Another bumper year for cyber fraud. The risks of illegal streaming sites...
and file conversion tools. Voice cloning apps condemned for lack of controls. A tool for US online surveillance. French parliamentarians reject encryption law. And a disgruntled developer and his kill switch.
Big business
The US Federal Trade Commission says reported losses from cyber-related fraud reached more than $12.5 billion in 2024, an increase of 25% from the previous year despite roughly the same number of reports. Almost half of the losses were linked to some form of investment scam, closely followed by online shopping fraud. This isn’t just big business. It’s a whole new form of international trade.
Myanmar provides an excellent illustration of the growth of cyber-related fraud as both a criminal undertaking and an officially-sanctioned enterprise. Justice for Myanmar says last year companies linked to the Myanmar military and its militia forces created two new cyber scam compounds in a region known for this type of activity. That’s despite Thailand cutting off power to the area in an attempt to control their activities. Satellite imagery of the area shows the scale of the expansion.
This follows the model of North Korea, which earns most of its foreign currency from cyber-related fraud. In the most egregious recent example, the FBI said North Korean hackers stole $1.5 billion from a cryptocurrency exchange, the largest such heist yet seen. It’s now reported that most of the proceeds of the heist have been successfully laundered. A report into the theft found that it began with a social-engineering attack.
Threats
Adverts: Microsoft says attackers used malicious ads embedded in videos on illegal streaming sites to lead victims on a merry dance that ended with information stealing software being installed on their machines.
Converters: The FBI is warning that criminals are using free file conversion tools to infect devices, also with information stealing software. The warning applies both to online websites and apps that convert files between different formats.
Snail: The FBI also says an extortion group has been sending physical mail to corporate executives, threatening to leak their organisation’s data unless a ransom is paid. Some of the letters try to appear more legitimate by including a password obtained in a previous data breach.
Quickbooks: There’s been a spike in phishing attacks that leverage QuickBooks’ legitimate domain. KnoweBe4 says it’s seen a 36.5% increase in use of the platform this year. The method works by setting up free accounts that can then be used to send apparently authentic emails.
Denial: A newly discovered network of compromised webcams and video recorders has been used to deliver one of the biggest denial of service attacks yet seen. Nokia says the so-called botnet was sending vast quantities of data to use up all the available bandwidth inside a targeted network or its connection to the internet. It’s a reminder about the importance of ensuring connected devices are kept up to date (and for manufacturers to provide updates). Ars Technica
CAPTCHA: As well as being an abiding frustration, these human verification challenges are an increasing security threat. The technique begins with a normal “I’m not a robot” tickbox. What’s different is that clicking it takes the user to a subsequent verification process designed to hijack the Windows clipboard and execute a malicious command. The best defence is to be sceptical about any request following a CAPTCHA challenge. Malwarebytes
Warning: A new campaign in the US is using messages and calls to scare victims into thinking they’re being investigated for an alleged crime. In Massachusetts, text messages are telling people they’re the subject of an “investigation” and should call a phone number to avoid “further legal action.” Elsewhere, scumbags pretend to be law enforcement officers and call potential victims over WhatsApp and other platforms to tell them their details have been found in connection with drug trafficking. Cybersecurity Insiders
AI
Voice: Most popular voice cloning apps lack any protections against abuse because they allow uncontrolled copying of other people’s voices, according to Consumer Reports. As well as an absence of controls, the group points out that some companies specifically encourage use of their products for pranks and deception.
Personal: Google says Gemini AI is now capable of using information from Google apps to “to deliver contextually relevant responses that are adapted to your individual interests.” This is all part of a drive towards turning AI chatbots into personal assistants which is likely to appeal to many users. Data protection laws mean the feature won’t be available for the moment in the European Economic Area, Switzerland, and the UK.
Propaganda: There’s a vast amount of Russian propaganda online and it’s poisoning large language models and AI chatbots. NewsGuard says one in three responses from the 10 leading generative AI tools are now returning pro-Kremlin falsehoods.
Control: AI agents represent a significant issue for privacy and security, according to the head of privacy-focussed messaging platform Signal. Meredith Whittaker likened their use to “putting your brain in a jar.” TechCrunch
Trump
Social: A US government contractor is reported to have developed a tool to facilitate the process of scanning social networks and online services for publicly available data about a target individual. A leaked document seen by 404 Media lists more than 200 sites from which data can be harvested and provided to government agencies including Immigration and Customs Enforcement. This comes as a prominent Palestinian activist and legal US resident remains in detention following his arrest on Saturday. Mahmoud Khalil was detained over his role in pro-Palestinian protests. The Trump administration is trying to deport him.
Risk: A key way of recruiting spies is to identify those disgruntled with their country. Hardly surprising then that Russia and China are reported to be targeting fired US federal workers, with a special focus on those with security clearances and possible knowledge of critical infrastructure. The Independent
XTwitter: Not so fast Elon. Yes – there was a successful attempt to take XTwitter offline this week. No – there’s no proof it originated in Ukraine. Indeed it’s not clear who was responsible, despite claims by a pro-Palestinian collective that they were behind the attack. According to WIRED, what does seem clear is that XTwitter failed to configure its most important resources so that they were adequately protected.
In brief
Encryption: Members of the French parliament have voted against a bill that would have required messaging platforms like WhatsApp and Signal to hand over decrypted chat messages of suspected criminals within 72 hours. We doubt this is the end of this story. techradar
LastPass: A catastrophic security breach in 2022 led us and many others to advise against using LastPass as a password manager. The US DoJ has now confirmed that attackers have succeeded in breaking into LastPass vaults and are using information in them – including passwords – to steal cryptocurrency. Brian Krebs has the full story.
Kids: Kazakhstan is discussing the introduction of SIM cards specifically designed for use by children. Parents would be required to buy the cards which would restrict access to dangerous websites and social media. They would also report a child’s location to parents through a special app.
UK: Least surprising story of the week; the UK government is woefully underprepared for a catastrophic cyber attack. The parliamentary Public Accounts Committee said while the cyber threat to the UK government is “severe and advancing quickly” many IT systems lack resilience and the vulnerability of hundreds of legacy solutions is unknown. Computer Weekly
Bluetooth: Undocumented commands have been found in a Bluetooth chip used in roughly a billion devices. Tarlogic Security say they allow spoofing of trusted devices, unauthorised data access, as well as the ability to connect to other devices on the same network. The Chinese manufacturer said the commands were included for “testing” purposes and it would remove them.
Monitor: Online adverts vacuum up a vast range of information about us, even down to the brightness of a phone’s screen, and inevitably that data ends up being stolen. In a podcast, Malwarebytes talks to a researcher about his investigation into leaked data and what it revealed about him.
Revenge: A developer sabotaged their ex-employer by installing a “kill-switch” that was activated when he was fired. 55-year-old Davis Lu now faces up to ten years in prison.
Updates
Apple: Important updates to fix a security flaw exploited in an “extremely sophisticated attack.” The issue lies in the WebKit browser engine so it affects pretty much all of Apple’s products. It’s one to install asap.
Firefox: Make sure your Firefox browser is up to date or it may stop working today. The issue is a fundamental security certificate that has now expired,.
Chromecast: Google has told users not to factory-reset old and outdated Chromecast devices which, basically, have stopped working. It says it will release a fix over the next few days.
Patch Tuesday: Second Tuesday in the month means a deluge of security updates, notably from Microsoft which released fixes for 57 vulnerabilities, six of them previously unknown. Other manufacturers releasing updates included; Adobe, Chrome, SAP, Ivanti, Fortinet, NVIDIA, Zyxel, and Zoom.
Microsoft: If you use Windows 11 and your printer has suddenly started misbehaving, the probable cause is a faulty Microsoft update. The fix is to revert to a previous version using a method called Known Issue Rollback. Microsoft has also announced that it will be retiring the Publisher app in October.
HP: And a round of applause for HP and its ability to generate unfavourable publicity with its printers. In its latest exploit, it managed to release an update that users say made it impossible to use genuine HP cartridges,