The brave new world of AI. More details on the M&S data breach.
Signal blocks Microsoft's AI feature. Tracking a stolen iPhone to Shenzhen. And Chinese espionage in academia.
AI everywhere
We try not to cover products until they launch (because so many never do), but this week there’s a clear trend in artificial intelligence that’s worth highlighting. First, there was Google with its annual I/O developer conference which put AI front and centre - which is exactly where it figures in the company’s plans. Among the announcements, its Gemini assistant will take an even more prominent role in its search engine. US users can try out a feature that allows them to try on clothes virtually. Gmail will use AI to create personalised smart replies. Google Meet is adding real-time speech translation (with a short lag). Of course, the underlying aim is to keep people on Google’s services for as long as possible - and to drive up advertising revenue.
This week also saw OpenAI buy former Apple designer Jonny Ive’s startup for a cool $6.5 billion. The partnership aims to create a new AI product, described as a “core device” like the iPhone. According to The Wall Street Journal, “it will be capable of being fully aware of a user’s surroundings and life, will be unobtrusive, able to rest in one’s pocket or on one’s desk.” One Apple watcher suggested it could be as compact as an iPod Shuffle and worn round one’s neck. OpenAI says eventually it expects to ship 100 million of the devices a year.
Whatever happens to the specific products, the direction of travel is clear. The aim is to make AI central to everything, everywhere, all the time. In this context, the behaviour of Anthropic’s latest model is….interesting. In testing, engineers told Claude Opus 4 to act as an assistant for a fictional company. They gave it access to emails that implied it would be replaced with a new AI system, and that the engineer behind the change was having an extramarital affair. Claude Opus 4 promptly responded by threatening to reveal the affair if it was replaced. Anthropic says its findings resulted in activating safeguards, which are reserved for “AI systems that substantially increase the risk of catastrophic misuse.” If you have time, Anthropic’s (admirably frank) Safety Report is well worth reading. For a broader view of the risks of AI, MIT has created a database that tracks and classifies them. Prepare to be concerned.
Threats
M&S: If you’re one of Marks and Spencer’s online customers, do watch out for phishing emails. There are already reports that criminals are taking advantage of the recent cyberattack which provided them with all the details they need to create highly convincing lures. For companies, it’s worth noting that the origin of the breach appears to lie with a third-party contractor, reportedly Tata Consulting Services. M&S CEO Stuart Machin said the attackers pretended to be a supplier employee who needed their password reset. M&S says the incident would reduce this year’s profits by £300 million.
Leak: News has been coming in about a vast password leak that has exposed 184 million passwords, including login credentials for Apple, Google and Microsoft. The researcher who found the database containing the details says it’s unclear who created it or where the information came from. WIRED has more details but it would probably be prudent to change passwords for affected services and ensure that multi-factor authentication is enabled.
Zoom: A new phishing campaign is using urgent Zoom meeting invitations to try to steal login credentials. SpiderLabs says the campaign is sophisticated, uses pre-recorded video of participants and is designed to make the target believe the call has been disconnected, prompting them to try to re-authenticate via a fake pop-up.
Domains: Behind a simple domain name like google.com lies a spiders-web of subdomains, and many organisations fail to keep track of them. Infobloxexplains how attackers are taking advantage of this failure. It’s a complex technique but the bottom line is that it’s vital to manage subdomains and their records so they can’t be exploited.
KeePass: A fake copy of the password manager is being used to steal credentials and install ransomware on target networks. The malicious software is hidden within a version of the app that otherwise functions normally. Needless to say, downloading sensitive software like a password manager requires particular caution; never click on an advert for such apps and double-check a site to ensure it’s genuine. WithSecure
Crypto: With the value of a Bitcoin exceeding $111,000, it’s hardly surprising criminals will go to extraordinary lengths to steal them. Intelligence On Chain has the story of how a sophisticated scam fooled a cryptocurrency owner. He lost everything.
AI
Blocked: Secure messaging app Signal is warning users of its Windows desktop version that Microsoft’s AI Recall tool threatens the privacy of their messages. Recall works by taking a screenshot every three seconds so it can be indexed and searched. Signal says it has decided to block Recall from taking the screenshots, though users can change the setting if they want to.
Unlearning: US writer and deep thinker Neal Stephenson is worried about AI. “I follow conversations among professional educators who all report the same phenomenon, which is that their students use ChatGPT for everything, and in consequence learn nothing. We may end up with at least one generation of people who are…mental weaklings utterly dependent on technologies that they don’t understand and that they could never rebuild from scratch were they to break down.” via Simon Willison
Change: From hospital procedures to a hair salon, Bloomberg has eight snapshots of how AI is changing work in the US.
Reading list: Last Sunday the Chicago Sun-Times published ‘Heat Index,’ its guide to “the best of summer.” It included a list of suggested books. The problem; many of them were dreamt up by AI. The journalist responsible, who used to work for the syndication service involved, said he “just kind of republished this list that [an AI program] spit out.” Alas, it wasn’t the only hallucination in the guide. The Verge Sun-Times
Trump
Hacked: 410 GB. That’s how much data was obtained by the hackers who broke into Telemessage - the version of Signal that the Trump administration has been using. And it turns out that plenty of other high-profile organisations have been using it as well. Security researcher Micah Lee has a list of them. They include numerous government agencies, major banks, investment firms, and Washington DC’s police department. How any of them thought this was a good idea is baffling.
Recruitment: China and the UAE are among those hoping to profit from the US loss of government workers. China is doing it more or less surreptitiously through a network of front companies that are targeting the ex-employees. Zero Day says the UAE received Pentagon approval to approach to staff of the Defense Digital Service, who resigned en-masse last month.
In brief
Phones: We’re often asked what happens to stolen iPhones. Various investigations over the years have tracked many of them to a single building in the Chinese city of Shenzhen. The Financial Times is the latest to trace the circuitous journey of an iPhone stolen in London, and the huge criminal industry behind it. It’s a reminder that it’s critically important to be aware of your surroundings when using a smartphone in public and to enable the maximum protections on it. ZDNet
Cell: UK cellphone giant O2 misconfigured its 4G network so that it leaked device details and enabled users to be geolocated by simply calling their phone number. Mast Database
Coinbase: More gruesome details about the data breach at the largest US cryptocurrency exchange. Here’s a timeline to conjure with. In April, Coinbase changed its user agreement to limit class action lawsuits. The changes applied to disputes initiated after May 15. On May 14, Coinbase disclosed its data breach. It says it received an extortion demand related to the breach on May 11.
23andMe: A US pharmaceutical company has bought the bankrupt genomics firm for $256 million (or roughly $17 per account). Regeneron aims to use the DNA profiles of 23andMe’s customers to support its genomic drug research.
Refunds: A lawsuit in the US seems to have persuaded Amazon to start sending refunds to customers after initially refusing to give them their money back for returned items. The issue affected cases in which Amazon said it never received the returned product. Bloomberg
Criminal: Sweden has adopted a law criminalising the purchase of online sexual services, including sex chats and live video performances. Euractiv
Moscow: Russia’s lower house of parliament has approved proposals to mandate the use of a tracking app by foreign nationals in Moscow. If, as expected the upper house agrees, all foreigners will have to install an app on their phones which will record their biometric data, and monitor their movements in real time. State Duma
China: Turkish authorities have arrested seven Chinese nationals for using “IMSI catchers” to spy on mobile communications. The devices are designed to harvest details and communications from mobile phones. The targets appear to have been exiled members of China’s Uyghur minority and Turkish officials. Middle East Eye
Impersonation: And a Chinese intelligence operation has been uncovered at Stanford University. The Stanford Review says an agent had targeted students over an extended period, focussing primarily on women researching sensitive topics related to China. The paper says it’s just part of
extensive espionage activities at the university. There’s little doubt this reflects what China is doing at other academic institutions around the world.
Updates
Apple: A hasty update to fix problems with last week’s iPadOS release that affected older models.
Windows: Microsoft released an “out-of-band” (i.e. emergency update for Windows 10 to address an issue that left some machines stuck in a recovery loop. Meanwhile, a new feature for Windows 11 is designed to improve security by requiring additional authentication in order to run some administrator commands.
Tor Browser: Version 14.5.2 includes important security updates.