Finding the phone numbers of 3.5 billion WhatsApp accounts. Exploiting job cuts.
Microsoft's risky AI helper. US surveillance. Playing the long game. And London phone thieves are Apple fans.
Leaky
WhatsApp makes it easy to find contacts on the platform; add a phone number and it will tell you if there’s a related account. Turns out that could be used to extract the phone number of virtually every WhatsApp user on the planet. University of Vienna researchers obtained the information by inputting 63 billion possible phone numbers and then recording the 3.5 billion successful results (together with profile details). Despite bombarding WhatsApp with 7,000 queries per second, the platform made no attempt to limit the searches. WhatsApp has now implemented controls and said it was grateful to the researchers for identifying “a novel enumeration technique that surpassed our intended limits.”
This type of story reminds us that the more convenient a technology is, the less likely it is to be secure. In the case of WhatsApp, it would have been relatively simple to design the system to block multiple contact searches. Instead, the platform regarded phone numbers and profile details as “publicly available information.” But, as the researchers found, in some cases profiles revealed sensitive details about users including sexual orientation, political views, drug use, and links to other social media platforms. Millions of phone numbers were also associated with accounts in countries where WhatsApp is banned.
Threats
Jobs: Scumbags are busily taking advantage of the “challenging” employment market by posing as recruiters and sending messages about job vacancies. They use a variety of tactics but a favoured one is to try to lure victims into an interview over Zoom. In reality, the link is designed to install malicious software on the target device. As with all unsolicited or unexpected contacts, scepticism is the watchword. Malwarebytes
LinkedIn: Meanwhile, Britain’s domestic security service has warned that China is using the employment platform to target the UK parliament and “lay the groundwork for long-term relationships.” LinkedIn is a favoured tool of Chinese intelligence agencies (which we’ve seen personally several times). The most common approach involves a young, female recruitment consultant making contact in an attempt to open a conversation. AP
Ingenious: Apple’s systems allow anyone to create a support ticket. That means you shouldn’t trust unexpected communications from Apple, even if they appear genuine. Apple user Eric Moret has a great account of a scam that exploits the feature. It begins with a text message containing an unexpected two-factor authentication code and continues with repeated phone calls in which scammers masquerade as Apple support agents. It’s all designed to steal the victim’s iCloud credentials - and in Moret’s case it worked.
Copyright: XTwitter users are being targeted with notices asking them to review possible copyright violations. Clicking on the button to review them brings up a login page designed to harvest the users account credentials. Forbes
Shopping: It’s almost time for Black Friday and the start of scammers’ most beloved time of the year. NordVPN says there’s a sharp rise in the number of fake online shops at this time of the year, including a flood of eBay lookalikes. Euronews
AI
Copilot: Microsoft has taken the bold step of releasing a new feature while warning that it’s inherently unsafe. “Copilot Actions” contains a set of “experimental agentic features” designed to perform “everyday tasks like organising files, scheduling meetings, or sending emails.” But Microsoft also warns that users should only enable Copilot Actions if they understand the security implications. Of these, the most important is that malicious prompts can be inserted into innocuous looking documents, potentially allowing data to be stolen and malicious code to be run. Copilot Actions are turned off by default and only available in test versions of Windows for the moment.
Trust: Despite the well-demonstrated propensity of AI models to make mistakes, a survey found that British users tend to believe what they say anyway. Consumer group Which? tested the responses of popular chatbots to questions on issues such as health, finance, and travel. Accuracy ranged from 50% (Meta) to 71% (Perplexity). A survey of more than 4,000 UK adults found half of them used AI to search the web - and 47% of those said “they trusted the information they received to a “great” or “reasonable’ extent.” The Register
Personal: An Anthropic researcher weighs up the pros and cons of AI large-language models. It’s a long article examining the potential ways in which AI could be misused. One eye-catching possibility is the evolution of ransomware to power personally targeted blackmail (supported by AI’s ability to analyse the contents of a device and identify incriminating details.) The conclusion of the article is that there’s too much focus on developing AI models and far too little on making them safe.
Trump
Panopticon: 404 Media reports on the extensive surveillance capabilities of Immigration and Customs Enforcement, covering vehicle records and combining them with other information including phone numbers, addresses, associates, and social media activity. Extensive may be an understatement.
Agency: The Trump administration’s cuts to the US Cybersecurity and Infrastructure Agency have resulted in an “approximately 40% vacancy rate across key mission areas,” according to its acting director Madhu Gottumukkala. He says the agency will now embark on a hiring spree to try to address the deficiency.
In brief
Long game: Financial scammers are willing to engage in protracted conversations to gain the trust of their victims. Researchers at the University of California San Diego found that on average they engaged with people over 7.8 days (the longest scam went on for 46 days). To examine the scammers’ tactics, the researchers built a system using AI personas to engage them at scale and identify common tactics. One giveaway is a request to move the conversation from the original platform, usually to WhatsApp.
Samsung: This week saw headlines about “unremovable Israeli spyware” on some Samsung phones. The reality is slightly different. The “spyware” is actually a marketing app called AppCloud which is designed to persuade users to install other apps and it’s been around for several years. Nonetheless, it does have Israeli roots, collects some personal information and it can’t be removed easily. Calling it “spyware” might be a stretch but it’s a good example of the lack of transparency in our relations with everyday technology. Forbes
Loyal: Smartphone theft in the street is called “apple picking,” and it seems thieves in London do have a strong preference for iPhones. London Centric has talked to Samsung owners who had their phones stolen only for them to be returned when the villains found they weren’t iPhones. The article also has a salutary warning not to engage with strangers who strike up a conversation that involves looking at and unlocking your device.
Exposed: The US Department of Defense is at heightened risk because so much sensitive data about personnel and their devices is easily accessible through data brokers and data breaches. The US Government Accountability Office says the department needs to address the security risks of publicly available information.
GDPR: The EU is proposing changes to its data protection framework that envisages loosening controls on the use of personal data to train AI models. Opponents have called it “the biggest rollback of digital fundamental rights in EU history.” The changes also provide for an end to individual cookie popups. Instead, users would be able to save their preference as a browser setting. Neowin
Updates
End-of-life: A reminder not to continue using devices - particularly routers - when manufacturers stop supporting them. For example, some 50,000 ASUS WRT routers have been compromised in an attack that researchers say appears likely to be linked to China. All of the devices are “end-of-life,” with support for some of them ending as far back as 2023. And D-Link is warning about three remotely exploitable vulnerabilities that affect all models and hardware revisions of its DIR-878 router. It has also reached end-of-life but is still available in several markets.
Chrome: And a reminder to make sure you keep your web browser updated (just shut it down every evening). Updates are too frequent to mention, but this week there are two particularly serious vulnerabilities that affect the way Chrome handles JavaScript which of course is fundamental to the way we interact with the web. The issue also affects any browsers built on Google’s Chromium codebase including Microsoft Edge, Opera, Brave and Vivaldi.
AirDrop: Google says the Quick Share file transfer feature on Pixel 10 smartphones now works with Apple AirDrop. Google apparently developed the capability without any input from Apple and, for the moment, it requires AirDrop’s “Everyone for 10 minutes” mode to be enabled. We await Apple’s reaction to this with interest.
Fortinet: Updates to address a new FortiWeb vulnerability that is being actively exploited.
WhatsApp: Meta is reported to be testing support for multiple accounts on the same iPhone. We usually wait until features are released before reporting them, but this is a feature that has been requested for so long that we thought you might be interested. WABetaInfo