only country affected by the hack. It says “dozens” of other countries have been targeted, with the focus mainly on very senior government officials. The whole affair has revealed the horribly insecure nature of the world’s communication infrastructure. in part, this is because it’s built on decades of legacy solutions which were designed with reliability, not security as their key requirement. The FBI’s abrupt about-face on encryption gives an indication of how serious the situation is.
Meanwhile, Microsoft says a Chinese government-linked group has begun targeting critical infrastructure organisations and US government agencies. The Register reports that their aim is to gain remote access by tricking people into opening a document or connecting to a booby-trapped website. The main focus has been on the US defence industry, aviation, telecommunications, financial and legal services sectors, as well as government and non-governmental agencies. In the UK, the national cybersecurity agency warned that the country faces a widening gap in its ability to fight cyber threats and the number of “severe incidents” it has handled tripled in the past 12 months. The direction of travel here is perfectly clear and the speed of escalation alarming.
Threats
Trends: HR-related lures dominated phishing attacks in the third quarter of the year, according to KnowBe4. Among the subject lines; reminders to review policies, performance reviews, and salary notices. KnowBe4 says it also saw a rise in the use of QR codes while Microsoft was the most impersonated brand. Above all, fraudsters simply love moments when shoppers are looking for good deals. This year, Darktrace says it saw phishing attacks increase by 692% in the run up to ‘Black Friday’ compared to the start of November.
Possession: A Russian programmer suspected of sending money to Ukraine was arrested, beaten up and forced to hand over his phone. When it was returned to him - and after he managed to flee the country - it turned out to have spyware on it. The lesson; never trust a phone that has been out of your sight. Citizen Lab
Printing: Beware of Google ads when you’re trying to fix a printer problem. Malwarebytes explains how scumbags exploit Google’s ecosystem to make sure their fake adverts are what you see when you search for help.
Microsoft: A sophisticated new phishing kit is designed to steal Microsoft 365 credentials and bypass multi-factor authentication. It uses a variety of lures, including document-sharing notifications, IT department notices, password reset alerts, and pay-related messages. Bleeping Computer
Word: This is a new one for us. Attackers are using corrupted Word documents to bypass security defences. On trying to open the files, Word will offer to recover the content thus displaying a QR code that leads to a fake Microsoft 365 login screen. Any.Run
TLD: Generic top-level domains are those three letters at the end of web addresses and emails. Examples include .shop, .top, and .xyz. They account for only 11% of new domain registrations but make up 37% of reported cybercrime domains. Brian Krebs
AI
Bluesky: As more and more people desert XTwitter for Bluesky, it has emerged that users’ posts are being harvested to create datasets for machine learning. This is probably contrary to EU and UK data protection rules and definitely against Bluesky’s terms and conditions but neither of those seem to be of much concern to the increasing number of of people exploiting the way Bluesky works. 404 Media
Names: ChatGPT grinds to a halt when it comes across a small number of specific names. It turns out they’re people who have complained about being defamed by the bot. ArsTechnica
Dubbed: A Spanish-language movie is using AI to clone the actors’ voices and translate their dialogue into English. The Witch Game is due to be released in cinemas in the US and the UK. techradar
Jobs: AI makes it easy to apply for a job which means recruiters are flooded with applications. Unfortunately, as the FT explains, that has led to employers coming up with ever more elaborate ways to try to identify suitable candidates.
Ads: OpenAI is considering putting adverts on ChatGPT in an effort to increase profits. FT via 9to5Mac
Deepfakes: YouTube has been hosting hundreds of adverts featuring deepfake copies of celebrities including Arnold Schwarzenegger and Sylvester Stallone. The videos flog erectile dysfunction supplements and were easily able to evade Google’s ‘enforcement systems.’ 404 Media
In brief
Crime: Another good week for law enforcement as cybercrime gangs were nobbled in South Korea and the UK, while Europol took down an encrypted messaging platform used to coordinate illegal activities. But the impact of ransomware was amply illustrated in the US where vodka maker Stoli Group’s subsidiaries filed for bankruptcy protection following a cyber attack in August.
Spyware: The use of sophisticated spyware like Pegasus may be more common than previously thought, according to research by a security company. iVerify says scans of 2,500 devices revealed seven were infected with Pegasus and they belonged to corporate executives as well as journalists and activists.
ExxonMobil: The oil giant is alleged to have targeted over 500 climate activists and journalists in a concerted effort to discredit them and undermine climate litigation. Exxon has dismissed the allegations as “conspiracy theories.” VulnerableU Citizen Lab
Honeytrap: A UK court has been hearing details of a wide-ranging operation that targeted journalists and critics of Russia and considered using women as “honeytrap” agents. Hundreds of “sophisticated’ devices were used to gather intelligence, including hidden bugs and jammers, the court was told. ITV.
Wildlife: Remote controlled cameras and microphones intended for monitoring wildlife are being used by local government officials in India to surveil women without their consent, according to Cambridge University researchers.
Passwords: We’re not keen on using web browsers to manage passwords, not least because browsers are so riddled with vulnerabilities. It’s a view shared by renowned hacker Marcus Hutchins who explains how to break into Chrome-based browsers and access passwords stored in them.
Photos: Being careful about what you reveal in photos is a longstanding part of our awareness sessions. A couple of stories this week illustrate this. First, a blog dissects the technology on the desk of the new head of NATO. We’d argue the details are much better left out of the public eye. And a new website demonstrates what Google AI can learn from our photos. Again, better it were left unlearned.
Workplace: Apple makes a big deal about its commitment to privacy. That commitment doesn’t extend to its employees, according to one of them. Amar Bhakta is suing the company, saying Apple’s insistence on staff only using Apple devices and iCloud accounts breaks California law. Semafor
Finger trouble: Most TV productions wouldn’t get on air without WhatsApp, but of course it’s also a popular way for staff to vent spleen about the slings and arrows they suffer. Alas it’s also easy to send messages to the wrong people. This week we heard about the case of a well-known and very popular UK show, a long voice note complaining about pretty much everything ended up being sent not to one colleague but the entire team. It’s that old lesson; never write anything you wouldn’t be happy for the whole world to see.
Updates
7-Zip: There’s a nasty vulnerability in the popular file utility which could be exploited to allow malicious software to be run remotely. A fix was released last month.
Bluesky: NiemanLab explains how journalists can verify their accounts through their employers while keeping control of them.
Microsoft: Anyone using Windows 11 on an unsupported machine is about to be bombarded with pop-up messages telling you to stop. The fact that the machine is perfectly capable of running Windows 11 is immaterial. TechRadar
Veeam: Updated for Service Provider Console to fix a critical issue that could be used to attack the machine remotely.
SonicWall: Fixes for 6 vulnerabilities in Secure Access Gateway.