Security failure at scale. AI data loss. WhatsApp risks. Abusing surveillance technology.
Data protection in California. And social media use declines - except in North America.
Broken
Network security outfit SonicWall has admitted that last month’s security breach affected anyone who used its cloud service to store backups of their firewall configuration files. Last month the company said “Fewer than 5%” were affected.” The backup files are valuable to attackers because they include firewall settings, policies, and network configurations, enabling someone to map a target’s complete infrastructure. SonicWall’s admission follows an independent investigation. The company has told customers to delete any existing cloud backups, change credentials, and store new backup files locally rather than in the cloud.
All this comes in what is laughably termed Cybersecurity Awareness Month, an annual event that’s supposed to result in improved attitudes to digital safety. The problem, as this newsletter illustrates every week, is that both the technology and the organisations that use it are woefully bad at cybersecurity. It’s true that this year has seen a spike in high-profile attacks, viz. Jaguar Land Rover, Marks & Spencer, Salesforce etc. etc., but the reality is that at every level too little emphasis is placed on the basics of digital security. Helpdesks continue to be tricked into resetting passwords without proper checks. And widely-used software turns out to have glaring flaws. This week a widely used database solution called Redis released an update to address a critical vulnerability that impacts every version released over the past 13 years. And dozens of Oracle customers are facing extortion demands after a vulnerability in E-Business suite was exploited for several months without anyone noticing.
In that context, it’s no surprise that ransomware groups are having such a fine time of it. Despite some successful law enforcement operations, it’s obvious that criminals continue to hold the upper hand. And recently, they’ve begun to co-operate with each other, provoking ReliaQuest to warn that there could be “a surge in attacks on critical infrastructure [that could] expand the threat to sectors previously considered low risk.” The impact of these attacks has been devastating for some companies and individuals but we fear we ain’t seen nothing yet.
Threats
WhatsApp: Attackers are using WhatsApp messages in a campaign designed to monitor financial activity. The messages contain a ZIP file with an apparently benign document such as a receipt. When uncompressed, a Windows shortcut appears. Running that is what causes the infection. Currently, the campaign is mainly focussed on Brazil. Trend Micro
1Password: Malwarebytes has the tale of one of its employees who received a convincing email trying to get him to hand over his login details for 1Password. The email told him his password had been found in a data breach and so he needed to change it. Had he followed the attached link, he would have given his details to the phisher folk. No matter how convincing an email looks, never follow links to do anything important like change a password.
Jobs: As if looking for a job isn’t stressful enough, it’s now essential to make sure recruiters aren’t actually North Korean scumbags in disguise. ESET says they’re using both fake and hijacked profiles to pose as recruiters on platforms like LinkedIn, Upwork, Freelancer, and Crypto Jobs List. They offer fake lucrative job opportunities to attract their targets’ interest. Victims are requested to take part in a coding challenge or a pre-interview task which involves downloading booby-trapped files to their devices.
Mouse: Regular readers will know we are avid collectors of weird ways to steal data. The latest involves the humble computer mouse - or in this case posh gaming versions of it. Researchers used machine learning to process the output of high-performance optical sensors and convert minute vibrations into intelligible speech. Mic-E-Mouse
AI
Lost: AI “is now the single largest blind spot for data exfiltration in the modern enterprise,” according to browser security platform LayerX. “Unlike email or file sharing, where security teams have built years of governance, the majority of AI usage is happening in the shadows; outside SSO [single sign-on], outside visibility, and outside enterprise control,” it says. Since it’s hawking its own security product, LayerX is hardly a disinterested party, but its warning does echo what we’re seeing.
Memory: Prepare to pay vastly more for computer memory thanks to demand created by the AI boom. “Nearly every analyst firm and memory maker is now warning of looming…shortages that will send prices skyrocketing over the coming months and years, with some even predicting a shortage that will last a decade,” Tom’s Hardware reports.
CAPTCHA: You know those irritating puzzles designed to prove we’re human. If they ever did, they don’t now. As a demo from Simon Willison illustrates, a web browser interface from Browserbase makes quick work of a succession of the puzzles.
Trump
Surveillance: A Texas Sheriff and the Flock surveillance firm claimed a license plate search was part of a search for a missing person but documents reveal that in fact it was part of an abortion investigation. The documents, obtained by the Electronic Frontier Foundation, show police were discussing whether they could charge the woman in the case with taking an abortion pill. Meanwhile, WIRED reports that US Customs and Immigration Enforcement plans to hire an investigations team to sift through social media to find leads for possible arrests and deportations.
Moved: Cybersecurity personnel at the Department of Homeland Security have been shifted to jobs supporting President Trump’s deportation agenda. Bloomberg says the employees were given a week to accept the changes or resign in what’s seen as an attempt to force them to quit rather than be fired.
Deleted: After Apple and Android banned an app to track ICE actions, Apple has also taken down one designed to archive video of the agency’s actions. The decisions were taken following pressure from the Department of Justice, saying the apps put ICE agents at risk.
In brief
Opt-out: A new law in California requires browser makers to allow Californians to opt out of having their personal data sold. It means browsers will have to include a setting to notify web companies that user data is not for sale. The law specifically states that this must be implemented in the browser itself rather than in hated cookie-pop-ups. The Record
Social media: Time spent on social media globally peaked in 2022 and is now steadily declining with young people cutting back first, according to figures from the Global Web Index analysed by the Financial Times. The one exception is North America. There, the FT says “ consumption of social media’s diet of extreme rhetoric, engagement bait and slop continues to climb. By 2024, it had reached levels 15% higher than Europe.” In China, a government campaign has banned expressing negative emotions online.
Russia: The government has been temporarily blocking foreign SIM cards, in a more apparently designed to counter Ukrainian drone strikes. The Record
VPNs: Yet another warning about free VPN apps, but one worth repeating. Free apps of any sort are never actually free but will always try to extract value from your use of them. They may also be unsafe. Zimperium looked at the security of some 800 free Virtual Private Networking services available to Android and iOS users. Their conclusion; they’re riddled with security failures and many come with the ability to spy on what the user is doing. ZDNet
Phones: Police in London finally managed to dismantle a gang which has been merrily removing iPhones from their owners and dispatching them to Asia where most are dismantled and sold for parts. This has been going on for years but police initiated an operation last December after seizing a shipment of 1,000 phones as it was about to leave Heathrow airport. Insurance statistics this year revealed that nearly two-fifths of phone thefts across the whole of Europe took place in the UK. The Register
Messaging: The EU has dropped a proposal to allow the scanning of private messages even on end-to-end encrypted messaging platforms after Germany and The Netherlands refused to support it. The legislation was part of efforts to combat child sexual abuse material.
Kids: Two 17-year boys have been arrested in connection with the cyber-attack on a nursery chain. Following the attack details of young children were posted online.
Targets: More evidence that younger people are particularly vulnerable to digital scams. A study of US cybersecurity found that over the past year there has been a significant increase in text messaging-based scams, especially for people aged between 18 - 29 years old. In one encouraging finding, the Consumer Cyber Readiness Report says use of password managers has risen from 36% to 42% since last year.
Updates
Microsoft: With 3 days left before the end of standard support for Windows 10, you won’t be surprised that 250 million or more computers have yet to be upgraded to Windows 11. The final updates and security fixes for Windows 10 arrive next Tuesday. After that, organisations will have to pay to continue to receive updates at a cost of $61 for the first year (a price that doubles in subsequent years). Consumers have a variety of options to continue to receive updates, unless they’re in the European Economic Area where Microsoft has had to agree to provide them free of charge. The Register
Smart: The Dutch government has urged citizens to update their smart devices. It says a third of the population admit to failing to update them frequently or regularly, and a significant proportion never does. It’s a timely reminder that smart plugs, lightbulbs and so on represent a significant risk. Tempting as it is, they can’t simply be installed and forgotten.