Cyber warfare. A Russian attack method to be aware of. AI use at work.
Trump's mobile scheme. A false alarm. Washington Post hacked. And WhatsApp introduces adverts.
War
There’s been relatively little media coverage of the cyber element of Israel’s offensive against Iran - but it has been a crucial part of the plan. Open Source Intel reports that a key element in the Israeli operation was to cripple Iran’s missile command structure. It quotes sources familiar with the operation as saying the initial phase included a targeted disinformation effort that triggered an emergency meeting of the Revolutionary Guard’s missile command. Once gathered in a fortified bunker, Israel attacked it with a precision airstrike that killed the entire senior leadership.
While the two countries have been trading missiles, researchers have been tracking a sharp escalation in cyber activity. Flashpoint says attacks targeting Israel increased by 700% and have ranged from destructive cyber operations to disinformation campaigns. For its part, Iran has been forced to cripple its internet connectivity in an attempt to slow down Israeli cyber operations. Despite this an Israeli hacking group has succeeded in creating havoc in Iran’s financial system.
Iran has toldcitizens to delete WhatsApp from their smartphones, alleging that the platform gathered user information to send to Israel. Iran provided no evidence to support the claim and WhatsApp insisted it doesn’t provide bulk information to any government. That said, spyware companies with Israeli origins do have a track record of exploiting flaws in WhatsApp on iPhones to infect targeted devices. It’s also true that while the content of messages is encrypted so that WhatsApp can’t access it, the metadata (or details surrounding a message) is not protected in the same way (see also WhatsApp below).
Threats
Russia: Attackers linked to the Russian government have been exploiting a little-known Google feature to defeat two-factor authentication and secure persistent access to Gmail accounts. The initial lure was a convincing email that appeared to come from the US State Department and was sent to prominent academics and critics of Russia. To lend it credibility, the message was copied to several fictitious “@state.gov” addresses. The Citizen Lab says, “We believe that the attacker is aware that the State Department’s email server is apparently configured to accept all messages and does not emit a ‘bounce’ response even when the address does not exist.” The aim of the message was to persuade targets to create an “App Specific Password” - these are used to enable Gmail to access services that don’t support multi-factor authentication. Citizen Lab says it expects this tactic to be seen increasingly often. As with all such attacks, the best defence is to ignore any request to create or share a password - no matter how convincing they seem - unless you’re sure you prompted it. Google
Points: A reminder that if you have a frequent flier account it’s essential to protect it and to be on the alert for scams. The BA Flyertalk forum has a long thread with sorry tales of people whose accounts have been raided after they received emails that looked almost identical to genuine ones. A unique password and multi-factor authentication are essential. In BA’s case, it also supports passkeys, which are by far the most secure form of authentication at the moment and should be used whenever they’re available.
SMS: At the oppposite end of the security spectrum lie authentication codes sent as text messages. These are a menace and should have been banned long ago. Any doubts about this will be dispelled by reports that a million such codes passed through a controversial Swiss company with links to government agencies and the surveillance industry. Bloomberg and Lighthouse Reports base their story on a whistleblower who told them the authentication codes included those sent by companies including Google, Meta and Amazon.
Research: A North Korean hacker group is using a booby-trapped research paper as a lure in a current campaign. The paper (purportedly about the Russia/Ukraine war) is attached to an email asking the target to review it. AnhLab
AI
Work: We know you know this, but take-up of AI tools at work is increasing - even when people know they shouldn’t be using them. Gallup has been tracking use of AI at work for the past two years, during which the percentage of US employees who say they use it occasionally has risen from 21% to 40%. Figures for frequent and daily use have also doubled (to 19% and 8% respectively). The Gallup research shows a huge gap between deployment of AI and guidance about how to use it. Meanwhile, a survey from GoTo suggests 54% of employees are using AI for “sensitive tasks or high-stakes decision-making…despite knowing they shouldn’t.”
Spam: Research suggests 51% of unsolicited email messages are now being created by AI. Barracuda and university researchers also found that generative AI is being used in targeted financial fraud (aka “business email compromise”) but that adoption there is far slower. In other words, the worst is yet to come.
Public: By default, the Meta AI app prompts users to post publicly in its Discovery feed. As TechRadar reports, that has led many people to reveal conversations with the app that most likely they didn’t intend others to see. Meta has added a popup warning about about this. Perhaps better to simply disable public sharing.
Obsessed: A 35-year-old man was shot dead by police in Florida after becoming obsessed with an AI entity being played by ChatGPT. Alexander Taylor charged at police with a knife after becoming convinced OpenAI had “killed” the entity. It’s one of a number of case studies pulled together by The New York Times which raise concerns over the interaction between vulnerable people and AI chatbots. As one researcher told the paper, “If people say strange things to chatbots, weird and unsafe outputs can result.”
Pokemon: A couple of researchers have been examining what happens when ChatGPT and ClaudeAI play Pokemon. The results demonstrate the impressive capability of AI models to solve complex problems. They also demonstrate a tendency to “panic” when confronted with a tricky situation. TechCrunch
Trump
Mobile: Donald Trump’s latest scam scheme to profiteer from the presidency appears to be a mobile phone plan. For just $47.45 a month + tax, subscribers will enjoy a 5G plan and a handset (colour = gold, naturally). The phone is billed as being “designed and built in the USA” which, as many observers have pointed out, would make it truly unique if it were true. The plan and the handset are due to be launched in September under a licensing deal with the Trump Organisation. CNBC
Visas: The State Department is restarting interviews for student visas with stricter social media rules, including a requirement to screen applicants’ social media accounts for hostility toward the US. This means the accounts have to be set to ‘public’ - something we advise against because of the risk to personal security. Washington Post
In brief
False alarm: Various reports have been circulating about a data breach involving around 16 billion login credential combinations. The numbers are stupidly large but the data isn’t new. The combinations come from previous breaches and have just been recompiled into a new format. What is worth noting is that the new format makes them easier to use, so a reminder to avoid reusing passwords and adopt a password manager if you don’t have one already. Bleeping Computer
Washington Post: The paper is investigating a breach in which attackers managed to compromise the accounts of several of its journalists. Among those affected were reporters covering national security and economic policy. The Post hasn’t provided any details about the attack but an internal memo suggested Microsoft accounts were compromised and a foreign government is suspected of being responsible. Bleeping Computer
Viasat: Satellite communications giant Viasat has become the latest victim of China’s Salt Typhoon cyber-espionage group, which has previously breached the networks of multiple US and global telecom providers. Viasat said it had investigated and “no evidence was found to suggest any impact to customers.” Mind you, it also said additional information on a government investigation was too sensitive to share publicly. Bloomberg
Mozambique: Predator spyware appears to be widely used by African countries with Mozambique becoming the latest country to adopt the product, according to research from the Insikt Group. The ongoing activity comes despite hopes that a combination of sanctions and public exposure would curb the activities of the Intellexa Consortium, the organisation that makes and markets Predator.
Air Gaps: Air gapping a computer means keeping it isolating it from the outside world. It’s used when security is the absolute priority, so it’s not surprising that people try to find ways to defeat it. The latest method to do so, identified by a researcher at Ben-Gurion University, involves ultrasonic signals emitted by the computer and a smartwatch which picks them up. So, more proof, if it were needed, that absolute security doesn’t exist.
Telegram: The messaging platform is useful for research but we’ve always advised against using it for confidential communications. That view is supported by news from the Organised Crime and Corruption Reporting Project which takes a close look at a Russian engineer who maintains many of Telegram’s servers. Merely a coincidence that he also has close ties to Russian intelligence.
Privacy: The UK information Commissioner has told manufacturers of smart home products to keep their noses out of people’s personal data. Citing everything from smart speakers to air fryers, the ICO says it is “closely monitoring compliance and [is] ready to act where corners are being cut or personal information is being collected recklessly.”
23andMe: The ICO has fined the genetics company £2.31million pounds for a “profoundly damaging breach that exposed sensitive personal information.” The regulator said 23andMe had failed to take basic steps to safeguard customer data. The breach in 2023 led to the company filing for bankruptcy protection. This week it said 15% of its customers had requested the deletion of their data. We’re surprised it’s not higher.
Updates
WhatsApp: It was only a matter of time. Meta says it’s adding advertising to the messaging platform. Adverts will be based on users’ activity on Facebook and Instagram but not on chats, the content of which is private but whose metadata decidedly isn’t. For the moment, advertising will be confined to the Updates tab. Incidentally, the Irish Data Protection Commission (which regulates Meta’s activities in Europe) says it has been told the changes won’t roll out in the EU until next year.
Microsoft: Last week’s updates included one that basically breaks most versions of Windows Server by preventing it from renewing IP addresses. Microsoft says it’s working on a fix and, for the moment, there’s no workaround other than issuing a fixed IP address. Meanwhile, there is a temporary fix for an issue that causes the classic Outlook email client to collapse when opening or starting a new message. It involves manually creating a temporary folder. The instructions are here.
DuckDuckGo: The privacy-focussed web browser has expanded its built-in Scam Blocker tool to protect against a broader range of online scams, including fake e-commerce, cryptocurrency exchanges, and “scareware” sites.
Zimbra: Emergency security update for Zimbra Daffodil 10.1.9, 10.0.15 and Zimbra 9.0.0 P46.
TP-Link: The US cybersecurity agency CISA has warned that attackers are exploiting a two-year-old vulnerability affecting multiple discontinued TP-Link router models. It’s the old story; once support for a device ends, so should your use of it.