Technology failure. Targeting Macs. Web browsers face AI-powered attacks.
US deports French researcher over phone messages. Crap passwords. And an advertising giant with data on 91% onadult internetusers.
Technology
This week brought more evidence about the frail security of the technology we use every day. First up is Apple with news that its Passwords app was vulnerable to phishing attacks for nearly three months after it was launched. The issues emerged when researchers looked at their iPhone’s App Privacy Report and saw that the Passwords app had contacted 130 different websites over the insecure (and now largely disused) HTTP protocol. They told 9to5Mac that the app defaulted to opening password reset pages using the unencrypted connection which meant data could have been read as plain text. The issue was fixed in iOS 18.2. Apple declined to pay the researchers a bounty for identifying the issue.
Meanwhile, there have been further reports about the extent to which Microsoft’s Windows LNK files are being widely exploited to run code on devices without the user’s knowledge. LNK files are shortcuts designed to launch a program or run a script. As such, they’re an ideal way to hide a malicious payload. This is a longstanding tactic (which we reported on most recently in 2023 and 2024). This week, Trend Micro detailed how a trivial weakness in how LNK files are displayed has enabled malicious commands to hide in plain sight. Trend Micro says North Korea, Iran, Russia, and China have all been merrily exploiting the flaw for at least eight years. Microsoft has refused to do anything about it, saying Windows Defender detects and blocks this type of threat. Given that at least 300 organisations have fallen victim to it, Defender doesn’t seem to be doing a very good job. We say users should remain very alert to the risk these small files represent.
Threats
Macs: A campaign that was targeting Windows users has turned its intention to the Mac ecosystem with the aim of stealing Apple ID details. LayerX says the technique involves exploiting browser functionality to display a pop-up window that freezes the underlying webpage. The aim is to make the user think their device is compromised so they visit a malicious website in the hope of fixing the non-existent problem.
Social: Last year saw a spectacular rise in the number of attacks targeting social media and email accounts in the UK, according to Action Fraud. It says reports leapt from 23,000 to 35,436 compared to 2023. Most common were investment fraud, ticket scams and theft of the targeted account. It’s urging users to make sure they have enabled multi-factor authentication wherever possible and, more simply, to “Stop! Think Fraud.”
VPN: An automated framework has been developed to launch brute-force attacks against networking appliances such as firewalls and VPNs. The technique means it’s essential to use secure passwords and multi-factor authentication and to keep devices up to date. Bleeping Computer
Signal: Ukraine says highly targeted attacks are using compromised Signal accounts to send malicious software to military and defence-related targets. The technique uses attachments masquerading as meeting reports. While this campaign is currently restricted to Ukraine, any Signal user working on sensitive projects should be wary of the desktop version of the app, be cautious of messages with attachments, and check for linked devices.
Graphics: Watch out for SVG files. Scalable Vector Graphics attachments are being used to evade security mechanisms and KnowBe4 says this year has seen a spike in their use.
Parcels: Social media has been awash with reports that fake parcels and QR codes are being used to infect devices with malicious software. The scam begins with a parcel turning up unexpectedly. It’s accompanied by a QR code in the hope recipients scan it. This would take them to a phishing website or some other malicious resource. It’s a variation on a long-standing practice of lending credibility to fake reviews by sending someone goods and then posting a review in their name. The practice is called ‘brushing’ and, despite what some online videos say, simply clicking on a QR code won’t be enough by itself to compromise a device.
Android: Malicious apps continue to be a problem on Google’s Play Store. Bitdefender found more than 330 that have been downloaded by over 60 million users. Many offered some functionality such as expense tracking and QR scanning while hiding malicious activity in the background. Since Google appears incapable of keeping scumbags out of the Play Store, it’s vital to be really careful about any app you install.
Jira: Swiss multinational Ascom has confirmed that it experienced a cyberattack amid what appears to be a widespread campaign targeting the Jira project management platform. The attacks are using compromised credentials, often belonging to contractors and third parties. Bleeping Computer
AI
Browsers: AI is being used increasingly often to exploit vulnerabilities in web browsers, steal user credentials, and bypass traditional security defences. Menlo Security says Microsoft, Facebook, and Netflix were the brands most commonly impersonated in browser-based phishing attempts. Its report puts the number of phishing sites being created every month at a frankly staggering 1 million.
Reality: Despite all the confident predictions about the future of AI, the reality is that no-one really knows what’s going to happen. A former sceptic about the usefulness of Large Language Models explains why he changed his mind. Nicholas Carlini says it’s quite possible that AI models might end up being capable of “performing most (all?) cognitive economically-useful tasks beyond the level of human experts.” Alternatively, he says they might improve gradually but fail to achieve a “fundamental paradigm shift that upends the world order.” The truth, he reckons, probably lies somewhere in the middle.
Echo: Amazon has told Echo users that from next week everything they say to the devices will be sent to Amazon’s cloud. Currently, there’s a setting that allows requests to Alexa to be processed locally. Amazon says the change comes as it expands Alexa’s capabilities with generative AI features. Ars Technica
Watermarks: Users are taking advantage of Google’s Gemini AI model to remove watermarks from images, including those published by Getty Images. As TechCrunch reports, Gemini seems unusually skilled not only at removing watermarks but at filling in any gaps as well.
Monitors: Schools are increasingly using AI monitoring software to keep track of pupils with the aim of preventing violence. Data received by the AP and the Seattle Times included sensitive student documents but also revealed the degree of surveillance being used.
Hallucination: OpenAI is facing a complaint under data protection law after ChatGPT fabricated a wholly false story about a Norwegian man murdering his children.
Slop: 404 Media has a thought-provoking article ($) about the mutually reinforcing relationship between AI-generated ‘slop’ and the platforms it appears on. Slop is a polite way of describing the vast quantity of rubbish that AI enables creators to churn out at minimal cost or effort. The article argues that the impact is to generate revenue and profit while undermining reality as many people experience it.
Trump
Critical: We’ve always warned travellers to the US to be careful about data on their devices in case they’re inspected at the border. Now it seems the same care applies to messages and emails. Le Monde reports that a French researcher was refused entry and sent home after officials found messages on his phone in which he expressed “a personal opinion on the Trump administration’s research policy.” AFP quotes a diplomatic source as saying the researcher was told his messages “conveyed hatred towards Trump and could be qualified as terrorism.” The US has yet to comment.
Russia: Reuters reports that several US national security agencies have halted work on a coordinated effort to counter Russian sabotage, disinformation and cyberattacks.
Chat: In a bid to identify the source of leaks, the Director of National Intelligence Tulsi Gabbard announced an investigation into the secure chat platforms and other collaboration systems used by the intelligence community. Leaks during the first Trump administration led the Justice Department to make concerted (and surreptitious) efforts to access journalists’ phone and email records.
Verdict: People have been having fun with Elon Musk’s Grok AI chatbot and asking it whether Republicans or Democrats have been better for the US economy. Based on statistical evidence, it’s verdict; Democrats. “The data speaks louder than party lines,” it says. And, economically speaking, Biden was the better president, it concluded.
In brief
Passwords: The latest list of crap passwords continues to include old favourites, with 123456 heading the list. What makes Specops’ list really worrying is that the passwords were all used to control access to Microsoft’s Remote Desktop Protocol. 123456 also topped the Specops total list (R) of the top five stolen passwords. It’s been the same story for every one of the nine years we’ve been producing this newsletter. Insane.
Paragon: Citizen Lab has been explaining how Paragon’s Graphite spyware was able to compromise the devices of some 90 Android users without them doing anything. Paragon took advantage of an undocumented vulnerability to automatically process a booby-trapped PDF file. Most of the targets were journalists, government critics and activists. Among Paragon’s founders was the former Israeli Prime Minister Ehud Barak. Paragon was sold last year in a deal worth $900 million.
Compliance: The European Commission has told Apple and Google to change products to comply with EU competition rules, or face fines. It ordered Apple to open up access to iOS notifications, and allow alternatives to AirDrop and AirPlay on the iPhone. Google was told to change its Play Store to allow more competition.
Quantum: The UK’s National Cyber Security Centre says organisations should begin planning now for a post-quantum future in which current encryption standards are no longer secure. The NCSC says migration to post-quantum computing should be complete by 2035, which will strike many as ambitious (to put it politely). Real-world quantum computers are probably much further than 10 years away but the NCSC’s suggestion that planning should begin now is probably sensible, if optimistic.
Theft: Last November, iPhones began disappearing from front porches in New Jersey moments after they were delivered. An explanation has now emerged. Criminals had managed to find Fedex tracking numbers and bribed phone store employees to give them order details and delivery addresses. Signed for delivery is definitely worthwhile. WSJ
Personal: A video has emerged in which advertising giant Publicis boasts about the detailed information it holds on 91% of the internet’s adult internet users. They use a fictional woman as an example. Their description could come straight out of Black Mirror. GIZMODO
Updates
Outlook: More problems with Microsoft’s email platform, this time with the web version which decided to block access to Exchange Online mailboxes. The issue was fixed fairly quickly after a change was undone. It’s the second time this month that Outlook services have suffered an outage.
Windows 10: Microsoft is stepping up efforts to persuade users to move to Windows 11. Emails warn them that support will end in October, unless they pay to extend it. The emails also imply that they should think about how to dispose of their existing computer, presumably in the hope that they’ll buy a new device with Windows 11 pre-installed. NB many of these computers will run Windows 11, even if Microsoft says they won’t. Windows Latest
YouTube: Google has confirmed that it’s investigating an issue causing low quality playback of videos in the YouTube iOS app.
Google: Updates to address problems which stopped many second-generation Chromecast and Chromecast Audio from working.
SecureDrop: Version 2.12.0 adds support for Ubuntu Noble, including a semiautomated upgrade process.