The risks of Google's ad dominance. Fake subpoenas. Location identification goes viral.
AI phones home. US telecommunication vulnerabilities. Spyware customers named. A scammer scammed. And GoDaddy does for Zoom.
Broken
A tricky week for Google with the decision of a US federal court that it has acted illegally to maintain a monopoly in some online advertising technology. In her ruling, the judge said Google had broken the law to ensure its dominance in the infrastructure governing how advertising works on the web. It’s the second similar ruling this year and could lead to a radical restructuring of the vast company which, before the decision, was valued at $1.88 trillion.
While, according to the ruling, Google’s behaviour damaged its customers and consumers, we’d suggest its dominance has also resulted in an ecosystem riddled with security vulnerabilities that the company has failed to address. Google says that last year AI tools enabled it to suspend nearly 40 million US advertiser accounts and take down 1.8 billion advertisements. And yet, we constantly have to warn about the risk from the results of Google searches that have been gamed to serve up malicious adverts.
And, again as we repeatedly report, the official Google web store is crawling with malicious extensions for the Chrome web browser. This week, a researcher published details of a spying operation affecting over 4 million users. It involved extensions claiming to offer protection against malicious software or to block advertisements but which actually collected browsing data, cookies, and other sensitive information. The operation appears to have been running since 2019 and some of the malicious extensions even sported a “Featured” badge in the Google store.
Threats
Google: A very sneaky and sophisticated campaign uses what appears to be an alert from Google that it’s received a subpoena to hand over the contents of recipient’s account. It passes normal email security checks and contains a link that leads to a convincing “support portal” page. The details of the technique are interesting for the technically minded. The takeaway is never to log into a service by following a link you receive.
Sextortion: Scammers are exploiting old techniques to fool people into thinking their email accounts and computers have been compromised. The tactic involves spoofing an email address, so that the phishing message appears to have originated from it. The aim is to scare the recipient into making an improbably large payment to avoid having sensitive details disclosed. Of course, the solution is simply to ignore it. Malwarebytes
NHS: Healthcare practices in the UK are warning about scam emails inviting patients to update their details to remain registered with their doctor. The emails tell users to install (malicious) software to complete the update. It’s a nasty tactic most likely to work with elderly people who should definitely be told about it.
Gourmet: Russian cyber-spies clearly believe (possibly correctly) that the best way to con a European diplomat is by appealing to their palates. Last year they invited them to a dinner reception, now it’s to a wine-tasting. Check Point says the invites originate from a highly-effective group dubbed Cozy Bear. As always, the attack relies on the recipient clicking a link or opening an attachment.
Graphics: We’ve written before about the use of scalable vector graphics (SVG) files in phishing attacks. It’s more important than ever to watch out for them because of an abrupt rise in their use. The files usually contain a link that leads to a fake login page for Microsoft 365. Trustwave
Brute: There’s been a sharp increase in the number of attacks relying on brute force to guess a correct password. Rapid7 says too many of the attacks work because of a lack of multi-factor authentication.
Embedded: A Russian cybersecurity firm says it has found pre-installed malicious apps on low-cost Android devices made in China. The apps masquerade as WhatsApp and Telegram. It’s a good reminder that even shrink-wrapping doesn’t guarantee a device is safe.
AI
Location: OpenAI only released its newest AI models this week, but they’re already being used to identify the locations shown in pictures. While this can be done manually, it’s time-consuming and needs some skill. The new models take seconds to do the same thing, and TechCrunch says it’s already become a viral trend which, from a security perspective, is a throughly bad thing.
Recall: After a delay of more than a year, Microsoft has finally begun rolling out its controversial Windows 11 feature that takes a screenshot every three seconds so they can be searched later. As a result of privacy concerns, Recall will be disabled by default and multiple settings allow users to control its behaviour. In reality, this sort of functionality is likely to become standard (notwithstanding the obvious security risks). It’s no coincidence that the latest ChatGPT update enables it to remember all the user’s interactions with it.
Training: Two approaches to providing AI models with the material they need in order to learn. In the case of Meta, it says it will begin training them on the public content shared by adults on Meta products. Apple’s approach aims to respect people’s privacy by creating “synthetic” data designed to mimic real content.
Avatars: Andreesen Horowitz has a fascinating round-up of the advances in AI-created human facsimiles - and how they might be monetised.
Up: OpenAI boss Sam Altman says the number of ChatGPT users has doubled in the past few weeks, with “10% of the world” now using the company’s systems.
Undercover: 404Media reports on an AI-powered platform that enables US police to deploy social media bots to engage with “college protesters,” “radicalised” political activists, and suspected drug and human traffickers.
Emotional: “Emotionally aware” targeted advertising is coming to LG TVs thanks to a deal with a company providing what it calls a “Large Emotion Model” AI platform. It’s supposed to work by gathering up publicly available script and plot information about anything the viewer watches and using it to analyse its emotional context. StreamTVinsider
Phoning home: Too busy to call an elderly relative? No problem, an AI startup will do it for you - though it stops short of actually mimicing your voice…for the moment.
Trump
Hold up: Oregon Senator Ron Wyden is demanding the release of an unclassified report detailing security vulnerabilities in US telecommunications systems. He called the withholding of the report a “multi-year cover-up” and said he’d hold up the nomination of the key cybersecurity official until it’s published. Wyden has campaigned relentlessly to improve the security of critical communications infrastructure. When he says there’a a problem, it’s worth listening.
Surveillance: US Immigration and Customs Enforcement (ICE) has paid Palantir tens of millions of dollars to modify a database platform to allow “complete target analysis of known populations” and to update the tool’s targeting and enforcement priorities. 404 Media
Persuader: The Washington Post reports that Apple CEO Tim Cook was instrumental in convincing the Trump administration to temporarily exempt some electronic products from the swingeing tariffs imposed on China. Cook apparently set out the potential impact on iPhone prices, though we’re not convinced it would have been able to pass them on in their entirety. Notwithstanding the temporary reprieve, Apple has already begun assembling the iPhone 16e in Brazil as it tries to shift production from China.
In brief
Spyware: A lawyer for the maker of Pegasus spyware has named Mexico, Saudi Arabia, and Uzbekistan as customers involved in the 2019 hacking campaign that targeted more than 1,200 WhatsApp users. The disclosure comes as part of Meta’s lawsuit against NSO group and is the first time it has publicly named any of its customers. TechCrunch
China: The Wall Street Journal reports that Beijing has privately told the US that it was responsible for years of intrusions into computer networks at ports, water utilities, airports and other targets. The paper says the admission was taken as a warning to the US not to involve itself in any future conflict over Taiwan.
Nissan: Researchers managed to remotely hijack a 2020 Nissan Leaf via its infotainment system. After getting initial access, they created a cellular connection that enabled them to take control of the vehicle’s systems including steering, doors, and lights. PCAutomotive
SMS: Brian Krebs has a long-read on the literal walls of phones used by a China-based group behind the ubiquitous SMS phishing messages and why the tactic is so effective.
Insurance: Ransomware operators almost triple their their ransom demands if they detect their victim has cyber-insurance, according to a study highlighted by the Netherlands government. The Register
Thailand: The Thai government has used a “sustained, coordinated social media harassment and doxxing campaign” to target the country’s pro-democracy movement, according to research by The Citizen Lab. It says the publication of personal details was designed to enable individuals to be directly attacked.
Revenge: It’s not uncommon for scammers to have the tables turned on them, but the resulting accounts are seldom as entertaining as this one. The video runs to over 10 minutes, but along the way it provides a perfect explanation of how scams work…as well as how hard it is to remain anonymous online.
Oops: If your Zoom call was unceremoniously interrupted on Wednesday, you can thank GoDaddy for the unscheduled break. It turns out that a “miscommunication” resulted in GoDaddy blocking the zoom.us domain. That’s quite some miscommunication. The Register
Updates
Apple: “Out‑of‑band” (i.e. emergency) updates for macOS and iOS to address two security issues which it says have already been exploited in “extremely sophisticated attacks against a small number of iOS targets.” The latest versions are iOS/iPadOS/macOS 18.4.1.
Microsoft: Not a great week for Windows 11 users. First Microsoft advised that a mysterious folder installed during the latest update is actually important, so anyone who’s deleted it should put it back! Then it admitted that the latest update is causing some devices to crash with the “blue screen of death.” The fix for that is to revert to the previous version. And to round things off, It issued an emergency update for Windows Server because of a problem launching some Windows containers.
Android: An automatic update rolling out to almost all Android devices means they will reboot themselves if they haven’t been used for three days. Like iPhones, Android devices are most secure when they’ve just been rebooted making it harder to access any data on them. 9to5Google
Fortinet: An update addresses a pretty ghastly issue that allowed passwords to be changed remotely without authentication.
Oracle: A typically huge number of updates, with some 40 related to critical issues.
Atlassian: Updates to address four high-severity issues impacting third-party dependencies in Bamboo, Confluence, and Jira, including some that were publicly disclosed nearly six years ago.
Cisco: Security updates for Webex App, Secure Network Analytics, and Nexus Dashboard.
Browsers: Important updates for Chrome, Firefox and related browsers. Latest versions are Chrome 136 and Firefox 137.0.2. As always, just close the browser down at the end of the day so that you can be sure you’re always running the latest version.
Tails: Emergency release to fix security vulnerabilities in the Linux kernel and the implementation of the Perl programming language.