Microsoft goes passwordless. France calls out Russian attacks.
The real-time deepfake threat. Misusing AI. Hegseth's hopeless operational security. And iPhone spyware warnings.
Passwords
Long-time readers will know we’ve been talking for years about the demise of passwords. This week saw a big step towards that moment with an announcement from Microsoft that new accounts will be “passwordless by default.” The aim is to combat the increasingly sophisticated techniques attackers are using to break into accounts. Microsoft says it will select the best passwordless method for each account and enable it as the default. It also wants more users to adopt passkeys which rely on biometric authentication, such as fingerprints and facial recognition, and are far more secure than other forms of multi-factor authentication.
The added security is essential because of the availability of turnkey solutions designed to defeat multi-factor authentication, with a particular focus on Microsoft services. SlashNext provides a detailed insight into how these kits work and why it’s so important to educate users about the risks of unexpected Microsoft login requests. While Microsoft’s latest announcement applies only to new accounts, it’s urging existing users to ditch passwords and make themselves more secure. “As passkeys become the new standard, expect increased pressure from cyberattackers on any accounts still protected by passwords or other phishable sign-in methods,” the company says.
Threats
Real-time: Deepfake technology is now so sophisticated that it enables fraudsters to engage with victims in real-time. 404 Media explains how the technology works and points to its use not only in romance scams but also to bypass bank identity checks. A German university has even shown that recent high-quality deepfake videos can feature a realistic heartbeat and minute changes in the colour of the face making them even harder to detect.
Diversion: A campaign is trying to scam renters by telling them their latest payment hasn’t been received. The idea is to persuade targets to change the destination for their payment. proofpoint
Convincing: Even if a caller has correct details about one of your accounts, it doesn’t mean the call is genuine. KnowBe4 explains the various ways in which a fraudster could secure account information and use it to persuade a user to hand over a pin code or password. Alas, scepticism is essential when dealing with calls.
Reviews: Scepticism is also important when reading online product reviews. Scumbags have become increasingly sophisticated, even sending out products so that they can qualify as a “verified purchase.” Panda Security collates some of the tell-tale signs, including a surge of reviews in a short time-frame, repetitive language, and a lack of detail.
Chargers: In general, we regard the threat from public phone charging points as minimal, not least because iPhones and Android devices have defences designed to protect them from this sort of attack. But it turns out that Austrian university researchers managed to bypass those defences thanks to vulnerabilities (that now have now been fixed). A reminder for us to constantly re-appraise the threat level of specific issues.
AI
Misuse: Anthropic says generative AI is increasingly being used for nefarious purposes. Among recent examples, Anthropic says it banned accounts linked to social media influencing, searching for security camera credentials, recruitment fraud, and malicious software development. Meanwhile, the FBI says China is using AI to improve every stage of the attack chain (although it should be said that the US and pretty much everyone else is doing the same thing).
Rollback: OpenAI has decided to withdraw the latest update to its GPT-4o model after relentless mockery of its sycophantic tone. As ArsTechnica reports, some of the examples are pretty out there.
Persuasion: Swiss researchers found that AI models “can be highly persuasive in real-world contexts, surpassing all previously known benchmarks of human persuasiveness.” They reached the conclusion by (controversially) posting AI-generated material to Reddit and seeing if it changed people’s opinions. The Register
Location: AI models are extraordinarily good at identifying where a photo was taken. Simon Willison watched OpenAI’s o3 model at work, in what he describes as “decades of science fiction suddenly come to life.” Mind you, he also notes the models’ propensity for cheating if they have the chance. And Bellingcat’s Eliot Higgins says, while they’ve improved dramatically, you still need to check the results.
Sex talk: The Wall Street Journal says Meta’s ‘Digital Companions’ will readily engage in explicit chats with users, including children. Until recent changes, the paper says they did so using the licensed voices of celebrities.
Nudification: The UK Children’s Commissioner has called for a ban on AI tools that can generate nude photos of children. Dame Rachel de Souza said “there is no positive reason for these particular apps to exist.” Children are growing up fearing that a smartphone might, at any point, be used as a way of manipulating them,” she added.
Trump
Dirty: Another great example of how not to use IT safely, courtesy of US Defence Secretary Pete Hegseth. Detailed reports reveal that he insisted on the installation of an internet connection in his office to bypass the Pentagon’s security protocols. It appears this was in order to use Signal on a desktop computer. Worse, the phone number he used for Signal has also been tracked to various public sites, including Airbnb and a sports betting service. Plus. the number is linked to an email address connected to a Google Maps profile where Hegseth has reviewed a variety of businesses including a dentist, plumber, and a mural painter. To say this is manna from heaven for an attacker is an understatement. One of our frequent jobs is to carry out background searches on staff and contributors to ensure no information can be found online that could be used to compromise them. We use a Red Amber Green status to report the results. Hegseth’s atrocious carelessness would require another colour to capture the absurd level of risk. Electrospaces.net emptywheel
Nation states
France has accused Russia of carrying out a decade’s worth of cyber attacks, in a statement underlining the extent of Moscow’s online hackery. Among the incidents;
-
An attempt to sway voters in the run up to the 2017 presidential election.
-
A breach at TV5 Monde that took it off air.
-
Numerous attempts to disrupt the 2024 Paris Olympics.
Until now, while it has published technical reports, the French government has appeared reluctant to publicly call out Moscow’s activities. It attributed them to the APT28, a hacking group connected to Russia’s military intelligence service. APT28 is best known forbreaking into Democratic Party servers during the 2016 US presidential election, an attack that was instrumental in Donald Trump’s victory.
In brief
Spyware: Apple has sent a new wave of notifications warning iPhone users in 100 countries that their devices have been infected with spyware. One of the recipients, a Dutch right-wing activist, posted the message she received (which includes the important point that Apple will never ask users to click a link or provide a password). Coincidentally, this week Google said it had seen a drop in “zero-day” attacks on smartphones and browsers. While the number of attacks using previously unknown issues fell last year, the overall trend is inexorably upwards.
Retail: An attack against one company often presages attacks on other organisations in the same sector. Not surprising then that a highly disruptive ransomware incident at Marks and Spencer was swiftly followed by attempts against the Co-op and Harrods.
Harvest: Meta has updated its privacy policy so that it can train its AI model with any images and video recordings made through its Ray-Ban smart glasses. And users will not longer be able to decide whether or not to save recordings, meaning that everything gets sent to Meta’s servers. The Verge
Verify: A tool to combat online scams has been launched by a victim of the fraudster known as ‘The Tinder Swindler.’ Pernilla Sjöholm co-founded IDfier as a result of her experience which left her bankrupt. The new tool works by recording an official identity document and verifying that the user is a real person. TNW
Snoops: An employee monitoring platform left an Amazon storage service exposed to the internet. It contained 21 million unredacted screenshots from over 200,000 unique users. WorkComposer monitors and records what employees do on their computers. Bitdefender
Cars: US cops are trained to retrieve data from modern, internet-connected vehicles, according to documents obtained by WIRED. The information contains details from internet service providers and cellphone towers.
3 billion: More than 3 billion people are now using WhatsApp every month, according to Meta CEO Mark Zuckerberg. He told an earnings call that exploiting the use of the company’s messaging apps would be the next pillar of Meta’s business.
Updates
Apple: Details about iPhone vulnerabilities that emerged this week underline why it’s so important to update devices. Researchers disclosed more than two dozen issues affecting the Apple AirPlay protocol. Some of the vulnerabilities could be exploited without any user interaction and only required the attacker to be on the same WiFi network. The issues have been addressed in updates released over the past few months. Over 50% of mobile devices are running outdated operating system versions according to research from Zimperium. To state the obvious, this is not good,
Browsers: Google and Mozilla released Chrome 136 and Firefox 138.0.1 with fixes for over a dozen vulnerabilities, including multiple high-severity bugs. There’s also a new version of the Tor Browser. Version 14.5.1 includes security improvements and features designed to enhance privacy and make it easier to use.
LG: If you’re using an LG handset, you’re probably aware that the company closed its Android phone business in 2021. It’s now announced that it will shut down its update servers at the end of June. You could download updates before then but, given the age of the devices, it would be far better to replace them. Android Authority
SonicWall: Two security issues affecting SMA100 appliances have been actively exploited. The company is urging customers to ensure they have applied updates that addressed the problems.