A £64 billion threat but businesses remain unprepared. SMS scams.
Zuckerberg's vision for the future of AI. Another security lesson from Mr Waltz. Microsoft tells Authenticator users to export their passwords...or else. Spyware maker fined $167 million. And the world of "kidfluencers.
Unprepared
Despite the annual cost of cyber attacks to UK businesses reaching £64 billion there’s a global failure to prepare for an incident. In one of the latest high-profile cases, Marks and Spencer denied claims by an insider that it didn’t even have a business continuity plan. If there was a plan it wasn’t very effective given that M&S’ online business remains “paused” two weeks after news of the attack emerged. More generally, while ESET research shows 59% of UK business have basic or advanced government cybersecurity certifications, that obviously leaves a vast number who don’t. And the government schemes don’t require a continuity plan anyway.
Although some details of the attacks on UK retailers remain unconfirmed, it appears that IT help desks were central to the incidents at both Marks and Spencer and the Co-op. Reports say the attackers pretended to be employees asking support staff to reset their network credentials. Clearly, they succeeded. This tactic also works the other way round, with attackers contacting employees as if they’re from IT and asking them to call back to fix a problem with their account. The scammers then install remote management software which gives them access to the user’s account.
The UK cybersecurity agency has issued advice to combat these types of attack but it comes down to having cast-iron processes for password resets and user verification. Just as with fraudulent payment scams, these attacks can only work if procedures are non-existent or ineffective…or if they’re not followed. Likewise, as the figures demonstrate, even with secure processes and excellent education, incidents will happen so it’s essential to be prepared for them.
Threats
SMS: A single phishing platform managed to steal 884,000 credit cards from 13 million clicks in just seven months in 2023 and 2024. A multi-national investigation says the platform sent text messages impersonating common brands such as parcel delivery services. Netcraft says the platform has now started using generative AI which enables it to create custom scams exploiting any brand in almost any language. The lesson; never click on links you receive to do anything important. NRK
Recruitment: North Korea’s tactic of infiltrating the IT workforce is now a threat for every industry, according to Palo Alto Networks. It cites the case of one of its clients who found that 90% of the applicants for a vacancy were North Korean. While in some cases the aim is to gain access to steal funds, in many instances North Korea is simply using the tactic as a way of earning much-needed foreign currency. The Record
Mac: A campaign has been using some 2,800 compromised websites to lure visitors into installing malicious software on their devices. The campaign is sophisticated and involves displaying a reCAPTCHA challenge exclusively to macOS users. Engaging with the challenge leads to a prompt to run a Terminal command. The campaign may be sophisticated. Preventing it is simple. Never run a terminal command without a very good reason. BadByte
Routers: The FBI is warning companies and consumers about the risk of routers that are no longer supported. It says attackers are exploiting old and outdated devices and they should be replaced.
Mystery: We’ve come across a few cases of the “mystery box” scam. This involves persuading people to sign up for a regular delivery of mystery items, usually related to a common brand or theme. This either enables the scammer to obtain financial details, or commits the victim to making recurring payments that can be nigh impossible to cancel. Bitdefender
AI
Shades: Recent photographs of Mark Zuckerberg invariably show him wearing a pair of Meta’s Ray-Ban branded glasses (not a great look, in our view). He’s been on a media tour to promote his vision for the future of AI - and specifically the new Meta AI app. (You may have already noticed this squatting awkwardly in your WhatsApp screen.) Vox examines Zuckerberg’s ambitions and the “privacy minefield” involved. It also concludes that resistance is probably futile.
Fluent: We used to be able to spot phishing emails because of their spelling and grammatical errors. Now the opposite is true, according to Sophos. If a message is perfect, it’s probably because it was written by generative AI because…to err is human. The Register
Agents: Microsoft is introducing the use of AI agents in Windows 11. In English, that means users will be able to tell Settings what they want it to do. For example, if you want to make a font bigger in theory the AI agent will do it for you. Or at least it will if you have a Windows Insider Copilot+ PC and you speak English. We mention this mainly because almost certainly this is a glimpse into how we’ll interact with our devices in the future.
Secret: 52% of employees are using AI at work, almost double last year’s figure, but a third of them are hiding from their bosses. A survey by Ivanti found that 36% concealed what they were doing to give them a “secret advantage” while 30% worried that being honest might cost them their job. We suspect the real figure for AI use is higher and so it’s essential to have a policy to deploy it securely. (Ivanti’s report also has interesting insights into technology at work in general.)
Fantasists: Rolling Stone has collected case studies of individuals who have formed intense relationships with AI chatbots, in some cases at the cost of their human relationships - and their grip on reality.
Trump
Hopeless: No sooner was (former) US National Security Adviser Mike Waltz photographed using a modified version of Signal than a hacker succeeded in breaking into it. The aim of using the TeleMessage app appears to be to ensure Signal messages are archived. Just one problem, unlike Signal, TeleMessage doesn’t encrypt them so that only the sender and receiver can read them. But hey, Waltz was only communicating with the most senior figures in the administration. 404 Media
Lessons: There are multiple lessons from the Trump’s clown circus but the TeleMessage debacle is a reminder to avoid modified versions of secure apps. They’re almost invariably unsafe and even if they’re OK today, that’s no guarantee they’ll be safe tomorrow. The other key lesson is that people will do stupid things, especially if they’re in positions of power. Plan and educate accordingly.
Database: The “Department of Government Efficiency” is amassing personal information about millions of citizens and residents in order to create a centralised database to support White House policies, according to reporting by The Washington Post.
Cuts: US cybersecurity capabilities are being gutted as a result of White House actions. The Record says up to 2,000 jobs are to go at the National Security Agency. Key cybersecurity experts have decided to take the option of retirement from the National Institutes of Standards and Technology. And President Trump has proposed major cuts to the US cybersecurity agency’s budget, citing false claims that conservatives are being “censored.” Unfortunate timing, given that the administration says it plans to normalise the use of offensive cyber operations as a tool of national power.
Passwords
Following the announcement that retail users will no longer be able to use passwords for Microsoft services, it now says its Authenticator app will stop supporting them. The decision means 75 million Authenticator users will have to export their passwords by August 1 or face losing them. Instead of its app, Microsoft is promoting its Edge web browser as the means to store and fill in passwords automatically on websites where they’re still required. While moving away from passwords is a thoroughly good thing, promoting a web browser as a password manager is not. Browsers are a constant target for attackers and are now so complex that they’re inevitably riddled with vulnerabilities that require endless updates. While we still need to use passwords, a standalone service is the least worst option to manage them.
In brief
Spyware: Some good news. the NSO Group has been ordered to pay $167 million in punitive damages to WhatsApp for a hacking campaign against more than 1,400 users. WhatsApp had only asked for $444,719 but a California jury found that NSO had engaged in “malice, oppression or fraud” and should be punished accordingly.
Deepfakes: And some other good news. A joint investigation has identified a key administrator behind a notorious deepfake porn site. He turns out to be an apparently respectable Canadian pharmacist living with his family in a Toronto suburb. Bellingcat and its partners discovered that in fact he was a central figure in the MrDeepFakes site which hosted videos of women whose faces had been superimposed on hardcore pornography actors.
Long game: Hackers waited six years to activate secret backdoors they planted in up to 1,000 Magento web stores, including one belonging to a $40 billion multinational. Sansec says the initial compromise involved popular ecommerce software from Tigren, Meetanshi and MGS.
Disinformation: Analysis of 135 Russian disinformation posts reveals that all but one of them were pretty pointless. However that one went viral and so the campaign will have been seen as an overall success. The post (which attracted 4 million views) said USAID had paid celebrities to travel to Ukraine. The Institute for Strategic Dialogue says AI makes disinformation so simple and cheap to produce that we should expect to see even more of it. Meanwhile, France has published a detailed report on Russian operations, calling them “a significant threat to French and European public debate.”
Gruesome: The world is witnessing the “severed fingers and abductions” stage of the cryptocurrency revolution, according to media reports collated by Ars Technica. The gory details include a man being abducted in Paris who was rescued but only after one of his fingers was cut off, and a British man who escaped by jumping off a 30 foot high balcony. In these and other cases either the victims or a close relation had significant crypto holdings. These aren’t the first such incidents but we haven’t seen so many in such a short time.
Kidfluencers: There’s a growing trend of child social media influencers who are using platforms like TikTok to market “get rich quick” schemes to other children. Rest of World reports from Brazil on the youngsters and the platforms allowing them to ply their trade.
Updates
Microsoft: Outlook is getting new controls to crack down on bulk email campaigns. The features require strict adherence to DKIM, DMARC, and SPF security standards. They’ll affect any domains sending more than 5,000 emails per day to Outlook users.
SonicWall: Another warning about yet more vulnerabilities affecting SMA 100, 200, SMA 210, SMA 400, SMA 410, and SMA 500v devices. SonicWall is urging customers to apply updates because at least one issue is already being exploited.
Cisco: Updates to address 35 vulnerabilities across a range of products.
Ubiquiti: Important update for UniFi Protect Cameras to fix a maximum severity vulnerability.