The security report that's worth reading. Phone theft. Shadow AI.
Advice for travel to the US. Not for profit web search. And the global spread of transnational cyber crime.
Trends
Every week brings a slew of surveys and reports, many if not most self-serving marketing flummery. One of the exceptions is Verizon’s annual Data Breach Investigations Report. Here are the headlines;
-
Ransomware continues to be a major threat, particularly to small and medium sized organisations.
-
Involvement of third parties in breaches doubled, making it essential to audit partners and suppliers.
-
Exploitation of vulnerabilities leapt by 34% and now accounts for a fifth of breaches. Updates aren’t optional.
-
46% of compromised systems with corporate credentials were non-managed devices, i.e. personal devices.
-
Humans - in other words all of us - remain the most common link in data breaches.
And by way of further context, some figures released this week on the cost of fraud and scams;
-
The FBI says cybercriminals and online scammers stole a record $16.6 billion in 2024, up from $12.5 billion the previous year. People over the age of 60 lost $4.8 billion, including $1.8 billion in investment scams.
-
The US Federal Trade Commission reports that Americans lost $470 million to phone scams last year. The FTC says the real figure is probably far higher because only a fraction of incidents are reported. Most common were package delivery scams, non-existent job opportunities, and fake fraud alerts.
Threats
Theft: A reminder about the extreme risk of having your phone snatched, particularly in London where police say they seize 1,000 stolen devices every week. Clients have reported this happening to them recently and the consequences can be grim. We recommend activating Stolen Device Protection on iPhones and Find My Device on Android. Above all, take care when using a phone in public.
FBI: Scammers are impersonating the FBI’s Internet Crime Complaint Center (IC3) and offering to “help” fraud victims recover their losses. This sort of impersonation is becoming increasingly commonplace. This month, Spanish police arrested suspects who allegedly posed as Europol agents and UK lawyers as part of a multi-layered cryptocurrency scam.
Remote: Zoom has a bunch of useful features, including the ability to give someone remote control over your computer. You won’t be surprised that cryptocurrency fraudsters are abusing this to install malicious software. The technique begins by inviting someone to take part in a podcast and share their screen to present some content. The fraudster then requests control in the hope the target doesn’t realise what’s happening. SEAL
Forms: Google Forms have been a boon to fraudsters since their launch in 2008. Free, trusted and ubiquitous, they tick every box on a scammer’s list of requirements. Above all, they lend themselves to creating spoofs of legitimate brands, which is why it’s so important to avoid entering important information on any page that you reach from a link you receive. ESET
Copycats: Proofpoint says state-sponsored attackers have begun copying the ClickFix social-engineering technique that uses dialogue boxes with instructions to copy, paste, and run malicious commands on a target machine. As always, the tactic relies on the individual clicking a button so in theory it should be relatively easy to avoid.
Unbelievable: It might seem unlikely that anyone could be persuaded to withdraw huge sums of money from their bank account and hand it to a stranger, but the reality is that it happens. It usually involves someone pretending to represent an online vendor and a fake law enforcement officer. KnowBe4 explains how the scam works and why people fall for it.
AI
Shadow: Research supports what most organisations know; the use of unapproved (or “shadow”) AI is rampant and most users will continue to use it even if they’re told to stop. Harmonic says data from companies using its tools showed large amounts of sensitive data being included in prompts, in many cases through the use of personal accounts. It’s vital to have a policy on safe use of AI and to include it in awareness sessions.
Age: Meta and Discord are among those testing new age verification tools to control access to content. This comes as new rules on age checks come into force in the UK. The rules will also require online businesses to ensure their content recommendations prevent children from accessing sensitive material.
Rentals: AI has arrived in the car hire sector in the form of a sensor tunnel being deployed by Hertz at 100 airport locations. The tunnels will ensure no scratch, no matter how superficial, escapes the sensors’ eagle eyes - nor the final bill. View From The Wing
Netflix: The streaming giant is trying out a new feature powered by OpenAI technology that aims to improve how users discover content on the platform. MacRumors
Cheat: Two ex-Columbia University students are hawking an AI tool designed to “cheat on everything.” It claims to read screen contents, listen to audio, and provide AI-powered answers in real-time. The students say they’ve already raised $5.3 million. The Verge tried it out and says it’s crap.
Demonic: ChatGPT appears to have been mainlining Dr Who judging by a conversation posted on Reddit. It begins normally enough, before ChatGPT’s female voice morphs into the lovechild of a Dalek and Cyberman. Oh, and ChatGPT has also taken to intermittently referring to users by their real names. “Creepy and unnecessary,” was one reaction. Especially as ChatGPT hadn’t been told what to call them.
Trump
Travel: The European Commission is reported to have provided specific devices to staff travelling to the US to avoid the risk of espionage. The Financial Times says the measures replicate existing precautions for trips to China and Ukraine. At the same time, the Committee to Protect Journalists has issued a safety advisory with similar advice. Incidentally, reports refer to “burner devices” which is misleading. Burner devices are intended to provide anonymity and hide someone’s identity. In the case of the US, the advice is simply to use separate devices to avoid disclosing any data or social media activity that might be detrimental to the traveller being able to continue their journey. We do regard this as a serious threat at the moment and the CPJ’s advisory has an invaluable checklist.
Signalling: Despite being caught using yet more Signal groups to share sensitive information, US Defence Secretary Pete Hegseth remains in post. It’s impossible to overstate the danger of his behaviour, not just to US security but because of the way it normalises the use of unapproved messaging solutions.
Security: Perhaps the most worrying security story about the Trump administration comes courtesy of NPR. It reports on a whistleblower who says the so-called Department of Government Efficiency arrived at the headquarters of the National Labor Relations Board. Data was promptly uploaded from the agency. Shortly afterwards employees saw log-in attempts from an IP address in Russia.
In brief
Search: An interesting article from Cisco Talos looks at search engines and the attempts of most of them to extract value from our interactions with them. The solution? It examines a “free internet metasearch engine which aggregates results from up to 229 search services” and which neither tracks nor profiles anyone who uses it. We’ve tried it out and the results are simple and impressively comprehensive. You can try out one that’s been set up for public use or, if you’re feeling slightly technical, host it yourself.
Persuasion: A network of thousands of TikTok accounts are exploiting the platform’s design to influence public opinion in Ukraine and elsewhere. TikTok lacks any controls over which accounts are allowed to go viral, so as soon as a Russian disinformation account is suspended, a new one is created to take its place. Meduza
Cyprus: The Cypriot Interior Ministry has drafted legislation providing for sweeping surveillance of journalists, including the use of spyware and searches of journalists’ homes and offices. With supreme irony, the bill is purported to align Cyprus with the European Media Freedom Act. OCCRP
Harm: A Pew Research survey reveals a basic truth about social media; plenty of people think it’s bad, just not for them personally. The research interviewed US teens from 13-17. 48% of them said social media sites had a mostly negative effect on people their age (up from 32% in 2022). But only 14% said that negativity affected them personally.
Spreading: Transnational organised crime groups in East and Southeast Asia are expanding their scam operations across the globe following crackdowns by regional authorities, according to the UN. The Office on Drugs and Crime estimates that hundreds of industrial-scale scam centers generate just under $40 billion in annual profits..
Updates
Privacy: A couple of privacy-related updates from WhatsApp and Google. Google. The WhatsApp feature is called Advanced Chat Privacy feature and is meant to protect sensitive information exchanged in private chats and group conversations by preventing anyone from exporting it. (Of course, it doesn’t mean they can’t take a screenshot.) Google’s feature is called Sensitive Content Warnings and is designed to protect against images in Google Messages that may contain nudity (though it doesn’t work on videos).
SonicWall: An issue that was fixed four years ago is being actively exploited. It affects SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v devices.
Zyxel: Updates to address two privilege management vulnerabilities in USG FLEX H series firewalls.
Asus: Users of AiCloud routers are urged to update their firmware because of an issue that could allow remote attackers to run commands remotely on affected devices.
Zimbra: Daffodil 10.1.7 includes new features including idle session alerts, a screenshot ban, and a number of fixes.
SecureDrop: Version 2.12.2 includes the first phase of automatic Ubuntu upgrades.