The limitations of end-to-end encryption. Accursed extensions. Unstoppable AI.
Hate speech surges on Facebook. Fortinet breaches. And the UK investigates TV makers.
Not so secret
End-to-end encryption is often misunderstood, and sometimes misrepresented, as a silver bullet for privacy. Reporting by The Intercept into federal investigations linked to anti-ICE protests in Minneapolis is a reminder that the reality is more complicated. According to court documents and reporting, investigators built their case not by breaking Signal’s encryption but through screenshots, participant devices, metadata, infiltrated chats and the fact that people ultimately have to act in the real world. Encryption protects messages in transit. It does not stop someone in the group sharing them, losing their phone, taking screenshots or being identified through everything that happens before and after the message is sent.
For anyone at risk of government investigation, Signal can provide a degree of protection but only if specific precautions are followed. These include:
-
Use disappearing messages and set shorter retention periods so old conversations are not sitting on devices indefinitely.
-
Turn on screen lock and device encryption because seized or unlocked phones undermine encrypted apps very quickly.
-
Be cautious with group chats. The bigger the group, the higher the chance someone shares screenshots, loses a device or cooperates with investigators.
-
Treat screenshots as inevitable. End-to-end encryption does not stop participants recording conversations.
-
Use usernames rather than exposing phone numbers where appropriate.
-
Review linked devices and account settings to reduce unexpected access.
-
Assume metadata and context still matter. Who met whom, when people travelled, photos, public posts and real-world actions may reveal more than message contents.
Threats
Extensions: With apologies for banging this drum again…but adding extensions to browsers should only be done if absolutely necessary - and you’re sure they’re safe. Researchers have found a network of 152 Chrome extensions that purport to offer live wallpaper, but which will also mess up your browser, monitor your activity and try to prevent you uninstalling them. Socket
Personal: Dutch police have taken down a scam operation aimed at raiding victims’ bank accounts. Most of the activity took place remotely but police say that in some cases the operation involved sending people to visit their victims in person. It’s a tactic that often targets older people and it’s vital to make sure they’re aware of this threat. The Register
Travel: Cyberattacks against hospitality, travel, and recreation organisations rose 24% year on year, according to Check Point. It says more than 47,000 travel-related domains were registered last month alone, with many of them already classified as malicious or suspicious. Booking.com, Airbnb, and Skyscanner are particularly popular among attackers.
Prime: Fraudsters love Amazon Prime Day, so shoppers should expect not just bargains but a surge in scams and fake deals. Among the things to look out for are fake order alerts and bogus customer support messages designed to steal passwords and payment details. Avoid clicking links in texts, emails or adverts, go directly to the app or website instead. And if Amazon ever contacts you unexpectedly about an account problem, verify it through your account centre rather than trusting the message.
World Cup: With the football extravaganza now well underway, a reminder to beware of websites offering free live streams of every game. Needless to say, not only will you not get to watch any football, you’ll also open your machine to unwanted downloads and malicious software. Malwarebytes explains how the scams work
AI
Unstoppable: We’d like to cut through the crap surrounding the US administration’s decision to restrict access to Anthropic’s latest models for “national security” reasons. The decision appears to follow news that Amazon researchers were able to “jailbreak” the models to find some minor vulnerabilities that an expert said “would be of more use to people defending computer networks than to those attacking them.” And in any case, as computing guru Bruce Schneier writes, “The problem isn’t any one particular model; it’s the general trend of increasing AI capabilities.” The challenge is how to control that power in general, not just in the case of Anthropic.
Hallucinatory: A report by consulting giant KPMG on adoption of AI by big organisations contained bogus case studies generated by AI. The report (“Redefining excellence in the age of agentic AI”) made numerous false claims about the use of AI, including by Swiss bank UBS, the NHS, and Transport for London. FT
Pliable: As little as 13 words of user-generated text can be enough to manipulate the AI agents behind tools like ChatGPT and Google’s AI search. A study from Cornell University suggests that it’s trivially easy for brands to inject promotional content on sites like Reddit, Quora, and Wikipedia with the end goal of poisoning or manipulating the output of AI tools.
Prepping: A small company has created an offline AI system powered by a 20W hand cranked generator. “It offended our European small-practical-car sensibilities to see people around us throwing kilowatts and thousands of tokens at tasks small models could accomplish just as well as huge ones, for a fraction of the cost and energy.” Squeez Labs writes. Its functionality is limited for the moment. “We’ve generated images (small), made poetry (bad),” Squeez says. But it demonstrably works.
Trump
Hate: Violent, abusive, and hateful speech has surged on Facebook after Meta relaxed moderation rules at the beginning of President Trump’s second term. The Center for Countering Digital Hate analysed nearly 8 million comments on Facebook directed at members of Congress. It found violent threats quadrupled in the six months after Meta’s policy changes, while comments targeting Trump with violence doubled.
In brief
Hacked: Tens of thousands of Fortinet firewalls and VPN gateways appear to have been compromised in a large-scale campaign that researchers say relied not on a new vulnerability but on stolen or reused passwords gathered from previous breaches. The operation highlights an uncomfortable reality: once credentials leak, they can remain useful for years if organisations fail to rotate them. That matters because, according to new research from SpyCloud, employee credentials and personal information are now exposed at 86% of Fortune 100 companies, helping fuel the shift from traditional phishing towards account takeover and credential-based attacks.
Persistent: Researchers have uncovered what appears to be one of the longest-running cyberespionage operations on record after a China-linked group allegedly maintained access to an isolated network for 10 years. The details are scant but it appears the attackers managed to hijack the organisation’s authentication process rather than relying on malicious software tools. Bleeping Computer
LinkedIn: A new feature lets apps automatically describe how people actually use their software. This means Adobe and HubSpot, for example, will display AI-generated summaries of a user’s activity and proficiency directly on their LinkedIn profile. LinkedIn says the aim is to replace self-reported skills with evidence of real usage.
Takedown: The FBI and Google have disrupted an industrial scale Chinese “phishing-as-a-service” operation. ‘Outsider Enterprise’ allegedly harnessed AI tools to enable criminals with little technical skill to create convincing scam websites and launch phishing campaigns through more than one million fraudulent URLs and 9,000 fake websites. Authorities say the operation was linked to nearly four million stolen credit card records and almost $2 billion in losses.
Roblox: Hackers have long targeted Roblox accounts to steal a player’s valuable items, but now they’re taking over developer accounts to hijack ownership of entire video games and digital worlds. Multiple developers, in other words the people who make games for others to play on the Roblox platform, said this had happened to them. And they accused Roblox support of doing nothing to help them get their games back. 404 Media
Ban: There’s not much to say about the UK government’s social media ban for under-16’s other than that it won’t work (cf. Australia) What it will do is gradually mandate age verification for all social media users and create confusion over whose responsibility it is to make such platforms safer for their users.
TV: The UK’s communications regulator is to investigate smart TV makers for illegal or hidden tracking of users’ viewing habits. The ICO’s inquiries will check whether device makers are obtaining consent and if users have the ability to opt out.
Updates
Oracle: Guidance to mitigate critical security vulnerability in PeopleSoft software that may have affected more than 100 organisations worldwide. Oracle also released its second monthly set of security updates which contains 245 patches.
F5: Emergency updates to resolve multiple NGINX vulnerabilities, including critical flaws that could lead to code execution.
Atlassian: 100 security bulletins that address dozens of defects across wide range of its products.
Splunk: Update to address critical issue affecting Splunk Enterprise.
Apple: For many years, Apple has provided a useful service that allows users to sign up to services without handing over their own email address. It’s called Hide My Email and works by creating a unique, randomised address for the sign-up process. Until now. Apple says these addresses will be moved to a dedicated subdomain (private.icloud.com). This will allow online services to block users who try to hide their real email, which they almost certainly will do.
Secure Boot: Microsoft is warning Windows and Linux users that a long-planned certificate rollover reaches an important deadline this month. Most supported devices should update automatically, but older systems may need a manual check. Nothing will suddenly stop working but devices that miss the transition will be less protected against future attacks.