The insider threat. Securing credentials. Personal agents. Fact-free.
Cryptocurrency risks. And wild ideas, some of which may even be realistic.
Insiders
One of China’s espionage tactics is to co-opt members of its diaspora into becoming intelligence assets, as The Economist reports (R). It cites the example of a prominent pro-democracy activist living in exile in New York. He was arrested last year and admits to having used his position to collect information for China and to report on his fellow activists. The reason; he was seeking permission from officials in Beijing to return to China to visit his sick parents.
The reason we highlight this is to demonstrate that the ‘insider threat’ is real, although it’s definitely not restricted to Chinese nationals. There are numerous examples of people working at organisations who may have begun their employment by being perfectly loyal until pressure was exerted on them or they were offered some cash. For example, in 2022 a manager at Twitter was convicted of taking bribes in return for providing private information about users to Saudi Arabia.
Mitigating the insider threat isfraught with challenges, not least the risks of damaging morale within an organisation or appearing racist. Nonetheless, when working on sensitive projects, it’s essential to be aware that the most effective way for an attacker to find out what’s going on is to suborn someone connected to it.
Threats
Credentials: Given that usernames and passwords are the frail mechanism that secure our online lives, it’s not surprising they’re what every attacker wants. Nonetheless, the growth in attempts to steal them is pretty extraordinary. According to SlashNext, the second half of last year saw a 703% rise in such attacks. Much of the increase is put down to the availability of kits that enable anyone to go phishing.
Phish-free: Fortinet has a great example demonstrating why we shouldn’t trust apparently valid email addresses and web addresses. In this case, scumbags are exploiting Microsoft 365 test domains and distribution lists to bypass email security protections and persuade victims to hand over their PayPal account information. The solution; never trust an unsolicited email, above all if it leads to a login request.
Hello: Veteran cybersecurity reporter Brian Krebs has an illuminating glimpse into the world of how crime gangs use voice calls as part of their scams. Their techniques are elaborate, sophisticated, and include an automated Apple security alert that could fool the most advanced user. It includes a 6 minute video that underlines just how convincing these scams can be.
Apps: Android users are being targeted with information stealing software masquerading as a premium version of the Telegram messaging app. And, Apple’s App Store isn’t immune to the problem either. The latest example is a fake version of the popular game, Baldur’s Gate 3. It’s a reminder to think carefully before downloading anything other than official, authenticated apps.
Landlines: Scammers are taking advantage of the UK’s transition to digital landlines. Claiming they’re calling on behalf of BT, they ask for personal details and payment information ahead of the switchover. Which?
AI
Personal: As we wrote over the holidays, one of the big developments in AI has been the arrival of “agents” which understand the context in which they’re operating, meaning they can operate largely without human interaction. They could be thought of as digital helpers which is how The Washington Post describes them. The problem is that in order to work, they require “intimate access” to our digital lives. As one AI expert remarks, “If you ignore the safety and security and privacy side of things, this stuff is so exciting, the potential is amazing. I just don’t see how we get past these problems.” Nonetheless, OpenAI boss Sam Altman reckons 2025 “may see first AI agents “join the workforce” and materially change the output of companies.” Or, in other words, do some of the jobs humans are doing.
Ubiquitous: AI everywhere all the time is also the most notable theme at this year’s consumer tech extravaganza in Las Vegas. Companies from Samsung to Delta airlines are promising to weave together our interactions with them and create a seamless (and monetisable) interface with our digital lives. As HISense puts it, “AI your life.” Of course, this just illustrates the extent to which we will be asked to grant access to all areas of our digital lives. TechRadar
Putin: A new English-language Polish film about Vladimir Putin premieres today. It uses AI to superimpose his real face onto an actor, and portrays him both as ruthless and as “a terrified man who is terrified of death.” Notes from Poland
Video: Former Google chief Eric Schmidt is reported to be working on an AI startup called Hooglee which says it aims to democratise video creation with AI. Forbes ($)
Looped: You might have seen the video last month showing a Waymo robotaxi stuck in a loop on a roundabout. You might also have heard of the tech CEO who nearly missed his flight because of a similar incident. Mike Johns found himself circling a carpark, unable to stop the car or get out. When he asked Waymo for support, the response was less than stellar. As Johns told TechCrunch, “In this digital age that we’re in, we’re so disconnected from the human factor,” Johns told TechCrunch. “I’m all for AI. I’m at that forefront between AI, automation, robotics, but there still is a human factor.”
Facts
Meta’s decision to align itself with President-elect Trump by ending fact-checking in the US and relaxing its moderation practices has led some to wonder what it will do if the new administration asks it to stop encrypting messages on WhatsApp. Meanwhile, Elon Musk says XTwitter/X will change its algorithm to promote “informational/entertaining content,” to avoid “too much negativity that technically grows user-time, but not unregretted user-time.” Translated, this means remaining users should expect more automated clickbait - albeit happy, shiny clickbait. One of the remaining places where facts matter is Wikipedia. No surprise then that the Heritage Foundation (of Project 2025 fame) is reported to be planning to “identify and target” editors who it deems guilty of antisemitism. On the subject of facts, President-elect Trump merrily used Truth Social to spread a series of lies that the problem with fires in Los Angeles was caused by the water policies of California’s Democrat governor. And Elon Musk claimed the fires were spreading because of the LA fire chief’s commitment to diversity, equity, and inclusion policies. Welcome to 2025.
In brief
Crypto: Anyone holding cryptocurrency (or thinking of acquiring some) should be aware of the risks of being targeted by crooks. Scammers stole $494 million worth of cryptocurrency last year from more 300,000 wallet addresses. That’s 67% more than 2023 - and it’s probably an underestimate. Scam Sniffer
Upgrade: Windows 10 reaches the end of normal support in October and remaining users are being urged to upgrade or migrate to avoid a “security fiasco.” Microsoft will continue to provide updates - but only if you pay for them. Some 63% of Windows users are still on the old system. This is not an encouraging statistic. Bleeping Computer
Cars: After a Tesla cybertruck exploded in Las Vegas, the company provided police with detailed data about its driver. It’s a reminder that cars are now basically computers on wheels and, thanks to cellphone syncing, they have access to much of the information on our smartphones. AP
Journalism: Depressing headlines from the Reuters Institute report on trends in journalism, media and technology. Its survey of editors, CEOs and media executives found widespread concern about the ability of the media to operate freely. Most are worried about a fall in referrals from search engines which are providing users with more ‘story-like’ responses. And many have given up on Facebook following its deprioritisation of news.
Police: A researcher found misconfigured number plate readers leaking real-time data and video about vehicles in the US. He found 150 of the devices could be accessed without a password. 404 Media ($)
Thoughts: “By 2100, the vast majority of “people” will be immortal computers running brain simulations.” That’s one of 14 ’wild ideas” from futurologist Robin Hanson which he defines as an idea many people think is obviously quite unlikely. He believes at least a third of his wild ideas are probably true…
Updates
Browsers: A fresh year seems like a good moment for a resolution to keep web browsers updated. Fixes for serious security vulnerabilities come thick and fast, so the only way to make sure a browser is protected as far as possible is to close it down at the end of every day. This week saw important updates for Firefox and Chrome.
Microsoft: Fix for a known issue causing the Outlook email client to stop responding when using CTRL+C to copy text. One problem, it’s only available in a test version at the moment and won’t be released until next week. Until then, there’s a workaround.
Ivanti: Update for Connect Secure (ICS) VPN appliances to address two issues which Google’s Mandiant unit believes has been exploited by Chinese nation-state attackers.
SonicWall: Urgent update for SonicOS firmware to address a vulnerability that could be used to bypass authentication.
Tails: Version 6.11 fixes issues identified during an external security audit. There’s no indication that any of them have already been used.