Making multi-factor authentication safer. Mocking a victim of romance fraud.
The short road to AI supremacy. Trump's first week. Surveillance pricing. And government sites and hardcore porn.
Authentication
Unapproved IT devices and services are a huge risk but everything points to them being increasingly common. Because we work mainly with media professionals facing enormous pressure and constrained budgets (and because that’s our own background), we completely understand why this happens. But it’s essential to mitigate this threat, especially given the increased sophistication of the services available to even low-level attackers. Information security policies are often seen as an unnecessary evil. Provided they’re concise, relevant and implemented, they can be the difference between security and disaster.
A key issue this year is the vulnerability of legacy multi-factor authentication solutions. That’s obviously true of methods that use hopeless insecure platforms like text messaging but it applies increasingly to previously trusted solutions like codes generated by authenticator apps. The problem is that these can be intercepted relatively easily with kits that are…relatively easily available. Wherever possible, we advocate the use of phishing resistant methods like passkeys and hardware keys. And it’s more important than ever to engage employees and colleagues in the issues around security. That will benefit them not only at work but also in their personal life. Especially when the dividing line between them is so blurred.
Threats
Romance: It’s bad enough to lose €830,000 in a deepfake scam. Imagine then being ridiculed across your home country after national TV airs a documentary about you. Admittedly, the facts are bizarre. The victim in this case is a 53-year-old French woman who was deceived into believing she was in a relationship with Brad Pitt. Her 18 months ordeal began when she joined Instagram and almost immediately was contacted by someone pretending to be Pitt’s mother. There followed a torrent of requests for money accompanied by AI-generated material, many showing Pitt in hospital. The victim told TF1 she had lost her life savings and had tried to kill herself three times. Rather than mockery, perhaps time would be better spent discussing the risks of AI and the certainty that such scams will become ever more widespread…and more convincing. BBC
Helpdesk: Attackers are using “email bombs” to overwhelm employees at large organisations and create a sense of urgency. They follow up the thousands of spam emails with calls and messages that appear to come from IT support. They then use Microsoft remote control tools to take over the target computer. Sophos has details and advice on protecting against this type of attack.
Tolls: US residents are facing a wave of text messages warning them about unpaid charges for road tolls. Researchers say the surge coincides with new features added to a popular commercial phishing kit sold in China. Krebs on Security
Telegram: Among those pardoned by President Trump was Ross Ulbricht who created a notorious marketplace on the dark web. Attackers are using his release from jail to create messages on XTwitter that directs users to a Telegram channel designed to trick them into completing a fake verification process. Bleeping Computer
Translate: Scumbags are exploiting a legitimate feature of Google Translate to fool people into following malicious links. The issue is that when someone uses the tool to translate a web page, Google creates a new link that ends translate.goog, making it look more authentic and more likely the recipient will click on it. Abnormal Security
Extensions: Yet more problems with add-ons for Google’s Chrome web browser. A researcher has found 35 that circumvent Google’s security controls to retrieve and execute code from remote servers. The extensions masquerade as VPN and ad-blocking tools. This follows news last month of a long-running campaign to compromise widely-used extensions. As we’ve said before, these add-ons make browsing easier but they don’t come without risk.
AI
Overtaking: Another week, another prediction of AI superiority, this time from the head of Anthropic. Dario Amodei didn’t provide a precise timeline but said it wouldn’t take much longer than three years for “AI systems [to be] better than humans at almost everything.” Once that includes robotics design, he added, a conversation would be needed about how humans would “find meaning.” Ars Technica
Location: GeoSpy is an AI-powered tool that identifies the location of a photo - and which works extraordinarily well. We’ve used it to demonstrate the risks of posting images online. It’s designed for official and enterprise use but until now anyone could sign up for it. Following a report by 404 Media, public access has been closed but it’s important to be aware that geolocation tools are now extraordinarily effective.
CIA: The US intelligence agency is using an AI-powered tool that helps analysts to predict the behaviours of foreign presidents and prime ministers by enabling conversations with virtual versions of them. New York Times
Facial: Despite law enforcement’s headlong rush to adopt facial recognition tools, the reality is that it doesn’t work very well. The Washington Post has a long-readabout its deficiencies - and the impact on the innocent people it has wrongly identified.
LinkedIn: Premium users of Microsoft’s business contact platform have launched a class action lawsuit in California accusing it of illegally sharing their private messages with third parties to train AI models. Last October Ireland’s data protection regulator fined LinkedIn €310 million for using member data for advertising purposes without obtaining their consent.
Trump
Following President Trump’s inauguration, many Facebook users began complaining that they’d been automatically signed up to follow him. Not so, says Meta. The official White House Facebook accounts are managed by the current administration so when the president changes so does ownership of those pages. That means it’s nothing to do with Trump’s personal account (current followers = 36 million). In other Trump-related news, as the US continues to grapple with attacks on critical infrastructure, he dissolved a committee investigating the issue - “a massive gift to Chinese spies,” according to Democratic Senator Ron Wyden. Trump also decided not to retain the services of the respected head of the US Cybersecurity and Infrastructure Security Agency and rescinded a Biden executive order on AI safety.
In brief
ID: The Spanish Prime Minister has called for an end to online anonymity to put an end to the “chaos” being sown by social media. He told the World Economic Forum that user accounts should be linked to a common EU identity wallet. His speech coincided with the UK’s announcement of a digital wallet to “simplify access to services and documents like digital driver’s licences.”
Pricing: Companies are using our location, demographics, and even mouse movements to charge different prices for the same products, according to new data from the US Federal Trade Commission. It’s now asking the public for their experiences of “surveillance pricing.”
Cookies: The UK regulator has launched an initiative “to bring the UK’s top 1,000 websites into compliance with data protection law.” The ICO will examine the use of cookies and require organisations to give “people meaningful choice on how their personal information is used online.” The regulator has also published guidance on paying for services in order to avoid targeted adverts.
Cars: Given that vehicles are basically computers with wheels, it’s hardly surprising they’re riddled with vulnerabilities. In one case, researchers discovered a security vulnerability in a Subaru service that gave them “unrestricted access to all vehicles and customer accounts in the United States, Canada, and Japan.” That means they could unlock, start and stop the cars. And to spice things up, a hacking competition has been revealing the lamentable security of EV chargers.
Trackers: Meanwhile, police in Colorado are so impressed with the ability of Apple AirTags (and Tiles) to reduce car crime that they’ve started giving them away. They come with a sticker reading, “Warning — Tracker Equipped: This vehicle can be traced by police if stolen!” CBS News
Redirected: You probably wouldn’t expect a Louisiana state government page to offer links to “animal porn Porn Videos” but it’s just one of many official sites taking visitors to unexpected places. The Intercept has been cataloguing them - and the simplistic configuration error porn merchants are exploiting to hijack the sites.
Updates
Truecaller: The useful but wickedly dangerous caller ID app is rolling out an update for iPhone users that will provide information in real-time. Truecaller is risky because if someone provides it with information about you, that will then be displayed to all Truecaller users. For example, imagine working in a country where you want to keep your identity hidden. You phone for a taxi and the driver overhears you talking about what you’re doing. They then enter your number as “British journalist.” That description will be displayed to any other Truecaller user you phone. (This is a real example of something that happened in West Africa.) You can tell Truecaller to “unlist” your number by going here and clicking on the tiny button. Ignore the nice blue link above which just tries to persuade you to download the app.
Android: Google has announced a new security feature designed to lock devices in case it’s stolen. Identity Check will require users to authenticate using biometrics when their phone moves outside a common trusted location. Initially, it will only be available on a small number of devices.
SonicWall: Emergency update for Secure Mobile Access (SMA) line of products.
Cisco: Fix for a critical vulnerability in Meeting Management that could allow a remote, authenticated attacker to obtain administrator access on affected devices.
Exchange: A vulnerability in Microsoft Exchange Server was one of the key methods used by China to break into US telecom and government networks. A fix has been available for nearly four years but Tenable says despite repeated warnings nearly all public-facing instances remain unpatched.
7-Zip: Update fixes an issue that could be used to download apparently safe files from malicious archives.
Oracle: The January 2025 Critical Patch Update (CPU) addresses 318 new security vulnerabilities across the company’s products and services. Some of them are downright nasty.