FFT news digest January 22 2021

Free speech

It would be misguided to lay all the blame for the spread of disinformation at the doors of Twitter and Facebook, but banning Donald Trump certainly seems to have had an effect. Amid warnings of uprisings and protests across the US, an image from inauguration day that went viral showed a lone Trump supporter with a bedraggled flag in front of the New York State Capitol. "I was hoping that we’d have more supporters out here," he is reported to have said. Obviously, the causes and mechanisms of disinformation are complex and multi-layered, but research by Zignal Labs found online misinformation about election fraud fell by 73% in the week following Twitter’s decision to ban Trump on January 8.

Meanwhile, China has been stepping up its efforts to discredit western vaccines and spread virus conspiracy theories, according to The Washington Post (R). But the China Media Project says posts by Chinese news outlets have been less prominent since Twitter made changes to its algorithms and started labelling them as state-affiliated.

Back in the US, the Twitter alternative, Parler, is continuing to try to get itself back online after failing to force Amazon to restore hosting services. It's reported to be planning to route traffic through servers located in the Russian Federation. So, that's bound to work out well.

The dedication with which rioters on Capitol Hill recorded their antics has created an extraordinary record of the attack on Congress. Every video ever posted to Parler can be downloaded (though they amount to terabytes of data). ProPublica has created a more manageable, interactive collection.

The fallout from the attack on Capitol Hill has also extended to the world of online dating. Tinder and Bumble are among platforms that are using images from the events to identify and ban the accounts of rioters. But, as The Washington Post reports (R), users of dating apps have also "taken matters into their own hands by striking up conversations with potential rioters and relaying their information to the FBI."

Threats

Dating: Police warn that criminals are using dating apps to extort money from users. The methods vary from sextortion (using recorded images for blackmail) to investment scams.

Collaboration: Criminals are trying to exploit home working by persuading users to install software that purports to help collaboration, but which in fact steals information or allows attackers to eavesdrop. Wandera's report also found that Saturday was when most phishing emails were received.

LinkedIn: Fraudsters are trying to steal banking details by sending out fictitious job offers and impersonating genuine HR staff. Motherboard

Fake ads: There's been an abrupt rise in the number of fake ads being posted on popular online marketplaces. Criminals lure victims with products at low prices to try to steal banking details. Group-iB

Vishing: The FBI has issued another warning about voice phishing attacks which it says are becoming increasingly common. The aim is to obtain user credentials by impersonating a colleague - or boss. Bleeping Computer

Smishing: There's also a rash of phishing messages sent by text. These can be hard to spot - though not if four turn up at the same time, as in this case.

Domains: Depressingly, there has been a surge in suspicious domain names containing the word "vaccine" and other virus-related terms. By surge, we mean the number doubled in the month to January 6. TechRadar

Android: Multiple apps in the Google Play Store are imitating legitimate, well-known software. The fake apps have been downloaded more than 10 million times and are used for advertising fraud. White Ops

Downbeat

Two-thirds of information security leaders expect their organisations to fall victim to a cyber attack this year, according to a survey for Proofpoint. Following an increase in ransomware attacks last year, it's not surprising 46% of those surveyed said they regarded extortion as the biggest threat. To underline the threat of ransomware, research shows that victims are paying attackers, even if they have backups for the encrypted data. Emsisoft found organisations were making the payments to try to avoid hackers publishing the data online.

Journalist safety

There's a plethora of online safety guides aimed at journalists, but many are contradictory, inconsistent and some are seldom updated. That's the conclusion of a study of 33 guides by US researcher, Kristin Berdan. There are four key conclusions; Emphasise risk assessment - and remember this will be different for each story; Don't mess with the journalistic workflow (if you do, the advice will be ignored); Security isn't just about staying safe, it can be a competitive advantage; And make security part of training and education for people starting out in journalism.

GDPR

There's been a marked increase in fines for breaking data protection regulations in Europe, with some €158 million in penalties since the end of January 2020. That's a 39% increase, with France, Italy and Germany the readiest to issue fines, according to research by DLA Piper. This week, the German regulator announced a €10.4 million fine against an electronic retailer for monitoring its employees by video "without any legal basis". These are still relatively early days for the GDPR but the evidence suggests there is a steady increase in the willingness of regulators to punish contravention with financial pain.

Dark patterns

Amazon is facing a concerted campaign over its approach to retaining customers. Regulators in Europe and the US are being asked to investigate whether it is breaking consumer protection laws in the way it has designed the process for canceling Prime subscriptions. 'Dark Patterns' is the use of manipulative design to make consumers do what a company wants them to do. There's even an online award - which in 2019 was won by...Amazon. Norway's Consumer Council has been a leader in investigating the practice - it says one in four users find it hard to unsubscribe from Amazon Prime.

In brief

Breached: The number of records exposed in 2020 rose by 141% to more than 37 billion, according to Risk Based Security. In its 2020 year End Report, it says (R) 69% of the incidents were caused by human error.

Pre-loaded
: A shipment of laptops supplied to UK schools under the government's Get Help With Technology scheme came bundled with malicious software. The Register says they were part of a batch of 23,000 devices provided by a company based in China.

Vaccine misinformation: Stolen data on Covid-19 vaccines were manipulated before being published online in an effort to undermine public trust, according to the European Medicines Agency

SolarWinds: More details from FireEye on how the SolarWinds hack was carried out - and its focus on Microsoft 365 instances. FireEye has also released a free tool designed to help companies determine if they might have been affected.

Zoom watermarks: Just like pages from a laser printer, Zoom sessions can have hidden watermarks. In a guide aimed at investigative journalists, The Intercept explains how they work - and how to avoid falling foul of them.

Who needs a backdoor
: Governments around the world keep on asking for 'backdoors' to be built into technology solutions so they can circumvent encryption schemes. New research shows why such access isn't needed.

Training: Lack of funding is preventing 25% of company directors from providing cybersecurity training. iomart found a series of basic failures in effective awareness training.

Vulnerability scanning
: The UK National Cyber Security Centre has new advice on detecting security defects.

Teams tracking
: Microsoft has provided managers with a range of built-in tools to measure their employees' performance. ZDNet explores the implications for privacy.

Updates

Windows 10: A range of problems are affecting Windows 10 systems, with some users reporting problems with installing updates. And Microsoft is reported to be working on a fix for an issue that can corrupt a hard drive because of a specially-designed icon. Bleeping Computer

Chrome: Version 88 permanently removes support for Adobe Flash Player and for FTP. It also helps to identify weak passwords (though we still recommend a standalone password manager).

Brave: With new version 1.19, Brave becomes first major browser to support IPFS, a peer-to-peer protocol that changes the way the web works.

Linux: Attackers are actively exploiting vulnerabilities in TerraMaster TOS (TerraMaster Operating System), Zend Framework and Liferay Portal. A new malicious software variant is designed to take over compromised devices so they can form part of a botnet (a collection of machines that can be controlled remotely and used for malicious activities). Checkpoint

Cisco: Multiple updates, four rated 'Critical'. Many of the issues could allow code to be executed remotely.

Oracle: First set of security updates for 2021 include 329 updates for more than 20 products.

VLC: Version 3.0.12 for Windows, Mac, and Linux has important security fixes. For Mac users, it has native support for Apple Silicon and fixes audio distortion in macOS.

Subscribe to receive the digest by email

Address

152-160 City Road
London, EC1V 2NX

Contacts
Email: info@fullframetech.com
Phone: +44 (0) 20 3290 2205
Support: +44 (0) 20 3290 2207

Company registration no. 10243217