Technology failures and fiascos. Defrauding the elderly. Meta's permissive AI rules.
Breaking MacBook screens with a greeting card. And researchers conclude social media can't be fixed.
Cracked
Regular readers will know that the frailty of modern technology is one of our abiding bugbears. This week has thrown up a motley collection of failures and f**k-ups that reinforce our view that many of the solutions in common use are simply not fit for purpose. The evidence;
-
Security researcher Micah Lee has been explaining how he managed to access US government messages sent using Telemessage, a supposedly secure clone of the Signal app. As he told the DEF CON conference, it came down to Telemessage’s hopeless security which meant messages were stored in plaintext despite claims they were encrypted “end-to-end.” And the app’s source code was riddled with vulnerabilities. (A reminder that clones of secure apps may be anything but.)
-
An encryption solution designed for police and military radios in Europe can be easily cracked. This is the same solution that two years ago was recommended to improve security in the same system. Ars Technica
-
Free WiFi on buses in Taiwan leaves them vulnerable to remote attacks capable of taking control of critical systems. The problem lies in the on-board router. Researchers say they told the manufacturer about the issue but the company has done nothing about it. DEF CON
Flaws in a carmaker’s online dealership portal exposed the private information and vehicle data of its customers, and could have allowed hackers to remotely break into any of its customers’ vehicles. TechCrunch
Threats
Older: Although research shows Generation Z faces a heightened threat from online crime, older adults remain a favoured target for fraud. The US Federal Trade Commission says Americans over the age of 60 lost $700 million to scams last year. In 2020, the figure was $120 million. Common tactics include fake security alerts designed to alarm the victim.
Passkeys: Proofpoint has shown how secure “FIDO-based” authentication solutions can be bypassed by tricking users into using a less secure method. It’s known as a downgrade attack and uses a dedicated tool that appears to show passkey authentication failing. The good news is that while the method is technically feasible, there’s no evidence of it being used. Yet.
Work: Scam job offers are rife at the moment, appearing as text messages that promise easy money for simple tasks. The old rule about anything too good to be true applies. appleinsider
Characters: Attackers are using a character from the Japanese Hiragana alphabet to make their malicious link look like a genuine Booking.com site. On some systems, the ん character resembles a forward slash which enables the scumbags to present a link that looks like the real thing but in fact leads to a very realistic copy of the actual Booking.com site. A similar technique is being used to imitate Intuit. Bleeping Computer
Booking.com: On the subject of the widely used travel site, Which? has an investigation into the ongoing problem of scam bookings - and advice on how to avoid falling for them.
Amazon: Scammers are using fake product recall messages to try to scare victims into following a link designed to steal sensitive information. The messages say an item doesn’t meet Amazon’s standards, isn’t safe to use, and a full refund is available. If in doubt, check your Amazon account rather than opening unsolicited links. Malwarebytes
Vibrations: The latest in our occasional series on exotic threats. This time it’s about eavesdropping on cellphone conversations. Researchers from Penn State have published a paper exploring the potential for remotely deciphering a call from the minuscule vibrations produced by the device’s earpiece. These are monitored by millimetre radar and fed through an AI model. At the moment, accuracy hovers around 60%. TechXplore
AI
Leaked: An internal document seen by Reuters shows that Meta’s AI rules allowed its chatbots to hold “romantic or sensual” conversations with children.
Homes: Researchers managed to use Google’s Gemini AI to hack smart homes. They inserted invisible prompts into Google Calendar invites so that when someone asked it to summarise their upcoming week, lights went out, shutters opened…that sort of thing. Black Hat WIRED
Snafu: That would be the polite way of describing Open AI’s calamitous rollout of its new large language model. Last week, we reported some early doubts. Those turned into widespread complaints which forced OpenAI to allow users to select earlier models. Bleeping Computer
Google: OpenAI is rolling out support that will enable Gmail, Google Calendar, and Google Contacts to integrate with the Pro version of ChatGPT. Once a service has been connected to ChatGPT, it can reference content from it in future interactions.
Tax: HMRC has confirmed it’s been using AI tools to monitor social media activity in some tax-related investigations. Daily Telegraph BBC
Interviews: AI has taken over so much of the recruitment process and brought with it so many problems that now employers are resorting to face-to-face interviews. The Wall Street Journal says virtual interviews are a particular issue because candidates are using AI to feed them answers to questions.
In brief
Screen warning: MacBook screens can be broken by something as thin as a greetings card if you put it on the keyboard and close the screen, as a viral TikTok video shows. The issue, according to Apple, is the tight tolerance between keyboard and screen.
Russia: The government has begun restricting voice and video calls on WhatsApp and Telegram, saying the move is aimed at preventing the use of foreign messaging apps for fraud.
China: Living in or visiting China is practically impossible without WeChat, the ubiquitous platform that does far more than just messaging. US academics and The Citizen Lab have analysed how the WeChat ecosystem uses analytics to track “user activity at an unprecedented scale with no way for users nor developers to opt out.”
Alexa: Users in the UK found themselves trapped in what resembled a Black Mirror episode, as Amazon’s smart assistant went on the blink. Among the results were alarms that refused to be silenced or went off at the wrong time. And users who blamed Alexa’s breakdown for their late arrival at work.
Age: Despite a rise in VPN use, UK traffic to pornography sites has plummeted following the introduction of age verification rules. Both Pornhub and XVideos saw a 47 percent fall according to Similarweb. While the UK Online Safety Act may have impacted pornography use, the flip side is its effect on legitimate sites such as Wikipedia, much of whose content also falls with the remit of the act. Cory Doctorow takes aim at the UK government’s decision as an example of politicians’ wilful failure to understand the fundamentals of technology.
Hanging up: Remarkably, AOL still offers dial-up internet access, 36 years after it was first introduced (under the Yahoo! brand). But the plug is finally to be pulled on September 30. Memories…
Unfixable: There’s reasonably broad agreement that some of the impacts of social media are profoundly damaging, whether it’s reinforcing false narratives, exacerbating polarisation, or any of the other issues you might choose to mention. Numerous mitigations have been proposed to combat these problems but University of Amsterdam research says there’s little chance any of them will be effective. The academics says this is because the issues underlying the negative outcomes are embedded in social media’s very architecture. Ars Technica has an interview with the authors.
Updates
WinRAR: The file archiver has issued an update to address a “zero-day” (i.e. previously unknown) issue that Russian attackers, among others, are reported to have exploited.
7-Zip: The popular file compression utility also has a serious vulnerability that affects all versions prior to the recently released 25.01.
Instagram: A new feature allows users to share their location with their followers. Instagram Map is turned off by default and arrives 10 years after a similar feature was discontinued following complaints about harassment and stalking.
Exchange: At the time of writing, more than 26,000 Microsoft Exchange email servers are missing the fix for a vulnerability in “on-prem” devices (i.e. those hosted by an organisation itself). What makes this so serious is that access to the on-prem server can be used to access the organisation’s online cloud environments. Shadowserver Foundation
Citrix: Fix for a Netscaler vulnerability that is being used to breach organisations. The Dutch cybersecurity agency says it’s already being used to attack organisations.
Lenovo: Users of the 510 FHD and Performance FHD webcams should ensure they are running 4.8.0 firmware which addresses a serious vulnerability in the devices. Eclypsium
Fortinet: The company has warned customers about a critical vulnerability in FortiSIEM which could allow an unauthenticated attacker to execute unauthorised commands. A way to exploit the issue has already been found. Customers need to upgrade to a fixed version. As a workaround, Fortinet suggests limiting access to the phMonitor port (7900).
Patch Tuesday. Bumper edition of the monthly update release. Security fixes from Adobe, Microsoft, SAP, Ivanti, Fortinet, Check Point, Intel, AMD, NVIDIA, Dell, Zoom, Synology, and Axis. Microsoft has admitted problems with Windows Server Update Services (WSUS) which is preventing the fixes from being installed. Home users don’t appear to be affected.