Tony Glover
Fresh Focus on Cyber-Attacks for CISA
One of the greatest challenges now facing President Trump’s new administration is to protect the US’s critical infrastructure and its economy from the rapidly growing menace of cyber-attacks. On Friday, the president’s nominee to head the Department of Homeland Security, Kristi Noem, signalled a new direction for America’s main cybersecurity agency, the Cybersecurity and Infrastructure Security Agency (CISA), which, she says, urgently needs to be realigned away from focusing on misinformation and curtailing free speech and more towards preventing cyber-attacks on critical infrastructure in the US.
Fake job offer scams gather pace
The New Year has begun with further news of a particularly cynical fraud campaign aimed at jobseekers. Lucrative-seeming fake job offers are being sent by email to individuals working in targeted organizations and in companies operating in critical industries. This month, cybersecurity company Crowdstrike has identified an email phishing campaign exploiting its recruitment branding to deliver malware disguised as an "employee CRM application." The fake email impersonates Crowdstrike recruitment and directs recipients who are curious about the personalized job offer to a malicious website. But Crowdstrike also reports that the cybersecurity company is also aware of a number of other fake job offer scams currently taking place.
AI gives the game away
The latest threat for companies using large language (LLM) AI software to replace human staff is the software’s innate gullibility. LLM software can be likened to some cowardly bank clerk in an old Western hold-up who not only willingly opens a back door for the bad guys but also willingly tells them the combination of the safe. The methods for persuading LLMs into naively disclosing the keys to the corporate kingdom are known as ‘LLM Jailbreak’ techniques. Palo Alto Networks Unit 42 researchers have named one such LLM Jailbreak, “Bad Likert Judge”.
US Healthcare companies on high cyber-alert
While the assassination of health insurance CEO Brian Thompson on the streets of central New York last week has been grabbing headlines this month, life-endangering cyber-attacks on the US healthcare industry are escalating at an alarming rate. Once again, the pressing need for both IT and physical security could not be more clear. According to John Riggi, national advisor for healthcare security and risk at the American Hospital Association, healthcare security must now be seen as far more than just an IT issue. This year has seen what amounts to a sea change in the way healthcare executives must view not only their own personal security but also the impact of cyber-attacks not only on their bottom line but also on the lives and well-being of patients.
$1bn Korean bust is tip of SE Asian cybercrime iceberg
Authorities in Korea and Beijing dismantled a sprawling voice phishing syndicate responsible for financial losses totaling US$ 1.1 billion. But South-East Asian observers believe this to be only the tip of an impenetrable iceberg of cybercrime in South-East Asia that is rapidly starting spread around the globe. The Korean bust was part of an Interpol-co-ordinated global operation involving law enforcement from 40 countries, territories, and regions and has ended with the arrest of over 5,500 financial crime suspects and the seizure of more than US$400 million in virtual assets and government-backed currencies.
Women break glass ceiling of Russian cybercrime
Women cybercriminals and lady Darknet hackers are now starting to make inroads into the hitherto male-dominated fraternities of Russian-speaking cybercrime. According to the cybersecurity training and certification cooperative, the SANS Institute, women cybercriminals sometimes now pose as men in order to obfuscate their identities as well as to gain credibility among Russian-speaking criminals. The SANS Institute interviewed one such woman cybercriminal, who is referred to only as a "Confidential Human Source (CHS)" in order to comply with her request for anonymity. “I often took my boyfriend to in-person meetings,” CHS revealed, shining a new light on a so-far largely unrecognized aspect of cybercrime, the fact that cybercriminals meetings are frequently also conducted offline.
The Chinese Communist Party is watching you
Research conducted by Which, the consumer watchdog magazine, has confirmed something the smartphone industry has known for years: Chinese electronic products are routinely used to spy on citizens in countries like the US and the UK. The latest suspects, domestic air fryers, join a long list of products the Chinese are accused of having used to spy on the West, which already ranges from smart watches to automobiles. Which analyzed three air fryers sold in the UK and found that Aigostar, Xiaomi Mi Smart, and Cosori CAF-LI401S knew their customers' precise locations and demanded permission to listen in on users' conversations. The Aigostar air fryer even wanted to know the user's gender and date of birth when setting up an account. Disturbingly, both the Aigostar and Xiaomi air fryers are reported to have sent personal data to servers in China.
Big Tech’s rapidly-shrinking green credentials
Big Tech is currently performing a rather awkward fan dance, trying to cover up its rape and pillage of the earth’s more finite resources with its rapidly shrinking green credentials. Silicon Valley’s green credentials may, however, soon vanish altogether under the vast amount of e-waste the rapid rollout of generative artificial intelligence (AI) has already started to generate. Measures such as the installation of waterless urinals and charging points for e-vehicles for Big Tech staff are merely Silicon Valley window dressing for what has always been an incredibly dirty and polluting industry. Named after the material used to manufacture semiconductors in Intel’s chip fabrication plants, Silicon Valley began with an ugly reputation for allowing vast amounts of toxic chemicals to seep into the local environment, allegedly making their way into the bodies of workers and children. Californian locals ruefully commented that the area should be renamed “Cyanide Valley”, as the notorious poison, which is used in the manufacture of semi-conductors, was claimed to have seeped into local soil and water sources.
Russian secret service steps up cyber-attacks on the West
Software giant Microsoft has made an urgent public announcement that the Russian secret service is currently sending thousands of weaponized spear-phishing emails to key individuals in over 100 organizations in countries including the US and the UK. According to Microsoft: “The emails were highly targeted, using social engineering lures relating to Microsoft, Amazon Web Services (AWS)… In some of the lures, the actor attempted to add credibility to their malicious messages by impersonating Microsoft employees.”
Can MSN’s new AI Copilot replace human workers?
In a matter of days, Microsoft will unveil the much-heralded new version of its Copilot software to a business world already severely disappointed by Big Tech’s initial AI offerings. It also comes hard on the heels of a stern warning from Gartner to organizations across all sectors that the cost of introducing artificial intelligence (AI) to the workplace could easily balloon by a staggering 500 -1,000 percent. But Microsoft’s current marketing push for its latest AI offering, a souped up version of its Copilot service, is rapidly gathering momentum, in spite of commercial AI’s dismal performance to date. Microsoft chief executive Satya Nadella is currently touring 39 cities around the world with new products and use cases for AI. He predicts that the performance of AI systems will double approximately every six months, and the AI revolution is about to be led by a souped-up version of the company’s existing Copilot software, part of the 365 package. "The question now is how do we transfer this to the real world…Think of Copilot as a user interface for AI," Nadella told an audience in Berlin.
Rocky start for Big Tech’s AI rollout
Companies are already becoming disenchanted with the initial rollout of Big Tech’s new artificial intelligence (AI) technology. Rapidly diminishing return on investment (ROI) and poor initial outcomes are forcing companies to rethink their earlier strategies, according to a new report from AI data services company, Appen. “As enterprises gain more AI experience, they are becoming more selective about which projects to pursue, and fewer initiatives are reaching deployment. Appen believes this trend is likely driven by diminishing ROI or the lack of significant outcomes,” says Appen. Gartner also recently issued a stern warning to organizations across all sectors that the cost of introducing artificial intelligence (AI) to the workplace could easily balloon by a staggering 500 -1,000 percent.
Big tech goes nuclear
America’s leading technology companies are now engaged in their own nuclear power race. Advertising and search giant Google has announced that it has signed the world’s first corporate agreement to purchase nuclear energy from multiple small modular reactors (SMR), to be developed by Kairos Power. By investing in its own nuclear energy facilities, Google has now joined the ranks of Amazon, Microsoft, and Oracle in investing heavily in nuclear facilities to power the rollout of new services based around their prematurely launched artificial intelligence (AI) services. According to a recent report from US Madison Avenue investment bankers, Jeffries: “If it feels like Graphics Processing Units (GPUs) are suddenly everywhere, it’s because they are. GPUs drive computation across a wide range of industries and applications, from big data analytics to machine learning [AI].”
Marriott to pay $52m fine for 300m customer data breaches
Marriott International has agreed to pay a $52 million fine for cyber-negligence resulting in data breaches affecting over 300 million of its customers worldwide, representing a fine of less than two cents per customer. The US Federal Trade Commission and attorney generals from 49 states ran parallel investigations into three data breaches which took place between 2014 and 2020. Cybercriminals were able to steal the passport information, payment card numbers, loyalty numbers, dates of birth, email addresses plus personal information from hundreds of millions of customers.
Cybercriminals are now grooming US and UK teens
By adopting such Nineteenth-Century criminal grooming methods to the online world of the Twenty-First Century, today’s threat actors are effectively criminalizing an entire generation not to pick pockets but to rifle fat online crypto wallets instead. When the media reports that a nineteen-year-old hacker has been arrested at his parent’s house for a major hack, such as the one that recently occurred at Transport for London (TfL), the sinister cybercriminals who may have orchestrated the cyber-attack doubtless breathe a sigh of relief. “What the police should be asking in a case like is who has been grooming the teenage hacker and for how many years?” says Fraser Hay, CEO and co-founder of one-year-old UK start-up The Hacking Games, whose aim is to use online gaming, TV and other media to encourage teenagers away from a life of online crime and towards careers in ethical hacking.
Cyber gets physical at Expo ‘24
Chief executives frequently vie with one another for the spotlight when delivering key speeches at major conferences. But the most-talked-about address of the day, given to a packed auditorium at the International Cyber Expo in London’s Olympia showground, forbade any recording or photographing of his talk. He also insisted he be referred to only as “Paul F”. “Paul F”’s bashfulness became understandable when he explained that the UK’s National Protective Security Authority (NPSA), where he is head of physical security, is now part of Britain’s secret intelligence service MI5. His talk neatly summed up the central theme of the show by providing evidence that the difference between cybercrime and physical crime has become blurred to the point of invisibility. He asked the very relevant question of whether a small drone spying into a City office using a telescopic lens and an 8k camera to read the staff’s log-in details through the window is a physical or a cyber-crime.