Defending against social engineering. The ubiquitous threat from deepfakes.
The viral app that pays you to record your phone calls. Scumbags post nursery children's details online. And are houseplants messing with your WiFi?
Persuasion
The devastating impact of ransomware attacks is all too evident from the incident at Jaguar Land Rover which is about to enter its fourth week. While some systems are being restarted in order to pay suppliers, production remains at a standstill. The culprit remains unidentified, though a hacker calling himself “Rey” says he’s responsible and claims it’s the second time in six months that he succeeded in breaching the company’s networks. Such claims should be taken with a shovel of salt, but there is every chance that those behind the attack share similar tactics with the young hackers who have caused havoc at leading organisations in the UK and around the world.
For organisations, the crucial lesson from these attacks is that the key risk stems from social engineering - or in other words from using psychology to persuade people to do something they wouldn’t normally do. Bloomberg has an invaluable long-read which delves into the background of Noah Urban and his role in the notorious Scattered Spider gang. His specialty had nothing to do with technology and everything to do with exploiting people’s good nature. “It was difficult to convince employees they’d filed an IT ticket when they hadn’t, but he could make them believe one must have been linked to their account by mistake—could they please help him out by just assisting him in closing it out so he could end his shift?”
Urban is now serving a 10-year prison sentence and two other alleged members of Scattered Spider were arrested last week, but the threat they represent remains. Social engineering works and, as we report below, AI makes it more powerful. It’s crucial to have tried and tested procedures and policies to mitigate the threat. No password should be reset, no payment made without checks to ensure the request is genuine.
Threats
Deepfakes: A survey by Gartner illustrates the widespread use of fake audio and video in attacks against organisations. The most common technique involved social engineering calls using deepfake audio, with 44% of cybersecurity leaders saying their organisation had experienced this in the past year. Gartner also found widespread attacks on AI systems with the aim of stealing sensitive information. The Register
Sex offender: A North Korean espionage group has been using “sex offender notices” to trick victims into running its malicious software.
AppSheet: Google’s AppSheet platform is being exploited to send phishing emails. Users are more likely to open the emails because they come from AppSheet’s legitimate infrastructure. Hackread
Copycats: A campaign that targets macOS users with malicious software is impersonating popular products delivered through fraudulent GitHub repositories. Some 100 software solutions are affected, including password managers such as LastPass and 1Password. The aim of the campaign is to persuade the victim to run malicious commands by copying them into the Terminal app (a so-called “ClickFix” attack). LastPass
FBI: The agency says cybercriminals are creating sophisticated spoofed versions of its Internet Crime Complaint Center (IC3) website to harvest visitors’ personal details.
AI
Voices: The pitch; we’ll pay you if you let us record your phone calls so we can flog the data to AI companies. The product; an app that briefly became the second most downloaded app in the social networking section of Apple’s US app store. The outcome; the app goes offline after TechCrunch finds an egregious security flaw that allowed anyone to access the phone numbers, call recordings, and transcripts of any other user. Every now and then we incline slightly towards despair.
Workslop: Stanford University researchers say employees are struggling with the impact of AI-generated work content that “masquerades as good work, but lacks the substance to meaningfully advance a given task.” In an article in the Harvard Business Review, they say “workslop” is destroying productivity, with employees reporting that they waste nearly two hours fixing the consequences of each case. The findings are based on an ongoing survey (which you can take…)
Kidspeak: Post of the week comes from a parent who says their 9-year old and his classmates have started using “that’s AI” to mean “I don’t believe you.” e.g. “We’re having dinosaur meat for dinner.” Response, “That’s AI.” We’re hoping fervently this is true. JA Westenberg
Trump
TikTok: In an attempt to highlight protests against immigration raids in Los Angeles, users have been referring to them as being part of the “LA Music Festival.” The idea is that music-related posts are a key driver of TikTok revenue so, unlike posts about immigration protests, it’s impossible to suppress them. Since control of TikTok in the US is about to pass to a consortium of pro-Trump billionaires, the value of such tactics may be short-lived.
YouTube: Creators previously banned for spreading misinformation about COVID-19 and elections are to be allowed back on the platform. YouTube cited its “commitment to free expression” as the reason for the decision. YouTube also plans to replace fact-checking with user-added context notes, similar to the approach at XTwitter. Parent company, Alphabet, also accused the Biden administration of having pressured YouTube to remove content that didn’t violate its policies. The Hill
OpSec: Courtesy of President Trump, comes a reminder to check who a message is being sent to. Perhaps he really did mean to post publicly his instructions to his Attorney General to hurry up and pursue his political opponents - but it certainly doesn’t look like it (not least because the message was promptly deleted before being reposted). Politico
In brief
Nursery: Criminals stole data from the Kido chain of nurseries and demanded a ransom. Kido refused, so the attackers promptly posted ‘profiles’ of 10 children online with pictures, birthdates, who they live, and contact details. They’re how threatening to publish more profiles unless they’re paid. One mother told the BBC that she had received a threatening phone call from the criminals. It appears the data was obtained from a software service called Famly that says it’s used by more than one million “owners, managers, practitioners and families”.
ID: Amid what could be described charitably as challenging times, the UK’s Labour government has suddenly decided that a digital ID will be mandatory in order to work in the country. This wasn’t included in the Labour Party’s election manifesto and is being positioned as a way to combat illegal immigration. Details are scarce though the government says it will be “designed with best-in-class security at its core.” So that’s all good.
Network: You probably saw headlines about the US Secret Service taking down a network capable of crippling telecom systems in the New York area. The announcement came in the run-up to the UN General Assembly and called it an “imminent telecommunications threat” with links to “nation-state threat actors.” That may be true but the main aim for creating a network of “SIM farms” is to send the malicious text messages that plague anyone with a cellphone. As such, the last thing their operators would want is to disrupt cellular services.
Israel: Microsoft has ceased a contract with the Israeli intelligence service which has been using cloud infrastructure to process and analyse Palestinian phone calls and messages. The contract was revealed in August and led to multiple protests by Microsoft employees.
Timid: The UK government is “too timid” in defending vulnerable undersea internet cables from attack, a cross-party committee says. The Joint Committee on the National Security Strategy warns that the UK’s undersea internet cable network represents a strategic vulnerability in the event of hostilities.
Expensive: Amazon is to pay $2.5 billion to settle claims by the US Federal Trade Commission (FTC) that it used sophisticated subscription traps to trick millions of users into enrolling in its Prime program and made it as difficult as possible for them to cancel.
Fail: Most anti-phishing training doesn’t work, according to a study by the University of California and Censys. The researchers say both face-to-face and simulated phishing emails were found to be equally ineffective. They say the key to the success of a phishing email is the subject matter. In their study, barely anyone clicked a link to update their Outlook password, but 30.8% followed one that referenced an update to vacation policies. The researchers say training fails because people don’t engage with the material - and they suggest organisations focus on technical measures instead. We agree technology is crucial - but so are initiatives that ensure employees are up-to-date with the tactics used to phish them.
Disinformation: Russia has flooded Moldova with disinformation ahead of parliamentary elections this weekend, according to researchers. They say coordinated campaigns mark a new phase in Russian influence operations. While spoof websites impersonate legitimate Western media outlets, AI bots are also being used to overwhelm comment sections with posts deriding the pro-European Party of Action. Meanwhile, Politico reports that a similar operation is taking place in the Czech Republic.
Batteries: An investigation suggests it would be wise to avoid low cost lithium-ion batteries because of the likelihood that they contain manufacturing defects. Lumafield used CT scans to examine more than 1,000 battery cells and found 33 had a defect that increases the risk of “short-circuiting and catastrophic failure.”
Plants: If your WiFi connection isn’t up to scratch the culprit might be your houseplants, according to Broadband Genie. It says large plants - or many of them - can absorb and deflect signals. There’s probably some truth in this given the physics involved in 2.4 GHz radio waves, but you’d need a lot of greenery in a small space to make a real difference. If you live in an apartment, the effect of all the neighbouring WiFi networks is probably much more significant. The Register
Updates
GoAnywhere: Fix to address a maximum-severity vulnerability affecting Fortra’s Managed File Transfer tool. The issue shares similarities with a defect in the same file-transfer service two years ago. That one resulted in attacks on more that 100 organisations.
Microsoft: For most users, Microsoft will end support for Windows 10 on October 14th, unless they’re in the European Economic Area (EEA) where they’ll get another year of free updates. This has nothing to do with munificence on Microsoft’s part but is instead the result of pressure from European consumer groups. They had argued that Microsoft’s decision to charge for ongoing updates was a breach of the EU’s Digital Markets Act. For anyone not in the EEA (i.e. the UK), ongoing support will cost $30, 1,000 Microsoft Reward points, or the use of Windows Backup. Windows Central
Meta: A year after introducing “Teen Accounts,” Meta is expanding their use to Facebook and Messenger. Meta says the accounts are “designed to address parents’ top concerns with automatic protections to limit who their teens are talking to online and the content they’re seeing, and ensure their time is well spent.” They were introduced to Instagram last year and are supposed to be mandatory for all teenagers, while 13 to 15-year-olds need a parent’s permission to change safety-related settings. We’re far from convinced about how effective any of this really is. And in any case, do you know a teenager who uses Facebook?
WhatsApp: Elsewhere, Meta is launching a translation function for WhatsApp messages. It can be activated by a a long-press on a message and tapping “Translate.”
SonicWall: A firmware update is designed to address a severe vulnerability in SMA appliances.
Cisco: Updates for 14 vulnerabilities in IOS and IOS XE, including one that is already being exploited.
SolarWinds: Emergency update to address a critical vulnerability in Web Help Desk that can be used to run code remotely without any authentication.