A ceasefire between Iran and Israel, but not in cyberspace. Hijacking search for support.
AI and employment. Privacy and personal safety. And the risks of public WiFi.
War
While a kinetic ceasefire holds, we wait to see what impact US and Israeli attacks on Iran will have in cyberspace. There have been multiple warnings about possible Iranian retaliation, including from the US Department of Homeland Security. As a former cybersecurity agency head warned, “Iran has a track record of retaliatory cyber operations targeting civilian infrastructure, including: water systems; financial institutions; energy pipelines; government networks and more.” There’s little doubt Iran has those capabilities though it’s improbable they would deploy them at the moment. To underline the potential threat to critical infrastructure, this week news emerged of an attack in April when unidentified attackers accessed the systems of a Norwegian dam and opened its valve at full capacity (without causing any damage).
Meanwhile, the Israeli government told citizens to turn off their security cameras, saying Iran was hacking them and using them to adjust missile targeting. The warning echoes similar concerns in Ukraine and, given the fragile security of many security cameras, such caution is well-founded. Israel has also expanded the powers of its cyber directorate and internal security service; a decision it promulgated by WhatsApp. CheckPoint says Iran’s Islamic Revolutionary Guard Corps has embarked on a phishing campaign targeting Israeli journalists, cybersecurity experts, and computer science professors. The campaign uses emails and WhatsApp messages which appear to come from real Israeli cybersecurity firms.
Researchers at CyberKnow have created a page to track all the hacktivist groups involved in the aftermath of the missile and air attacks. Currently, the total number is 119, most of them supporting Iran though, as the tracker shows, the picture is complex to say the least.
Threats
Helpdesk: Scammers are hijacking the results of searches for support from Apple, Bank of America, Facebook, HP, Microsoft, Netflix, and PayPal in an attempt to trick victims into handing over personal or financial information. Malwarebytes explains how the scam exploits a flaw to display a real support page but with a fake phone number.
FileFix: We’ve been banging on about the ClickFix technique because it’s so common. Now, attackers have come up with a variation which works by tricking users into copying and pasting a file path into Windows Explorer. The clever part involves modifying the copied file path to include PowerShell commands with some blank space to hide them from view. The same advice applies; never copy and paste commands or file paths without checking first.
Zoom: North Korean attacks are using social engineering to trick meeting participants into executing commands that enable them to take over target machines. The tactic begins by persuading the victim that they’re experiencing audio problems and need to run terminal commands to fix the issues. Security Week
Translate: Fake apps continue to be an ongoing threat to Android and iOS users. Hunt has spotted malicious versions of Google Translate’s Android app which are being distributed to install SpyNote spyware on victims’ devices. Meanwhile, Kaspersky says modified TikTok apps are targeting Android and iOS users via official and unofficial app stores to steal images from their devices.
Weddings: A scam targeting Android users in India is exploiting the cultural importance of wedding invitations to inveigle victims into installing malicious software. The invites usually arrive via WhatsApp or Telegram. Broadcom
Fortinet: The UK National Cyber Security Centre is warning about a newly identified threat that’s specifically targeting internet-facing FortiGate 100D series firewalls.
SonicWall: An attacker is using a malicious version of the SonicWall SSL VPN NetExtender app to steal VPN credentials from infected users.
AI
Jobs: While Amazon’s CEO said he expected to cut corporate posts as a result of reliance on AI, Goldman Sachs launched an AI assistant designed to boost productivity. The assistant will help employees in “summarizing complex documents and drafting initial content to performing data analysis,” according to a (particularly poorly written) internal memo. We don’t doubt AI is already changing the white collar job market but at least a new AI tool will help you apply for a new role if you need one. Alas, new data reported by The New York Times suggests employers are drowning in AI-generated job applications, with LinkedIn now processing 11,000 submissions per minute. The paper uses the example of an HR consultant who posted a single remote role and had to remove it after immediately receiving 1,200 applications. She was still sorting through them three months later.
WhatsApp: Meta says it’s introducing AI-generated summaries for private messages, first in English in the US and later in other countries and languages. The summaries will be created using Meta’s ‘Private Processing’ technology, which is supposed to create a “secure cloud environment” that stops Meta or WhatsApp (or anyone else) from seeing your summaries.
Detection: Researchers have devised a way to combat automated phone call scams. Many of these schemes depend on automatic speech recognition to transcribe their victims’ responses to the initial phishing call. The defence relies on distorting those responses so the automatic transcription doesn’t work. The Register
Search: Google’s AI overviews are having a noticeable impact on the number of visitors to the websites from which the summaries are drawn. Brightside says the overviews have generated more impressions but clickthroughs to the actual websites are down by almost a third over the past year.
Sceptic: Amid all the hype about AI, it’s refreshing to report an opposing view. In a trenchant interview with the Financial Times, the linguistics professor Emily Bender says large language models are “born shitty.” AI is pretty bad at most tasks and even the best systems available today lack anything that could be called intelligence, she argues.
Stock picker: We’re absolutely not endorsing this but…some Indian data scientists have produced a paper in which they claim to have predicted stock market movements with 99% accuracy. They say they did this by, um, combining planetary positions and astrological data with a machine learning model. We’re sure Emily Bender would have something to say about this.
Trump
Privacy: The risk of personal data on public sites was horribly illustrated by the killing of two Democrat politicians in Missouri. Court documents alleged the gunman used people search services to find the home addresses of his victims. While the EU has far more effective privacy regulations than the US, it’s still important to check what personal details are publicly available. Politico
WhatsApp: The US House of Representatives has banned congressional staff from using WhatsApp on government-issued devices, citing concerns over how data is encrypted and secured. Somewhat bizarrely, staffers have been told to use Microsoft Teams, Signal, iMessage, FaceTime, or Wickr instead. Given that WhatsApp uses the same encryption protocol as Signal, concerns about the content of messages seems misplaced. What does make sense is to be concerned about the metadata around messages - and also about the fact that the standard WhatsApp platform isn’t set up to retain a lasting record of congressional communications. But then neither are Signal or Wickr. The Verge
Borders: The Electronic Frontier Foundation has an updated guide for journalists crossing US borders. We don’t want to promote paranoia but we do advise caution, especially for anyone with passports containing exotic visa stamps.
LOL: The boast that the Trump-licenced mobile phone would be “Made in the USA” lasted less than a week. The new tagline is, “Designed with American values in mind.” Catchy. The Verge
In brief
Hotspots: Why should we be careful about public WiFi hotspots? Because of people like the Australian scumbag who has just pleaded guilty to setting up fake WiFi networks to steal personal data. Michael Clapsis created the free WiFi access points at airports in Perth, Melbourne, and Adelaide in order to redirect users to phishing pages and steal credentials. He then accessed personal accounts and collected intimate photos and videos of women. Ideally, we’d avoid public WiFi hotpots altogether but, since that’s not practical, it’s obviously crucial to be very careful about which ones to join. WAtoday
Authentication: The UK ’s National Cyber Security Centre has published advice urging people to adopt password managers and passkeys (written by the delightfully titled “Head of Citizen Resilience”). Like us, they recommend using a standalone app to manage passwords rather than saving them in your browser - though even that is better than nothing.
KIds: Seven people, including a 14-year-old, have been arrested or have surrendered to Danish authorities after allegedly using encrypted messaging apps to hire other teenagers for contract killings in what Europol calls a “violence-as-a-service” operation. All those involved are between the ages of 14 and 26. The Register
Facial: A website (f**kLAPD[.]com) enables anyone to use facial recognition to identify police.
Jammers: The US says Chinese companies are trying to smuggle illegal signal jammers into the US. The Department of Homeland Security has recorded an 830% increase in seized devices since 2021. Such devices can be used to interfere with law enforcement responses to crimes in progress.
Brazil: Federal police have charged former President Jair Bolsonaro with illegal spying on political rivals, journalists, and environmental protection activists. Bolsonaro and the country’s spy chief allegedly created a “parallel structure” to spy on over 30,000 people. and developed a specific tool to do so. El Pais
Newbies: 71% of newly hired employees click on phishing emails within the first three months of their employment, according to research by Keepnet. The survey of 237 companies found a key cause was a lack of security training when they joined their company. Help Net Security
Missing: UK government departments have lost over 2,000 laptops, phones, and tablets over the past two years, according to figures reported by The Guardian. This is a risk for every organisation, so it’s vital to reinforce messages about ensuring devices are suitably encrypted and never unlocked when they’re being transported from once place to another.
Updates
Microsoft: Fix for an issue that has been causing problems for Windows 11 updates.
Browsers: Mozilla and Google released updates to fix multiple vulnerabilities. The fresh version of Firefox also includes new features, among them vertical tabs.
WinRAR: Security update for the file-archiving software to address a vulnerability that can be abused for remote attacks.
Citrix: An emergency update for NetScaler ADC and NetScaler Gateway devices. The offending vulnerability is already being exploited.