The fight over data privacy. Information theft on a vast scale.
XTwitter's AI on the most dangerous men in America. Trusting the cloud. More spyware antics. And Telegram groups harassing women.
Apple
Apple’s decision to withdraw an encryption feature for users in the UK has highlighted the issue of personal privacy and thrown more grit in transatlantic relations. Apple is turning off end-to-end encryption for iCloud data in the face of a (not-so) secret UK government demand for a way to access the information. Apple said it had never built such a “backdoor” and never would. The UK order has prompted a probe by the US Justice Department along with allegations that the Biden administration knew about the issue but failed to mention it in testimony to Congress.
This affair is just one thread in an ongoing conflict over official access to encrypted data. In Sweden, the government is poised to introduce a law that would force communication providers to give police and security services access to the content of messages. The head of the Signal messaging platform says it will withdraw its services from the country if the bill is passed. As has been pointed out repeatedly, there’s no technical solution to provide access to content that only the “good guys” can use. Indeed, in Sweden, the armed forces are enthusiastic users of Signal. They have warned the government that the proposed legislation could not be implemented “without introducing vulnerabilities and backdoors that could be exploited by third parties.”
This debate comes at the end of a wholesale move from storing data ourselves to trusting others to hold it for us. There are growing suggestions that this may be a rather flawed strategy in terms of security. (see Cloud below). It’s entirely possible that having moved pretty much everything into the cloud, we’ll now see many people and organisations pulling it down again to regain control over their data - and the keys to access it. The Register reviews solutions that can replace what Apple is withdrawing.
Threats
Mass scale: A new addition to privacy-breach service Have I Been Pwned underlines the crazy scale of information theft. The new data includes 284 million (unique) email addresses and 244 million passwords that haven’t appeared on the service before. Troy Hunt, who runs Have I Been Pwned, has a great article explaining the process of information theft and how the stolen data is exploited.
Nightmare: If ever there were a story to convince us about the importance of multi-factor authentication it’s the gruesome tale of a US software engineer whose life has been upended by a simple download. As The Wall Street Journal reports, Matthew Van Andel installed an AI tool from GitHub. The tool worked but it contained malicious software designed to provide access to the host computer and everything on it. In Van Andel’s case, this included a password manager which lacked multi-factor authentication, and “session cookies” which allowed the attacker to break into his employer’s online resources. Van Andel lost his job but that’s only part of the waking nightmare he continues to experience. The obvious lesson is never to use just a password to secure an account, particularly anything as important as a password manager, but also to think thrice before downloading free software. This week Kaspersky reported on more than 200 GitHub repositories containing convincing looking projects that in fact contain information stealing software. And yet more malicious Chrome browser extensions were found in Google’s Web Store.
Twitter: Don’t trust direct messages, especially if they end up asking you to allow an app to access your account. Alex Banks explains how he fell for a scam that began with a relatively convincing request for an interview, apparently from a TechCrunch journalist. There has been a rash of these in recent weeks.
Deluge: Attackers broke into a company’s network by flooding its employees with phishing messages and then offering to help in the guise of IT support. ReliaQuest
Audits: Belgium’s cybersecurity agency has warned that attackers are posing as government cybersecurity officials to offer fake cybersecurity audits.
Recruitment: The UK cybersecurity agency is warning about recruitment fraud on sites like LinkedIn, saying they’re a favourite of foreign spies. “Think before you link when seeking employment or other opportunities online,” it says.
Kids: We missed this story when it was published this month - but it’s so crazy we reckon it’s worth passing on. Research found 46% of UK children aged 8 to 17 have been victims of online scams, including fake giveaways, phishing, and online shopping and ticket fraud.
AI
Grok: Despite an avowed commitment to free speech, XTwitter’s AI model temporarily blocked “sources that mention Elon Musk/Donald Trump spread misinformation.” Grok’s engineering head blamed the issue on a misguided employee. Elon Musk refers to Grok as a “maximally truth-seeking” AI. Incidentally, when asked to name the three people doing the most harm to America at the moment, Grok’s answer is Donald Trump, Elon Musk and either Valdimir Putin or Joe Biden.
Abuse: OpenAI’s latest threat intelligence reveals report illustrates some of the ways in which its tools are being used and abused. Among the highlights, Chinese spying tools and fake North Korean IT workers.
EU: Google and Meta have accused the EU of holding back Europe’s AI industry through excessive regulation. CNBC
Students: 92% of UK undergraduates use AI to help them with their studies, up from 66% a year ago, according to a survey by the Higher Education Policy Institute.
Trump
Cloud: Europe’s dependence on US cloud platforms is no longer safe, according to a Dutch entrepreneur and software developer. Bert Hubert says “it is madness to continue transferring the running of European societies and governments to American clouds.” Europeans should “have the courage to use different software and services” and “stop surrendering” to America.
Cyber: More details have emerged about the security risks surrounding the chaotic swathe Elon Musk and his minions are cutting through the US federal infrastructure. As The Washington Post reports, changes have been made to the White House’s WiFi network meaning users can remain logged in for a year (up from 7 days). And 21 officials from the US Digital Service resigned saying the actions of the so-called Department of Government Efficiency have included “mishandling sensitive data” and “breaking critical systems.”
Oops: Apple says it has been working to correct a problem with its dictation system which involved transcribing the word ‘racist’ as ‘Trump.’ New York Times
In brief
Spyware: The Italian spyware affair continues, with a priest becoming the latest person to reveal he was targeted with a sophisticated surveillance tool. Father Mattia Ferrari serves as chaplain on a migrant rescue ship owned by an NGO. Meanwhile, Cellebrite has suspended Serbia as a customer following allegations that its technology was used to unlock the phones of a journalist and an activist in order to install spyware on them. Amnesty International said this was a widespread practice and happened during police interrogations when phones had been taken away.
Stalkerware: The personal data of millions of people is being exposed because of a security failing in two surveillance apps installed on their phones. The issue means anyone can access data including messages, photos, and call logs extracted by Cocospy and Spyic. The apps are designed to be installed on a device but remain hidden from the owner. TechCrunch
Scum: A WIRED investigation has identified a network of Telegram groups targeting women who joined “Are We Dating the Same Guy?” Facebook groups. WIRED found Telegram members systematically tracking, doxxing, and degrading the women, circulating nonconsensual images, phone numbers, usernames, and location data.
Find My: Apple’s Find My network can be exploited to track any Bluetooth-enabled device, according to researchers at George Mason University. The issue works by tricking Apple’s Find My network into thinking the target device is a lost AirTag. Apple has acknowledged the issue but has yet to come up with a fix for it.
Crypto: The FBI says North Korean hackers were behind a $1.5 billion theft from a cryptocurrency exchange, the largest such heist yet seen. The thieves managed to compromise a crypto wallet platform used by the victim.
Google: QR codes are to replace SMS messages as part of the authentication mechanism for Gmail and other Google services. Forbes reports that the change aims to “reduce the impact of rampant, global SMS abuse.” Google’s decision is undoubtedly a good thing which highlights the lunatic insistence of financial institutions to continue using SMS to authenticate customers and transactions. After all, it’s nine years since the US standards institute advised against using SMS for multi-factor authentication.
Updates
Browsers: Amongst the underlying technology that makes browsers work is a specification for extensions. Google has developed a new version designed to make the add-on functionality safer by restricting what it can see and do. A side-effect of the new specification is to break some types of extensions, notably ad blockers. This week, Mozilla said that its Firefox browser will continue to support the existing version – and thus extensions like the popular ad blocker uBlock Origin.
Microsoft: A fix is on the way for some of the sluggish performance in Windows 11 File Explorer. The issue being addressed arises when trying to close down the app. A solution for other problems looks like being further away. techradar
Skype: In other Microsoft news, it seems that its venerable communications solution is heading for the scrapheap. A message in the latest preview version of Skype for Windows says, “Starting in May, Skype will no longer be available. Continue your calls and chats in Teams.” This is hardly surprising given the dramatic fall in user numbers from its glory days in the 2010s. XDA Developers
Parallels: A researcher has disclosed two issues in the widely-used virtualisation software for Mac devices which could give an attacker complete access to affected systems. The researcher demonstrated that an update designed to fix the issues doesn’t work. The exploits only affect Mac devices with Intel processors and Parallels says a(nother) fix will be along soon.
Outline: An update for Jigsaw’s (excellent) anti-censorship technology strengthens its ability to bypass controls. It works by using the WebSockets protocol which makes data look like regular web traffic and allows it to be routed through popular Content Delivery Networks. That means blocking it would also cut off access to large parts of the web as a whole.
Cisco: Updates to address serious vulnerabilities in some of its Nexus switches.