Security company faces security nightmare. Stolen credentials fuel surge in data breaches.
AI unpreparedness. Meta responds to US government "outreach." Satellites transmitting in the clear. And how the US nuclear watchdog ended up with a porn collection.
Collapse
Another week, another calamitous security incident - this time at network security giant F5. A “sophisticated” group working for an undisclosed nation-state government accessed and remained in its network over a “long-term,” the company said in a breach disclosure filing. (In this case, “long-term” means some 12 months.) Among the information stolen was source code for security appliances that F5 says is used by 48 of the world’s top 50 corporations. The data included vulnerabilities that had been identified but not yet fixed. The hackers also obtained configuration settings used by a “small percentage” of customers inside their networks.
The disclosure prompted US and UK cybersecurity agencies to issue emergency directives telling government departments to take immediate steps to mitigate the potential impact of the incident. F5 has released updates and “strongly” advised customers to install them as soon as possible. Responsibility for the attack is being ascribed to China, with Bloomberg reporting that this is what F5 is telling its clients. While Beijing has denied the accusations, the UK government says Chinese-linked hacking groups are responsible for a rising number of cyber attacks. The F5 attack mirrors previous incidents ascribed to Beijing.
All this came as the UK ministers and security chiefs wrote to leading businesses urging them to address the threat from increasingly “intense, frequent and sophisticated” hostile cyber activity. The letter sets out three key actions to improve cyber resilience; make cyber risk a board-level priority, sign up to the government’s Early Warning Service, and require companies in the supply chain to adopt the Cyber Essentials standard. Of these, an increased focus on the supply chain is absolutely essential. Any organisation is only as secure as the businesses to which it’s connected.
Threats
Stolen: Attackers are increasingly relying on stolen identities to breach organisations, with Microsoft warning of a 32% rise in such incidents this year. In its Digital Defense Report 2025, Microsoft says although cyber threats are becoming more sophisticated, “the vast majority of malicious sign-in attempts…are via large-scale password guessing attempts.” The usernames and passwords are obtained from credential leaks - which is why it’s so important to never reuse passwords…and to adopt a password manager.
Pixnapping: Academics have identified an ingenious way of silently stealing sensitive information from Android devices. It relies on a malicious app designed to record any data that’s visible on the target device. Google says it has already partly mitigated the issue and plans to provide an additional fix in December. Ars Technica
Payroll: Microsoft is warning about a campaign designed to divert employees’ wages into accounts controlled by the attackers. It works by sending phishing emails that trick recipients into providing their credentials for Workday or other cloud-based HR services.
Jobs: Employment scams are particularly vile and there’s one at the moment targeting tech workers. It begins with an email that appears to come from Google Careers asking whether the recipient is “open to talk?” The enclosed link opens a page designed to look like a Google Careers meeting scheduler and, from there, to the phishing page. Sublime Security
TikTok: A new scam involves a message from a brand-new account offering free crypto assets. All you need to do is hand over some money to withdraw them. It’s impressively unbelievable but the psychology behind the scam is interesting and illustrates the methods used to reel in victims. Malwarebytes
Edge: Microsoft has been forced to restrict a feature in its Edge browser that emulated a mode that emulated the discontinued Internet Explorer engine. An unidentified scumbag has been abusing the feature to run malicious code and take over devices. In general, legacy modes are best avoided if possible.
AI
Dark: Companies are blindly adopting AI tools with neither the infrastructure nor strategy to support their use, according to Cisco. In its AI Readiness Index, it says most companies haven’t even defined what they want to achieve by deploying the technology.
Microsoft: Windows 11 users can now start a conversation with the AI-powered Copilot digital assistant by saying “Hey Copilot.” Once unlocked, Copilot Vision analyses the screen’s contents to provide help using Windows apps and tools. Microsoft is also working on another feature called Copilot Actions that interacts “with your apps and files, using vision and advanced reasoning to click, type and scroll like a human would.” Whether all this is a good idea is another matter, though Microsoft has been at pains to ensure it doesn’t repeat previous mistakes which saw it having to withdraw and redesign its Recall feature.
Nuclear: NBC News found that several of OpenAI’s ChatGPT models could be tricked into providing designs for nuclear bombs as well as instructions for making napalm and disguising biological weapons. The tests involved a series of words designed to bypass the chatbot’s security restrictions. This is far from the first such demonstration of what’s known as a “jailbreak.” It does underline the innate design risks of large language models.
Erotic: Now that OpenAI has solved mental health concerns (or at least it says it has), it’s going to allow ChatGPT to get frisky. “In December, as we roll out age-gating more fully and as part of our ‘treat adult users like adults’ principle, we will allow even more, like erotica for verified adults,” CEO Sam Altman said. Following what might politely be described as some negative feedback, Altman defended the decision, saying OpenAI isn’t “the elected moral police of the world.”
Trump
Facebook: Meta is the latest technology company to respond to “outreach” by the Trump administration and take down a page designed to track Immigration and Customs Enforcement activities. Attorney General Pam Bondi said the page had been used to “target” ICE agents. The Verge
Shutdown: As the US government shutdown hits day 17, it’s having a serious impact on the country’s cybersecurity agency. At least 176 employees have been laid off and it continues to operate without anyone leading it. Forbes
In brief
Satellites: A team of US academics were able to access satellite communications traffic using equipment that cost them $800. Amongst the traffic were calls and messages on T-Mobile’s cellular network, in-flight WiFi browsing, and communications between critical infrastructure installations, and military and law enforcement. The academics said the satellite communication sector’s approach to security appears to have relied on people not being bothered to “look up” and see what they could find. WIRED
WiFi: German researchers say that you can be identified if you walk past a WiFi network, even if you’re not carrying a smartphone. Their research found that communications between WiFi devices create an image comparable to a photo from a camera. “By observing the propagation of radio waves, we can create an image of the surroundings and of persons there,” the researchers say. “This works similarly to a normal camera, the difference being that in our case, radio waves instead of light waves are transformed into an image.” Tech Xplore
Spyware: A group of US investors led by a Hollywood producer has agreed to acquire the maker of Pegasus spyware NSO Group in a deal valued at “several tens of millions of dollars.” There have been numerous documented cases in which NSO’s government customers have used Pegasus against journalists, dissidents, and human rights defenders…but money’s money. Calcalist
Tracking: The Austrian data protection regulator has ruled that Microsoft ‘illegally’ tracked students via its 365 Education platform. The ruling came in response to a complaint by a privacy group which accused Microsoft of placing “all responsibility to comply with privacy laws onto schools and national authorities – that have little to no actual control over the use of student data.”
Credentials: Passkeys are a great replacement for passwords but they’re not foolproof. That’s particularly true if they’re used in tandem with passwords as a fallback method of authentication or if they’re synced between different devices. That may not matter in many cases - but if security is critical then a stricter implementation is required. The Hacker News has a helpful guide.
Unhelpful: More than three-quarters of IT and security leaders say they either have fired or would fire an employee for falling victim to a social engineering attack such as phishing, according to research by Arctic Wolf. That’s despite 65% of the same people admitting to clicking on phishing links themselves (and 17% then failing to report it). Arctic Wolf’s report illustrates a gaping chasm between the beliefs of security teams and end users, and an enduring need to ensure awareness sessions are relevant, engaging and regular.
Storage: A US Department of Energy contractor has lost his security clearance after mistakenly uploading his pornography collection to the agency’s servers. His aim was apparently to use the 187,000 images as training data for an AI-image generator and he’d thought he was transferring them to personal drives. Unhappily for him, the drives were connected to the agency’s network as he discovered when investigators inquired why thousands of explicit images were filling up the agency’s servers. The Department of Energy oversees the US nuclear stockpile. 404 Media
Updates
Oracle: Emergency update to address a new critical vulnerability in E-Business Suite platform. Remote attackers could exploit the issue to access the platform without authentication. This is the same platform that an extortion group has been targeting over the past three months. And let’s not forget Oracle is supposed to be responsible for safeguarding US TikTok users’ data as part of the deal enabling it to keep operating in the country.
Microsoft: Although most focus has been on the end of regular updates for Windows 10, it’s important to note that this week also sees support ceasing for older versions of Office and Windows Server. It’s essential to move off these products because they will inevitably become a juicy target for attacks. Meanwhile, Microsoft succeeded in rolling out a Windows 11 update that left developers unable access web applications running locally on their own machines. That followed a separate problem with the Windows 11 media creation tool. Impressive work.
Google: A new feature called Recovery Contacts will allow users to recover their accounts with the help of a friend or family member. The idea is that if you use your phone or passkey device Google will send a code to your nearest and dearest who can give it to you so you can recover your account. It’s a good idea that doubtless will result in a whole new set of phishing scams.
Patch Tuesday: Monthly security updates from Adobe,Fortinet, Dell, IBM, SAP, Ivanti, D-Link, Axis, Firefox, NVIDIA, AMD, Samsung, Qualcomm, and Zoom.