Apple appeals against encryption order. The surge in AI-generated fakes.
An AI voice model so realistic some users freaked out. US proposes access to social media of would-be immigrants. And new reports on the scale of Russian disinformation in Europe.
Encryption
Apple is reported to be appealing against the British government’s not so secret order to create a way to circumvent its most secure cloud storage solution. The Financial Times says the appeal will be heard by the UK’s Investigatory Powers Tribunal, although its deliberations are also supposed to be secret so it remains to be seen how much detail will emerge. Meanwhile, it appears the government has deleted official guidance advising high-risk individuals to use encryption to protect their sensitive information. Instead, it seems they are being told to use Apple’s Lockdown Mode which is designed to protect devices, not encrypt data.
Over the Channel in France, the government is proposing a law that would force encrypted messaging applications to provide law enforcement with decrypted data on request. An amendment to France’s proposed “Narcotraffic” bill would require messaging platforms like WhatsApp and Signal to hand over decrypted chat messages of suspected criminals within 72 hours. As anyone with a passing understanding of encryption knows, it is simply not possible to create backdoors into encrypted services without fundamentally weakening their security. That reality doesn’t seem to have impinged on the determination of governments to try to force messaging companies to comply.
Threats
Fake: AI-generated fakes are one of the key threats to consider this year, with Crowdstrike reporting a 442% increasing in voice phishing (‘vishing’) attacks in the second half of last year compared to the previous six months. And a survey from iProov suggests the situation with video fakes is almost as bad with a 300% year on year increase in 2024. To illustrate; this week, YouTube warned that its CEO was included in an AI-generated video designed to steal creators’ credentials. The Guardian has a long-read on how deepfakes of celebrities have been used to defraud thousands of people, often with fake cryptocurrency investments.
Extensions: Another warning about the risks of extensions - and this one is really quite scary. SquareXLabs has shown how to exploit legitimate functionality in Chromium-based browsers to hijack extensions - and it has a video demonstrating this with 1Password. Google has yet to comment. In the meantime, it’s essential to be extraordinarily careful when installing extensions.
Cookies: ‘Session Cookies’ are small files created when users log into a website or application. They’re designed to make the experience easier by avoiding the need to log in every time you visit a new page. The downside is that if attackers steal them they can use them to trick the site into thinking they’ve already authenticated themselves. Longwall explains in detail how this works and what to do about it.
Brute: A huge network of compromised devices (a ‘botnet’) is targeting Microsoft 365 environments that are still using a legacy authentication method. The brute-force attacks involve spraying passwords at a target until they find one that works. The problem lies with Microsoft’s Basic Authentication service which has been phased out in most situations but which some services including email continue to use. Defence lies in ensuring good password practices. Security Scorecard (R)
Mobile: Attackers are increasingly focused on breaching organisations’ defences by targeting their employees’ mobile devices. Zimperium says phishing messages are “device-aware,” meaning the malicious payload only executes when accessed on a mobile device.
Payments: Fake invoices, payment requests and subscription notices are simple to create - and it’s equally easy to make them appear genuine. Intego has some of the latest examples. As always, the best defence is suspicion about any financial-related messages.
Error: ‘ClickFix’ is a social-engineering scam in which websites or attachments display fake errors and prompt the user to click a button to fix them. The latest variation involves emails saying a “restricted notice” is available to view. Fortinet
Sales: Online marketplaces are a hell pit of scams, as you doubtless know if you’ve used them. Cisco Talos has a useful guide to protecting yourself against the most common tactics.
AI
Realism: Returning to the subject of deepfakes, take a look at Sesame’s new Conversational Speech Model. Its creators say their aim is “to achieve ‘voice presence’—the magical quality that makes spoken interactions feel real, understood, and valued.” The result is an extraordinarily lifelike conversation and, for some people who’ve tried it, decidedly unsettling. Either way, it underlines how difficult it is becoming to distinguish between real and reproduction.
Abuse: 25 people have been arrested in a global crackdown on AI-generated child sexual abuse material. Europol said 19 countries were involved in the operation. Those arrested were suspected of belonging to a criminal group distributing sexual images of minors. Meanwhile, 404 Media reports that Chinese AI video generators have unleashed a flood of non-consensual pornography because of their lack of controls.
Journalism: The LA Times is the latest news outlet to try to use AI in its output. As with previous experiments, it hasn’t gone well. The new AI-powered “Insights” feature aims to provide context around articles that take “a stance” or are “written from a personal perspective.” In the case of an article about the Ku Klux Klan, the contextual comment defended the KKK as “a product of ‘white Protestant culture’ responding to societal changes rather than an explicitly hate-driven movement.” NiemanLab
Metaphors: A thought from Alison Gopnik, who is a professor at the University of California Berkeley. She says there’s a common misconception that AI large language models are individual intelligent agents, analogous to humans. Better, she argues, to think of them as “cultural technologies” like writing, print, pictures, libraries, internet search engines, and Wikipedia which increase human capacities by enabling more effective access to existing information.
Cheats: On the other hand…the latest AI reasoning models resort to cheating at chess to avoid losing, according to a (yet to be peer-reviewed) study. Palisade Research found that they stole moves or simply took pieces off the board if they were in their way. It’s not the first time this tendency has been seen…
Trump
Social: Anyone applying for US citizenship or personal residency would have to disclose their social media details under a policy proposed by the Trump administration. The proposal by the federal agency that oversees legal migration was published in the Federal Register this week. The agency said the information was “necessary for a rigorous vetting and screening” of all people applying for “immigration-related benefits.”
Security: Swingeing staff cuts at US security and intelligence agencies would “have a devastating effect on cybersecurity and our national security,” the former head of the National Security Agency warned in congressional testimony. “Eliminating probationary employees will destroy a pipeline of top talent essential for hunting and eradicating [Chinese] threats,” he said. The Register
Russia: Have US cyber agencies been told to stop focussing on Russia? The Record and The Washington Post think so. The reality is complicated and the truth is that no-one knows what’s actually going on, probably including the agencies themselves. As with so much else with Trump’s administration, the one clear winner is Russia itself. If you’re interesting, Kim Zetter has had a go at untangling the unholy mess.
Aid: The US has canceled a $95 million contract designed to bolster the cybersecurity defences of European and Asian allies. Among those benefiting from the aid were Albania, Moldova, Azerbaijan, and Kosovo. The contract with IBM provided consultancy effort. It was among the 90% of USAID contracts cancelled by the Trump administration.
In brief
Tracking: More evidence that the technology we use is expressly designed to track everything about us. An Irish academic found that mechanisms on Android devices begin building profiles on users before they even open their first app. Meanwhile, WIRED explores Teslas - or as it puts it “a surveillance system on wheels.”
Cellular: We often warn about the the threat posed by fake cell towers. Now the Electronic Frontier Foundation has released a free, open-source tool designed to detect cell-site simulators, also known as IMSI catchers or Stingrays. The tool will run on a cheap mobile hotspot.
Spyware: A court in Catalonia has ruled that three former executives of NSO Group should be indicted for their alleged role in a notorious hacking scandal. Spanish authorities are believed to have used NSO’s Pegasus spyware following anti-government protests in the mid-2010s. The Record
Solar: Chinese scientists explain how to sabotage a solar farm by targeting an inverter with electromagnetic waves.
Printers: Brother has denied reports that its has begun degrading print quality when third-party cartridges are used. Ars Technica
Shutdowns: 2024 was the worst year yet for internet shutdowns, according to Access Now. It says there were at least 296 incidents across 54 countries, many in Africa. “Authorities increasingly defaulted to internet shutdowns to disempower and disconnect people,” the group says.
Disinformation: Separate reports illustrate the scale of Russian disinformation efforts in Europe. Intrinsec looks at how the linguistic characteristics of fake articles betray their Russian provenance, while the French government reports on the disinformation campaign waged by Russia since it invaded Ukraine.
Updates
Apple: New features are designed to create a safer online experience for children. They include an updated age rating system, a simpler way for parents to set up child accounts, and new App Store controls.
Google: The latest Android update includes live detection of scam messages. It’s also introducing a privacy-focussed feature that aims to hide users’ primary email addresses when signing up to apps and services.
Browsers: Updates for Chrome and Firefox include important security fixes. New features include password functionality in Chrome and the introduction of vertical tabs in Firefox.
VMware: Security updates to address three actively exploited security flaws in VMware ESXi, Workstation, and Fusion.
Zimbra: Daffodil 10.1.6 includes fixes for meeting notifications and managing attachments.
Tails: Version 6.13 includes improved support for dealing with WiFi problems.