"The most consequential security breach" in US history. Targeting search terms.
Artificial General Intelligence hoves into view. Phishing tests don't work. And the EU axes e-privacy plans.
Trump
We’re not proposing to provide ball by ball commentary on the extraordinary goings on in the US, but the country’s global importance means we will highlight information security stories as they happen. This week, veteran technologist Bruce Schneier said the US government had “experienced what may be the most consequential security breach in its history.” He goes on to list the myriad ways in which the security of some of the most sensitive systems in the US is being undermined. “What makes this situation unprecedented isn’t just the scope, but also the method of attack. Foreign adversaries typically spend years attempting to penetrate government systems such as these, using stealth to avoid being seen and carefully hiding any tells or tracks. In this case, external operators with limited experience and minimal oversight are doing their work in plain sight,” Schneier writes.
Other developments this week include;
-
Chat logs revealed that a member of Musk’s ‘Department of Government Efficiency’ - or DOGE - was linked to a cybercrime community.
-
A federal judge said the US Treasury was more vulnerable to hacking since DOGE accessed its systems. Despite assurances, court documents show a DOGE staffer briefly had “write” access to a Treasury database.
-
DOGE staffers effectively shut down the Consumer Financial Protection Bureau, and gained access to protected information including confidential information on Twitter’s competitors.
Elon Musk and right-wing influencers are redefining “doxxing” to describe journalists and others seeking to hold the government accountable by reporting on public information.
-
US Immigration and Customs Enforcement plans to monitor and locate “negative” social media discussion about the agency and its top officials, according to contract documents reviewed by The Intercept.
-
The Cybersecurity and Infrastructure Security Agency placed several members of its election security group on administrative leave. All were part of the agency’s teams working to counter disinformation.
-
President Trump intends to nominate a former administration official with no discernible cybersecurity experience as the next national cyber director.
Threats
Search: A sneaky campaign is targeting web searches for book titles, documents and charts. If a search result is clicked, it brings up a CAPTCHA image with an embedded link. That in turn leads to a genuine CAPTCHA challenge and, if that’s completed, to a forum where a file is displayed with the original search keyword. If the user tries to download the document, they’re asked for personal information including credit card details. Dastardly. Alas, as we’ve said before, you can’t trust Google search results. Netskope.
North Korea: Pyongyang makes much of its foreign income from cybercrime and this week saw reports of three different campaigns it has been running. Two involve fake job interviews and the third tries to persuade Windows users to execute malicious code, often via PowerShell commands.
Deepfakes: Only 0.1% of people can detect a deepfake, according to a survey by a verification outfit, iProov. It’s hardly a disinterested party, but there’s no question that the quality of deepfake technology makes it a key threat this year.
Romance: We’re only half way through February and Meta says it has already taken down more than 116,000 accounts and pages across Facebook and Instagram that were linked to romance scams. That compares with 408,000 for the whole of last year. Meta adds that the scam accounts often originate in West African countries, with members of the US military or famous celebrities the favoured lures.
AI
Speed: Artificial Intelligence is progressing so rapidly that “in a decade, perhaps everyone on earth will be capable of accomplishing more than the most impactful person can today.” That’s the view of OpenAI boss Sam Altman who says the road to artificial general intelligence or AGI is coming into view more quickly than anticipated - and with it both great opportunity and significant risk. On the plus side, it could power unprecedented economic growth and create a world free of disease. Less positive; “we can see…AI being used by authoritarian governments to control their population through mass surveillance and loss of autonomy.” (AGI is roughly defined as a system equivalent or superior to human intelligence.)
Decay: As we power towards AGI, researchers at Microsoft and Carnegie Mellon University warn that increasing reliance on generative AI results in less critical thinking and the possible “deterioration of cognitive faculties that ought to be preserved.”
Sales: One of the obvious impacts of generative AI is the disappearance of some categories of employment as the technology replaces humans. Sales is a good example, as OpenAI told an audience in Japan. “If you start to look around your organisation, think about all the small tasks that people in your teams do…”
DeepSeek: There are multiple security and privacy issues in the Chinese chatbot’s iOS app according to analysis by NowSecure. Among the issues are extensive data collection and device tracking. If you’re using it, their advice is to delete it immediately.
Copyright: Thomson Reuters has welcomed a court decision in a copyright case against an AI firm. The court ruled that fair use can’t be relied on as a defence for using proprietary data without permission to train AI models. The Register
Thoughts: Meta has been demonstrating a machine with the ability to turn thoughts into words. Just a few issues; it’s only 80% accurate, costs $2 million, needs a shielded room, and is the size of small car. techradar
In brief
Tests: We’re longtime sceptics about the effectiveness of phishing tests (i.e. those emails designed to help users spot dangerous messages). The Wall Street Journal has been looking at the latest research which found the tests achieved a 2% reduction in phishing success rates. As one cybersecurity specialist told the paper, “Phishing education is good. Tricking people into falling for a phish so you can lecture them that they failed, that’s the part that is terrible.”
Backdoor: Predictably, the UK government’s reported decision to order Apple to give it access to user data is causing waves while achieving the rare sight of bipartisan action in the US Congress. Two senators have asked the newly confirmed Director of National Intelligence to reevaluate US cybersecurity and intelligence-sharing relations with the UK as a result of the order.
Italy: As another Italian emerged to claim he was targeted with sophisticated spyware, the Italian government denied reports that it was behind the surveillance and threatened legal action against anyone making the claims.
Germany: A court has ruled that XTwitter must release information enabling researchers to track the spread of election-related information on the network. Reuters
Location: You might remember a report last year that revealed a market in data revealing the location of US military and intelligence personnel serving overseas. It has now emerged that the ultimate source of the data was a little-known Lithuanian advertising technology company. WIRED
Privacy: The EU Commission has withdrawn plans to toughen up rules around online tracking technologies after co-legislators failed to reach agreement over the proposals. The decision is not surprising given that discussion about the plan has been dragging on since at least 2017. TechCrunch
Seagate: Hard drives previously used to mine cryptocurrency are being sold as new by unsuspecting retailers. An investigation by Heise indicates large quantities of the drives with thousands of hours of use have surfaced in the market, particularly in Europe, Australia, Thailand, and Japan.
Updates
Apple: Emergency security updates for iPhones and iPads to address a previously unknown (‘zero-day’) vulnerability that the company says was exploited in targeted and “extremely sophisticated” attacks. Apple’s security advisories seldom use this sort of language so this is an update to be installed asap. This week also saw updates for all supported macOS versions.
Microsoft: Monthly set of updates includes 63 fixes, two for issues that are being actively exploited. Meanwhile, the latest Windows 11 update aims to sort out irritating audio and webcam problems.
Adobe: 45 security updates along with a warning that some vulnerabilities could allow code to be executed remotely.
Zimbra: Multiple security updates including one in Classic Web Client rated critical.