A week of disastrous security breaches. OpenAI on defeating voice verification.
Russia uses ISPs to target diplomats in Moscow. And Dark Web travel agencies.
Tea
This has been an absolutely ghastly week for data breaches, with countries, cities, companies (and of course individuals) affected on a grand scale. Possibly the worst of the lot is at Tea, an app designed to allow women to talk safely about men they’re dating. Not only were personal details and real ID scans exposed but so were private messages. Data from the hack was published on 4chan and was advertised as revenge for claims made on the app about some men. The Tea app has attracted widespread attention for enabling women to post anonymous reviews of their dates.
The source of the Tea data appears to have been an internet-exposed backup system which lacked any form of protection. A security researcher told 404 Media that it was possible to access messages discussing abortions, cheating partners, and phone numbers. Tea says the breach only affects users who signed up before February 2024 - though it adds that’s a “preliminary finding.” Tea also says it has no evidence photos can be linked to individual users, although NBC News reports that a Google map has been created which purports to show the locations of Tea users affected by the hack.
The Tea breach comes in a week of security incidents which included Luxembourg, Aeroflot, a major Miami-based media company and the Irish public broadcaster RTE. And the intelligence portal used by the CIA and other agencies, and the US city of St Paul, Minnesota which was so badly affected by a cyber attack that the National Guard was deployed. This week also saw the FBI warning about new tactics being used by the Scattered Spider group which this year has targeted the retail, insurance and aviation sectors. The unfortunate reality is that the availability of new tools and techniques means the current advantage is very much on the side of the attackers.
Threats
Facebook: A devious method opens a new window inside an existing browser window to try to steal user credentials. It’s known as “Browser-in-the-Browser” and, as is now commonplace, the fake login page is worryingly convincing. Password managers and passkeys help to defend against this sort of attack - but so will resisting the temptation to sign in on pages you didn’t open directly. Gen Threat Labs
Backups: Cloud backups are an increasing target in ransomware incidents as attackers seek to maximise their leverage. Google says the strongest defence remains “foundational security,” with credential compromise and misconfiguration the primary entry points for attackers.
Amazon: The US Federal Trade Commission is warning about text messages designed to steal payment or account info by offering an Amazon refund.
Zoom: Subject lines like “Critical Situation – Emergency Meeting” are being used to lure victims into a fake Zoom call. The landing page is almost indistinguishable from the real one. Cofense
Jitsi: Attackers can secretly record users’ audio and video by luring them to a site and requesting they start an audio and video sharing stream. The technique works because of an option in Jitsi that hides permission pop-ups. Jitsi says it’s a feature not a bug, so it won’t fix it. Zimzi
Retraction: Last month we covered a story about a novel way to circumvent passkeys. Expel, which was behind the report, has now retracted it. Sorry for that. The technique involved persuading a target to scan a QR code and, in principle, it could work. However, it seems that in the case Expel examined it didn’t result in any data being accessed.
AI
Security: OpenAI boss Sam Altman says the financial industry faces a “significant impending fraud crisis” because of the ability of AI-generated or “deepfaked” audio to defeat voice verification checks. This hardly counts as news because people like us have been warning about the issue for years. But it’s a reminder to avoid signing up for voice verification when you can.
Confidentiality: Altman also warned that there’s no legal confidentiality when using ChatGPT as a therapist. He told a podcast that the AI industry hasn’t worked out how to protect this sort of conversation. This could create a privacy concern for users in the event of a lawsuit, he said, because it would require OpenAI to disclose the conversations. Of course, this applies to any interaction with AI chatbots which should give us pause for thought before asking them to transcribe phone calls and meetings.
Wearable: Amazon has acquired the startup behind a $50 wearable device that listens to everything around you and uses AI to produce personalised summaries, reminders, and suggestions. Amazon told The Verge that it cares “deeply” about customer privacy and security, and has been a strong steward of customer data since its founding…
Trump
Dismissed: The US Department of Defence has forced West Point to revoke a teaching position occupied by Jen Easterly, the respected former head of the country’s cyber agency. This comes after far-right activists targeted Easterly online and criticised her leadership of the Cybersecurity and Infrastructure Security Agency. The Army told Politico it was “crafting a deliberate approach to ensure that our future officers are best prepared to meet the demands of the modern battlefield.” Easterly posted a measured response on LinkedIn setting out her experience which will now not be shared with the next generation of US military leaders.
In brief
Eavesdropping: Russian spies are exploiting local internet service providers to collect intelligence from devices belonging to diplomats and foreign embassy staff in Moscow. Microsoft says the technique involves directing targets to a page designed to trick them into installing malicious software masquerading as a security update. Once installed, the malware removes encryption from data sent by the device allowing it to be read as plaintext. Although this case focusses on Moscow, the same threat exists anywhere governments can interfere with internet service providers. Microsoft has useful advice on how to mitigate the risk. WIRED
SharePoint: Last week’s breaches of SharePoint servers has shone an unforgiving spotlight on the wretched business of security flaws and the convoluted process of addressing them. In SharePoint’s case, Microsoft is investigating whether the breaches resulted from a leak in the way it provides previews of fixes to security companies. Microsoft has blamed Chinese-linked groups for the attacks whose more than 400 victims included the US National Nuclear Security Administration.
Gated: Governments around the world are embarking on a concerted effort to control access to the internet depending on a user’s age. The only problem is that the mechanisms to do so are hopelessly inadequate - and sooner or later will result in a ghastly data breach into the bargain. As the UK is demonstrating, VPNs make it trivially easy to bypass age controls - and the likelihood is that the young people (who the measures are designed to protect) will sign up for free services that are inherently unsafe and will compromise their online security. The Register TechCrunch
Tracking: A large-scale study has lifted the lid on how some Andriod applications are able to use WiFi and Bluetooth connections to track a user’s movements. It also examines how some of them access sensitive data without requesting the necessary permissions from the Android operating system. Tech Xplore
Privacy: Data brokers are in “rampant non-compliance” with US state privacy laws, according to a University of California study. While brokers register as required, they fail to comply with requests to opt out of tracking and delete the data they hold about individuals. The study found that, in 40% of cases, brokers didn’t even reply when asked what data they had.
Sovereignty: Microsoft says it “cannot guarantee” data sovereignty to customers in France, and by implication in the wider EU, should the Trump administration demand access to customer information it holds. Microsoft told a French Senate inquiry that it would have to comply with “well-framed” requests. The Register
War: China has been studying the Russia-Ukraine war. RAND says a key lesson it has drawn is the “growing need to take more proactive operations in the space, cyber and electronic warfare domains in peacetime to ensure victory in wartime.” RAND’s report was commissioned by the US air force. It doesn’t make for rosy reading.
Travel: Trustwave has a fascinating report on Dark Web travel agencies that are powered by stolen credit cards and compromised loyalty accounts. The operations run through Telegram channels, meaning “customers” can message the “agencies” direct and enjoy prices up to 70% below market rates. Some of the operations even offer money-back guarantees if things go wrong.
Training: It has always been obvious to us that one size absolutely does not fit all when it comes to cybersecurity awareness. A leading Irish cybersecurity consultancy has collated some of the research around this. It has found, as we have, that the only meaningful approach to awareness requires an intimate understanding of the challenges faced by the people to whom you’re talking - and content tailored to the needs resulting from them. BH Consulting
Updates
Apple: Updates across Apple’s products to address a nasty vulnerability in Google Chrome that has already been exploited.
Dropbox: Why do we recommend a standalone password manager? Because of examples like Dropbox which has just announced it’s shutting its Passwords service and has given users until October 28th to export their data or lose it. Dropbox’s rationale is to focus on its core product. And if password management isn’t core to a company’s business, it’s a very good reason to find an alternative solution that is.
Android: Google is to allow Android users to disable a security feature because it seems it resulted in so many of them being locked out of their devices. Failed Authentication Lock automatically locks devices after too many failed logins. Android Authority
Adobe: New generative AI features for Photoshop simplify the process of adding and removing people and objects in photographs. What used to be a laborious process now takes just a few mouse clicks. The potential for misuse is unlimited…
SonicWall: Updates for three vulnerabilities in SMA appliances. Two of the issues can be exploited without any user interaction.
TP-Link: The company has warned that old Archer C50 routers should no longer be used because of a vulnerability that will not be fixed.