Insider espionage. Messaging threats. AI re-imagining reality.
The Trump administration goes large on Gmail and Signal. Taking care when leaving XTwitter. And fake electronics with positive reviews.
The insider threat
The threat from people inside an organisation is real - and a great example is currently playing out in Ireland’s High Court. It involves two HR software companies and a compliance manager called Keith O’Brien. While working for one of them - called Rippling - O’Brien considered moving to its competitor - called Deel. It’s alleged that Deel paid him about €5,000 a month to stay at his current employer as a corporate spy. When suspicions first arose, O’Brien says he tried to cover his tracks (including by taking an axe to his phone and flushing the remains down the drain at his mother-in-law’s house). The details emerged after O’Brien decided belatedly to confess.
It’s not the only insider story this week. An intern at GCHQ, the UK’s signals intelligence agency, has pleaded guilty to taking sensitive information home. Prosecutors said the intern downloaded a “top secret” tool estimated to be worth millions of pounds. He stole the software two days before his year-long placement at GCHQ was due to end.
And AI giant Anthropic says it is beginning to sweep physical offices for hidden devices as part of a drive to improve security. It says the sweeps are conducted “using advanced detection equipment and techniques” and look for “intruders.” It’s also sourcing employee devices from vetted manufacturers and carrying out regular tests of its physical security. To be frank, we’re slightly surprised it’s not doing these things already.
Threats
Messaging: Separate campaigns targeting Taiwan and Argentina underline the affection attackers hold for the messaging ecosystem. In the case of Taiwan, malicious apps were designed to mimic legitimate platforms. If installed, they provided the attackers with extensive control over infected Android devices. In Argentina, a hacking group accessed SMS gateways to bypass multi-factor authentication and hijack user accounts. At the risk of repeating ourselves, it’s essential to be cautious about installing apps, and to avoid text messages for multi-factor authentication whenever possible.
Credentials: Sophos says leaked passwords, brute-force attacks, or phishing incidents were behind 62% of the security incidents it investigated last year.
Zoom: A very convincing website installed ransomware on victims’ devices by creating a fake copy of Zoom’s real website and mimicking its legitimate domain. This was an impressively sneaky campaign in which the attackers waited nine days before starting work in earnest. The DFIR Report
Telegram: The Israeli Internet Association has warned about a surge in attempts to hijack Telegram accounts through the exploitation of voicemail systems. The technique takes advantage of users’ frequent failure to change the default PIN code for their cellphone voicemail service. This allows attackers to access Telegram verification codes. Ynetnews
AI
Faking it: A new version of ChatGPT included an image generator that resulted in one million new users in a single hour. It turns out it excels at creating fake receipts. A tool called Phazr allows you to appear as anyone you like in your next video call. All it needs is a single photo (although at present it only works on Linux). Krisp.ai has an offering designed to “soften” the accents of call centre agents. And Adobe has updated its video editing platform with AI-powered features, including one that can extend clips by two seconds (in 4K quality with appropriate background audio).
Cut: In restructuring for “the world of AI,” Dell has reduced its workforce by 22,000 (from 133,000) since February 2023.
Atrophy: Researchers found that using generative AI at work resulted in less critical thinking, potentially causing cognitive abilities to deteriorate over time. Separately, an (anonymous) philosophy professor says the average US university student is “functionally illiterate.” Like a good philosopher, he defines his term, saying students are “unable to read and comprehend adult novels by people like Barbara Kingsolver, Colson Whitehead, and Richard Powers.”
Wikipedia: The online encyclopaedia says it has seen a 50% rise in bandwidth used for downloading multimedia content since January 2024. Not because of its readers, but because automated programs are vacuuming up the content to train generative artificial intelligence models.
Trump
Flagrant: Use of insecure and unapproved communications platforms is reported to be rife among members of the US National Security Council. Citing documents and interviews with officials, The Washington Post details how Gmail was widely used, including for “technical conversations involving sensitive military positions and powerful weapons systems relating to an ongoing conflict.” Meanwhile, Politico says national security adviser Mike Waltz’s team regularly set up chats on Signal to coordinate official work on issues including Ukraine, China, Gaza, Africa and the Middle East. Four people said they had been added to the chats which were a commonplace way of discussing “any given national security topic.”
In brief
Deletion: If you’re considering leaving XTwitter, you’re not alone. 32 million users are reported to have left the platform since Elon Musk took over in 2023. Among them are many brands including Center Parks whose case illustrates why it’s better to stop using the account, rather than deleting it. That’s because deleting it allows someone else to register the handle and impersonate the brand…or the user.
Takedown: Europol has shut down one of the largest dark web paedophile networks in the world, seizing 91,000 unique videos depicting child abuse. The KidFlix network had some 1.8 million users. Nearly 1,400 have been identified and 79 have been arrested so far.
Terrorgram: ProPublica reports on the rise and fall of Terrorgram, an online Telegram community that encouraged members to carry out murders, physical attacks, and hate crimes.
Spyware: Satisfyingly, users of spyware tools like Pegasus keep getting exposed because researchers have become increasingly skilled at identifying them. TechCrunch
Leaking: NiemanLab has an extensive guide on how to leak secrets to journalists. For recipients of leaks, the most important advice is never to publish any original documents. There are numerous examples of the disastrous results of failing to follow this rule. In one case involving the BBC, a reporter tweeted images of government emails that included the whistleblower’s name.
Empty: An electronics expert bought a WiFi repeater on eBay. It turned out that the only working part of the device was a bright blue LED. Despite being wholly fake, it had several positive reviews.
Updates
Apple: Updates for pretty much all the company’s products. They include important security fixes. Latest versions are iOS/iPad 18.4, macOS 15.4, Safari 18.4. The updates also cover older versions of its operating systems. Incidentally, the latest versions silently enable automatic updates for macOS and iOS users. While it’s good to install updates quickly, major changes frequently cause problems which is why we often advise waiting a couple of days to see what Apple has managed to break. It’s slightly naughty of Apple to enable this setting without telling anyone.
Thundermail: Mozilla (maker of the Firefox browser) has overhauled its Thunderbird mail client to compete with Gmail and Office 365. Thundermail is accompanied by other web services, including scheduling and file-sharing. Some of these may require a subscription. The Register
Gmail: Meanwhile, Google is adding support for sending end-to-end encrypted emails for enterprise users. The feature won’t require additional software or special configurations which is its advantage. Less good is that it’s not true end-to-end encryption in which only the contents of a message can be accessed only by the sender and receiver. Ars Technica explains.
Browsers: Another week, another set of important security fixes for all the leading browsers. If there’s one really simple thing we can all do to stay safer, it’s to close browsers at the end of the day so that they’re always up to date. Among the issues addressed is a complex vulnerability in Chrome that Kaspersky says was exploited to target Russian media and academics and which bypassed security protections as if they “didn’t exist.”
Canon: Users of a wide range of printers should check for updates that address a nasty vulnerability.
SecureDrop: Version 2.12.1 improves the reliability of upgrades to Admin Workstations.
Tails: Version 6.14.1 improves the way files are protected from possible security vulnerabilities in Tor Browser.