Microsoft accused of "gross cybersecurity negligence." Executives in the cross hairs.
Anthropic copyright settlement blocked. US withdraws from anti-disinformation agreements. And lessons from Jaguar Land Rover.
Negligent
We don’t follows many US senators but Ron Wyden is an exception. He’s not only knowledgeable about technology but he’s also forthright in calling out the problems created and perpetuated by the technology industry. His latest target is Microsoft. In a letter to the Federal Trade Commission, he accuses the company of “gross cybersecurity negligence” and says glaring failures enabled a ransomware attack against US critical infrastructure. In particular, he cites the case of a 2024 incident at Ascension, one of the largest hospital operators in the US. The attack shut down computers, forced the suspension of surgeries and resulted in the theft of sensitive data about more than 5 million patients.
Senator Wyden said an investigation by his office found that the Ascension hack began with a malicious link served up to a contractor following a search on Microsoft Bing. As a result, the contractor installed a software tool that gave hackers access to Ascension’s network. According to Wyden, the attackers then gained access to privileged accounts by exploiting an “ancient, insecure” encryption technology which Microsoft discourages companies from using but which is supported by default on Windows computers.
Microsoft has been guilty of a series of security lapses; indeed a US government report issued last year said an “inadequate” security culture had helped suspected Chinese hackers to steal emails from US officials. As a result, Microsoft launched an initiative to revamp security across the organisation. This has had some positive results but the fact remains that it and all the other technology giants remain more focussed on rolling out new products than on fixing underlying problems. That’s obviously a problem for everyone, but above all for organisations, and individuals, facing an elevated level of threat. For high risk projects, it’s crucial to take specific precautions and specialist advice.
Threats
Executives: A wave of spear phishing (targeted) emails are focussing on senior executives across a wide range of industries. The emails pose as OneDrive document-sharing notifications with subject lines such as “Salary amendment” or “FIN_SALARY.” Stripe
Teams: Attackers are using a fraudulent Microsoft Teams download site to try to infect Mac users with information stealing software. CloudSEK says the criminals registered the teamsonsoft[.]com domain and created a realistic looking download page complete with official Microsoft branding and logos.
Impersonation: Chinese spies impersonated a US congressman in an attempt to collect information ahead of US-China trade talks, according to the Wall Street Journal. The paper says the messages, which came from a non-government email address, asked recipients to provide feedback on proposed sanctions against China, telling them their insights were “essential”.
Facebook: A sophisticated campaign is targeting content creators and small businesses with deceptive advertisements promising free Facebook verification badges. The ads are bundled with a video tutorial that guides viewers through the process of downloading and installing a malicious browser extension Bitdefender
Kenya: Police installed commercially available spyware on the phones of two filmmakers while they were in custody, according to analysis by Citizen Lab. The documentary makers were arrested after being accused of publishing false information. As we warn in our awareness sessions, the risk to journalists doesn’t always stem from sophisticated spyware. The tool used in Kenya is called FlexiSPY. It has many of the capabilities of much more expensive solutions but costs from just $179 per year. CPJ
AI
Copyright: Anthropic has sought to differentiate itself from other AI giants by putting ethics at the forefront of its operations. A $1.5 billion agreement to settle an authors’ copyright lawsuit was very much part of that framework. Unfortunately for Anthropic, a federal judge in San Francisco has blocked the settlement, saying it left important questions unanswered. Reuters
Source: Google’s AI-generated Overviews are drawing about a tenth of their source material from…AI-generated content. Originality.ai (which makes AI detection software) studied 29,000 Google queries, ran the results through one of its tools and found that 10.4% were probably generated by a large-language model. (Due to our ban on tech jargon, we should add that a large language model is an AI system trained on vast amounts of data, so in this case it’s as if the snake is eating its own tail.)
SIFT: On a similar theme, a digital literacy expert has a strategy to “help determine whether online content can be trusted for credible or reliable sources of information.” SIFT stands for; Stop - check your emotional response to what you’re reading; Investigate - what others saying about the source; Find - search other sources to cross reference; Trace - look for any original content to make sure it’s being quoted accurately. MIT via Simon Willison
Trump
Disinformation: The US has terminated agreements to fight disinformation that the Biden administration signed last year with European countries. The agreements were focussed on hostile states including Russia, China, and Iran. FT
Facial: The US Immigration and Customs Enforcement is to pay up to $10 million to use Clearview AI’s facial recognition software. The agency says it will use the software to identify individuals who assault its agents. According to Forbes, it has also used fake cell towers to spy on people’s phones.
In brief
Lessons: A nasty cyber incident at Jaguar Land Rover (JLR) closed production lines and damaged consumer confidence (not to mention its share price). That’s bad - but it could have been worse. Unlike some organisations, JLR reacted immediately to the attack and shut down IT across its (widely distributed) operations. This is likely because it had a well-rehearsed response plan. It’s now a racing certainty that sooner or later all organisations will experience a security breach - the key is what is done to prepare for it. Deciding what to do once you have been attacked is guaranteed to make a bad situation worse.
Apple: Lots of excitement about new Apple products this week, but what caught our eye was the news that one of the key features of its new AirPods won’t be available in the EU when they’re launched. The AirPods Pro3 can translate audio in real-time but the feature is powered by Apple Intelligence and that’s currently the subject of EU data protection concerns.
WhatsApp: Meta’s former head of security claims the company ignored repeated warnings about WhatsApp vulnerabilities and privacy violations. Attaullah Baig, who’s suing the company for wrongful termination, says more than 1,500 WhatsApp engineers had unrestricted access to user data. He accuses WhatsApp’s executives of retaliating with negative work reviews as soon as he started reporting his concerns.
Pakistan: Amnesty International says Pakistan is using phone tapping and an internet firewall to spy on millions of people in what it calls one of the most far-reaching surveillance programmes outside China, . Reuters
China: Security journalist Kim Zetter has the story behind the unmasking of a vast Chinese operation to vacuum up proprietary information from industrial organisations and research groups. She talks to the leader of the team at Mandiant that revealed what was going on. Even though this happened 12 years ago, the details remain fascinating and throw light on some of the activities that have powered China’s extraordinary growth.
Fined: A costly week for Google which is facing fines of nearly $4 billion for misleading users about their privacy and “abusing its dominant position in advertising.” The decisions came in a San Francisco court and in an announcement by the European Commission. The Commission also told Google to “stop its illegal practices and…put an end to its inherent conflict of interests in the Adtech industry.” Or else.
Blur: Every smartphone has a unique fingerprint created by the characteristics of its camera lens. Researchers are calling it a “blur signature” that’s the result of a variety of “degrading effects.”
Qatar: A new law imposes strict limits on filming and photography in public places. An addition to the existing Cybercrime Law criminalises the publication or circulation of images or video of individuals without their consent, regardless of whether the subject was aware they were being recorded. Pinsent Masons
LookCam: The security camera’s Android app is riddled with security vulnerabilities, according to a security researcher. Wladimir Palant says the app’s encryption scheme and access controls are both fake. “Everything that could be done wrong, has been done wrong,” he says. The app has been downloaded more than a million times.
Updates
Plex: The media streaming platform has told users to reset their passwords following the theft of “emails, usernames, and securely hashed passwords.” (Hashing means that the password has been converted into a string of characters that can’t be read by a third party - providing a secure method has been used).
Microsoft: Monthly release includes fixes for streaming issues caused by last month’s updates.
Patch Tuesday: Monthly security updates from Adobe, SAP, Ivanti, Dell, IBM, NVIDIA, Arm, Qualcomm, and D-Link.
Signal: The secure messaging app has introduced its first paid feature which allows users to create secure backups of text conversations. Up to 45 days of storage is free. Longer periods will cost $1.99 per month.
Zoom: Urgent security update for Windows client and Workplace platform to address multiple flaws, including a critical vulnerability that could allow attackers to hijack or manipulate the application. Security updates for Zoom come thick and fast which means it’s always worth checking you have the latest version when launching the app.
SecureDrop: Workstation 1.4.0 and Client 0.17.0 improves Tor integration and fixes issues with USB devices.