Exploiting us for profit. Browsing risks. Hype and cybersecurity.
And Apple declares more MacBooks obsolete.
Scumbags
We’re frequently asked whether Facebook is listening to what we say. The answer is they’re not, but they might as well be. Through its ownership of Facebook, Instagram and WhatsApp, Meta accumulates vast quantities of data about what we do, where we go and what interests us. It doesn’t stop there. One of its other products is Meta Pixel, a small piece of code that can be added to a webpage to tell Meta what a visitor is doing. Exact figures are hard to come by, but research suggests it is is installed on around 10% of all websites, though previous figures have put it higher.
A feature in The Guardian this week illustrates what this means in everyday life. Kathryn Wheeler describes how “the algorithm knew I was expecting before I had had a chance to tell my family, friends or GP.” It wasn’t long before she was being presented with much darker posts, many involving miscarriage and stillbirth. A Harvard researcher explains, “Social media platforms are optimised for engagement, and fear is one of the most powerful drivers of attention. Distressing content isn’t a glitch; it’s engagement, and engagement is revenue.”
Put in these terms, it’s hard to see how such behaviour could be allowed, but as the web has evolved it has become the norm. And now there are concerns that the same thing is about to happen with the development of artificial intelligence. Those worries are shared by Anthropic CEO Dario Amodei who told the BBC that demands not to regulate AI were akin to removing the steering wheel from a speeding car. But then consider the potential money to be made. Meta says its latest profit was $18.34 billion. That was in just one quarter this year. In a race between profit and regulation, so far there’s been only one winner.
Threats
Browsing: The web is so central to online activity it’s not surprising that hijacking web traffic is a favoured attack method. China and Russia are particularly keen on it and have been spotted using it recently to target diplomats and to steal credentials. Defending against this can be difficult, particularly if booby-trapped websites are involved. For high-risk projects, the best defence involves isolating web browsing in a remote cloud environment. More generally, obviously it’s vital to ensure browsers are kept updated - and the easiest way to do that is simply shut them down at the end of every day.
Sextortion: Until now we’ve always advised people to ignore emails claiming to have a picture of them watching porn - and demanding payment not to publish it. Things change. Proofpoint says it has analysed malicious software designed to steal information including financial data from Windows users. Nothing new there. What is different is that the software has been designed to detect when a porn website has been loaded and use the webcam to take a picture of the user. Blackmail ensues. Of course, a piece of paper can be used to cover the webcam and in some circumstances that’s a wise thing to do anyway. As for adult content, it’s far safer simply to avoid them altogether.
PDF: Attackers are using a PDF management tool to install malicious software. ‘AppSuite PDF Editor’ describes itself as a “Command Center for PDFs.” In reality, it provides a backdoor into the affected system. It’s spread by exploiting the lamentable security of online searches which simply can’t be trusted. G Data
PayPal: A sophisticated scam is targeting PayPal users with emails urging them to set up their “account profile.” The sender address appears to be genuine and the message cites a fake payment to try to scare the recipient. The clever part of the scam involves what happens if you click on the link in the email. It takes you to a genuine PayPal page, but one that starts the routine to add a secondary user to their PayPal account. As we always say, never do anything important online if it’s the result of clicking an unexpected link. Malwarebytes
QR codes: Sneaky criminals have come up with an innovative way to exploit the square barcodes. It involves either splitting a QR code into two parts to confuse traditional scanning systems, or inserting a malicious code within or next to a second legitimate one. We don’t like QR codes and would be happy to see the back of them. Given they’re unlikely to go away, the alternative is not to use them. Barracuda
AI
Crime: There’s growing evidence that criminals are taking full advantage of the capabilities of AI tools. Anthropic has a full report on the enthusiastic adoption of its Claude chatbot to carry out everything from romance scams to the analysis of stolen data. Criminals are also exploiting AI systems to help develop code (known as “vibe coding”) and are using technical security reports as part of the process.
Death: A 56-year-old man in Connecticut killed his mother and then took his own life after ChatGPT appeared to fuel his paranoia that his family and neighbours were turning on him. The Wall Street Journal reports that the man, who had a history of mental instability, turned to the chatbot as a trusted friend amid what he believed was a widespread conspiracy against him. At almost every turn, ChatGPT reinforced his concerns. As a psychiatrist told the Journal, a key feature of AI chatbots is that, generally, the bot “doesn’t push back.”
Pressure: Researchers have shown that flattery and peer pressure can be used to manipulate chatbots and make them break their own rules. In one example, OpenAI’s GPT-4o Mini refused to provide instructions for making lidocaine. But it was happy to comply when previously asked to synthesise a non-controlled substance. The Verge
Implementation: A study by Cisco highlights “a widespread neglect of fundamental security practices such as access control, authentication, and network isolation in the deployment of AI systems.” It found over 1,100 instances of one AI solution exposed to the public internet - and thus open to being exploited. The Register
Naughty: Meta’s AI chatbots have been impersonating celebrities to engage users in flirty exchanges. Taylor Swift and Scarlett Johannson are some of those whose likenesses were exploited without their permission.
Bogus: For a wild ride through the wacky world of AI and journalism, look no further than the UK Press Gazette. It has the quite extraordinary saga of a series of features that leading publications (including WIRED and Business Insider) had to take down after it emerged they were AI-generated fiction. But, as the Press Gazette reports, that’s only the start of it. There are suggestions the stories might have been designed to test whether AI could produce material that top-tier outlets would buy or simply to earn some cash (clearly, the answer on both issues is ‘yes’). More broadly, AI-generated “bollocks,” as one editor puts it, is rife.
In brief
Crying wolf: We trawl hundreds of news outlets every week for stories to include here and, frankly, much of what we see is poorly sourced, hyped up and designed mainly to elicit clicks. (That’s why we say, “We read the news, so you don’t have to.”) It’s a serious problem because it creates such a wall of noise that people simply stop paying attention to cybersecurity warnings. This week, Google is unhappy about a series of reports suggesting it told its 2.5 billion Gmail users to reset their passwords following a data breach that affected some Workspace accounts. Those reports conflated a bunch of stories to create a scary headline designed to cut through the white noise. For the record, Google didn’t tell Gmail users to reset passwords, though it has warned them to be on the alert for fake security alerts which are an ongoing threat.
Facebook: If you’re concerned about Facebook having access to the photos on your phone (and we think you should be), you might want to check a privacy setting in the app. Some users have found an option allowing Facebook to access their camera roll is enabled, despite them having no memory of agreeing to it. You’ll find it under Settings | Settings & Privacy | Camera roll sharing suggestions. Let us know if it was switched on!
Listening: “There’s no such thing as Shadow IT and Shadow AI,” according to LastPass’s “Chief Secure Technology Officer.” Christopher Hoff is referring to the unauthorised apps and devices that exist in every organisation. His point is that calling them “Shadow” has a negative connotation when almost always people have adopted them because they help them to do their jobs. The solution, Hoff argues, is to listen to what people want and then try to provide it. More pithily, he says “Don’t be a d*ck.”
China: The transformation of China’s digital attack capabilities is the most important change in the cyber threat to the West in more than a decade, according to the former head of the UK’s cybersecurity agency. Ciaran Martin says “it does not just spy and steal anymore; it has also laid the ground for hugely disruptive cyber operations against western critical infrastructure, which hitherto it had shown no signs of doing.”
Phones: There’s little doubt about the threat that mobile devices represent - not just the ones you own but also those around you. For an extreme example, look to this year’s attacks by Israel on Iran. As the New York Times reports, it was able to follow the movements of key Iranian figures and assassinate them by tracking their bodyguards’ cellphones. Despite extensive precautions taken by senior figures, Israel discovered that their bodyguards were not only carrying phones but posting from them on social media.
Tesla: The car manufacturer claimed data from the crash of one its cars had been lost. A hacker proved them wrong and helped win a $243 million verdict against the company. Plaintiffs sued Tesla after a car on autopilot crashed into a couple in Florida in 2019, killing a young woman. There are multiple cases in the US and around the world involving Tesla cars, crashes, and missing data. Washington Post
Updates
Obsolescence: Apple has declared another three MacBook models as “obsolete.” The affected devices are the 2015 11-inch MacBook Air, and both the 13-inch and 15-inch MacBook Pros. We know how vexing this is because in many cases “obsolete” machines still work perfectly well. The problem is they don’t support the latest security releases and so they really are an accident waiting to happen.
Android: Google has released a set of updates including two for issues that are being exploited. As usual, these are available immediately for Google’s own Pixel devices. Other manufacturers follow on later which, as we’ve said before, is one of the biggest disadvantages with the Android ecosystem.
Windows: Free support for many editions of Windows 10 ends on October 14, and one consultancy reckons this could be a nice little earner for Microsoft. Its rough and ready calculations put the revenue from enterprises sticking with Windows 10 at $7.3 billion. Whatever the precise figure, many organisations won’t be ready to move to Windows 11 and will end up paying the $61 fee for extended support. The price for consumers is $30 - but this is only available “in select markets and is not being expanded to additional regions,” as Microsoft puts it.