A data broker and the "nightmare scenario.
" Another Strava cock-up, this time it's the French navy. SIM fraud in the UK. ChatGPT gets personal. The risks of Sign in with Google. And security failures at companies that should know better.
Data broken
You have probably never heard of Gravy Analytics but quite probably it has heard of you. And tracked your movements. It’s one of the myriad data brokers that record and sell smartphone tracking details to pretty much anyone willing to hand over some cash. The problem is that it appears to have been hacked. The attackers say they’ve accessed the location history of millions of users, dating back to 2018. A sample published on a hacking forum included tens of millions of location data points across the world from ordinary users whose phone apps track where they go.
The story was first reported by 404 Media. It quoted one analyst as saying, “A location data broker like Gravy Analytics getting hacked is the nightmare scenario all privacy advocates have feared and warned about. The potential harms for individuals is haunting.“ The root of the problem lies in the way in which popular apps interact with online advertising platforms to enable real-time bidding for the most lucrative targets. This means that the stolen information could include data from pretty much any app that carries advertising.
The lesson is to disable location tracking wherever and whenever possible and practicable. The US National Security Agency has a useful summary of what to do. As Gravy Analytics’ breach notification in Norway demonstrates, the European General Data Protection Regulation is no guarantee of protection. Coincidentally, this week also saw yet another report illustrating the privacy risks of fitness trackers - this time courtesy of the French navy. Crew members of one of its nuclear-armed submarines inadvertently shared sensitive information about its patrol schedule via the Strava workout app. The investigation by Le Monde is the latest in a series of such reports.
Threats
SIM: There’s been a sharp rise in SIM swap fraud in the UK, according to consumer group Which? This has reached epidemic levels in the US but until now has been a more moderate threat in the UK. The fraud works by criminals persuading mobile operators to issue them with a new SIM card. With that, they can start trying to steal bank details and social media accounts. Do check with your mobile provider about any additional security measures they offer, including passwords and pin codes without which changes can’t be made.
Russia: Microsoft says Russian state-sponsored hackers have begun focussing their efforts on breaking into WhatsApp accounts. A multi-stage scheme begins with what looks like a message from a US official containing a QR code to join a WhatsApp group. It’s intentionally broken and, if the recipient responds, the attackers reply with a shortened link that leads to another QR code. That code leads to a page that’s used by WhatsApp to connect an account to a linked device. If the target logs in via that page, the attackers get access to their account. Ingenious but easy to defeat. Just don’t trust QR codes or links that require sign-ins, even if they come from someone you think you know.
iMessage: Apple automatically disables links received in iMessages. Unsurprisingly, this annoys criminals so they’ve started asking recipients to open the links in their browser. (Frankly, you’d have to be half asleep to fall for their ruse because it looks so suspicious.) Bleeping Computer
Speared: Research has shown just how effective AI can be at creating targeted phishing emails. A comprehensive study found that AI tools achieved a 54% click-through rate against 12% for regular phishing emails.
Fires: As firefighters continue to confront wildfires in California, scumbags have been busy setting up domains designed to exploit the disaster. Their aim is to impersonate official organisations and harvest donations. Veriti
Ads: In a move that says much about Google’s attitude to security, crooks are now using search ads to promote phishing sites that steal advertisers’ credentials for the Google Ads platform. Bleeping Computer
AI
Personal: OpenAI appears to be preparing new features that will give its ChatGPT bot personality traits including ‘Chatty’, ‘Skeptical’ and ‘Forward thinking’. They’re part of the toolset that already allows users to customise ChatGPT’s responses. TechRadar
Kids: 26% of US teenagers have used ChatGPT for homework, twice the number for 2023, according to the Pew Research Center.
Futurology: A thoughtful essay by Ethan Mollick examines progress towards Artificial General Intelligence (loosely defined as machines that can outperform expert humans across most intellectual tasks). His verdict; it looks like we’re further along the road than many thought possible even recently. But his concern is that there’s too little thought being given “to envision and articulate what a world awash in artificial intelligence might actually look like.”
Journalism: AI will change jobs, more than eliminate them, according to John Micklethwait who is editor of Bloomberg and used to edit The Economist. “Getting the stories is where the humans still matter. The machine can’t persuade a cabinet minister to tell you that the chancellor has just resigned,” Micklethwait writes. That is, of course, providing you can find ways to pay the humans.
Nutshell: Grand predictions about AI are all very well but this cartoon is a pretty good summation of where much use of the technology stands at the moment.
Googled
We loathe services like ‘Sign in with Google,’ and a new security snafu simply reinforces our view that they’re not safe. In this case the issue is specific to Google and affects domains that have been abandoned and are back on the market. Dylan Ayrey found that by re-registering a domain and creating a Google Workspace for it, it was possible to access data belonging to the previous owner. As Ayrey explained to the Shmoocon conference, the issue lies with the OAuth standard. The way it works is that once it’s associated with an email address and a service, that link lasts forever. Hence the new/old email address works even if someone takes over a domain name. Initially, Google downplayed the issue before eventually awarding the researcher a $1,337 bounty - though it hasn’t fixed the problem. Instead it said it was up to users to delete any accounts they’d signed up for with an impacted email. Truffle Security
In brief
Hopeless: A private security company and one of the world’s biggest web hosting companies take pride of place in this week’s hall of shame. A researcher said the security company, which has provided services to health facilities, rail operators, and high-end fashion brands, left more than 124,000 files exposed online. And in the US, the Federal Trade Commission found that GoDaddy has filed to put in place basic security measures. It will be required to develop and implement a comprehensive information security program. Words fail.
WiFi: A new vulnerability has been identified in the WiFi protocol which allows an attacker to slow down a network by tricking an access point into misconfiguring itself. Linus Tech Tips explains the problem and the (relatively limited) impact.
Facts: Misinformation and disinformation are the biggest global risks over the next two years, according to the World Economic Forum. Their report comes as researchers detailed a pro-Kremlin disinformation campaign ahead of a presidential election in Croatia and a senior EU offical said more elections might need to be cancelled because of foreign interference. And, according to Axios, Google has told the EU it won’t add fact checks to search results or YouTube videos - and it’s pulling out of a voluntary agreement that aims to combat disinformation.
China: Beijing-linked spies who broke into the US Treasury Department also stole documents related to property sales near US military bases, according to CNN.
DORA: Today sees the arrival of the EU’s new regulation designed to strengthen the financial sector’s ability to combat cyber attacks. The Digital Operational Resilience Act (DORA) requires organisations to ensure they can withstand, respond to, and recover from cyber threats. It applies not only to financial institutions but also to their technology providers. BH Consulting
Porn: There’s a noticeable move towards use of age verification for access to adult websites. The UK media regulator has issued new rules to make it harder for anyone under 18 to view online pornography services. Companies must adopt methods including photo ID matching, facial age estimation and credit card checks. In the US, the Supreme Court looks setto uphold a Texas law requiring users to prove their age in order to access pornography websites.
Fines: Google’s parent company was fined a total of almost $2.9 billion last year for anti-competitive practices. The figure for Apple is $2.1 billion. Proton has been tracking fines issued to big tech companies - and the minimal impact they will have on their vast revenues.
Email: It’s time to ban email, Terence Eden argues, calling it “an analogue process in a digital world.” We wouldn’t go quite that far but we would argue (and constantly tell awareness sessions) that email is frequently used to do things it should never be let anywhere near, including particularly sensitive projects.
Updates
Microsoft: As well as its set of monthly updates (around 160 of them), Microsoft has also advised Outlook users to read emails in plaintext because of a particular nasty vulnerability. It also seems to dumped a highly misleading interface for Bing that appeared to be designed to make people think that were using Google.
Patch Tuesday: As well as Microsoft, there are monthly security updates from Adobe, Chrome, SAP, Ivanti, Fortinet, Cisco, NVIDIA, Zyxel, and Zoom. Several of the vulnerabilities addressed in the updates are serious.