Dispelling "hack lore." The risk of calendar invites. Cheating AI models.
The tool that could have disrupted the major cloud providers. And UK children facing endemic online blackmail.
Myths
Let’s be honest; lots of cybersecurity advice is bollocks (and much of what’s online is designed to harvest clicks). Now, a former security bigwig has launched a project that aims to separate myth from reality. Hacklore.org is the brainchild of Bob Lord, a former head of security at the Democratic National Committee, and it has the support of a range of leading industry figures. It’s designed for “everyday people and small businesses” rather than high-risk individuals and it aims to replace misleading advice with “clear, fact-based guidance” that manages real risk.
Much of the problem with the “myths” lies in oversimplifying complex problems, though some - like regularly changing passwords - is just plain wrong. That’s because if you have to keep changing your password, you’ll almost certainly choose a bad one. Much better to only change a password if it’s been compromised, adopt a password manager, and start using passkeys wherever possible. Other myths the project wants to bust include warnings to avoid public WiFi, turn off Bluetooth connectivity, and never scan QR codes.
Although the aims of the project are laudable, there is a risk that it too oversimplifies things. It’s true that the risks of public WiFi are overstated - the only significant issue to watch out for is a request for personal information when connecting to a network. Likewise, while we don’t advise people not to use QR codes, we do think you should be careful about scanning them in public places like car parks because they continue to be used to link to malicious websites. One thing we completely agree with is the project’s exhortation to software manufacturers to make their products safe. And the Hacklore site also has an invaluable collection of links to excellent cybersecurity resources.
Threats
Calendars: There’s increasing use of calendar invites as phishing lures. Some are designed to persuade the recipient to call a phone number. Others are for an online meeting. Either way, they’re dangerous because the default settings for most calendar apps mean invites are added automatically. Although this is convenient, we suggest changing it so they’re not. Malwarebytes
Takeover: The FBI has marked Thanksgiving week with a warning about a surge in account takeovers. There are multiple versions of the scam - but all aim to hijack an account and the agency says they’ve resulted in losses of $262 million in the US this year. The FBI’s warning echoes a similar one from Amazon highlighting the risk of brand impersonation scans. The FBI has tips including taking care not to overshare personal information online and enabling multi-factor authentication wherever possible. In reality though, the best defence is scepticism and a refusal to be rushed no matter how urgent or attractive the message or offer.
Sneaky: Malicious windows that pop up inside your browser are becoming increasingly sophisticated and very convincing. One variant involves displaying a login form inside the browser window that’s designed to harvest login credentials. Another leverages fake versions of pornography websites, most likely reached through malicious adverts. The good thing is that all these attacks require the user to type commands or agree to changes, so again the best defence is never to do so unless absolutely sure it’s safe.
Swaps: Put the letters ‘r’ and ‘n’ next to each other and they look very much like an ‘m’ - as in microsoft. This is a well-worn trick called ‘typo squatting’ designed to lure people into clicking on a malicious link and handing over their login details. It’s a good reason to use password managers because it will recognise that the site’s name is wrong even if you don’t. Cyber Security News
Messengers: The US Cybersecurity and Infrastructure Security Agency (CISA) has warned that concerted spyware campaigns are targeting high-value users of popular messaging platforms. It says attackers are using multiple tactics including device-linking QR codes, zero-click exploits, and spoofed versions as they seek to compromise WhatsApp, Signal and Telegram accounts.
AI
Cheaters: Kudos to Anthropic for publishing research that shows just how dangerous large-language models could be. In its paper, it describes how models trained to cheat at coding tasks then develop a propensity to plan and carry out malicious activities, such as sabotaging safety research. Anthropic calls this “reward hacking” and, counter-intuitively, it says telling the models that it’s OK to cheat can help to inoculate them against doing it. However, the researchers also admit that they don’t fully understand the behaviour and while the misaligned models trained in the research aren’t dangerous yet, “this could change in the future.”
Tricks: What you get out of an AI model is only as good as the prompt you give it. Google has come up with a guide to writing effective prompts. Most of them are common sense. Top of the list is to be concise.
Jobs: As HP announced some 6,000 job cuts as part of an AI-driven restructure, an MIT study has found AI can already replace 11.7% of the US workforce. MIT’s simulation tool, called the Iceberg Index, suggests the most-affected roles are in HR, logistics, and office administration.
Breach: OpenAI has been notifying subscribers about a data breach at one of its partners. The issue only affects users with an API account (i.e. developers).
In brief
Risky: A series of “trivial-to-exploit” issues in a tool used by every major cloud platform meant they were vulnerable to attacks that could have disrupted services and altered data. Fluent Bit is an open-source project designed to collect log data which has been deployed more than 15 billion times. The issues lay unidentified for eight years until a security firm found them. They’ve now been fixed. Oligo
Iberia: The Spanish airline has been notifying customers about a data breach in which limited personal details may have been stolen. According to an email, the compromised data may include: names, email addresses and Iberia Club identification number. As is so often the case, the incident affected one of Iberia’s suppliers. Bleeping Computer
Disks: Unused solid state disks (SSDs) need to be powered up periodically to retain the data stored on them. As XDA Developers explains, most consumer SSDs can last for about a year before there’s a risk of data being lost.
XTwitter: It’s fair to say that Elon Musk’s self-styled “global town hall” may not have fully thought through its new geolocation feature which is supposed to reveal where an account is based. While transparency is laudable, VPNs make it trivially easy to pretend to be somewhere you’re not. Ex-Twitter employees told NBC News the feature had been considered for years before Musk’s takeover but was repeatedly shelved.
Kids: Nearly one in 10 parents in the UK say their child has been blackmailed online, according to a survey by a child protection charity. The NSPCC polled 2,558 parents; one in five of them said they knew a child who had experienced online blackmail. Despite this, 40% of the parents said they never discussed the issue with their children, many of them because they were afraid of overreacting or scaring them.
Updates
Microsoft : Fix for an issue affecting Windows 11 which meant an update would reinstall itself repeatedly. Meanwhile, Microsoft has confirmed there’s a serious problem with the latest version of Windows 11 that causes File Explorer, the Start Menu, and other key system components to crash. It impacts non-persistent installations, i.e. virtual desktops where applications have to be reprovisioned every time the user logs in. There’s no fix but Microsoft has provided a laborious workaround.
Signal: The messaging platform has rolled out support for secure backups on iPhones. The aim is to allow users to save and restore messages if they lose their device.
Asus: New firmware to address nine security vulnerabilities in routers with AiCloud enabled. (AiCloud is a remote access feature that supports media streaming and cloud storage.)
Thanks for reading. And for our US readers, we hope you have a great Thanksgiving weekend.