An uphill struggle against sophisticated spyware. Protecting mobile phones from theft.
Using AI to research people. The future of the the US according to ChatGPT. YouTube takes over TV. And failing to con self-checkouts.
Surveillance
Italian media groups have filed a criminal complaint amid a spyware scandal involving WhatsApp and the country’s government. The groups are trying to initiate an investigation into who was responsible for deploying the spyware. The Italian government has denied involvement but it’s notable that among the targets of the spyware were an investigative journalist and two activists working on migration issues. The government is reportedlyrefusing to respond to questions about the affair on the basis of national security.
The affair came to light when WhatsApp revealed it had contacted 90 of its users, including journalists and members of civil society, who had been targeted with sophisticated Paragon spyware. This type of software often requires no interaction from the target, and exploits ‘zero-day’ vulnerabilities that are unknown to the manufacturers. Spyware companies insist their products are used only to support legitimate law enforcement, a claim that has been shown repeatedly to be ludicrously untrue. This week iVerify said it has found traces of Pegasus spyware on a further 11 devices and most of these belonged to business executives.
We’ve often argued that it makes little sense to try to distinguish between nation states and criminals when talking about cyber threats. This week, Google said much the same thing, arguing that adversarial nations use of criminals for state activity and purchase criminal capabilities to further their political aims. Equally, capabilities developed by nation states often end up in the hands of criminals. Google says the only answer lies in increased international cooperation.
Threats
Theft: Mobile phones, particularly iPhones, are irresistible to criminals - and it’s not uncommon for them to use violence to steal them. In the UK, government figures from last September put the daily number of snatch thefts at more 200. Obviously, it’s crucial to keep security in mind when using phones in public, even if the location appears safe - as one LinkedIn user describes in painful detail. Both Apple and Google have effective features that reduce the ability of criminals to access vital features. And police have good advice on how to protect yourself and your phone. Unfortunately, in most countries, the sheer number of thefts and lack of resources means that if a device is stolen the police won’t do anything to get it back or apprehend the thieves..
Signal: An update for the encrypted messaging app aims to close down a method being used by Russia against persons of interest, particularly those in Ukraine. The issue involved Signal’s ‘linked devices’ feature and employed malicious QR codes that, if scanned, would link the target account to one controlled by the attackers. The codes masquerade as group invites, security alerts or apparently legitimate pairing requests from the Signal website. Google
Ghost: The US cybersecurity agency and the FBI say ransomware groups using Ghost malware have succeeded in attacking targets in multiple industry sectors in over 70 countries. The common factor in the attacks were out of date systems and software.
Workers: The easiest way to access an organisation is by stealing the credentials from one of its employees. Latest tactics involve the use of automated timesheet reports and messages telling the recipient they’ve lost their job.
Browsers: There’s a growing trend of using fake updates to trick users into infecting themselves with information stealing software. Amongst the campaigns, Proofpoint highlights one that’s targeting macOS devices. The campaigns begin with messages containing links to websites hosting the fake updates. As well as technical defences, the best protection is for users to remember never to follow links to install updates.
AI
Research: Artificial Intelligence offers great potential to organisations needing to research potential clients, or threats. A startup called Astral has a video showing how it could be used to “browse the internet to find potential customers, then convert them while you sleep.” As security researcher Rachel Tobac points out, this is exactly the same process used to hack people and companies. Barracuda examines the same idea from the perspective of OSINT researchers and explains how AI can overcome the challenge of dealing with vast amounts of data. Of course the same issue applies; what can be used for fair purposes can also work for foul. Alas, this is a relationship we are going to find increasingly common.
Voice: Scammers used AI voice cloning technology to impersonate Italy’s Defence Minister and request €1 million from prominent executives to free kidnapped journalists. Among the targets were owners of Prada, Armani and Inter Milan. At least one attempt appears to have been successful. Euronews
Friend: A writer spent $70 on an AI boyfriend (named Thor) after her husband abruptly walked out on her and her children. She says it helped her to process her grief and left her wondering whether the true potential of AI might be in providing emotional support.
Manners: If you use AI chatbots, do you say “please” and “thank you”? 67% of respondents to a survey said they did (the figure for the UK was 71%). It seems politeness might pay off. A researcher told TechRadar, “Studies show that when we’re polite, we trigger patterns in the AI that connect to helpful, detailed human communication. Polite prompts can improve AI performance by up to 30%.”
Trump
Dystopia: Someone on Reddit asked ChatGPT to forecast what the US would look like in 5 and 10 years time, based on what the Trump administration has done so far. The results read like extreme dystopian fiction. ChatGPT’s original response has been deleted from Reddit but BoingBoing has a copy. When we ran the same prompt, we got much the same results - though ChatGPT’s basic model didn’t seem to know Trump was already president. The o1 model’s response was longer, more thoughtful and concluded, “Under the assumption that Trumpism proceeds with minimal effective resistance, the U.S. will likely move rapidly away from its post–World War II democratic norms into a more authoritarian, unequal, and internationally isolated future.”
God mode: The Department for Government Efficiency (DOGE) has gained full, unrestricted access to USAID’s digital infrastructure, according to reporting by The Atlantic ($). It also quotes a NASA employee as saying they’re working on the assumption that its systems are “completely bugged.”
Elections: The US Cybersecurity and Infrastructure Security Agency has frozen efforts to aid states in securing elections, according to an internal memo viewed by WIRED.
Incompetent: As well as leaving its website open so that anyone could edit it, the ‘Department for Government Efficiency’ also managed to publish a selection of classified information from the National Reconnaissance Office. That’s the federal agency that designs, builds and maintains US intelligence satellites.
Tariffs: A spike in the cost of technology looks like being an early result of Trump’s infatuation with tariffs. The Bank of America says Apple would need to increase iPhone prices by 9% to offset their impact. Acer has already said its laptops will cost 10% more from March.
In brief
YouTube: TV is now the primary device for watching YouTube in the US, with more than one billion hours of content consumed every day. Slightly unfortunate then that it turns out that, until recently, flaws in Google’s infrastructure made it possible to obtain the email address connected to any YouTube channel.
Google: If you think the quality of your search results have declined, you’re probably right. A study by WalletHub suggests this could be part of Google’s strategy to avoid monopoly accusations.
Germany: At least two Russian disinformation groups are targeting German audiences in the run-up to Sunday’s federal elections. They have been using deepfakes and fake news sites to push false narratives in support of the far-right AfD party. Recorded Future
Blocked: Spain’s premier football league has been relentless in pursuing anyone pirating TV coverage of its matches. After winning a lawsuit against Cloudflare for hosting pirate streams, Spanish Internet Service Providers started blocking specific Cloudflare IP addresses. This also affected many legitimate websites, including GitHub, Reddit, and those of many private organisations. El Pais
RedNote: CitizenLab took a close look at the Chinese social media app. Their findings make for grim reading securitywise, not least an apparent failure to use industry-standard encryption tools.
Swatted: An 18-year-old Californian has been sentenced to 4 years in jail for a ‘swatting’ campaign in which he induced police to raid innocent people’s homes, often with guns drawn. The teenager began the campaign when he was 16. He boasted that he usually got “the cops to drag the victim and their families out of the house cuff them and search the house for dead bodies.” DoJ
Wrong number: 404 Media has established itself as a leading source for cybersecurity news since it launched a year ago. So journalists there were slightly surprised when a US government contractor contacted them with a view to buying forensic technology used to bypass Android and iPhone security features. The rationale for the request remains a mystery, though some have suggested AI might have had a hand in it.
Protector: A new entry in Apple’s App Store describes itself as “Uber with guns.” Protector says “Protector is a revolutionary personal security app that enhances personal protection and makes private security available to the general public in an on-demand fashion.” Price; $100 per hour.
Thief: An ingenious Idaho man used a homemade ring with a barcode on it to try to buy expensive goods for the price of a can of soup. He was caught when he applied the scam to a $300 grill. His modus operandi was to use self checkouts, which was brave considering their propensity to flag up even genuine transactions.
Updates
Microsoft: Windows 11 users are complaining that the latest update (KB5051987) solved some problems but introduced others. One of them affects File Explorer and prevents some folders from opening. Another means that the update won’t install at all, possibly a good thing in the circumstances. Meanwhile, Microsoft has released a BIOS update that fixes problems on Asus devices.
Apple: A new iPhone model was announced this week and with it Apple withdrew from sale the iPhone SE, iPhone 14, iPhone 14 Plus. The new iPhone 16e is intended to be an entry level model - albeit at a price $170 higher than the device it replaces. Apple is promoting its support for Apple Intelligence while reviewers are highlighting the many features it lacks (including missing support for MagSafe charging). In case you’re wondering what the ‘e’ designation in its name stands for, Apple replied it’s basically meaningless. SixColors
Browsers: Important updates for Firefox and Chrome. Google also released a new version of its Enhanced protection feature which uses AI to offer “real-time” protection against dangerous websites, downloads and extensions. And Opera is offering a version of its browser which is designed to improve users’ health by encouraging them to take regular breaks and do breathing exercises.
Juniper: Update to address a critical vulnerability that could be used to bypass authentication and control Session Smart Router (SSR) devices.
Atlassian: Fixes for critical vulnerabilities in Bamboo, Bitbucket, Confluence, Crowd, and Jira.
OpenSSH: Fix for two issues that can be exploited to intercept traffic and take down servers.