Taking security seriously. Webcams and digital video recorders under attack.
ChatGPT comes to WhatsApp. Artificial immortality. Spying on journalists in Serbia. And the vanishing web.
Communications
The US cybersecurity agency CISA is the latest body to urge senior government and political officials to adopt end-to-end encrypted messaging apps following Chinese breaches of telecom networks. “Highly targeted individuals should assume that all communications between mobile devices—including government and personal devices—and internet services are at risk of interception or manipulation,” CISA said. Although this advice is directed at one demographic, the underlying message is that communications networks simply cannot be trusted (something we’ve been saying for years).
While it’s practically impossible for individuals to protect themselves against nation-state spying, it is entirely possible to make everyday communication more secure. CISA’s advice includes using secure apps like Signal, adopting phishing-resistant multi-factor authentication and taking advantage of a password manager. Veteran cybersecurity manager Bob Lord has a post on Medium with some specific things organisations should do in the next 30 days;
-
Update your Employee Security Handbook to standardize on end-to-end encryption for all business communications.
-
Request that the CEO direct staff to use Signal (or your chosen solution) exclusively for business communications.
-
Ensure the CEO personally champions this practice throughout the organization, making it a cultural norm. They should mention it at all-hands meetings and in emails to the workforce. Repetition is key.
For a more personal take, the Electronic Frontier Foundation outlines how to protect your ability to have a private conversation.
Threats
Things: The FBI is warning that attackers are scanning the internet for Chinese-branded webcams and DVRs that are out-of date or end-of-life. Attackers are focussing on Hikvision and Xiongmai devices in the US, Australia, Canada, New Zealand, and the UK.
Finance: Google’s Play Store is littered with malicious copies of genuine banking apps. Once installed, they ask for sensitive personal information and documents which enable fraudsters to drain bank accounts. McAfee says there are more than eight million active installations globally.
Voice: Trend Micro breaks down an incident in which an attacker used social engineering via a Microsoft Teams call to impersonate a user’s client and gain remote access to their system. Nasty.
Tasks: There’s been a sharp rise in scams targeting people looking for remote work, usually involving repetitive tasks such as liking videos or rating product images. In 2020, the US Federal Trade Commission reported 5,000 cases. In the first half of 2024, there were 20,000.
Captcha: It’s wise to avoid websites offering free or pirated content, but an additional reason comes in the form of fake verification challenges. They’re accompanied by ads that lead to malicious software designed to steal passwords. gbhackers
Invites: Criminals are using fake Google Calendar invites that appear to come from someone the recipient knows. They usually include a link to Google Forms or Google Drawings and are designed to support a range of financial scams. Check Point
DocuSign: This is a perennial problem; in its latest guise an attacker has succeeded in taking over the Microsoft Azure cloud infrastructure of multiple European companies. The initial emails were made to look like a DocuSign request to review and sign a document, and contained either an attached PDF file or an embedded HTML link, which eventually led to a fake Outlook Web App login page. Unit 42
Russia: Researchers have uncovered two families of Russian spyware designed to attack Android devices. Google says it protects against them and, in any case, they appear to need users to grant them unusual permissions in order to work. Lookout
AI
WhatsApp: Want to try out ChatGPT? Just add 1800CHATGPT (that’s +18002428478) to WhatsApp and start chatting. Only in text for the moment and it’s a decidedly cut-down version of the real thing because the data used to train it doesn’t include anything after 2022. And just in case enterprising fraudsters decide to take advantage, as OpenAI says, bear in mind that ChatGPT will never initiate a conversation with you.
Video: You can now point your phone’s camera at something and ChatGPT will analyse it in real time. And, if you prefer talking to typing, none of this requires you to enter or read text (see next item). TechCrunch
Voice: We wrote last week about the feature that allows you to talk to OpenAI’s ChatGPT bot. It’s pretty remarkable and we should have linked to this FAQ that explains it in relatively clear terms.
Mistaken: A less than stellar performance from Apple Intelligence which summarised a BBC headline completely incorrectly. In a notification, it said the alleged killer of United Healthcare’s CEO had shot himself. The BBC is not amused.
Unprepared: Almost no UK businesses feel they’re prepared for AI-powered phishing scams, according to Vodafone. Its report says a third of them have provided no cybersecurity training for their staff in the past two years. Employees are vastly over-confident in their ability to spot scams, and junior staff are the most vulnerable to hackers. So all good then.
Recall: Microsoft’s troubled all powerful memory machine appears to have hit another problem. The feature takes snapshots of the Windows desktop so they can be searched later, prompting concerns about privacy and security. In response, Microsoft released a ‘sensitive information’ filter to prevent banking details and such being saved. Just one problem, it doesn’t appear to work. techradar
Immortal: Several companies are offering to provide copies of people that live on past their death. A company called Life’s Echo is taking that concept a step further with fully interactive simulations based on in-depth interviews (conducted by an AI avatar). These are used to create a digital clone of the individual which can interact with friends and family. techradar
In brief
Spies: Serbia is using Cellebrite software to unlock the phones of journalists and activists in order to install spyware on them, according to Amnesty International. In one case, it says an investigative journalist was detained on suspicion of drunk driving. He locked his phone and handed it to police while being questioned. When he got it back, it turned out to have surveillance software on it.
Router: You’ve quite likely heard of TP-Link products. You may even have one. Well their manufacturer is Chinese and the US is wondering whether to ban them because of security concerns, according to The Wall Street Journal. ZDNet appleinsider
Passkey: Microsoft is so keen on the partial replacement for passwords that its users aren’t going to be able to avoid them. “We’re implementing logic that determines how often to show a nudge so as not to overwhelm users, but we don’t let them permanently opt out of passkey invitations,” a couple of senior managers said in as blog post.
Tinder: Journalists were able to identify hundreds of soldiers from nations including Germany, the UK and the US via the Tinder dating app. Details included home addresses and travel movements that can be tracked via the application. Follow The Money (R)
Fingerprinting: The UK Data Protection regulator has issued an unusually forthright rebuke to Google over its decision to allow advertisers to ‘fingerprint’ user devices. The technique enables organisations to track users by recording various bits of information about their devices - and it’s hard to evade. The regulator warned organisations that fingerprinting almost certainly contravenes data protection regulations.
Social: One of Twitter’s founders has come up with a new social media app. Mozi has only one focus; enabling users to let friends know when they’re going to be in the same place. No posts, no photos, just location information. At present, only available for iPhones.
Melting: The web is vanishing, according to a study by the Pew Research Center. It says 38% of webpages accessible in 2013 aren’t available today. The Verge examines a growing phenomenon, with local news a particular source of concern.
Updates
Apple: The latest iPhone and Mac operating system versions allow AirTag users to create a shareable link and send it to a number of airlines (9to5Mac has a list of them here). Meanwhile, there’s a report that Apple is to stop selling the iPhone SE and iPhone 14 in Europe because of the introduction of EU rules requiring devices to use a USB-C charging port. Frankly, we wouldn’t advise anyone to buy the existing iPhone SE because a new one is due to launch in March.
FaceTime: The latest version of the iPhone operating system includes new audio and video modes for FaceTime. ‘Wide Spectrum’ picks up more background noise, ‘Voice Isolation’ cuts it out. You can adjust the settings during a call by opening Control Centre and tapping Mic Mode. It’s also where you can change the video settings.
SonicWall: When it scanned the internet, BishopFox found more than 430,000 firewalls were exposing their management interfaces online. Many of them were also running old hardware and vulnerable firmware versions.
Citrix: There’s a new warning about attacks targetingNetScaler and NetScaler Gateway appliances. The tactic is to ‘spray’ passwords at the devices until they find one that works.
Apache Struts: Users are being urged to ensure the Struts2 Framework is up to date. Critical vulnerabilities affect all versions below 6.4.0. ACSC
SecureDrop: Version 2.11.0 includes automatic checks to ensure all servers are ready for migration to Ubuntu 24.04 (Noble).
Thanks for reading. We wish you and yours all the very best for the festive season.