Attacking with WhatsApp. Hacking XTwitter accounts. ChatGPT Search opened to all.
UK orders Apple backdoor. Trump's cybersecurity chaos. Ransomware payments down, number of attacks up. And cutting off the power to scam centres.
Hacked
An Israeli spyware company has used WhatsApp to target around 90 journalists and members of civil society. WhatsApp told Reuters that the attacks used malicious electronic documents that required no user interaction to compromise the targeted devices. Among those affected was the director of an Italian news website known for investigations into corruption, organised crime, the Catholic Church, and the youth-wing of the Georgia Meloni’s right-wing ruling party. The Guardian reports that Paragon Solutions, which makes the spyware, has now terminated its contract with the Italian government.
Paragon is just one of multiple spyware manufacturers, many founded in Israel, which say they prohibit the use of their products against journalists and members of civil society. In reality, it’s routine for spyware to be used in exactly that way - until and unless it becomes public knowledge. While in most cases the tools are not deployed at a mass scale because of their cost, they are a definite threat to anyone engaged in sensitive investigations. This week, more details emerged of an unlawful police operation to spy on two BBC journalists in Northern Ireland.
There’s a limited amount users can do to protect themselves against these types of attacks. By their nature, they exploit vulnerabilities that have yet to be discovered publicly (so called ‘zero-day’ issues). There are software tools that can scan for spyware but they’re expensive or cumbersome to use. An exception is iVerify which offers a basic version of its enterprise product. It costs $0.99 and covers one scan per month. Other than scans, iPhone users can turn on Lockdown Mode which increases protection by reducing functionality. Rebooting phones every day can also help but, above all, keep mobile devices updated.
Threats
XTwitter: Multiple high-profile accounts have been exploited in recent days to promote various memecoins (i.e. a particularly risky form of cryptocurrency). Victims include Donald Trump, TIME Magazine, the NASDAQ, the Tor Project, and BBC journalist Laura Kuenssberg. Sentinel Labs says most of them were the result of classic phishing messages in which users were asked to reset their passwords. In Trump’s case, it appears hackers used a vulnerability in the bit.ly service to hijack old web links.
Mac: The time when Mac users could feel relatively safe from malicious software is long gone. In fact, the likelihood is that Macs are now at greater risk than ever before, with the emergence of new tools designed to steal information from them. The threat is increased by the capabilities of AI, so it’s essential to only install genuine apps from trusted developers. Malwarebytes Objective-See
Deepfakes: TikTok’s parent company ByteDance has demonstrated a new AI tool capable of generating extraordinarily realistic deepfake videos. Their example of Albert Einstein giving a lecture is particularly striking. Last year 46% of organisations reported seeing deepfake-related scams. We’ve no doubt this figure will increase this year, with a particular emphasis on using AI to create credible copies of senior executives.
Google: Scammers are using fake ads on Google to hijack Microsoft advertising accounts. The “malicious ads, appearing on Google Search, are designed to steal the login information of users trying to access Microsoft’s advertising platform,” Malwarebytes says.
Extensions: With apologies for repetition, be really cautious when installing browser extensions. SquareX Labs has a report setting out how a seemingly innocuous add-on could be used to take over a device, something previously thought to be impossible. The process is complex but appears to be viable. Above all, it depends on convincing the user to install an extension, so that’s the point at which the attack can be stopped.
Facebook: Fake copyright infringement notices are being used to trick users into divulging their credentials. The campaign exploits Salesforce’s automated mailing service, so the phishing messages originate from noreply@salesforce.com. Check Point
AI
ChatGPT: You can now use OpenAI’s chatbot to search the web without setting up an account. ChatGPT Search is pretty impressive - and much better than Google at providing narrative answers (without the irritation of adverts). Or course it’s worth keeping in mind, as OpenAI says, “ChatGPT can make mistakes. Check important info.”
Google: For its part, you can also use Google’s Gemini model to search the web without logging in (though the AI snippet in Google’s normal tool works just as well if not better for ordinary web searches). Google has alsoreleased its new flagship AI model (Gemini 2.0 Pro Experimental, in case you’re interested). The new model is supposed to excel at coding and handling complex prompts. Google says it has “better understanding and reasoning of world knowledge” than any of its predecessors. In other Google news, it’s removed a pledge not to use AI for weapons or surveillance from its website.
DeepSeek: Interest in the Chinese AI company DeepSeek has spawned multiple phishing campaigns, fraudulent investment schemes, and malware attacks. Cyble
Scans: Brazil has banned Tools For Humanity from paying people in return for scanning their irises. Tools For Humanity (its Chairman is Sam Altman of OpenAI fame) is trying to create a verification system based on iris scans. The Brazilian data protection regulator said the offer of money in return for biometric data was inherently flawed.
Police: UK police forces appear to be enthusiastically adopting tools from US surveillance giant Palantir. The Times reports ($) that the technology enabled Bedfordshire police to find 123 at-risk children in eight days. And the company says it signed a £819,000 contract with Leicester Police in October. They’re just two examples of multiple deals between Palantir and UK public bodies.
F**ked: If you ask Google how to turn off its AI-powered search function, you’ll be told to fiddle around with your browser settings. It appears there’s an easier way. Just insert a swear word in the search term, i.e. “How to turn of f**king Google AI search”. Less satisfyingly, adding -ai to the search also has the same effect. Ars Technica
London calling
The Washington Post is reporting that the UK government has ordered Apple to create a backdoor allowing it to access any content uploaded by the company’s users anywhere in the world. The paper sources its reporting to “people familiar with the matter.” The government has refused to comment. If correct, the order would require blanket capability to view encrypted material rather than assistance with accessing specific accounts. Apple can appeal against the order which was made under the UK’s Investigatory Powers Act which affords the government sweeping surveillance powers. If the appeal fails, the company would probably be forced to stop offering encrypted storage to UK customers.
Trump
Whatever you think of Donald Trump, there’s no question that his new administration is a disaster in terms of information security. The idea of a bunch of Elon Musk’s twenty-somethings running around government departments vacuuming up rafts of data runs counter to every security rule imaginable. TechCrunch lists some of the ways in which Musk and his lackeys are running roughshod over normal security practices. The approach of most mainstream media to treat this as just another news story misses the extraordinary nature of what’s happening. Quite apart from the political implications, our concern is that it encourages exactly the sort of contempt for security and data protection that gives rise to the most serious cyber incidents.
In brief
Ransomware: Despite the relentless flood of stories about ransomware attacks last year, the money extorted as a result of them fell sharply. Chainalysis says the fall is probably due to law enforcement takedowns and disruptions, as well as more awareness of the issue. The bad news is that the number of incidents continues to rise. Recorded Future reckons the figures suggest new attackers are trying to get in on the game, but aren’t very good at it. Yet. Ars Technica
Abandoned: Researchers have identified some 150 Amazon-hosted storage instances that have been abandoned by their owners but continue to serve updates to applications and websites. The instances were previously owned or used by governments, Fortune 500 firms, technology and cybersecurity companies, and major open source projects. It cost the researchers just $420.85 to re-register them. It would be hard to overstate how dangerous this is and, as watchTowr says, it’s a vivid illustration of the risks of abandoning services without closing them down properly. The Register
China: A Chinese social media influence operation has used the recent floods in Valencia to urge Spanish citizens to overthrow their government. Graphika says it’s the first time it has seen the Spamouflage group call for the overthrow of a foreign government.
Healthcare: The US government says a brand of patient monitor is collecting and sending medical data to a remote Chinese IP address. Hospitals have been told to disconnect the devices which can also download and execute files.
Power: Thailand has cut the power supply to three parts of Myanmar which are known to be bases for online fraud, mainly the type of scam known as ‘pig butchering.’ This is the fraud that involves gaining the trust of victim and persuading them to invest their savings before disappearing with the money. Israeli news outlet Calcalist has a good overview of an utterly vile industry, and the devastating impact on its victims.
Updates
Apple: There’s a new version of the latest iPhone software, specifically for iPhone 11 devices. Meanwhile, Apple has announced significant changes to its AppleCare+ programme. It’s removing the ability to make upfront payments in stores in favour of monthly or annual subscriptions. Bloomberg reports that the advance payments still seem to be available for online purchases.
Microsoft: Microsoft 365 is losing its built in VPN feature, in part probably because its limitations meant most people didn’t use it. The announcement coincided with a price rise, the first in 12 years, though you can avoid it by downgrading to a plan that doesn’t include AI features.
Netgear: Urgent updates for multiple WiFi router models to address two critical vulnerabilities.
Browsers: Important updates for Firefox and Chrome browsers. They’re intended fix high-severity issues affecting memory management. It’s also a reminder that browser updates come thick and fast, so best practice is to close the browser every day; this means you’ll always be using the latest version.
Zyxel: There are vulnerabilities in the company’s CPE Series devices and they’re being actively exploited but there are no plans to fix them because the models are no longer supported.
Tails: Version 6.12 addresses security issues identified in a recent audit.