Chinese cyber espionage in overdrive. Booby-trapped browser extensions.
Outlook spam filters. OpenAI's plan to make money. And the employees putting everyone at risk.
China
The White House has been providing yet more details about China’s extraordinary success in breaching US telecommunications networks - and they make for grim reading. As we see so often, the fundamental problem was a complete failure to get the basics right, as a White House official told reporters. In one case, a single administrator account had access to over 100,000 routers so, by compromising the account, the Chinese “gained broad access across the network.” As the official said with masterful restraint, “That’s not meaningful cybersecurity to defend against a nation-state actor.”
The so called “Salt Typhoon” attack was described by one senator as the “worst telecom hack in our nation’s history,” but it’s only one element in sustained Chinese cyber attacks against the US. This week, it emerged that China succeeded in accessing government documents in a “major” cyber breach at the US Treasury Department. It told lawmakers that the hackers gained remote access to some employee workstations by exploiting a tool designed to provide remote access technical support. It seems the attackers specifically targeted the Office of Foreign Assets Control (OFAC), which is responsible for imposing foreign sanctions.
China continues to deny any involvement in the attacks, saying it“consistently opposes all forms of hacking” and that the US has failed to provide evidence to back up its claims. Those denials would be more convincing were it not for years of cyber attacks which have been convincingly ascribed to Beijing. The exact number of personnel involved in the People Liberation Army’s cyber operations is difficult to assess but estimates have previously put the number at around 130,000.
Threats
Extensions: Browser extensions are undeniably useful, but alas they’re also a certifiable security risk. This week, researchers found 36 attacks involving booby-trapped updates for genuine extensions. Among them, are widely used products including ChatGPT for Google Meet, Bard AI Chat, and YesCaptcha Assistant. The malicious updates were designed to enable data to be stolen from infected browsers. We’re not saying don’t use extensions, but it’s important to ensure they’re genuine. And we would avoid using them on devices involved in sensitive projects.
Outlook: Microsoft’s spam filters seem to have taken an extended break for the New Year and are failing to spot obvious phishing emails. This is a recurrent issue with Outlook which has varying protection levels; setting them to “High” might fix the problem. On the other hand, you might want to dump Outlook and replace it with Gmail because it’s better (though not perfect) at keeping rubbish out of your inbox.
VW: Sensitive information belonging to 800,000 owners of VW Group vehicles was found online. The source of the data is a VW mobile app for VW, Audi, Seat, and Skoda electric vehicles. Spiegel
Holidays: Action Fraud is warning about scumbags who are targeting people booking holidays. The BBC has a case study of a woman who was scammed after responding to an advert on social media.
AI
Money: OpenAI has released details about its plans to move to a for-profit structure. It says it will adopt a public benefit corporation model which will require it to balance the interests of shareholders and stakeholders with those of the public.
Eavesdropper: Apple has agreed to pay up to $95 million in a settlement with users whose conversations were inadvertently captured by its Siri voice assistant and potentially overheard by human employees. This story was initially framed as proof that Apple was using conversations to target ads. We think that’s unlikely, but if this settlement is approved, we’ll never know either way because the details won’t be disclosed. Reuters
Surgery: US university researchers say they’ve use videos of surgeries to train robots to perform procedures with the skill of human doctors, to the extent of learning to correct their own mistakes during operations. Washington Post
In brief
Naughty: Most employees are pretty good at avoiding cyber risks, but a small subset makes a habit of behaving badly, according to a survey by Mimecast. It’s a finding that bears out our own experience. And it’s compounded by the fact that the ones who take the risks can influence others - particularly if they’re using unapproved software.
Email: Some 3.3 million email servers are using communication protocols that don’t support encryption. (In other words, they’re running POP3/IMAP services without TLS enabled.) This means usernames and passwords aren’t protected when they’re transmitted. The new year would be a great time to check that email is as secure as possible. The UK cybersecurity centre has a free tool.
Predators: The New York Times has a gruesome report on a group of men who offer to build online audiences for young girls. Their real aim is to persuade them to produce sexually explicit images.
Telegram: Has added a third-party system for verifying accounts. The idea is to provide more “transparency” by allowing approved services to verify users. Frankly, transparency sounds like the last thing it will achieve.
Thanks for reading (this abbreviated newsletter). Normal service will resume next week. Meantime, we wish you and yours all the very best for 2025.