Another shaky week for the internet. WiFi hotspots.
Governance fails to keep pace with AI adoption. China hacks the US. Russia blocks FaceTime. Online safety advice for younger people. And the not-so private toilet camera.
Shaky
In a week that saw another outage at Cloudflare, news also emerged of a critical vulnerability in a very widely used website development tool that could allow affected servers to be attacked remotely. When we say widely-used we’re talking about sites like Facebook, Instagram, Netflix, Airbnb and Shopify. The tool in question is a JavaScript library called React which is used to create interactive elements on a website. React is the basis for multiple frameworks that build complete websites. Exploiting the vulnerability in an affected server is simple - although the researchers who found it are withholding details while everyone rushes to fix it.
As for Cloudflare, it uses React and says the outage was caused by efforts to mitigate the vulnerability in it. The outage was was much shorter than the previous one last month but it still managed to cause widespread disruption. As Cloudflare proclaims, “20% of all websites are protected by Cloudflare.” Of course that means if Cloudflare goes down, so do they.
If all this sounds vaguely familiar, it might be because last week we reported on vulnerabilities in a tool used by every major cloud platform. The issues meant the platforms were open to attacks that could have disrupted services and altered data. Despite this they lay undiscovered for eight years. We keep on returning to these issues because of the threat they represent to modern societies. We are living in a world built on software we barely understand and rarely question, and the vulnerabilities we keep discovering demonstrate that our digital foundations are far more fragile than we imagine. And now we’ve added AI to the mix. This meme describes the “precarious tower of modern tech.”
Threats
WiFi: We agree that the risks from using public WiFi hotspots are often exaggerated - but that doesn’t mean they’re non-existent. This week, a court in Australia jailed a man for repeatedly setting up fake networks at three airports and on domestic flights. The 44-year-old appears to have targeted women and succeeded in stealing personal information as well as intimate photos and videos. The technique he used is called an “evil twin” attack which creates a hotspot with the same name as a legitimate network. When an unsuspecting user tries to connect to it, they’re taken to a page that requests email or social media credentials.
Extensions: A new bunch of malicious browser extensions has highlighted a problem with the way these tools are certified. Koi Security says the extensions were “weaponised” in mid-2024 after years of legitimate operation. The problem is that Microsoft and Google certify extensions when they’re submitted but it’s not an ongoing process. That means a patient attacker can accumulate thousands of downloads before releasing an update that makes it dangerous. Our advice is to steer clear of almost all extensions, especially those from unknown suppliers.
Party: Scumbags are exploiting the holiday party season to send fake invites to try to trick people into installing remote management tools. Symantec
Podcasts: It seems that Mac users should keep an eye on their Podcasts app. 404 Media’s Joseph Coxsays he sometimes unlocks his Mac and finds the app running with seemingly random podcasts open. A respected Apple expert has replicated the behaviour which is counter to the way the Mac operating system is supposed to work. The concern is that a podcast name or subscription could contain a malicious link. Apple Insider
WhatsApp: Attackers are using the messaging platform to distribute a malicious app designed to steal financial credentials. The campaign begins with a link to a fake Google Play Store and a copy of a discount retail app. Rather than a download link, the page asks for a phone number and says the link will arrive via WhatsApp. Cleafy
AI
Governance: There’s a growing mismatch between AI adoption and how its use is managed. Cybersecurity Insiders found that 83% of organisations in a survey were using AI tools but only 13% had “strong visibility” into how they were handling sensitive data.
Frozen: McKinsey and other top consulting companies have frozen graduate pay offers for the third year in a row as AI starts to reshape the industry, according to reporting by the Financial Times. Firms are seeking “more mid-career, specialised” staff as they spend less time on traditional strategy consulting and more helping companies implement technology and AI, the paper says.
Party: Elon Musk shared his advice with Joe Rogan on how to “make people really laugh at a party.” It involves telling Musk’s Grok AI to do a “vulgar roast” of someone. (For non-US speakers, a roast is when you insult someone in an allegedly comic fashion.) “You can even say, take a picture… make a vulgar roast of this person based on their appearance…at the party,” Musk advises. What fun.
In brief
Spies: China maintained long-term access to sensitive US government networks, sometimes for years, and succeeded in installing malicious software and stealing data. The US cybersecurity agency and the National Security Agency say Chinese government spies had used a “terribly sophisticated piece of malware” to carry out the intrusions. The first warning about the operation came from Google in September. It believes the impact extends far beyond government, with “dozens” of US organisations affected.
Banned: Russia has blocked Apple’s FaceTime app in what the communications regulator says is part of a crackdown on terrorism and crime. The move follows the imposition of restrictions on WhatsApp, Telegram and YouTube. Reuters
Pixel: Google is rolling out a new feature for managed Pixel devices which could allow employers to read some messages. The tool is designed to help companies comply with record-keeping requirements and legal requests. It means that while text messages remain encrypted in transit, a copy is kept that’s visible to whoever is managing the device.
Oversharing: Despite the risks, people continue to to reveal too much information about themselves online. It’s a particular risk for young people and a hugely important issue to discuss with them. ESET and WIRED have (separate) articles that provide useful advice about “operational security” and what to do if someone is exploiting details found online.
Mandate: The Israeli Defence Forces has decided that senior officers must use iPhones for official communications, according to Army Radio. The aim is to reduce the risk of intrusions on senior officers’ handsets, according to the report. Jerusalem Post
India: The Indian government has scrapped a decision to order smartphone makers to pre-load a state-run security app on all new devices. The order had been widely criticised, and both Apple and Samsung had said they wouldn’t comply with it. Reuters
Hijack: Meta says it’s launching a new, centralised support hub for Facebook and Instagram. In a masterful understatement, it acknowledges support “hasn’t always met expectations.” This might help users regain control of hijacked accounts - though the new hub is accessed through the Facebook and Instagram apps, so it’s not immediately clear how they would help a user who is locked out of them.
Crap: When Kohler launched a camera designed analyse a user’s gut health from photos of the contents of their toilet bowl, it emphasised a focus on privacy and security saying data would be encrypted “end-to-end.” No pun intended. Normally, that would be taken to mean that the company providing the service couldn’t access the data. Except in this case Kohler can. Its privacy policy says the user agrees the company can employ anonymised data to train its AI models. So not quite so private after all.
Updates
Windows 11: In its latest unreliability achievement, Microsoft’s recent updates seem to have broken a number of key Windows components including the Start menu and Explorer. The problem affects “enterprise or managed environments” and could result in systems crashing or failing. The endemic problems with Windows 11 have prompted one ex-Microsoft engineer to take to YouTube to implore his former employer to stop fiddling with AI features and focus on stability and performance “just till it doesn’t suck.” The Register
Android: Users should check whether there are updates for their devices following a warning that two vulnerabilities are being actively exploited. Normally, Google issues updates for its Pixel devices first while it takes much longer for other manufacturers to follow suit. This time, Samsung released its own updates almost immediately.
Apple: An updated list of devices now considered obsolete includes the very popular iPhone SE. This means it won’t receive updates and, alas, this means it’s time to dispose of it safely.
Netflix: Those nice people at Netflix have decided to de-improve their ever more expensive service by removing the ability to stream content to TV sets from Android devices. They imposed a similar restriction on Apple devices a few years ago. Android Authority
SecureDrop: Version 2.13.0 changes the installation procedure and will make future updates far simpler.
Thanks for reading. And for our US readers, we hope you have a great Thanksgiving weekend.