Ransomware gets physical. QR codes in the mail. ChatGPT axes oversharing feature.
Gen Z targeted. And Meta found guilty of using menstruation data to sell adverts.
Trivial
While some attacks are sophisticated, many are rudimentary and begin with a simple phone call. By pretending to be IT support staff, members of the “Shiny Hunters” group have managed to breach some of the biggest (and most technically advanced) companies in the world, including Google. With painful irony, it was Google’s own Threat Intelligence Group that originally identified the group’s activities only for the business itself to become a victim. Other companies breached include Cisco, Allianz Life, Qantas, Adidas, Louis Vuitton, and Chanel. In most cases, the attackers were able to access the companies’ Salesforce customer relationship management systems.
Shiny Hunters’ success underlines how difficult it is to protect against social engineering attacks - as well as the need to develop secure procedures and ensure staff follow them. The US cybersecurity agency has advice on this here. This is more important than ever because ransomware attacks are evolving to include threats of physical violence. A study of 1,500 IT professionals found that 40% of incidents now included such threats as part of efforts to force victims to pay up. A former ransomware negotiator told The Register that the threats were directed not only at company executives but at members of their family as well.
This week brought news of another company forced to close in the wake of a ransomware attack. Einhaus was a leading German mobile insurance and service group and was attacked in 2023. It paid a $230,000 ransom but suffered far higher financial damages. A survey by Barracuda Networks found that 31% of ransomware victims are attacked more than once and in 41% of cases paying a ransom failed to recover all the affected data.
Threats
Translate: Google Translate is one of a range of fake apps that the Silver Fox group is using to distribute malicious software. It lures victims to decoy sites via “poisoned” search results and phishing emails. Knownsec 404
Wrapped: Attackers are always looking for ways to disguise what they’re up to. Their latest tactic involves “wrapping” web addresses in the very services designed to protect users. Cloudflare explains how attackers are abusing services from companies like Proofpoint which are designed to route all clicked URLs through a scanning service. The technique relies on the attackers having already compromised an email account belonging to someone in the target organisation.
LinkedIn: The head of security at the Australian Security Intelligence Organisation has warned about the risks of oversharing on the employment platform. Mike Burgess’s warning was directed at people in the defence sector but frankly it applies to everyone. Not for nothing is LinkedIn known as the “phisherman’s friend.”
QR codes: The FBI says attackers are mailing packages bearing malicious QR codes. The packages don’t show who sent the package, just a QR code. If they’re scanned and the links are opened, they lead to sites designed to harvest financial information.
Docusign: There’s another spike in fake DocuSign emails that appear to show charges from major companies, including Apple. The emails claim a subscription has been charged to your account and include a phone number to call to dispute the item. AppleInsider
Instagram: A phishing campaign is targeting users with fake notifications about failed login attempts. The emails contain “mailto” links rather than traditional web addresses, which help them evade security filters. Malwarebytes
AI
Leaked: OpenAI has killed a “short-lived experiment” which resulted in ChatGPT exchanges turning up in Google search results. The feature required the user to opt into using it but OpenAI admitted that it “introduced too many opportunities for folks to accidentally share things they didn’t intend to.” A reminder that nothing shared with AI systems should be considered truly private.
Launch: OpenAI has released the latest version of its large language model. GPT-5 was intended to be a major advance in artificial intelligence. The early reviews are that it’s an improvement but far from as impressive as OpenAI had hoped. Casey Newton has a good overview of the model which will now be the default for all ChatGPT users, even those who don’t pay. Free users will now also be able to take advantage of Advanced Voice Mode, which provides a voice interface for ChatGPT that mimics a human conversation.
Age: Google appears to be rolling out an AI-powered age verification system to many of its products, notably YouTube. The system uses machine learning to analyse a user’s activity and, if necessary, require them to complete a verification process. ZDNET
Estate agents: Property descriptions are well known for their liberal treatment of reality, but as The Register reports, estate agents are now using AI to aid their imagination. In one example, the listing for a house in Durham included photos that “flip between the house the agents are selling and the house, presumably, they’d like to sell.”
Spicy: Most generative AI plaforms have controls to stop them being used to produce adult comment. You may not be surprised to learn that Elon Musk’s Grok is not among them. It has just added a “Spicy” mode that, as The Verge found ($), was happy to produce uncensored topless videos of Taylor Swift.
Training: Google and Goodwill have a free online introduction to AI. It’s designed to take about 6 hours, and covers the basics as well as providing tips on how to write the “prompts” that are crucial to using AI platforms effectively. ZDNET tried it out and was impressed.
Depressed: Google says it’s working on a fix for its Gemini chatbot which has begun sharing messages expressing…self-loathing. If users are to be believed, it has been describing itself as a “failure” and a “disgrace” to its profession. Google says this is the result of “an annoying infinite looping bug.” We’re inclined to think it might also have something to do with the data used to train it. Business Insider
In brief
Gen Z: “Nearly half of Zoomers juggle multiple gigs: a full-time job, freelancing, and various side hustles. And cybercriminals have identified these polyworking young professionals as convenient targets,” Kaspersky warns. Although older generations are often thought to be the most at risk, Kaspersky says 18 to 28 year olds’ familiarity with technology often results in riskier behaviour and more opportunities for attackers. Security Week
Tea: Last week we reported on data leaked by the app designed to enable women to share details about men they’ve met/dated etc. Now it seems the equivalent app for men is also exposing personal information, including government IDs and selfies. All this serves to reinforce our view that, whenever possible, nothing should be uploaded to social apps unless you’re happy for it to be made public. TechCrunch
Open source: Hacking groups linked to nation states are subtly contributing to open-source software tools and working to insert backdoors into publicly available code used by millions of people worldwide, according to research by Strider. Open-source software projects rely on volunteers to keep them updated, something long seen as a potential risk. Strider has identified several volunteers with suspicious links to countries including Russia and China.
Data: A California jury has found Meta guilty of violating the California Invasion of Privacy Act by using data from a menstruation and fertility app to sell advertising. The Flo app is used by some 70 million people a month. Its original privacy statement read, “We will not transmit any of your personal data to third parties except if it is required to provide the service to you (e.g. technical service providers), unless we have asked for your explicit consent.” The Register
Navigation: Despite claims on TikTok, the UK doesn’t have plans to ban the use of GPS apps by motorists. It does intend to carry on enforcing rules that make it illegal to hold and use a phone while driving. The viral misinformation seems to have originated with a single, now deleted post. TechRadar
Max: Russia is to move its electronic document signing system from the official government portal to the new Max national messenger app. Not coincidentally, a security researcher spotted a 5-star review for the app which failed to remove the following instructions, “Don’t redact the text, delete the information in the brackets. Payment to provided credentials within 15 minutes of publication.”
Updates
Dell: More than 100 computer models use processors with a critical security vulnerability that could allow attackers to take over the devices, steal passwords, and access sensitive data. Dell has released updates and says users should install them immediately. Tens of millions of devices are affected, including the Latitude and Precision series which are widely used by organisations.
Microsoft: The US cybersecurity agency has issued a rare emergency directive as the result of a critical vulnerability in Microsoft Exchange email servers. It has given federal agencies until August 11 apply Microsoft’s recommended mitigations.
SonicWall: Password reuse and a vulnerability that has been addressed are behind a spike in attacks targeting Gen 7 and newer firewalls. according to the company. SonicWall says the cause of many of the incidents it’s investigating are related to a failure to reset local passwords when upgrading devices.
WhatsApp: A new feature is designed to make the app’s group chat feature a bit safer. A “safety overview” context card includes information about the group’s creation date, the number of members, potential scam attempts, and instructions on how to control who can add you to WhatsApp groups. “It will include key information about the group and tips to stay safe. From there, you can exit the group without ever having to look at the chat.” Meta says that in the first half of this year WhatsApp took down 6.8 million accounts “linked to criminal scam centers.”
D-Link: The US Cybersecurity and Infrastructure Security Agency has warned about serious vulnerabilities affecting some D-Link WiFi cameras and video recorders. In the case of older models, the issues haven’t been addressed because they’re no longer supported. For the rest, updates were released in 2020.
Google: The company had planned to deactivate web links that had been shortened using its goo.gl service. Now it’s reversing course…mostly. It appears to be the result of feedback that “the links are embedded in countless documents, videos, posts and more.” Google says shortened links will continue to work unless a deactivation notification has already been issued.
Zimbra: Hhotfix for the following editions: Zimbra 10.1.11 (Release Notes), Zimbra 10.0.17 (Release Notes).