Why identity is the new key to security. Free gifts.
AI gets new skills - and introduces new risks. Testing internet legislation. The menace of stalkerware. And the huge market in illegal gambling.
Identity crisis
One of the biggest technology deals this year was Palo Alto Networks’$25 billion acquisition of CyberArk, a leading player in identity security. As Forbes reports, the deal “underscores a shift that’s been building for years - one where identity is not just another layer in the stack, but the connective tissue holding everything else together.” The traditional approach to cybersecurity involved barriers to keep attackers out, and systems to detect them if they managed to get in. It assumed authorised users were legitimate and threats were external. But now many of the most damaging incidents stem from compromised credentials and unauthorised access by insiders, or by attackers impersonating them.
Research suggests organisations are ill-prepared to deal with this sort of threat. Orchid Security found that basic identity controls such as login rate limits, password complexity and account lockout policies were missing as much as 40% of the time. And in 48% of cases credentials were being stored insecurely. As Orchid points out, this isn’t so much due to negligence as because of the ever more complex business of managing identity securely. Hence Palo Alto Networks paying so much for a company which does precisely that.
Credential theft is so valuable that much of the cybercrime job market is focussed on those with relevant skills. ReliaQuest says experts in deepfakes, and English speakers adept at social engineering are in high demand. It warns organisations to prepare for the rising threat of social engineering attacks. In particular it points to the need for “strict help-desk procedures, secondary verification for MFA (multi-factor authentication) device enrolment, and training users to only use official channels for IT support.”
Threats
Gifts: KnowBe4 has been examining the “free gift” scam which tries to elicit a response from victims by offering them a product from a trusted brand. To claim the gift, all you have to do is complete a short survey and pay a minimal “shipping fee.” Of course, the aim is to steal financial data. As KnowBe4 explains, while the scam appears pretty basic, its ability to evade common security checks is based on a sophisticated technical infrastructure.
Contact: Attackers are using organisations’ public Contact Us forms to initiate conversations and bypass email filters. Check Point says the campaign is mostly focussed on the US and many of the targets are involved in critical industry sectors, though other countries and businesses have also been affected. One novel aspect; the attackers’ strategy involves creating convincing websites for the fake companies they claim to represent. Their About Us page shares the same photo…of White House butlers.
Kids: Children are increasingly at risk of financial exploitation by criminals who approach them online, according to research from The Children’s Society. The UK charity says minors are being used to launder money and the exploitation is often accompanied by sexual threats. This is a worldwide problem and can have devastating consequences as a recent example in Kansas illustrates. Forbes reports that within an hour of meeting someone on TikTok a child had shot himself because of a threat to publish nude photos of him online. The gunshot was fatal.
SendGrid: Fraudsters are exploiting the email platform to distribute phishing emails and evade security controls. The lures are disguised as security alerts and contain a link that, if clicked, leads to what looks like a genuine SendGrid login portal. Cofense
World Cup: Almost 500 malicious domains have been registered as scumbags prepare to target next year’s FIFA World Cup tournament in the US. BforeAI
AI
Risky: AI assistants are gaining new capabilities - and with them bringing new threats. This week, Anthropic launched Claude for Chrome, a web browser-based AI agent that can take actions on behalf of users. But if your AI assistant can control your browser, what’s to stop a malicious site from controlling it? Anthropic has implemented controls to mitigate some but not all of the vulnerabilities. Researchers are concerned. Simon Willison, who has written extensively on AI security, says, “in the absence of 100% reliable protection I have trouble imagining a world in which it’s a good idea to unleash this.” Writing about the risk of malicious hidden prompts, venerated technologist Bruce Schneier said, “This kind of thing should make everybody stop and really think before deploying any AI agents. We simply don’t know to defend against these attacks….It’s an existential problem that, near as I can tell, most people developing these technologies are just pretending isn’t there.”
Privacy: Meanwhile, Anthropic is to start training its AI models on users’ data, including chat transcripts, unless they opt out. If you do agree, previous chats will be off-limits, unless they’re resumed. Anthropic will also retain user data for five years, again unless users opt out.
Safeguards: OpenAI is strengthening safeguards for ChatGPT’s interactions with distressed users following the death of a teenager who killed himself after spending hours discussion suicide with the chatbot. The measures include a particular focus on content filters and on longer interactions which OpenAI points to as a particular risk.
WhatsApp: A new feature offers users “a little help” with writing their messages. ‘Writing Help’ is WhatsApp’s latest AI feature and is designed so that messages remain private. “You can review the suggestions from AI in various styles such as professional, funny, or supportive,” WhatsApp says. It’s initially available in the US in English, and sounds like a ghastly idea.
Liars: The Commonwealth Bank of Australia has been ordered to rehire 45 workers it fired and replaced with an AI chatbot. A union had claimed the bank lied when saying the chatbot had reduced call volumes by 2,000 a week. The bank admitted an “error.” Bloomberg
Trump
Control: In a test to the limits of domestic internet legislation, the 4chan messaging platform is refusing to pay fines levied under the UK’s Online Safety Act. It’s now suing the UK communications regulator in Washington DC, saying threats and fines it has issued “constitute foreign judgments that would restrict speech under US law.” It has called on the Trump administration “to invoke all diplomatic and legal levers available to the United States to protect American companies from extraterritorial censorship mandates.” Meanwhile, the Financial Times reports that the UK government has yet to formally withdraw its demand that Apple grant access to customer data. Not only that, but the order appears to be far broader than originally thought.
Copycat: The Social Security Administration’s chief data officer alleges that the Department of Government Efficiency uploaded a copy of all federal Social Security numbers to insecure cloud storage, creating “enormous vulnerabilities” for people’s private information.
Phone: A wee update on the Trump Organisation’s “gold-finish” smartphone which seems to be going through something of an identity crisis. A “premium” Android device was due to be on sale by September, though the promised date has long disappeared from the Trump Mobile website (along with a pledge that it would be “designed and built” in the US). As for the phone itself, the first publicity photos for it looked like an iPhone, the latest like a Samsung Galaxy. The reality remains a mystery - but Trump Mobile is still urging people to pay $100 to get in line to be the first to find out. The Register
In brief
Stalkers: More evidence that “stalkerware” apps should simply be banned. Not only are they often used by abusive partners, but they’re also inherently insecure. TechCrunch has been following one app called TheTruthSpy for years and has demonstrated its security failings which can be exploited to reveal details about both the stalker and the stalked. While TheTruthSpy is no longer available, its underlying code is used in many apps with similar functionality and similar failings. It’s a disgrace that they continue to be available in Google’s Play Store. TechCrunch
China: A Beijing-backed espionage campaign known as Salt Typhoon may have “stolen information from nearly every American,” according to the FBI. The deputy assistant director for the bureau’s cyber division told The Register that people shouldn’t assume China is only interested in people who work in sensitive areas. Salt Typhoon began in 2019 and succeeded in gaining widespread access to US telecommunications infrastructure. It was only uncovered last year.
Proton: The privacy-focussed communications company says it’s begun moving some physical infrastructure out of Switzerland citing “legal uncertainty” created by the government’s proposed surveillance law. Its privacy-first AI chatbot, Lumo, is the first product to be affected. TechRadar
Russia: As the government moves to exert greater control over internet usage, reports say Google Meet experienced several outages over the past week. Users had migrated to Meet after regulators blocked Telegram and WhatsApp calls. Meduza
Throttled: Microsoft is limiting the number of external recipients to which new 365 accounts can send emails. The 100 recipient limit is part of an attempt to crack down on scammers who have been abusing Microsoft’s default onmicrosoft[.]com setting.
Gambling: Illegal operators captured 71% of Europe’s online betting and casino market last year, or €80.65 billion, according to Yield Sec data. That represents a 53% rise in illegal gross gaming revenue. In this case, “illegal” means platforms not licensed to operate in jurisdictions they are targeting or transacting with. At least these platforms don’t have theft as their basic business model, unlike websites that lure gamblers with free credits and eventually abscond with any cryptocurrency funds they have deposited. As KrebsOnSecurity reports, hundreds of polished sites have emerged - all linked to the same Russian platform designed to make fraud as simple as signing up for an email account.
Purgatory: An online Telegram group named Purgatory is behind a series of hoax active-shooter alerts at US universities over the past week. WIRED reports that the group is selling what are known as “swatting” services for prices ranging from $20 to $50. It’s also offering intimidation services, including tyre slashing and throwing bricks through windows, for as little as $10.
Updates
Word: Microsoft is changing the default location for autosaving Word for Windows documents. From now on, they will be saved automatically to the cloud. Microsoft says, “Now you don’t have to worry about saving your documents.” That is unless you don’t have access to the cloud. Since this behaviour is on by default, anyone who doesn’t like it will have to go into settings to turn it off.
Citrix: Thousands of NetScaler ADC and NetScaler Gateway instances remain vulnerable to attack because of vulnerabilities that are already being exploited. Citrix has urged customers to install the fix immediately.
Passwordstate: Update to address a high-severity vulnerability in the enterprise-grade password manager. The issue can be exploited to gain access to vaults that are often used to store organisations’ most privileged credentials.
Spotify: Shortly after announcing quarterly losses, the music platform has launched a direct messaging feature that consolidates sharing in a dedicated chat-like interface. We can see the advantage for Spotify, which has admitted that its revenue from advertising has been disappointing. Doubtless the move will also be welcomed by scammers who get a new way to interact with potential victims. We’re less clear about the benefits for users, who face a 10% hike in prices from next month.
Android: Google has announced a huge change to its policy on which apps can be installed on Android devices. While it has gradually imposed a little more control on the ecosystem, its approach has been pretty much “anything goes.” From next year, that’s all changing. It says it will check and verify the identities of developers regardless of where they offer their apps. Despite being a victory for common sense and security, it conflicts with the desire of many Android users to install what they want from wherever they want. Many of them have taken to Reddit to express their displeasure.