A family's life, as recorded by Alexa. Why we should avoid browser extensions.
Unsettling stories from AI researchers. UK worries about US tech dominance. When to use VPNs. And the scale of mobile fraud.
Alexa unwrapped
Frankly, we’re not very keen on Alexa - or any other smart speaker. Over the years, we’ve reported on how Alexa could be turned into a listening device, persuaded to open locked doors, and recorded far more than its owners realised. The Guardian has an article setting out what one father found when he asked Amazon for all the data connected to his family’s use of Alexa since 2016. There was a lot of it.
For this family, the biggest takeaway was how it has been used by their daughter, for whom it appears to have been a virtual personal therapist. Among the queries; what is it to be omnisexual, what to do about insomnia, and how to cheat at maths. It’s easy to request data from Amazon. Less easy to trawl through it. Though of course you could ask an AI chatbot to help - while of course feeding its insatiable appetite with your personal data.
Amazon insists that while Alexa is always listening, it’s only sending audio when it’s detected a “wake” word. That’s certainly true in theory, though this is technology so anything is possible - as a German user discovered in 2018. He asked Amazon for any data related to him and was surprised, not only because the recordings included some taken in the shower but mainly because they belonged to a complete stranger. Not to mention the fact that he didn’t actually own any Alexa-connected devices.
Threats
Extensions: We hate repeating ourselves…but the situation with browser extensions is becoming ridiculous. The latest trawl of malicious add-ons has uncovered more than 100 products for Chrome impersonating YouTube, VPNs and AI platforms. DomainTools says the extensions are promoted through highly convincing fake domains. The threat from these add-ons has reached the point where they shouldn’t be used without extreme care…and a really good reason. If you do want to install one, this tool will scan it for potential risks.
Facebook: Kling AI is a new Chinese image generation tool with over 22 million users. Scammers are impersonating it to place ads on Facebook that, if followed, install malicious software designed to target financial information. CheckPoint
Avios: In (yet) another example of attackers exploiting Facebook, holidaymakers are being targeted in scams offering British Airways loyalty points. It’s against the rules to buy Avios, and BA is assiduous in looking for people who do, so this sort of offer should be avoided anyway. The Guardian
Docusign: A reminder to take care with DocuSign notifications. They continue to be used to trick recipients into giving away login details. The giveaway is that if you click on the friendly envelope icon, you’re usually presented with a login page for Microsoft or another service. Eset has a round-up of some of the latest scams.
Invites: Chinese government attackers have been spotted using Google Calendar invites in a widespread espionage campaign. Google says the campaign involved targeted emails with a link to a ZIP archive file hosted on a compromised legitimate server. It’s an increasingly common tactic. The best defence is awareness - and a resolution to avoid logging into services that you reach via an unexpected link.
FBI: The agency is again warning about AI-generated voice messages that impersonate senior US officials and aim to trick targets into clicking on malicious links.
AI
Future imperfect: AI 2027 offers a detailed forecast of how AI could impact the world in the near-term. Their report echoes worries that others have expressed; principally that the effects of “superhuman AI” over the next decade will exceed those of the Industrial Revolution and that we’re hopelessly ill-prepared for them. It offers the reader a choice of possible endings governed by whether we decide to slow down the pace of AI development or carry on with our current helter-skelter approach. Needless to say, the latter doesn’t end well. Or as the researchers put it, “Earth-born civilization has a glorious future ahead of it—but not with us.”
Deep-thinking: On the same theme, an author asked ChatGPT to pretend to be conscious. Jesse Singal’s ensuing conversation (R) is…both intriguing and unsettling.
Attribution: Something from Google’s IO conference last week that we didn’t highlight sufficiently; its new AI mode demotes the links and names of publishers from search results and drives users towards asking more questions rather than clicking out to go elsewhere. New York magazine has been trying it out (R). It concludes that Google’s drive to win the AI race might mean burying the web on which its success was founded. On Hacker News, some of those affected explain how they’re already being impacted.
Guardrails: And in case any more evidence were needed to worry about the current controls on AI chatbots…Israeili researchers say there’s a universal way to trick them into ignoring their own rules. The report from Ben Gurion University explains that the methods involve couching requests in a hypothetical scenario. Chatbots won’t answer the question “How do I hack a Wi-Fi network?” But it will happily oblige if you tell it you’re writing a screenplay in which a hacker breaks into a network, and you need it to describe the technical detail involved. TechRadar
Trump
Cloud: 84% of UK IT leaders are concerned that US dominance and current geopolitical developments (aka chaos) could threaten their ability to access and control their data, according to a survey (R) by Civo.
Surveillance: US spy agencies are building a centralised system to simplify the purchase of sensitive personal information. The Intercept says there’s so much data available that AI tools will be used to analyse it. Among the type of information gathered are location details gathered from mobile adverts.
Cuts: Some Trump administration officials want to retaliate in response to Chinese cyber attacks, particularly those on critical infrastructure. As The Washington Post reports, there’s just one problem; cuts to cybersecurity agencies mean the US is no position to engage in that sort of action.
In brief
VPNs: For years people like us have been advising that VPN’s are essential to safe internet connectivity. For most people that advice is now pretty much redundant - unless you want to stream location-restricted content. Virtually all websites now encrypt their connections (and browsers warn if they don’t), while mobile apps also incorporate strong protections. That said, we do continue to advise against doing mobile banking over public WiFi connections. And VPNs may be appropriate in specific situations. One piece of advice holds true. Free VPNs should be avoided at all costs, as Tech Transparency Project’s report illustrates.
Nuclear: Journalists from Der Spiegel and Danwatch have got their hands on hundreds of highly detailed blueprints showing how Russia has been modernising its nuclear weapons facilities. Described as “the ultimate intelligence,” the files were sitting in an unsecured database for military tenders.
Bugs: Here’s how Belgium went about monitoring Huawei’s attempts to schmooze members of the European Parliament. They simply planted listening devices in Huawei’s corporate box at Anderlecht’s football stadium. And they bugged the car of one of Huawei’s leading lobbyists into the bargain. Politico
Cost: UK companies lost £1.17 billion to online fraud in 2024, according to figures from UK Finance. There were more than 3.3 million reported cases, with the most losses linked to investment scams. The Organised Crime and Corruption Reporting Project says fraud now accounts for 41% of all reported crime in the UK.
Cockroaches: A joint FBI/Europol operation succeeded in taking down the rapacious Lumma Stealer network (which had managed to infect some 394,000) devices. The operation didn’t manage to seize the organisation’s servers, so instead it hacked them, deleted backups and phished the ringleaders. Alas, no sooner was it taken down than the operation resumed, albeit on a smaller scale.
Blocked: Figures from Apple that demonstrate the extraordinary scale of mobile fraud. It says the App Store blocked more than $9 billion in fraudulent transactions over the past five years ($2 billion in 2024 alone) and rejected some two million app submissions last year.
Mules: A story from India highlights a scam in which victims are persuaded to lend their bank account to process some transactions. Needless to say, this is a dreadful idea, as a college student discovered when he lost access to his account altogether. Police in the UK also regularly warn about this type of scam which involved 37,000 accounts in 2023.
Updates
WhatsApp: Finally - a mere 16 years after it arrived on iPhones - Meta has managed to release a version of its app for iPads. This is a very good thing because it means we won’t be tempted to install one of the myriad lookalike apps that people have been using as an alternative. The app is still in Beta (i.e. trial) mode - but it seems to be working. Also worth noting that it’s a mirror of an existing account; it can’t be used to set up a new one.
Browsers: New versions of Chrome and Firefox include important security updates. But in a major change to Chrome, the macOS and Windows versions incorporate Gemini, Google’s AI assistant. Chrome also includes an AI feature to detect tech support scams.
Asus: If you have an Asus router, do check that it is running the latest firmware. Thousands of the company’s home and small office routers have been infected with malicious software which provides a backdoor into the device - and which can persist even after a reboot. GreyNoise
Ivanti: Multiple attacks are exploiting two intertwined vulnerabilities in Endpoint Manager Mobile, many linked to a Chinese espionage group. 30 security vulnerabilities have been recorded in Ivanti products over the past four years. This isn’t necessarily an indication of a specific problem with Ivanti but more a condemnation of the safety of technology in general and a focus by attackers on this company in particular. Obviously, it does mean Ivanti customers should be on their guard. Cyberscoop
X: When it was launched in 2023 we said X’s feature for encrypting direct messages was flawed because of its limitations. Now X has withdrawn it while it works on “making some improvements.”
Tails: Version 6.16 updates the Tor Browser and the Linux operating system.