The growing problem of SMS blasters. Exploiting insecure cellphone protocols.
AI in the workplace. Social media and the US border. Russia considers restrictions on WhatsApp.
SMS
A series of incidents suggests there’s a growing problem of fake cellphone base stations being used to send scam SMS messages. The “SMS blasters” are designed to mimic a genuine base station and send messages to any device connected to them. Many of the cases have involved Chinese nationals. Last week, a Chinese tourist was arrested in Oman for driving around the capital with an SMS blaster and sending messages designed to lure victims to a phishing page for a local bank. Last month, a UK court sentenced a Chinese student to a year in prison for doing the same thing in London.
“SMS blasters” are not a new issue but, as Commsrisk points out, they’re a poorly understood one. The telco sector news site has created an interactive map showing just how widespread the problem is, with three cases in the UK over the past year. The attraction for criminals is that, despite their high cost, fake base stations bypass the controls on messages imposed by genuine mobile network operators. They work by forcing phones to use a 2G connection which lacks the security protections of more recent standards.
The simple way to protect against such tactics involves simply disabling 2G connectivity. That’s simple on Android devices because they have a specific setting to do so. Unfortunately, it’s not so easy on iPhones. These require a user to put their device in Lockdown Mode which most people won’t do because it disables so many other features.
Threats
Location: A surveillance company in the Middle East has been tricking phone operators into revealing the location of cellular subscribers, according to research from Enea. The company says the technique relies on bypassing security measures in the notoriously insecure protocols used to route calls and text messages between networks. Our standing advice is to regard cellphones as a significant risk to anyone working on sensitive projects or in high-risk situations.
Social: Although software and hardware vulnerabilities are a threat, the real risk stems from social engineering. That’s the view of a former senior Israeli cybersecurity officer. As he told The Register, “You don’t need to be a superpower, you don’t need to be the NSA with zero days, you just need to have the skills to understand how the organisation that you’re targeting operates, who the actors are, [the] processes and procedures, language, culture.”
Password: A single compromised password led to the closure of a 158 year-old transport company in the UK - and the loss of 700 jobs. The company was operating 500 lorries until it was attacked with ransomware in 2023 after scumbags guessed a single employee’s password. The company knows who the employee is but hasn’t told them they were responsible. “Would you want to know if it was you?” one of its directors said. BBC
AI
Liars: Research from Howdy.com suggests there’s a set of wholly unhealthy attitudes towards AI in the US workplace. Employees think they’re expected to use it, so one in six of them pretend to do so. 22% say they use it when they’re not confident about what they’re doing. And a third of those surveyed said learning and using AI (and checking for mistakes) takes as much time as doing their job without it.
Companion: 75% of US teens have used AI to seek advice, flirt, or share deep conversations, according to a study by Common Sense Media. A third of those surveyed said they’d discussed serious matters with AI companions instead of real people at least once. About the same percentage describe AI chats as just as satisfying or more satisfying than talking to humans.
Blocked: Services are differentiating themselves by offering versions free of AI content. The DuckDuckGo search engine has a version that doesn’t include any AI-generated content. And by default the privacy-focussed Brave browser will prevent Microsoft’s Recall tool from taking screenshots.
Delta: The airline has told passengers that a new AI-powered ticketing system isn’t designed to track their behaviour in order to sell high-earners more expensive tickets. PYOK
Watermarks: Leading tech companies have proposed invisible “watermarks” as a solution for identifying AI-generated content and combatting deepfakes. The only problem is that researchers at the University of Waterloo have come up with a tool that can remove them.
Detector: Researchers in Italy have developed a method for tracking people by creating a unique identifier based on how their bodies block WiFi signals. While using WiFi as a sensing mechanism isn’t new, this technique uses AI to achieve a high level of accuracy and enable people to be tracked between different locations.
Trump
Travel: “I just deleted my entire social media presence before visiting the US – and I’m a citizen,” writes a technologist in The Register. Mark Pesce says 2025 should be remembered as the year “socials transformed from self-expression to entrapment.” While we agree about the risks of social media (and content stored online or on phones), it’s also worth pointing out that a phone devoid of any content at all is also a red flag for suspicious officials.
AI: An executive order bans “woke AI” and AI models that aren’t “ideologically neutral” from government contracts, calling diversity, equity, and inclusion (DEI) a “pervasive and destructive” ideology that can “distort the quality and accuracy of the output.” The order came as the White House published an AI action plan which moves the administration’s focus from managing the societal risk of AI to reducing “bureaucratic red tape.”
UK: The UK is reported to be trying to find a face-saving way to back away from its demand for access to the encrypted data of Apple’s users. The Financial Times says this comes in the face of pressure from senior leaders in Washington, including vice-president JD Vance.
In brief
Sued: A US bleach manufacturer is suing its IT provider over a 2023 ransomware attack. Clorox says Cognizant support agents failed to carry out proper checks before handing over credentials to hackers. Partial transcripts of alleged conversations between the hackers and the Cognizant support staff show no attempt to verify the identity of the callers asking for their passwords to be reset. Cognizant has denied responsibility. Reuters
Spain: Police are reported to be profiling people based on their phones, with Google Pixel devices at the top of the list. Android Authority says the issue is the use of the Graphene operating system which is a privacy-focussed alternative to the default one. Graphene is supposedly popular with drug traffickers.
Russia: There are signs that WhatsApp may be included in a list of software subject to restrictions being developed on the orders of President Putin. An influential member of the State Duma complained it was being used by 68% of Russian citizens despite being owned by an “extremist” company.
Age: The UK begins enforcing age verification checks today as part of the Online Safety Act which requires sites to make it harder for under-18s to access sexually explicit material. There are obvious ways to circumvent the controls but, as the BBC discovered, they might not be needed. When one of their journalists tried to access a major pornography website, all he had to provide was an email address. BBC
Ring: The security camera outfit has been trying to reassure users that mysterious logins to their accounts are the result of an errant “backend update” and not a security breach.
Data: A private intelligence company is marketing hacked data to a wide range of industries, including debt collectors, couples in divorce proceedings, and companies looking to poach their rivals’ customers. 404 Media
Updates
SharePoint: Google and Microsoft say attackers linked to the Chinese government appear to be exploiting a serious vulnerability in SharePoint servers. The issue only affects self-hosted servers, as opposed to cloud instances. Microsoft has issued an update to address the problem but the current advice is that anyone running self-hosted versions of SharePoint should assume they have already been compromised. Among more than 400 organisations affected is the US National Nuclear Security Administration, which has a key role in maintaining the country’s nuclear arsenal.
Cisco: Three recently addressed vulnerabilities in Cisco Identity Services Engine (ISE) are now being actively exploited in attacks.
Apple: A new service called AppleCareOne allows US customers to protect three devices for $19.99 a month. In a major change, it will be possible to enrol devices that are up to four years old (although they have to be in “good” condition). We’ve asked when/if the model will be rolled out to other countries.
Tails: Version 6.18 includes a new mechanism for connecting to the Tor network which helps to circumvent censorship.