Lessons from Signalgate. A security veteran snared by phishing lure. Deepfake porn.
Y2K but worse. The problem with 23andMe.And the hack that breaks (most) paywalls.
That Signal Snafu
Every week we trawl the news for examples to highlight how to keep information secure. Seldom do we see a case of what not to do quite as spectacular as Signalgate.
First - and probably most important - it illustrates what’s happening in pretty much every organisation. Employees, especially senior ones, are using solutions that either haven’t been approved or are downright prohibited. Sooner or later this will go horribly wrong (though perhaps rarely as horribly wrong as in the case of Trump’s clown show).
Second- even if a platform is secure (which Signal definitely is), that doesn’t mean that everyone is going to use it securely or that information shared on it will stay safe. Among the key lessons from this episode is that rules about sharing data exist for a reason and users must understand and accept them.
Third - just like any other platform, using Signal securely relies on understanding how it works. Here are some key issues;
-
Check before adding someone to a group. Phone numbers get reused or passed on. In a large group, someone must take responsibility for managing it otherwise we guarantee it will end up containing members who shouldn’t be in it.
-
Use “Approval required to join” for Group links. This protects against someone mistakenly (or deliberately) inviting someone to join a Group who shouldn’t be there.
-
Turn off “Contact joins Signal notifications.” How many contacts do you have with the same name? If a contact called Mark joins Signal, how do you know who that is?
-
Give contacts a nickname. On the same theme, give contacts a nickname. That way US National Security Adviser Mike Waltz would have known ‘JG’ was the editor-in-chief of The Atlantic when he added him to the Yemen group.
-
Use “Disappearing Messages” but don’t rely on it. It’s good practice to avoid retaining sensitive information (unless you’re in government when that’s exactly what you’re supposed to do). But even if a message is set to automatically delete itself, that doesn’t mean someone couldn’t have taken a screenshot of it.
-
Create a “Registration Lock PIN.” This means it’s impossible to hijack your Signal account, even if someone were to take control of your phone number (for example through a SIM swap).
And finally, Signalgate has also highlighted the risks of payment apps like Venmo. CBS News looked at Waltz’s account after the publication of The Atlantic’s report and found it wide open. Waltz’s contacts included journalists, government officials, active and retired service members and members of congress. So, thanks to him for reminding us that accounts on platforms like Venmo should definitely be set to Private.
Threats
Hunt: In proof that no-one is immune to a good phish, security expert Troy Hunt fell for a scam that provided an attacker with access to his newsletter mailing list. His account of what happened is an object lesson in just how easy it is to be taken in by the increasingly credible emails bombarding our inboxes and social media accounts. In his case, the key was probably jet-lag (he was in London on a trip from his home in Australia). The giveaway was the email address from which the phishing email was sent. If you receive a message telling you to reset a password or enter authentication details, always check who sent it - even if your email client doesn’t display the information automatically.
BEC: The number of Business Email Compromise attacks continues to rise with a report showing a 13% month on month increase in February. Sums involved also rose with the average reaching $39,315. Gift cards remain the most popular request followed by payroll diversions. It’s crucial to have iron-cast procedures to approve any financial transactions because sooner or later every organisation experiences this type of scam. Fortra
DeepSeek: Crooks are using fake Google ads to exploit interest in the Chinese AI platform. The ads look like legitimate ones from DeepSeek but if clicked they take users to a fake website that prompts them to download malicious software. More evidence (not that it’s needed) that Google Ads cannot be trusted - and that a tool to block adverts is essential to safe web-browsing.
Maps: And, for good measure, the information on Google Maps needs to be treated with caution as well. Google has just filed a lawsuit in the US against a group responsible for creating thousands of fake companies that overcharged and scammed victims. The businesses provided services such as locksmiths and towing businesses. CBS News
AI
Apple: Way back last June, Apple made a big deal about its upcoming and now-delayed Apple Intelligence features. That delay has led to a class-action lawsuit in the US accusing the company of using the announcement to drive “unprecedented excitement” in the market and convince users to upgrade to more capable and expensive devices. Axios
Porn: Research shows a surge in the popularity of deepfake porn services, with the 10 most popular “nudifying” websites receiving 18 million views in January alone. Bloomberg reports on how one community fought back.
Agents: More examples of how AI agents are appearing in the workplace and carrying out activities to help - or replace - employees. Otter.ai’s Meeting Agentcan schedule follow-up calls and draft emails. Microsoft is introducing a set of agents in Security Copilot designed to help security teams tackle high-volume, repetitive tasks including phishing attacks and identity and access management.
Collapse: A YouTuber built an army of AI bots to confound scammers’ call centres and keep them on the line for hours. The scumbags’ growing frustration is really quite satisfying.
Messed-up: 404 Media returns to the subject of AI-generated rubbish that is polluting the online experience. Its headline pretty much sums it up; ‘Brainrot’ AI on Instagram Is Monetizing the Most Fxxxxd Up Things You Can Imagine (and Lots You Can’t)
Trump
Privacy: A new executive order would give Elon Musk’s DOGE access to sensitive personal information about nearly every American, according to the Electronic Privacy Information Center (EPIC). The White House argues the order will eliminate information silos. EPIC says, “It’s clear the president and the DOGE think there’s no scrap of Americans’ personal data they shouldn’t have access to, no matter what the law says.”
Balls: The best-known member of Elon Musk’s team of DOGE technologists once provided support to a cybercrime gang that bragged about trafficking in stolen data and cyberstalking an FBI agent, according to digital records reviewed by Reuters. His online handle; bigballs.
Security: Another of President Trump’s latest executive orders directs the White House to prepare plans that would move responsibilities for cybersecurity to state and local government. The order said local officials were best placed to deliver cost-efficient solutions. Experts question whether they’re also best placed to defend against nation-state attacks on critical infrastructure.
In brief
23andMe: You’ve probably seen the news that the DNA-testing company has filed for bankruptcy protection in a bid to find someone to buy it. You’ll also have seen advice that anyone who has used the service should delete their data. It’s worth knowing that even if you do request deletion, 23andMe will retain some details “for compliance with applicable legal obligations.” And, in any case, as the BBC reports, the company has been struggling to deal with the number of people trying to delete their accounts.
Epochalypse: Remember Y2K? Y2038 is the same idea but many, many times worse. The problem lies in the way some computers track time. In January 2038, that system will reach its mathematical limit and affected devices will roll over to negative numbers making them think they’ve time travelled to 1901. If the problem isn’t addressed, the ensuing chaos would cause the collapse of critical infrastructure, banking, hospital services… The list is long. Epochalypse-project.org has the gory details.
Bounty: A St Petersburg company which is widely regarded as a front for the Russian government is offering $4 million for undisclosed (‘zero-day’) ways to break into the Telegram messaging platform. Mind you, in 2023 Operation Zero said it would pay $20 million for issues that could be used to hack iPhones and Android devices.
Teens: As the Netflix drama ‘Adolescence’ tops the UK viewing figures, the country’s National Crime Agency has warned that “online networks of teenage boys dedicated to inflicting harm and committing a range of criminality” are among the most significant concerns for British law enforcement.
Influencers: The UK cybersecurity agency has recruited social media stars in an attempt to persuade people to use two-factor authentication. Some of the resulting videos are more amusing than others. France took a different approach. Its privacy regulator sent a phishing test to more than 2.5 million school students. 8% fell for it - which is a lot better than the results in corporate environments.
Paywalls: A clever hack allows access to most paywalled content by simply adding “pure.md/” to the beginning of a web address. It also works on social media/networking sites including LinkedIn and Instagram, enabling full profiles to be viewed without logging in.
Updates
Microsoft: It’s only taken a couple of months but there’s finally a fix for a Windows 11 problem that caused some printers to churn out garbled pages. Meanwhile, Microsoft is investigating an Exchange Online issue that results in spam filters quarantining valid emails.
Privacy: Vivaldi is adding Proton’s VPN option to its web browser, albeit in a basic form. It means that browsing sessions will be protected from online surveillance. The option does require signing up to Vivaldi or Proton, and it’s not suited to circumventing geographic content restrictions.
Browsers: Google has fixed a previously unknown (‘zero-day’) vulnerability in its web browser. It has already been used in attacks targeting Russian media outlets and education organisations. And a similar issue seems to behind Mozilla telling Windows users to make sure their Firefox browser is up to date. That has resulted in an emergency update for the Tor Browser.
Maps: After users reported that their Timeline data had disappeared, Google admitted that a technical issue caused the deletion. Anyone with an encrypted backup should be able to retrieve the data. ZDNET
Draytek: Users of the company’s routers were told to disable VPN and remote access features and to update the devices’ firmware after many of them appeared to be stuck in a reboot loop.
VMware: Urgent fix for Tools for Windows to address an issue that could allow authentication to be bypassed.