Data for sale. Sounding the AI alarm.
The US military addresses the risk of advertising trackers. Illegal streaming in the UK. And the disappearing "patch window.
Breached
We might as well face it: it’s virtually guaranteed that our online data is going to be stolen and put up for sale. By way of illustrating the problem, Brian Krebs reports on a new identity theft service that is selling digital scans of more than 153 million driving licences from people in the US and Canada. The people behind the service claim the data comes from a breach at “a major identity verification company.” Krebs tested the service with his own details and found it did indeed contain three pairs of photos of both sides of his licence. Shortly after he published his story, the theft service vanished from the dark web (at least in its current iteration).
This week also brought news of pitifully poor security performance by cloud storage giant Dropbox. Some 5,000 accounts were compromised by attackers who exploited an integration that allowed users to access Dropbox using Lenovo IDs. Dropbox blamed “an issue with Lenovo’s email verification process.” This meant an attacker could register a Lenovo ID using a Dropbox user’s email address and then use that ID to access the associated account. None of the affected accounts had multi-factor authentication enabled.
Using a third-party service to access an account is called Single Sign-On (SSO), and we don’t like it. Apple, Google, Meta et al all promote the feature and it’s tempting because it does make it simpler to access the myriad accounts we have. But it also creates a dependency: the security of one account becomes dependent on another service, its authentication systems and the tokens connecting them. As attackers increasingly target authenticated sessions rather than passwords, that’s an increasingly valuable basket in which to put all your eggs. Better to use a third-party password manager and keep everything separate.
Threats
Codes: A cautionary tale from veteran US journalist Michael Isikoff, who has explained how Russia’s FSB compromised his Signal account using a convincing message posing as “Signal Support.” The attackers warned that his account would be deleted unless he followed instructions and supplied a recovery key, ultimately giving them access to an account he used to communicate with confidential sources. The FBI says the Russian campaign has compromised thousands of messaging accounts and specifically targets journalists and other high-value individuals. Signal will never contact users inside the app asking for recovery keys, PINs or verification codes.
Movies: A large-scale operation used fake movie streaming apps to trick users into compromising their Android devices. Intel 471 says the attackers appeared to be Chinese-speaking threat actors who lured victims with adverts on Meta that impersonated Netflix as well as a rich variety of invented streaming brands.
AWS: A password spraying campaign is targeting AWS users, with at least 150 organisations affected so far. A cloud security firm says the attackers are focused on “root” user accounts and appear to be trying multiple password variants against a list of valid email addresses. The AWS root user has complete access to the account’s resources, billing information and account settings. Best practice is to take advantage of AWS features that allow administrative tasks to be carried out using temporary “root” sessions. Datadog
Callback: Phishing emails don’t always want you to click a link; they might try to persuade you to call a bogus support number. The tactic is known as callback or telephone-oriented attack delivery (TOAD). It works by sending fake invoices, subscription renewals and even calendar invitations which can evade conventional email security because they don’t contain malicious links or attachments. Phoning the number on them will connect the victim to a live scammer. If you do need to query an invoice or payment, use a number you know to be genuine. Barracuda
AI
Alert: Um, not to be alarmist…but the past few weeks have seen increasingly urgent warnings about the risks of AI. The latest comes from ChatGPT maker OpenAI and more than 100 technology and security companies. They warn that AI-enabled cyber attacks will become far more widespread and sophisticated in the coming months, putting vital businesses and services - from hospitals to water treatment plants - at risk. OpenAI says the only solution is “collective action on cyber defence” while adding, apparently without irony, that “more defenders should be empowered with cyber-capable AI.” In practical terms, security basics have never been more important: triage updates, remove unnecessary privileges, use phishing-resistant authentication, and ensure critical systems can be rapidly isolated and recovered. As AI agents proliferate, it’s vital to monitor and restrict their access, and to require human approval for high-impact actions.
Finance: Talking of risks, the international body that monitors the global financial system has warned G20 leaders about the potential impact of the most capable “frontier” AI models. The Financial Stability Board was set up following the 2008 financial crisis. In a letter, its chair said the impact of frontier AI on cyber risk was the most immediate concern for the world’s financial infrastructure, and called on institutions and technology providers to “prepare for more severe scenarios involving simultaneous disruption across multiple firms or shared technology dependencies.”
Support: 27% of Americans say they turn to AI chatbots like ChatGPT for personal, emotional, or social queries. Among adults under 50, the figure rises to nearly 40% according to research by Elon University in collaboration with The Washington Post. “It is like my best friend because I can talk to it about anything and not be judged,” one participant said.
Recognition: A new system for facial recognition claims to be able to identify people even if they’re wearing a mask covering their nose and mouth. The researchers say it uses AI to process biometric data from the area around the eyes and forehead. Meanwhile, a German artist has created a “digital camouflage” shirt that appears to confuse AI-powered surveillance cameras. He told 404 Media that the shirt is a response to the proliferation of such cameras. It works by employing a combination of shapes and colours that baffles one of the most widely used recognition algorithms.
In brief
Tracking: The US military is disabling advertising identifiers on government-issued phones and computers after reports that commercially available location data is being used to identify and target US personnel in the Middle East. The decision highlights the potential risk from data gathered by different apps and advertising companies, which can be used to track the location of individual devices. The risk can be reduced by disabling advertising tracking and restricting unnecessary location access. This won’t prevent all tracking, but makes it harder to link commercially collected data to a particular device. Reuters
Nigeria: On the same theme, 404 Media has talked to a couple of cyber researchers who (bravely) travelled to Nigeria to confront an online scammer. They had tracked him down by researching his online activity. It’s a power that could - and should - be used more widely against cyber criminals, but it’s important to be aware of the potential for it to be turned on journalists and investigators.
Spyware: Researchers say a member of Serbia’s student protest movement was targeted with Pegasus spyware. The Citizen Lab says the infection was enabled by exploiting a vulnerability in iMessage which didn’t require any user interaction. The student was one of 14 cases in Serbia in which individuals received threat notifications from Apple ahead of elections this year. The exploited vulnerability was addressed by Apple in iOS 18.4.1, which is why we bang on about the importance of installing updates.
Criminal: The line between criminal gangs and the Russian state has long been blurry, but a respected British analyst says organised crime networks are now becoming ever more important in President Putin’s “war against the West.” Writing in Internationale Politik, Mark Galeotti says it’s increasingly difficult to tell the security services from the criminal gangs. As evidence, he cites last year’s arrests of 11 Serbs who were charged with being part of a coordinated, Europe-wide campaign to provoke inter-communal tensions.
Surveillance: China’s state-owned shipping giant COSCO uses concealed equipment on board its ships to spy on military communications near the coastlines of target nations, according to US administration officials quoted by Reuters. The arrangement allows China to collect communication signals from vessels and aircraft operating across Europe, North America and Asia, they said.
Detector: Last week, we reported on research suggesting most spy detectors don’t work. This week comes news from South Korea where academics have developed a $7 phone-case that uses embedded LEDs to detect cameras hidden inside hotel rooms or rented properties. The phone uses an app to illuminate objects and analyse reflections to spot hidden lenses. The device recorded a 94% accuracy during testing. KAIST
Pirates: Given the ever increasing cost of streaming services, it’s not surprising that illegal solutions are so popular. In the UK, 31% of adults surveyed by an anti-piracy initiative said they had accessed content illegally within the previous three months. For 18- to 24-year-olds, the figure was 51%. As we say, not surprising but very risky from a security perspective - quite apart from the illegality.
Updates
Vanishing: Microsoft says AI capabilities mean the window to apply updates has effectively disappeared because of the speed with which attackers can weaponise disclosed vulnerabilities. It argues that this means organisations can no longer rely on patching alone, and need to be able to contain serious vulnerabilities by restricting access, disabling vulnerable services or applying other compensating controls. In practical terms: know what’s exposed, prioritise vulnerabilities that are actually exploitable, and have a plan to reduce the risk immediately while a permanent patch is tested and deployed.
Microsoft: As for its own products, this week brings customary bugs for the company’s users. Highlights: a problem with Microsoft Defender that is flagging legitimate Google search links as malicious, and erroneous notifications that “Microsoft Defender Antivirus is turned off,” even though it’s still operational.
Brave: The privacy-focused browser is adding a feature called ‘Email Aliases’ that allows users to generate disposable email addresses when signing up to a new service.
SonicWall: Attackers are exploiting two zero-day (previously unknown) vulnerabilities to take over Secure Mobile Access (SMA) Series 1000 devices. Fixes should be applied immediately.