Critical infrastructure; a disaster waiting to happen. Fake everything.
AI errors create fertile ground for crooks. FBI told to improve smartphone security advice. The deadly risks of a compromised phone. And China's miniature spy drone.
Critical
Multiple US government agencies have issued a fresh warning that critical infrastructure remains under threat from Iran - and many key targets are exposed on the internet. The agencies, including the FBI and the National Security Agency, said defence industries with relationships to Israel were particularly at risk. Analysts say that in many cases previous Iranian attacks on critical infrastructure systems have been unsophisticated, targeting internet-connected systems that are unprotected or have a weak default password. The new warning came barely a week after the previous one and suggests that, at the very least, the US government wants to be able to say it alerted operators to the risk they face.
Sooner or later a catastrophic attack on a critical piece of national infrastructure is bound to happen. There have been plenty of examples of less serious incidents. This week, France published details of a series of such attacks linked to China - and that followed last week’s news about an incident at a Norwegian dam. In the case of the dam, officials think the attackers exploited a weak password for its web-based control panel. Luckily, the facility was small and the valve that was opened caused no serious damage.
Meanwhile in the UK, the armed forces minister has warned thatcyber attacks and the sabotage of submarine cables are creating blurred lines between war and peace. Speaking to the Joint Committee on National Security Strategy, Luke Pollard highlighted the issue of “grey zone threats,” saying, “It is legitimate to have a question about at what point is someone at war.” In a report released in June, the China Strategic Risks Instituteanalysed 12 incidents of apparent undersea cable sabotage since January 2021. It concluded that China and Russia are stepping up operations to target undersea cables and the UK is unprepared to meet the threat.
Threats
China: Criminals based in China appear to be behind a network of fraudulent retail websites designed to steal payment data from online shoppers. Apple, PayPal, Nordstrom, Hermes, and Michael Kors are among the brands affected. Silent Push
TOAD: That’s Telephone-Oriented Attack Delivery, a ridiculous acronym but a growing problem. It combines an initial lure with voice calls to try to persuade targets to give up personal information. In the latest variation, attackers are using PDF attachments to entice recipients to phone numbers that seem to belong to brands including including Microsoft, DocuSign, Dropbox, PayPal, and Adobe.
DocuSign: Do take care with DocuSign notifications. They’re a particular favourite of attackers and there’s a sophisticated variant doing the rounds at the moment. It begins with an email from what appears to be a known contact and ends with a Google login page. Obviously, that should never be the result of a DocuSign notification. Malwarebytes has the details.
Microsoft: Researchers have found that with the help of AI it can take just 30 seconds for hackers to create a phishing site. Okta says the sites impersonate legitimate sign-in webpages, including Microsoft 365, and are built with an AI website creation tool.
Travel: The US Federal Trade Commission says the cost of travel-related fraud reached $274 million last year. It says AI has enabled the creation of fake listings that are almost impossible to separate from real ones. The fakes included free or low-cost vacations, cut-rate student travel packages, and misleading time share offers.
Bluetooth: There’s a problem with Bluetooth; even its inventor admits it was never designed with security as a priority. These days, it’s far more widely used than first envisaged - and weaknesses in the protocol can be used to impersonate a trusted device. 9to5Mac explains how - and why it’s sensible to be cautious about the Bluetooth devices to which you connect.
AI
Wrong: When asked for the address of major companies’ websites, AI chatbots provide incorrect answers in a third of cases. Netcraft points outthat this provides a glorious opportunity for scumbags to exploit. So, a reminder when using AI tools that it’s always wise to verify before trusting what they tell you.
Medical: A doctor examines Microsoft’s claims that its new AI framework outperforms human physicians (in a report modestly titled “The Path to Medical Superintelligence”). Dr Dominic Ng’s conclusion is that medical AI will undoubtedly play an increasingly important role in medicine but this test was rigged in AI’s favour.
Exploitation: North Korea is using and abusing ChatGPT to automate research and reconnaissance of public data to find targets for attacks.TechM
Meta: Mark Zuckerberg and his minions are kindly suggesting that users give them access to their photos in return for AI tools and sharing suggestions. As TechCrunch points out, this is a neat way for Meta to access a whole new resource with which to train its AI models.
Racist: Depressingly, racist videos made with AI are going viral on TikTok. Media watchdog Media Matters says the videos have accumulated millions of views and appear to have been created with Google’s AI video generation tool Veo 3. TikTok told The Verge that it proactively enforced “robust rules against hateful speech and behavior.” Given that one video racked up 14.2 million views, TikTok’s proactivity needs some work.
Trump
Mobile: Senator Ron Wyden has told the FBI to update its guidance to US officials on how to secure their mobile devices. Senator Wyden (who actually knows what he’s talking about) says the guidance is obsolete given the level of current threats. Among his recommendations; officials should enable ad-blocking features and disable ad-tracking IDs. They should also enable anti-spyware lockdown modes available on both Android and iOS devices. Coincidentally, the US cybersecurity agency has just warned that attackers are busily exploiting vulnerabilities in a version of Signal being used by the administration.
Border: US Customs and Border Protection is asking technology companies for products that can analyse data from devices seized from travellers entering the country. WIRED says the tools must be able to identify “hidden messages” and “find patterns” in a user’s data.
Privacy: The Department of Human Services has partnered with the so-called Department of Government Efficiency to create the first searchable national citizenship data system. NPR says the information in it has been drawn from social security and immigration databases.
Threat: Iranian hackers have threatened to publish more emails relating to President Trump and his close aides. They distributed a previous batch in the run-up to last year’s election, without having any discernible impact on the final result. Reuters
In brief
Cross-reference: A US Department of Justice report illustrates why smartphones are a threat to anyone for whom confidentiality is important. It reveals that in 2018 a hacker working for the Sinaloa drug cartel managed to access the call records of a US diplomat in Mexico City. By cross-referencing the records and geolocation details with feeds from the city’s extensive camera network, the cartel identified, surveilled and “in some cases” killed cooperating witnesses and potential sources. The DoJ report is long and much of it is redacted. Matt Johansen has an excellent summary, including vital lessons for anyone responsible for deployments in high-risk environments. Perhaps most important; treat phone numbers as credentials and war-game what would happen if a single phone were to be tracked.
Stalkerware: A security snafu in an Android spyware app has exposed thousands of its customers (and its administrator). ‘Catwatchful’ masquerades as a child monitoring app. Like many of its ilk, it claims to be invisible and undetectable while uploading the phone’s content to a dashboard where it can be viewed by the person who installed it. It’s at least the fifth stalkerware app to experience a data breach this year. TechCrunch
Aviation: After causing havoc in the retail and insurance sectors, the hackers known as “Scattered Spider” appear to have turned their attention to aviation. First US carrier WestJet was hit. Now Qantas says attackers managed to access a third-party platform containing data for some six million customers. Most of these attacks involve the hackers persuading help-desks to reset passwords. Bleeping Computer
Crime: Cybercrime reports account for more than 30% of all reported crimes in Western and Eastern Africa, according to Interpol. It says online scams, ransomware, business email compromise, and digital sextortion are the most common crimes.
Off air: A by-product of Israel’s attacks against Iran has been to highlight Teheran’s extensive propaganda operation in support of Scottish independence. Dozens of such accounts on XTwitter mysteriously went silent when Israel launched its offensive which forced Iran to cripple its internet. UK Defence Journal
Hikvision: Canada has told the Chinese security camera maker to close operations in the country. Officials said Hikvision represented a threat to Canada’s national security, although it didn’t provide any details. Our own assessment is that Hikvision products are reasonably safe to use in low-risk locations - and absolutely not for use in sensitive ones.
Drone: Chinese scientists have built a mosquito-sized drone that comes complete with cameras and microphones. It can be controlled by a smartphone and it’s too small for radar to detect. PetaPixel
Updates
Microsoft: Support for Windows 10 was supposed to end in October but Microsoft has come up with an intricate plan for people who want (or need) to stick with the old operating system (there are some 400 million PCs that don’t meet the requirements to upgrade to Windows 11). To continue receiving support, an individual user either has to pay $30, or use Windows Backup to sync their settings to the cloud or redeem Microsoft Rewards points.
Brother: Multiple printer models have serious security problems, including one that could be used to generate a default administrator password. The issues also affect some devices from Fujifilm, Ricoh, Toshiba, and Konica. Brother has provided updates or workarounds to address the issues.
D-Link: If you still have one of the company’s DIR-816 WiFi routers, it’s time to dispose of it (securely). A researcher has found six vulnerabilities in the model and since it’s no longer supported they’ll never be fixed.
As this year we coincide with July 4th, we wish our readers in the US all the very best for Independence Day and for the year ahead.