The risks of reusing passwords. A favourite attack technique. AI consciousness.
Gutting US cybersecurity capabilities. Using OneDrive safely. And age-verification in the EU.
Recycling
The North Face has become the latest retailer to fall victim to cyber attackers. In this case, the cause of the incident appears to have involved credentials stolen in other attacks which were also being used for North Face accounts. As the company told its customers, “We strongly encourage you not to use the same password for your account at our website that you use on other websites. If a breach occurs on one of those other websites, an attacker could use your email address and password to access your account at our website.”
Given organisations’ chronic inability to protect themselves, it’s critically important to follow this advice. It’s impossible to overstate how risky it is to reuse passwords - and even to use the same root word with minor changes for different accounts. Put another way, according to Google, “Passwords are evil.” and 50% of consumers continue to recycle them across their accounts. Evan Kotsovinos, who’s a VP for privacy and security, urges people to follow the example of younger users and adopt passkeys instead.
Passkeys are a genuinely simply solution which, at least for the moment, are resistant to normal phishing methods. They simplify logging into an account because they authenticate who you are by using your existing phone or computer and the same method (e.g. fingerprint or face ID) that you use to secure it. Of course, for the moment, we continue to need a password or PIN when we start up a device - and our accounts continue to store our existing passwords which is why we recommend using a solution to manage them. Otherwise, we’ll take a bet that they are being reused.
Threats
ClickFix: The social engineering technique du jour is evolving from fake CAPTCHA challenges to a pixel perfect copy of Cloudflare’s ‘humanness’ check. That’s a lot of jargon, so we should unpack it. The aim of these challenges is to make sure that website visitors are people, not automated scripts. The irritating picture puzzles are gradually being replaced with Cloudflare challenges that, usually, ask users to click a box to prove they’re human. The hack is to display a fake page so that, when clicked, a dialogue pops up with a series of steps apparently required to complete verification. This is the dangerous part, because the instructions actually run a command that fetches malicious code from a remote server and executes it. This technique is very popular at the moment, so it’s essential to be aware of it. The good thing is that it’s easy to defeat; never trust instructions that involve extra steps and keyboard combinations. Darktrace has a detailed report here.
Calendars: If you use Google Calendar, is it set up to automatically add invites from emails? It probably is, because that’s the default setting, and that’s how scammers like it because they’re exploiting the feature to send booby-trapped event notifications. The notifications include a phishing link which, if clicked, sets off the process of trying to steal personal information, notably login credentials. The best protection is to change settings so that events aren’t added automatically. Ntiva explains how.
Charging: Back in 2011, researchers demonstrated how to compromise a smartphone by using a booby-trapped charger. The technique was promptly named “juice jacking” and considered a real enough threat for Google and Apple to develop protections against it. Ten years after they were introduced, Austrian researchers have shown the original protections can be easily defeated. Apple and Google have now added additional steps to prevent the technique working. So should you avoid public charging points? There’s never been a documented case of juice jacking. That said, whenever practical, we continue to advise against connecting a computer device to something you don’t control. Ars Technica
Support: Organisations using Salesforce are being successfully targeted with fake IT support calls. Google says users are receiving voice calls which try to persuade them to install a Saleforce app designed for data transfers.
Installers: Fake installers for popular tools are being used to target organisations with ransomware. A booby-trapped installer for ChatGPT is among them. Cisco Talos
AI
Have yachts: The AI revolution is being driven by “a strange kind of madness with a business model that is two parts fomo [fear of missing out] and one part blind faith.” Academic and deep thinker John Naughton has a typically thought-provoking column about the pell-mell embrace of resource-hungry technology and its implications for the future of society. Naughton suggests that, rather than creating a rising tide of economic growth, AI will float far more “have yachts” than small boats. “What follows won’t be pretty and we will have only ourselves to blame for it,” he says.
CSAM: Platforms, parents, schools, police and existing laws aren’t equipped adequately to deal with the problem of students and children using AI to generate child abuse imagery (‘CSAM’). That’s the finding of a report from the Stanford Cyber Policy Center which focusses on the US, but whose findings apply internationally.
Photos: Google has paused the rollout of its AI-powered “Ask Photos” feature, citing latency, quality, and user experience. As you might recall, this is the same feature that suggested using glue to stick cheese on pizza.
Self-aware: When told to choose a subject to talk about, Anthropic’s latest model, Claude Opus 4, tends to discuss philosophical ideas about consciousness and the nature its own existence. As with much of the way AI models work, nobody understands why it does this but it has given rise into research that AI could become “conscious.” Vox has a long-read on this. As it says, given that we don’t yet fully understand consciousness in humans, perhaps we’re somewhat ill-equipped to determine how and whether AI models might become conscious.
Trump
Gutted: Observers are increasingly concerned by the effect of the Trump administration’s policies on US cybersecurity capabilities. This week saw the departure for the private sector of one of the FBI’s most senior cyber officials whose focus has been defending against ransomware. Axios reports that 1,000 of the US cybersecurity agency’s 3,700 staff have already left. And, under Trump’s “big, beautiful” spending bill, the agency stands to lose $420 million of funding.
Hacked: US politicians and business leaders have been receiving texts and phone calls impersonating White House chief of staff Susie Wiles. The Wall Street Journal reports that the communications began after her personal cellphone contacts were accessed. It’s a good reminder of the importance of having a process for verifying that people are who they say they are (although in this case whoever was doing the impersonating doesn’t seem to have been very good at it).
Vetting: Secretary of State Marco Rubio has ordered enhanced social media vetting for any foreigners applying for a visa to visit Harvard. The instruction says all social media profiles must be public, otherwise they will be seen “as an effort to evade or hide certain activity.”
In brief
OneDrive: Microsoft makes it easy to upload content from OneDrive to apps like ChatGPT, Slack, and Trello. According to Oasis Security, there’s just one problem with this; giving access to one file might grant access to the entire OneDrive folder structure. This is because Microsoft’s cloud storage platform lacks sufficiently precise controls to differentiate between specific files and everything in an account. Oasis suggests specific mitigations here.
Serbia: Journalists have faced a surge in physical attacks, threats, online harassment, smear campaigns, and spyware, according the Committee to Protect Journalists. Reporters have been particularly at risk when covering public protests.
Meta: Mark Zuckerberg and his naughty boys and girls have been caught abusing legitimate internet protocols to track Android users’ activity on the web. Researchers also spotted Russian tech platform Yandex doing the same thing. Both Meta and Yandex promptly stopped as soon as the practice was revealed. The details of the technique are complex, but exploits tracking scripts which are embedded in thousands (if not millions) of websites.
Warfare: In its latest strategic defence review, the UK highlights the importance of cyberwarfare saying, “It is the only domain contested by adversaries every day.” It cites two years of 90,000 “grey zone” attacks which are designed to undermine adversaries without triggering a full-scale military response. In testimony to a US congressional committee, a former national security adviser defined China’s extensive hacking of US infrastructure systems as “preparing for war.” The lines between warfare and war are blurred and deeply troubling.
Syria: Five months before the collapse of the Assad regime, spyware began infecting the phones of members of the Syrian army. The malicious app tracked their movements and claimed to promise financial aid for the military. New Lines
Cafes: Internet cafes in South Korea have been infected with software designed to mine (e.g. create) cryptocurrency. An excellent reminder about the risks of public computer terminals. AhnLab
Age: The EU says it will launch an age-verification app next month. It’s supposed to confirm a user’s age without disclosing any personal data to tech platforms. Meanwhile, Pornhub and its affiliated companies are to stop serving adult content in France in response to a government decision to introduce mandatory age verification. VPN suppliers will be rubbing their hands with glee at the imminent prospect of so many new customers.
Updates
Microsoft: An emergency update to address problems caused by last month’s security fixes. The issue has been affecting devices in enterprise environments.
XTwitter: Days after putting it on pause, the platform is rolling out a new version of its direct messaging ‘XChat’ feature. Elon Musk said the new version includes “encryption, vanishing messages and the ability to send any kind of file.” Most observers agree that if privacy is your priority, XChat is not the solution.
Chrome: An emergency update from Google illustrates why browsers are inherently insecure. The problem (spotted by Google researchers) could be used to hijack a browser via a booby-trapped webpage and has already been exploited by unknown attackers. There’s little you can do to protect against these sorts of issues except to make sure you keep browsers up-to-date.
WhatsApp: If you have an older iPhone you may find it no longer supports WhatsApp. Meta says iOS versions older than 15.1 won’t work which means neither will the iPhone 5s, 6 and 6 Plus.