Identifying the risky ones. Bypassing passkeys. YouTube scam adverts.
Misleading AI search results. Chinese hacks. And North American railways at risk.
Risk
Most employees reduce security risks by behaving sensibly and adopting simple cybersecurity rules. That’s the good news. The bad news is that there’s a small minority, defined as the “chaotic risky,” who are a security disaster. These are the findings of research by Living Security designed to promote their risk management platform. Despite being self-serving, their study does chime with what we find in our work. Some key points;
-
Just 10% of employees are responsible for 73% of all risky behaviour.
-
Contractors and remote employees are often seen as a security liability but in fact they tend to be less risky and more vigilant than the overall average.
-
The worst offenders (the “chaotic risky”) are often senior executives, staff employees and those with privileged access.
While Living Security is trying to sell a specific product, there are simple approaches that can help to improve user attitudes to security;
-
One size really doesn’t fit all. Specific teams and specific projects need approaches that are tailored to their needs.
-
Senior executives are often the worst offenders, so work with them to make sure they buy into security programmes.
-
Above all, accept that people will break rules if that’s what they think they need to do to get a job done.
Threats
Smart: Attackers have come up with an ingenious way to bypass passkeys. The technique is slightly complicated to explain but it’s important to emphasise there’s no problem with passkeys themselves - instead the technique exploits a fallback method for logging into an account when the user doesn’t have access to the passkey. This involves a QR code which the scammers try to persuade a victim to scan. Expel explains how it works.
YouTube: An advert is trying to trick viewers into installing an app that claims to fix non-existent iPhone problems. Perhaps YouTube might like to explain how such an obvious scam evaded its controls.
Mastodon: Users are receiving “verify your account” messages asking them to click on malicious links.
Mac: A malicious software tool designed to target Apple laptops has received a major update. It now comes with a feature designed to allow attackers to control devices remotely. The infection usually begins with a LinkedIn message offering a job. Moonlock
Amazon: A new campaign is targeting Prime customers with messages saying their subscriptions will automatically renew at an unexpected price. Malwarebytes
AI
Misled: The results of AI-generated search engine summaries are suggesting phishing sites when users ask them to find legitimate pages. Netcraft says that of 131 hostnames provided in response to natural language queries for 50 well-known brands, 34% of them were not controlled by the brands’ owners.
WeTransfer: The file transfer outfit has been trying to reassure users that, despite new terms of service, it has no intention of using uploaded files to train AI models.
Grok: xAI, the company behind Elon Musk’s chatbot, has been apologising for its “horrific behaviour,” saying a recent update made it “susceptible to existing X user posts; including when such posts contained extremist views.” Meanwhile, research found that the new Grok 4 model is a security disaster, and could be induced into providing dangerous output. Molotov Cocktails anyone?
Chess: Google’s Gemini chatbot refused to play Chess against the Atari 2600, after learning the vintage gaming console had already beaten other AIs. The Register
Trump
China: As it emerged that Chinese state hackers had broken into a US National Guard network and a leading Washington DC law firm, the Trump administration is planning to spend $1 billion on “offensive cyber operations.”
Pressure: The EU has stalled an investigation into XTwitter for breaking digital transparency rules amid trade talks with the US. Reuters
Stingray: A report says there are signs that cellphone surveillance tools were used during a recent protest at an an Immigration and Customs Enforcement field office in Washington state. The so-called “Stingray” devices are designed to capture unique phone IDs. SAN
Detector: The FBI is using polygraph tests to assess the loyalty of officials to their new leadership, according to reporting by The New York Times. It says some senior officials who have taken the test have been asked whether they said anything negative about FBI director, Kash Patel.
Diplomacy: The State Department’s key cyber diplomacy unit is among those hit by agency-wide cuts. The sweeping reorganisation also affected staff working on policy towards China. NextGov Cybersecurity Dive
In brief
Rail: It’s taken 12 years but the Association of American Railroads is finally going to update an insecure protocol that can be exploited to engage brakes and bring trains to sudden stops anywhere across North America. A researcher identified the issue in 2012 but says he was “ghosted” by the railroad association. “All of the knowledge to generate the exploit already exists on the internet. AI could even build it for you,” the researcher told (R) 404 Media. Although the industry is now working on a fix, it may take “years” to implement.
University: The vast scale has emerged of a data breach at New York’s Columbia University. The attack took down its authentication system and stole personal data from every person who applied to the university between 2019 and 2024. Bloomberg
Analysis: Security researchers say Chinese authorities are using a new tool to analyse seized phones. Lookout says the software enables them to obtain text messages, including from apps like Signal, as well as images, location history, audio recordings, and contacts. TechCrunch
Probe: France has launched a criminal investigation into XTwitter over alleged manipulation of its algorithms for the purposes of “foreign interference.” Reuters
Spain: Spain has raised eyebrows by giving Huawei a contract to manage its phone wiretapping infrastructure. The government awarded the contract despite US and EU concerns about Chinese government controls which have led to widespread restrictions on Huawei. The Record
Russia: The Russian parliament has passed a new law criminalising internet searches for “extremist content.” This covers some 5,500 items, including anything related to the “LGBTQ movement”, terrorist groups, and fascist ideology. It also covers searches for VPNs and methods to circumvent the controls. Washington Post
Theft: Germany’s meticulously-worded laws appear to have allowed the theft of €2.5 million in cryptocurrency to go unpunished. A regional court found that the law of theft applies to physical things and since cryptocurrencies are virtual the law doesn’t cover them. Heise
Bags: Belgium has started using bread bags in a campaign to warn the elderly about cybercrime threats. The bags carry messages, in particular never to give a password or a PIN code to a caller - no matter how convincing they might be. VRT
Updates
Windows: National cybersecurity agencies in the UK and Germany have told organisations to prepare to upgrade to Windows 11 or face elevated levels of risk. Although the official date for Windows 10’s “end of life” is October 14 2025, it will be possible to continue receiving support for three years after that. However Microsoft’s strategy is drive everyone to Windows 11, so the cost of extended support will double each year - and Windows 10 will feel increasingly obsolete. That presents a real challenge for organisations happily running the old system on devices that won’t support the new one. NCSC
Exchange: After saying it wouldn’t, Microsoft now says it will provide extended security updates for Microsoft Exchange 2016 and 2019 servers for six months after their “end of life” date on October 14. At a price to be disclosed next month.
Cisco: A new maximum severity vulnerability in Identity Services Engine makes it essential to check recent updates have been applied.
SonicWall: Any organisations still using Secure Mobile Access 100 devices should be aware that they’re vulnerable to remote attack even when they’re up to date. SonicWall stopped selling and supporting the appliances earlier this year and it’s abundantly clear that any still in use will almost certainly be attacked. The Register
Oracle: The latest quarterly release addresses 309 security issues across the company’s entire range of products.