Anatomy of a phishing scam. Ransomware on the up and up. Deepseek leak.
Ubiquitous surveillance. Backdooring critical routers. And the deepfake website with billions of views.
Walkthrough
Even the most sophisticated user can fall for phishing scams. This week, a programmer has a great account of how he very nearly gave attackers access to his Google account. Zach Latta says it all began when he received a phone call from what appeared to be Google Workspace saying it had spotted an unusual login attempt and he should reset his password. The call seemed to come from a genuine Google number, was crystal clear and the female speaker was entirely convincing. Latta was suspicious and asked for email confirmation which duly turned up from workspace-noreply@google.com. Even when he started recording the call and accused the attackers of phishing him, the attackers didn’t give up. In fact, they even provided a LinkedIn profile to try to persuade Latta that he was talking to a genuine Google employee.
The recording of the call is fascinating and underlines how utterly relentless these scumbags can be. It also demonstrates that they will find and exploit any vulnerability that exists. As in similar cases with Google Forms and Google Translate, the key here was the ease with which an unverified user could leverage the company’s services to send what looked like genuine emails. Google told The Register that it hadn’t seen any evidence of this being a widespread tactic. We disagree. There are numerous examples, one of which led to the theft of half a million dollars of cryptocurrency.
Defending against these scams is relatively easy, in theory. Never trust a caller who asks you to reset the password for an account. Never provide any personal information to a caller. And, alas, never trust technology giants to protect you. In practice, amidst all the other demands on our time, it can be very easy to be taken in by ever more sophisticated attacks. Although in this case, as one wag commented, “The first evidence that it was a scam was that you received a call from Google support. Google’s lack of customer support is legendary.”
Threats
Ransomware: There was a sharp rise in ransomware attacks last December, with NCC Group reporting the highest number it’s recorded in a single month. The total of 574 attacks compares with 387 in December 2023. NCC says new, aggressive ransomware groups are partly responsible for the increase.
Phishing: Smartphones are lousy at preventing phishing, with 24% of respondents to a survey by Omdia saying they had been victims of such attacks. “Anti-phishing protection proved to be a weak spot across all devices, as none successfully intercepted all phishing texts, calls and emails,” Omdia said.
Hidden: Hypertext Markup Language and Cascading Style Sheets are the foundations for webpages and emails. Alas they’re far from secure and attackers are exploiting the way they work to hide text inside emails and confuse security software. Cisco Talos explains how the method works and what to do about it. It’s an obvious effort to promote its Email Defence product but it does highlight an issue that needs to be addressed.
PDF: Yet more examples of PDF files being used for nefarious purposes. In one, attackers have been targeting mobile devices with messages impersonating the US Postal Service. In another, they use Amazon Prime as the lure to steal credit card data.
PIN: 9% of people are using 1234 as their PIN code, according to a study by ABS Australia. Its analysis also explains why anything beginning with 19 or 20 is a bad idea.
AI
DeepSeek: No sooner had China’s AI newcomer devastated Nvidia’s shareprice and upended conventional wisdom than it had to halt new registrations and was accused of stealing other companies’ training data. Oh, and it also failed to secure a database with lots of sensitive information. And users who installed the DeepSeek app are now sending data to China which is doubtless most grateful. So, just another tranquil week in the wild world of AI.
Attacks: One of the easier predictions to make about AI is its growing role in crime and cyber attacks. So it has proved. The Wall Street Journal reports on its use by hackers linked to China, Iran and other foreign governments who are exploiting it for “malicious code writing, hunts for publicly known cyber vulnerabilities and research into organisations to target for attack.” And Abnormal Security examines a tool called GhostGPT which can generate highly complex and sophisticated malware scripts.
Myths: The UK data protection regulator has reiterated its concerns about lack of transparency in the AI industry. “Some AI developers told us they “did not mean to” process people’s data, or they were using this data purely incidentally.” This isn’t good enough and is certainly not a legal defence, the ICO says.
Ages: The Electronic Frontier Foundation takes aim at ‘age estimation scans,’ calling them “creepy AF – and harmful.” The scans have been suggested as one solution to the problem of verifying people’s ages in order to access certain websites and services. The EFF says they’re inaccurate, discriminatory, and liable to misuse.
Surveillance
The US has built up a stockpile of surveillance technology “nearly unmatched in the Western world,” according to analysis by The New York Times. From tracking apps and ankle monitors to databases and investigative tools they’re part of what the paper describes as a “technology arsenal” available to be used in President Trump’s deportation operation. A review of nearly 15,000 contracts found that Immigration and Customs Enforcement, and Citizen and Immigration Services spent $7.8 billion on immigration technologies since 2020. But surveillance is ubiquitous - as UK employees are discovering. In a survey by ExpressVPN, 85% of workplaces said they were using monitoring tools to some extent to assess the productivity of their remote workers. That’s up from 78% in its previous study in 2023.
In brief
Routers: An as yet unidentified miscreant has been inserting invisible “backdoors” in Juniper routers around the world in key sectors such as semiconductor, energy, and manufacturing. They lie dormant until woken up by a specific signal. Black Lotus Labs
Location: It took a 15-year-old schoolboy to identify an issue with content delivery giant Cloudflare that could be used to identify someone’s general location. The problem was caused by Cloudflare storing copies of message attachments closest to the place they were opened. The issue is now fixed but it underlines how careful you have to be if you want to conceal your real location.
Process: We empathise with anyone responsible for the processes around joiners, movers and leavers, as a couple of stories this week illustrate. In the UK, the British Museum had to close some of its exhibits after a fired IT contractor sabotaged a number of its systems. In Florida, a former Disney employee pleaded guilty to hacking and destroying part of its IT network.
Disinformation: Researchers say Russian-backed groups are flooding the internet with disinformation in the run-up to Germany’s parliamentary election. Much of the content is in support of the right-win AfD party and appears to be linked to a US fugitive turned Kremlin propagandist. Newsguard
TalkTalk: The UK telecoms company is investigating a data breach after a threat actor began selling alleged customer data on a hacking forum. One of TalkTalk’s suppliers seems to be the source. Bleeping Computer
Pirates: An estimated 700,000 households in Sweden are now paying to access pirate TV services. That’s a significant percentage of the country’s 11 million population. Given the unstoppable rise in the costs of streaming subscriptions, we’re be surprised if the figures weren’t similar elsewhere. Mediavision
Risky: UK government networks are facing a “severe” risk of a major cybersecurity attack which is “advancing quickly.” Among the reasons, the National Audit Office highlights an increasing number of legacy systems, and a failure to fill cybersecurity roles with one in three posts vacant or filled on a temporary basis.
Deepfakes: Bellingcat has been investigating a website that hosts non-consensual deepfake pornography. MrDeepFakes has nearly 650,000 members and receives millions of visits a month. Even Bellingcat hasn’t been able to identity its owners, beyond links to a Chinese fintech firm and a Maltese company led by the co-founder of an Australian pet-sitting platform.
Updates
Apple: Important updates for iPhones, iPads and Macs include a fix for numerous issues, one of which is believed to have been exploited. Latest versions are iOS/iPadOS 18.3, macOS Sequoia 15.3, Sonoma 14.7.3 and Ventura 13.7.3. Meanwhile, researchers have identified two vulnerabilities with the fundamental design of some Apple processors. The cause of the problems lies in the way the chips try to speed up operations by preloading data to anticipate what they’re going to be asked to do. Apple says it will fix the issue in future updates.
Satellite: Exciting developments in the ability of everyday smartphones to make calls via satellite in areas lacking terrestrial coverage. This week Vodafone demonstrated a video call from a remote area of Wales using a new fleet of spacecraft (which are basically cell towers in low earth orbit - with 53 square metre antenna arrays). And Bloomberg reports that the latest iPhone operating system allows some T-Mobile subscribers in the US to test connectivity using SpaceX’s Starlink service.
Microsoft: The January Windows update has accrued an impressive collection of problems, including one that basically broke audio playback. Microsoft has released a new version designed to fix that issue and with advice on the others.
Scareware: Microsoft has released a preview version of a new security tool for its Edge web browser. ‘Scareware blocker’ is designed to combat scams that lock up a browser in an attempt to frighten users into accepting malicious IT support.
WhatsApp: Update for iOS devices addresses a problem with the app’s “View Once” feature. It meant users could access photos and videos that were meant to disappear after a single viewing.
Bitwarden: A security feature is being added to accounts without multi-factor authentication. It works by requiring email verification codes whenever users log into their account from an unrecognised device.
TeamViewer: Update to address a high-severity issue in remote access solutions for Windows.
Zimbra: Fix for a critical vulnerability in the Classic Web Client.