M&S users face prospect of perfect phishingattacks. Booby-trapped invoices.
Failing to secure AI use. US steps up border surveillance. And a cryptocurrency exchange's epic fail.
Retail
Following attacks targeting the UK retail sector, Google is warning that similar companies in the US are now being targeted. Google’s Threat Intelligence Group said, “These actors are aggressive, creative, and particularly effective at circumventing mature security programs,” adding “they have had a lot of success with social engineering and leveraging third parties to gain entry to their targets.”
Three weeks after news of the attack on Marks and Spencer emerged, its online business remains “paused” and it has belatedly admitted that customer data was stolen in the incident. “For extra peace of mind” customers are being forced to reset their passwords. Not so calming is the amount of information that may have been stolen, including names, birth dates, phone numbers, home addresses, email addresses, and online order histories. In other words, exactly the sort of detail that enables a scammer to craft an almost perfect phishing lure. M&S customers should be on their guard.
There’s still no clarity about how the attackers compromised M&S, although there have been widespread reports that “SIM-swapping” was involved. SIM-swapping works by persuading a mobile provider to issue a new card without the customer’s consent so, theoretically, it could have been used to impersonate an employee. New figures show the UK experienced a 1,055% rise in unauthorised SIM swaps in 2024 compared to the previous year. It’s essential to implement the maximum possible security on mobile phone accounts, including activating multi-factor authentication wherever available. Whether SIM-swapping was actually involved in the attack on M&S is unclear. The origin for stories appears to be The Times whose report ($) fails to provide any source for its claim.
Threats
Invoices: A sophisticated campaign has been abusing a legitimate Spanish email service to defeat security checks and deliver booby-trapped invoices. The emails come with a request to review the invoices. If they’re opened, the viewer is then asked to click a button to fix an error in displaying the attachment. It’s vital never to be fooled by this type of prompt which is the reddest of red flags. Fortinet
Tariffs: The Trump tariff saga is providing fertile ground for crime groups who are targeting shoppers looking to avoid higher prices. Forcepoint says fraudsters are creating multiple fake online stores that offer popular brands at huge discounts. The websites can be convincing. When an offer looks too good to be true…
Browsers: Add-ons or extensions are now virtually ubiquitous among employees but LayerX says the security risk they represent isn’t properly understood. While LayerX is obviously trying to flog its security products, its report does highlight an issue that we frequently cover. The combination of browser vulnerabilities and the access extensions require in order to work creates a significant threat, and LayerX’s report provides some useful advice - not least to audit what people are using.
Vintage: Russia has been breaking into high-value mail servers by exploiting a type of vulnerability more commonly used in the past. The issue, known as XSS or “cross-scripting,” results from screw-ups in the software that powers web servers; it allows attackers to compromise browsers when they visit an affected website and it first came to prominence in 2005. ESET says the affected platforms are Roundcube, MDaemon, Horde, and Zimbra. Security updates addressed the exploited issues but it appears compromised organisations failed to apply them.
Fake: The FBI says attackers have been using text messages and AI-generated audio to impersonate senior government officials and trick their colleagues into providing access to their personal accounts. The Bureau has told the public, “if you receive a message claiming to be from a senior US official, do not assume it is authentic.”
AI
Security: Another warning about the need to place security at the centre of how AI is being used in organisations, this time from the UK cybersecurity agency’s annual conference. When attendees were asked to raise their hands if they genuinely felt they had a good grasp of the security risks of AI, not a single one was raised. As The Register’s report points out, this is a particular risk for smaller companies as they deploy AI solutions to compete with larger organisations.
Choices: OpenAI CEO Sam Altman says younger ChatGPT users are relying on it to make key choices about their lives. “They don’t really make life decisions without asking ChatGPT what they should do. It has the full context on every person in their life and what they’ve talked about,” he told an AI conference. He also said the eventual goal for ChatGPT should be to record every detail of a person’s life. TechRadar TechCrunch
Brevity: Telling an AI chatbot to be concise can make it provide fake answers (“hallucinations”), according to a study from a French AI-testing company. Giskard says requests for shorter answers particularly affect questions about ambiguous topics.
Rehiring: Financial services giant Klarna says its use of AI to replace human customer support has gone too far and so it’s started to recruit people again. “I just think it’s so critical that you are clear to your customer that there will be always a human if you want,” Klarna’s CEO said.
Trump
Photos: US Customs and Border Protection (CBP) plans to photograph everyone who leaves the US by car, the agency told WIRED. CBP already uses “biometric facial comparison technology” for people departing from 57 US airports, including Atlanta, New York JFK, Dallas-Fort Worth and Los Angeles LAX.
Jet: President Trump’s proposal to accept a luxurious jumbo jet from Qatar is the biggest example (so far) of his administration’s wilful disregard for basic security standards (and its frail grasp on reality). It’s so dangerous because it reinforces the notion that security requirements simply don’t apply to some people - or that they’re not necessary. If the plane were to be used for presidential travel, the required modifications and checks wouldn’t be complete before the end of Trump’s term in office. Bloomberg Reuters
Grants: The Trump administration has canceled grants for studies focused on online censorship and disinformation. The New York Times says officials claim the research has resulted in the censorship of conservative views. Among the projects affected are tools to evade Chinese internet controls and a mechanism to detect AI-generated videos and photos.
In brief
Passkeys: This year has seen more and more talk about “passkeys” and the death of the password. There’s just one wrinkle. Passwords aren’t dead yet and that creates a problem for passkeys. As KnowBe4 points out, for accounts that support passkeys, the chances are that we previously used a password to access them. And that password still works, which means all the existing recommendations about passwords (long, strong, unique) still apply. As does the need to use multi-factor authentication. KnowBe4’s article has a good explanation of how passkeys work, why they’re worth adopting, and also why we should all be using a password manager, even with passkeys.
Settled: Google is to pay Texas $1.375 billion to settle two lawsuits brought by the state. They accused Google of tracking users’ geolocation, recording incognito searches, and collecting biometric data.
Identity: Wikimedia has filed a lawsuit in the UK over a new law that will require it to verify the identity of its users. Wikimedia says the Online Safety Act will endanger the privacy and safety of users, especially those at risk from hostile governments.
Cancelled: When is a lifetime subscription not for life? When it involves a VPN provider that has new owners. Customers have been taking to social media to complain that Lifetime Deal accounts for VPNSecure have been deactivated. The new owners say they didn’t know about the subscriptions when they bought the company and so they can’t honour them. Ars Technica
App Store: Apple is furious about being forced by the EU to allow developers to bypass its App Store payment system. A measure of its ire can be seen in what appears to be an effort to scare customers who don’t use Apple’s solution to pay for apps. The tactic involves the use of a red warning triangle that the company itself advises should only be used to advise about “critical” events. And that definitely does not apply in this case.9to5Mac
Capture: Microsoft is to add a new feature to Teams messenger to stop users taking screenshots during meetings. Prevent Screen Capture will turn the meeting screen black when a user tries to take a screenshot. This sort of protection is useful, but as with all such features there’s nothing to stop people simply photographing the screen.
Exchange: Coinbase is the largest US cryptocurrency exchange and it’s facing costs of up to $400 million due to a cyber attack According to Bloomberg, hackers suborned so many customer service representatives that for most of this year the attackers had virtually “on-demand” access to some of the company’s most valuable customer data.
Updates
Microsoft: Fixes for at least 70 security issues in its monthly update, including five “zero-day” (previously unidentified) vulnerabilities that Microsoft classifies as “exploitation detected.”
Apple: Security updates across the full range of Apple products and they’re important because they address multiple vulnerabilities, more than 30 in the case of the iPhone. The updates also cover older software versions.
Patch Tuesday: As with Microsoft and Apple, there are important monthly updates from Adobe, Microsoft, SAP, Ivanti, Fortinet, Supermicro, Intel, AMD, Arm, Zoom, Dell, ASUS.
Google: A new security feature in its Chrome browser is designed to detect and block scams offering fake technical support. This type of attack involves a website that displays a prompt designed to trick the user into thinking their computer has been compromised in some way. Google is using its large-language AI model to stop the scams. It follows a similar move by Microsoft in January.
SecureDrop: Workstation 1.2.0 and SecureDrop Client 0.15.0 include better printing support and download progress bars.
Zimbra: Daffodil 10.1.8, 10.0.14 and Zimbra 9.0.0 P45 address security vulnerabilities as well as some minor usability improvements.