Persuading organisations to take security seriously. Phishing for dummies.
Gartner predicts infrastructure collapse from misconfigured AI. Meta's social media immortality patent. Password managers. And the robotic vacuums revealing all.
Scale
The UK government has launched a fresh attempt to persuade businesses to take cybersecurity seriously and “lock the door” on cyber criminals. The latest statistics suggest that there’s something chronically wrong, with 82% of businesses and 77% of charities in the UK saying they experienced some form of incident over the past year. That data comes from the catchily named Cyber Security Longitudinal Survey which aims to track trends over multiple years. Unhappily, one of the trends it has tracked is the high number of organisations that report the same experiences year after year.
In the face of all this, the government is hoping to persuade more organisations to sign up to its Cyber Essentials scheme. This is by no means a panacea. Cyber Essentials is lightweight, self-assessed, and (many believe) routinely abused by organisations because they lie about what they’re actually doing. Despite this, we highly recommend it because it does focus on the basics and, if treated seriously, will sort out the most obvious security threats. It’s also cheap with prices starting at £320 + VAT. If you want to find out more, the government offers a free 30-minute consultation with a cyber advisor.
Threats
Clever: A devious new platform offers anyone the chance to go phishing, with a worryingly high chance of success. It works by loading a company’s real website into the attacker’s infrastructure. This allows it to harvest any information a user sends, including the details needed to access their account. All this is managed through a snazzy portal that means would-be criminals need virtually no technical expertise. Defending against this type of attack is tricky, though the attack begins with a fake web address and so the old advice still holds; don’t click on links to do anything important like verify account information, just open the webpage directly in another tab. Abnormal AI
Extensions: This week brought yet more instances of malicious browser extensions. Q Continuum found 287 instances which essentially could be used to spy on their 37.4 million users. With apologies for repetition, just avoid adding anything to your browser unless you have to.
Booking.com: The travel reservation platform has become a seething mess of fraud and falsehoods, with both operators and tourists being relentlessly targeted. Bridewell reports on a resurgence of malicious activity this year, while we have come across multiple scams directed at property owners. We advise being extremely sceptical about any Booking.com communications, even if they appear genuine. If you use the platform, never follow links to log in to the website - open it up in a new browser tab or better yet use the app.
ClickFix: This social engineering technique remains extraordinarily popular among attackers, with new variants emerging every week. Huntress says it was the entry point for 53% of all malicious software infections it spotted last year. The latest variants are clever but they still require a victim to open up a terminal window and run commands in it. Defence is simple. Just don’t! Security Boulevard
AI
Collapse: Gartner warns that by 2028 misconfigured AI will result in the collapse of a G20 country’s critical infrastructure. “A secure ‘kill-switch’ or override mode accessible only to authorised operators is essential for safeguarding national infrastructure from unintended shutdowns caused by an AI misconfiguration,” Gartner says.
Nosy: Microsoft has admitted that its Copilot assistant has been poking its nose in places it doesn’t belong. Despite policies designed specifically to stop it summarising confidential emails, that’s precisely what it’s been doing. The cause appears to be a bug in the system which Microsoft is now trying to fix. Among the organisations affected is the UK’s National Health Service. Not surprising then that the European Parliament has disabled AI features on the work devices of lawmakers and staff. “The full extent of data shared with service providers is still being assessed. Until this is fully clarified, it is considered safer to keep such features disabled,” an internal email seen by POLITICO said. Good advice.
Passwords: Don’t be tempted to ask a chatbot to come up with a random password. Research has found that if you do, it will be predictable, easy to guess and quite probably the same as generated for other users. Irregular
Glasses: Meta is planning to add facial recognition to its lineup of branded smart glasses at some point this year. According to an internal memo reported by The New York Times, “We will launch during a dynamic political environment where many civil society groups that we would expect to attack us would have their resources focused on other concerns.” In a statement, Meta said it was “still thinking through options.”
Disease: Researchers from Johns Hopkins, Oxford, Stanford, Columbia and NYU are calling for guardrails on certain infectious disease datasets that could enable AI to design deadly viruses. “Responsible governance and scientific progress are not contradictions,” the researchers say. Axios (R)
Alive: A patent awarded to Meta covers the use of AI that could allow a user to continue posting from beyond the grave. The idea is to use someone’s data to train a language model which could then be used to respond to newsfeeds, DMs, and even audio or video calls. “The language model may be used for simulating the user when the user is absent from the social networking system, for example, when the user takes a long break or if the user is deceased,” the patent says. Technology companies have long been flirting with the idea of enabling a virtual life after death. In India, entrepreneurs are already using deepfake technology to enable dead and absent relatives to appear at weddings and other occasions.
Trump
Freedom: Reuters says the State Department is developing an online portal designed to enable people to see content banned by their governments. The content would include alleged hate speech and terrorist propaganda and Reuters’ sources say the administration views the portal as a way to counter censorship. As The Guardian reports, since President Trump took office the US has gutted funding for programmes to support internet freedoms.
Trawl: The Department of Homeland Security has demanded technology companies provide details of accounts which have been posting criticism of Immigration and Customs Enforcement, according to The New York Times. Government officials quoted by the paper say Google, Meta and Reddit have complied with some of the requests.
In brief
Passwords: Academics say they identified a series of vulnerabilities in popular password managers in the event that their servers were compromised. Bitwarden, LastPass, Dashlane, and 1Password say they have addressed the researchers’ findings. While no security solution can be perfect, it’s far safer to use a password manager than not to.
Surveillance: So it turns out that Ring’s much-criticised “Search Party” feature wasn’t designed just to track dogs. 404 Media has got hold of an internal email from the security company’s founder saying the feature could be used to “zero out crime in neighbourhoods.” (We presume Ring isn’t suggesting canines are behind every neighbourhood crime.)
Tablets: Malicious software was implanted in the firmware of Android tablets from multiple manufacturers, according to Kaspersky. It only names one product (from Alldocube) but the report underlines the risk of buying low-cost products, even though many perform perfectly well.
Spyware: More evidence of the use of spyware against journalists and activists. Amnesty International says a prominent journalist in Angola was targeted successfully with Predator spyware. In Kenya, the authorities used Cellebrite software to access the phone of a political activist after he was arrested.
Outsourcing: Workers at an Indian company accessed highly sensitive Australian court documents after a firm subcontracted a deal to provide voice-to-text transcription. Canadian company VIQ Solutions had been authorised to use only Australian employees to transcribe the court proceedings. ABC
CARINT: There’s a growing business in developing and selling tools to gather intelligence by hacking into the technology in cars - and Israeli companies are leading the market. Haaretz reports (R) on ‘CARINT’ and says one company has developed an “offensive” tool designed to tap into a car’s microphones and cameras.
Persuasive: Researchers found that turning on X’s algorithmic feed shifted users’ political opinions to the right, while turning it off had no effect. The ‘For You’ feed led users to follow more right-leaning accounts, and they continued following them after the algorithm was turned off. Nature
Robohack: DJI has admitted that a “backend validation failure” meant its robotic vacuum cleaners could be accessed remotely without any authentication. The issue was identified by a user who wanted to control his Romo vacuum with a PS5 gamepad. He found he could - but he also had complete access to thousands of others round the world, including video from their cameras and maps of the rooms they had cleaned. The Verge ($)
Updates
Chrome: Staying safer online isn’t always complicated. Just shutting down your browser every day ensures it stays up to date. That’s never been more important because of the number of vulnerabilities that keep on turning up in them. So far this year, Google and Mozilla have both issued five updates to address numerous security issues.
Google Maps: Google really wants you to sign into Maps, so it seems to have decided to severely limit its usefulness unless you do. As 9to5Google puts it, “The differences in functionality between the signed-in and signed-out versions of Google Maps are stark, to say the least.” They include hiding reviews, images, and businesses and attractions. if you’re not signed in.
Microsoft: Faulty detection rules designed to block phishing campaigns were responsible for recent problems with Exchange Online.
SecureDrop: Version 2.14.0 ensures KeePassXC remains installed on Tails. It also lprepares for the upcoming SecureDrop App.