Impotence in the face of online crime. Lost iPhone threat. AI and suicides.
Samsung spyware breach. And a collapsing Russian robot.
Phishing for dummies
A lawsuit filed by Google illustrates the preposterous scale of online scams and the lack of effective controls to do anything about them. Google’s lawsuit is directed at 25 unnamed China-based scammers, who are alleged to be behind an operation described as a “phishing for dummies” service. For a monthly fee, subscribers buy access to hundreds of templates and tools to create fake websites designed to trick victims into entering financial information and other sensitive details. The scams often begin with text messages warning of an “unpaid toll violation” or a package delivery problem. Research by Silent Push found that over a 20-day period, the kit had been used to create more than 200,000 fraudulent websites and target over one million victims in 121 countries.
The problem is that none of the defendants are going to end up in court. While the scammers’ infrastructure appears to have been disrupted following the lawsuit and international efforts to combat cybercrime do yield results, the chances of China extraditing anyone to the US are vanishingly small. Google’s lawsuit is the second it has filed this year; the previous one was also directed at 25 unnamed individuals in China who are accused of breaking into more than 10 million devices worldwide. In a reflection of the powerlessness of US courts, Google says it’s working with the US Congress to create “robust public policy” to address the threat of scams. The proposed legislation would cover increased funding to protect older people, a taskforce to block automated phone calls from abroad, and a national strategy to counter the compounds where many scams originate.
Threats
iPhone: The Swiss National Cyber Security Centre is warning about scam messages that claim to have found your lost or stolen iPhone but are actually trying to steal your Apple ID credentials. The scammers appear to be taking advantage of the Find My app message where owners often include an email address or phone number so they can be contacted if someone finds their device.
Hotels: Fraudsters have been stepping up the use of compromised Booking.com accounts to attack travellers. They begin by stealing a hotel’s account and then use it to send messages to guests which, while fake, contain real reservation details. The messages usually claim a security issue requires updated banking information. Sekoia.io
Hyphens: You have to admire the ingenuity of the scumbags behind phishing campaigns. One of their latest tactics is to use “soft hyphens” to defeat email filters. Most email clients don’t display the hyphens, so the recipient doesn’t see them and they appear to the filter as multiple random letters separated by hyphens (though that alone seems pretty suspicious).
Hi: Investment scams are now the fifth most common type of fraud in the US according to a broker comparison site, and they often begin with a simple “Hi, How are you?” message. Fraudsters scour social media sites and the web for potential victims, and they’ll try to keep the conversation going even when told they have the wrong person. ZDNET
Facebook: Criminals exploited legitimate Facebook features to bombard more than 5,000 businesses with phishing emails designed to steal their credentials. Check Point says the scammers created Facebook Business pages for fake businesses and used the Business invitation feature to send apparently genuine phishing emails.
Photos: Some popular Android-based photo frames download malicious software when they start up, according research by Quokka. It says the behaviour didn’t happen on all of the Uhale-branded products but they also suffered from multiple other security issues. The Chinese company hasn’t commented.
AI
Suicides: Seven more families have filed lawsuits against OpenAI, claiming that the company released its GPT-4o model prematurely and without effective safeguards. Four of the lawsuits address ChatGPT’s alleged role in family members’ suicides, while the other three claim that ChatGPT reinforced harmful delusions that in some cases resulted in inpatient psychiatric care. TechCrunch
Spies: In the first documented case of its kind, Anthropic says Chinese state attackers used the company’s AI to launch cyber attacks with minimal human intervention. There were some 30 global targets including large tech companies, financial institutions, chemical manufacturing companies, and government agencies. Anthropic says only a small number were compromised.
Jobs: 32% of organisations expect to reduce their headcount next near as a result of AI, according to research by McKinsey. Large enterprises are more likely than smaller companies to expect an AI-related reduction, although McKinsey says the overall impact on the number of jobs and the nature of work remains unclear.
Private: In its ceaseless quest for more data, Google has launched “Private AI Compute” which is designed to reassure users that they can take advantage of AI capabilities while their data remains protected. Google says the feature is designed to process “the same type of sensitive information you might expect to be processed on-device” while using the greater power of Google’s infrastructure.
Trump
Breach: The effects of a security breach at the US Congressional Budget Office continue to be felt, with other federal employees warned against interacting with the agency. An email obtained by Politico told Library of Congress staff not to open links in emails or interact with staff via Zoom or Microsoft Teams.
Grok: NewsGuard has found instances of the X AI chatbot stating that Donald Trump won the 2020 presidential election. In one case, when asked initially who won, Grok gave a more or less balanced answer before going on to say “I believe Donald Trump won the 2020 election.” In two other cases, it simply said Trump won. NewsGuard says it found multiple examples of users pointing to Grok’s response as evidence of 2020 election fraud.
ICE: Fake videos of immigration enforcement raids are rife on Facebook, according to 404 Media. Despite being wildly unbelievable, one has garnered 4 million views and 16,600 likes. Meanwhile, the FBI has warned that criminals have taken to posing as Immigration and Customs Enforcement officers. It’s urged ICE agents to identify themselves when challenged by the public.
In brief
Samsung: Attackers exploited a vulnerability in Samsung Galaxy devices for nearly a year, installing spyware designed to record calls, track locations, and access photos and logs before Samsung addressed the issue in April. Unit 42 says the surveillance campaign took advantage of an unidentified (“zero-day”) flaw in Samsung’s mechanism for processing images.
Insurance: The Association of British Insurers paid £197 million in cyber insurance claims to UK organisations last year. That’s a 230% year-on-year increase over the £59 million paid in 2023. It says malicious software and ransomware accounted for 51% of the claims.
WhatsApp: Meta appears to be planning to add extra security features for users at high risk of being targeted by hackers. WABetaInbfo spotted that the latest test version of WhatsApp includes a new “Strict account settings” feature, although enabling it will reduce the app’s functionality.
Awareness: Simulated phishing emails combined with sustained cybersecurity training significantly reduce risky behaviour, according to a multinational research project. That’s not altogether surprising given that in the research anyone who clicked on one of the fake emails had to attend mandatory training before being allowed to go back to work. We’re dubious about the practicality of this type of approach. We believe tailored awareness programs are cheaper, more effective and and actually leave people some time to do their jobs.
Armenia: Russian disinformation groups have begun targeting next year’s parliamentary elections at an unusually early stage. NewsGuard says the tactics remain the same with AI-generated news sites, coordinated social media accounts and manipulated videos being used to spread fake stories about government corruption while portraying pro-Kremlin parties as patriotic saviours.
Robot: The public unveiling of Russia’s first humanoid robot did not go well. After staggering on stage and giving a feeble wave, it promptly collapsed whereupon its minders dragged it away and covered it with a black shroud. They blamed calibration and lighting issues. The video is worth a look. New York Times
Updates
Microsoft: Fix for a problem which prevented some Windows 10 PCs from signing up for extended security updates. Microsoft also released its monthly set of updates, which include solution for more than 60 vulnerabilities.
Asus: New firmware to address a critical security vulnerability in several DSL series router models.
Patch Tuesday: Monthly security updates from Adobe, Dell, IBM, SAP, Ivanti, Intel, NVIDIA, Synology, and Zoom.
Tails: Release 7.2 updates the Tor Browser, Thunderbird, and the Linux kernel.