Stone martens

Image: Pixabay

Not only nice people live in our neighborhood. There is also a stone marten. And do you know what that little creature is particularly fond of? The wiring and hoses in cars. Years ago, the windshield-washer fluid line in our car was chewed through. Recently, the neighbor’s car suffered gnawed cables as well. Once that was repaired, the marten struck again. The same car.

Children and teenagers do not like walking through our street. That is because almost every house has a device that emits a high-pitched beep as soon as it detects movement. It also fires off flashes of light. Apparently, stone martens do not like that. And young people, who have a wider acoustic frequency range, are not fond of it either (with some devices I can actually hear it myself).

There are more defensive strategies. Under our hood there’s a toilet freshener block. The neighbors use a bundle of dog hair. Someone else has placed a piece of wire mesh under the car. And finally, someone even had a kind of electric deterrent installed in the engine compartment. I asked Copilot what it thought of all this. According to it, the mesh and the (harmless) high voltage are reasonably effective, but with other solutions you also need a fair bit of luck. Forget about the scent products. Although: proven in practice, I am inclined to say. Whereupon I must immediately admit that I cannot prove a causal connection between the toilet block and the absence of bite damage.

The stone marten is a predator with a strong territorial drive. It marks its habitat with scent traces. When it encounters the scent of a competitor, it tries to remove it. For example by chewing it away. In addition, those wires have a pleasant smell and likewise a pleasant bite. It is also nice and warm there after a car has been driven, and well sheltered.

No measures had been taken for the car that was attacked twice. That implies that the measures taken by the others do work. Just as burglars are likely to choose the least secured house in a street, the stone marten also opts for a snack that does not require it to pinch its ears or nose. Or where it does not receive electric shocks. That neighbor at least has the luck of driving a leased car. Perhaps that made him more careless than the rest. But still, it causes him quite some hassle.

Yesterday I visited the datacenter of a company where a lot of money is involved. That was evident from the physical security measures. From the outside it looked a bit like a prison. Once inside, my identity was checked and my fingerprint was stored on a badge. The badge hung from a bright red lanyard stating that I was only allowed to walk around when accompanied, and the badge showed the name of my host. With the badge I could pass through a single-person airlock deeper into the building: the outer door opens, you step in, the door closes, you present your badge and your finger and if everything checks out, the inner door opens. But first you still had to pass through a detection gate (which of course triggered on my belt) and my belongings went through a scanner.

The nature of my visit meant that we also went up onto the roof. At the door to the roof, my host first had to inform security, because obviously that door was secured. Not only with a badge reader, but also with a door-open status detector – hence that phone call. Once on the roof, I saw how a swiveling camera was keeping a close eye on us. Once back inside, my host had to sign us out.

There was an impressive number of screens in the security control room, connected to an even more impressive number of cameras. Of course the guards cannot possibly watch them all constantly, but the systems alert them with a beep when they detect something out of the ordinary. From the sound of the beep, the guards know where to look.

Our neighbor has granted me access to the security camera footage at the front of his house. Two see more than one, he must have thought. Moreover, his camera captures our front garden rather generously. It also immediately provided an innocent opening to ask what the camera at the back of his house sees. Our backyard is neatly out of view. As it should be, because there we value privacy more than security provided by a third party.

And so everyone – at least everyone who gives it a thought – adjusts their security to their own needs. I just hope we do not end up in an arms race with that marten.

There will be no Security (b)log next week.

 

And in the big bad world…

• this data theft comes with a smell.
• other countries are struggling with the theft of high-value data, too.
• Microsoft says MS Teams is increasingly being used in ‘Hello, this is the helpdesk’ attacks.
• this international report explains how to defend yourself against covert Chinese networks that make use of your equipment.
• even that innocent snipping tool turns out to offer opportunities to attackers.
• ransomware criminals are arming themselves against the quantum computer, too.
• AES-128 turns out to be perfectly safe from the quantum computer.
• a ransomware negotiator passed information to the opposing side.
• quite a few governments worldwide have access to ‘exclusive’ spyware.
• Apple is fighting grabby law-enforcement agencies — and in the same time, all other curious parties.

 

 

Leonardo & Cookie Monster

Photo: author

A long time ago, somewhere in the 1980s, I was on holiday in Italy with my parents. We visited many places, including Padua. There, we wanted to see an ancient university building, but it was just closing. The friendly caretaker gestured that we were welcome to accompany him on his locking-up round. And so it happened that, moments later, we found ourselves standing at the lectern of Leonardo da Vinci.

Have you ever been somewhere where it felt like you weren’t really supposed to be there, yet the moment felt magical? That’s how it felt back then, and I felt it again this week, when I went to get a cup of hot water for tea at the office. The machine showed a red bar. Not a good sign. The screen no longer displayed the usual options for every imaginable type of coffee, but choices such as ‘remote-controlled measures’ and ‘ingredient management’. And in the top left corner was the most important label of all: ‘machine administrator’. With, right next to it, a ‘log out’ icon. So yes, we were logged in as administrator.

Let me speculate for a moment about what might have happened here. The machine had a malfunction, as evidenced by the red light (on the adjacent machine, that bar glowed white). A maintenance engineer had been called in, but couldn’t immediately fix the problem. For a moment it looked as if various things simply needed refilling, but there was more going on; the bottom message on the display read ‘middle grinder empty’, yet that container was absolutely brimming with coffee beans. So the engineer must have left to fetch spare parts, and forgot to log out.

Colleagues from my meeting stood there, grinning. Stumbling into something like this while a security officer happened to be visiting – well, that was rather perfect. I see this more often: people smile sheepishly, feeling a kind of second-hand embarrassment. Someone hasn’t followed the rules and a security officer has caught them red-handed. Oops. Here comes trouble!

Coffee machines fall well outside my official jurisdiction, but I can of course use this example to highlight the broader issue. And that issue isn’t so much that people occasionally forget to lock their workstation – you get that, don’t you – but rather the more general picture that security isn’t always top of mind. When it really should be.

Recently, I was in a discussion about AI. It was about how you’re not allowed to include personal data in your prompts; for example, you can’t just paste in an entire letter and ask the system to analyse it. A manager said that one of his employees had approached him with a brilliant idea: ‘I’ll just ask AI to remove the personal data first!’ The employee was sent away with the instruction to think very carefully about what he had just said. Hopefully by now he has realised that you shouldn’t ask Cookie Monster to keep the cookies safe before washing the cookie jar.

Look, I understand that you don’t share my professional deformation of seeing risks everywhere. But surely a certain level of basic hygiene is not too much to expect, right? You don’t have to be a Leonardo, but don’t be a Cookie Monster either.

 

And in de big bad world…

• browser extensions are turning out to be a serious problem.
• the Dutch government is investing in security for small and medium-sized businesses. [DUTCH]
• the NCSC is issuing urgent warnings about the risks posed by the AI model Mythos. [DUTCH]
• thecompetitor, too, turns out to have an AI model considered too dangerous forbroad release.
• your travel data may have been leaked via booking.com.
• the Cybersecurity Act and the Act on the Resilience of Critical Entities have been passed by the Dutch House of Representatives. [DUTCH]
• vishing can now be handed over to AI as well.
• the chief privacy officer of Logius fears US interference with DigiD. [DUTCH]
• our national privacy watchdog will start preventive audits of ICT suppliers. [DUTCH]
• once again, a fake text message about a parcel is doing the rounds. [DUTCH]

 

Ethical hacking

Image from Unsplash

After years, it was time for me to go back to training. I looked for one where the chance would be small that I’d learn very little; something that tends to happen quickly when you’ve been around the block in this field. A course on ethical hacking more than met that requirement.

For more than three decades, I’ve viewed the world from the right side of the line. My work revolves around security policies, risk analyses, and compliance, to name just a few things. I read and hear about what goes on on the wrong side of the line and try to make life as difficult as possible for the folks who hang out there. With this hacking course, I wanted to see the world from their side for once. Because, as Sun Tzu already knew in the fifth century BC: ‘Know your enemy and know yourself, and you will not have to fear the outcome of a hundred battles.’

But what is ethical hacking, exactly? Broadly speaking, there are two kinds of hackers: the good and the bad. The latter usually make the news, for instance through data breaches at the police or at telco Odido, both here in the Netherlands. That’s how hacking is known to the general public: unlawfully breaking into computer systems. The people who do this come in many shapes and sizes. At the bottom of the ladder you find the script kiddies: people who use ready‑made recipes to do things without really understanding how they work. And right at the top you have organized crime and state actors.

But there are also benevolent hackers. Like their malicious counterparts, they look for weaknesses in defenses. The big difference is that they don’t exploit those weaknesses for personal gain; they responsibly report them to the organization where they found the vulnerability. You can hire ethical hackers to test your systems, but some also operate on their own initiative. Quite often, if they play by certain rules, they even receive a reward. That can range from a T‑shirt to (a lot of) money.

Of course, after a five‑day course I am far from a seasoned hacker. Quite the contrary: last week my head was spinning from hacking tools with countless options, the many ports that can be attacked, and lots of other things that any self‑respecting hacker is expected to know by heart. Back in the MS‑DOS era, you also had to do everything from the command line (the C:\ prompt), but by today’s standards that feels rather archaic. And yet that’s still how things work in that world, only now with Linux instead of MS‑DOS.

The most important thing I learned is that hacking involves quite a lot, but that once you’ve mastered the tricks, it can be remarkably easy – at least if your opponent doesn’t defend themselves well. In the simple scenario we practiced, you find the IP address of your target, check which ports are open, investigate whether known vulnerabilities exist for the services running there, and boom, you’re in. Obviously, it’s (hopefully!) not always that easy, but the principle is likely the same: the hacker looks for weak spots in the defense. And you’d much rather have those vulnerabilities discovered by an ethical hacker than by a criminal. That only helps, of course, if you then actually act on the findings. Fortunately, everyone understands that. Right?

I’ve always had admiration for colleagues who do this for a living. Now that I better understand what they do, that respect has received a serious upgrade. It’s important, rewarding puzzle work that requires a great deal of knowledge and skill. They make discoveries that sometimes cause quite a stir. And then you see them walking around beaming. A fine sight.

Finally, I’d like to share something entirely different that I learned and that anyone who uses AI chatbots such as Copilot, ChatGPT, and Claude can enjoy. It’s about ELI5. That stands for ‘explain like I’m five’ and ensures that answers are phrased in simple terms and don’t assume prior knowledge. Not baby talk, but often using nice analogies. Just try something like: ‘ELI5: Explain what an IP address is.’

 

And in the big bad world…

• You can even hack a coffee machine.
• The Russians might be in your router (tip: reboot it from time to time).
• It’s not only the Dutch police who have been hacked.
• A romance scammer ends up in prison after accidentally trying to lure a colleague.
• Even astronauts suffer from IT problems.
• This trick exposes North Korean fake job applicants.
• Security legend Mikko Hyppönen has taken a different path these days: he fights drones.
• This new AI model is considered too dangerous to be released publicly for now.
• Some presidents still have room to grow when it comes to security awareness.
• Iranian state hackers have their sights set on critical infrastructure in the United States.

 

 

AI calling your parents

Image from Unsplash

Have you ever had no time (or no desire) to call your parents? Then there’s now a handy service that everyone will benefit from!

This is about a company offering a rather unusual AI service. They actually call your elderly parents. So you don’t have to. On their website you’ll find a photo of the Czech founder with his mother, accompanied by the story of how he lived abroad but wanted to stay in touch with her. Different time zones, a demanding job, and “the unpredictability of life” kept getting in the way. And so the idea for his company was born. It helps people feel “remembered, connected, and valued,” they say.

A bit more information from their website. “Mary” calls the elderly person and asks how they’re doing. She also remembers what you tell her. Incredibly handy, of course: if you tell her today that you need to see the doctor, she’ll ask you tomorrow how it went. She also makes use of 1,400 “life story questions” – something like a database full of opening lines. On top of that, she sprinkles interesting little facts throughout the conversation to help keep the mind sharp.

Before long, the older person will likely no longer realise they’re talking to AI. Simply because AI sounds so natural. I’d bet that you and I wouldn’t hear the difference either. And once you start considering Mary a friend, you’ll probably tell her the same things you’d tell a real friend. For example, about your health – something older people talk about quite often. The company proudly displays the logo “HIPAA compliant” on its website. HIPAA is U.S. legislation concerning the privacy and security of medical data. But it’s less strict than our GDPR. In the EU, medical data is considered special-category personal data, which is subject to extra stringent rules.

Older people are particularly vulnerable when it comes to cybercrime. Recently there are a lot of stories about fake police officers showing up to collect money and jewellery, supposedly because some great danger is looming. Criminals could easily piggyback on a service like this. For example, by pretending to be Mary and asking clever questions to manipulate their victim. Because they trust Mary, there’s a greater chance they’ll go along with the story. You can basically wait for this to happen, sad as that may be.

In your work, you may sooner or later get a phone call from a fake Mary as well. These scams already happen. Three years ago, an American named Brianna was supposedly kidnapped. Her mother received a call and heard her daughter speaking. Or so she thought. Because with AI, a few seconds of audio – stolen from social media – is enough to make someone sound lifelike while saying anything you want. The same could happen with your manager, for example, asking you to email certain data. So if you get a strange request over the phone, call the person back on the number you know to verify that it’s legitimate.

And as for Mary? I prefer to call my mother, who turned 93 today (happy birthday!), myself. Much nicer that way.

 

And in the big bad world…

… a training course got in the way of filling this section.

 

 

Rusting chains

‘The weakest link in IT security is always the one between the screen and the backrest of the office chair,’ someone joked in the comments under my previous blog. That blog was about WhatsApp and Signal accounts that had been hacked through their owners. Directly opposed to that is a statement by a former general director of our organization: ‘People are the strongest link in security.’ How do these statements relate to each other?

You often hear that first quote. It basically means: the computer user falls for it with eyes wide open because they don’t understand it all. Some even dare to speak of ‘that dumb end user.’ That, at any rate, is unfair: you simply cannot expect every employee to thoroughly understand all the ins and outs of cybercrime and information security or to be constantly alert to suspicious situations. So stupidity is almost never the issue (I will come back to that ‘almost’).

A chain consists of multiple links. According to the old saying, the weakest link determines the strength of the chain as a whole. That saying implies that one link can be designated as the weakest. But what if another link rusts faster and overtakes its already weak neighbor? Then suddenly a different link becomes the weakest. If the chain is then put under tension, it may break in a completely different place than expected. In short: I don’t believe much in the weakest-link theory. What I do believe in is a chain that is regularly maintained. If a weak spot is found, it should be repaired.

The security chain has two kinds of links: technical and human. I am keeping it simpler here than other models because this is all I need to make my point. Ideally, the technology would be able to keep all harm and inconvenience outside. Our mail filters would recognize all phishing attempts and send spam flawlessly to the trash. All DDoS attacks would be repelled before they reached your network. And hackers wouldn’t stand a chance because all break‑in attempts would be crushed instantly.

We all know that this isn’t how things work. A hundred percent protection through technology alone is an illusion. You wouldn’t think so if you walked through a security expo where vendors promote their hardware and software. They always seemed to sell perfect security, and with the rise of AI that has only become ‘worse.’ But reality is different: the links in the chain have some rusty spots. And do you know why that is? Because the links rub against each other. It’s not like one system protects everything; there is interaction. And things can go wrong there. In the interaction between technical systems, but also — more often? — in the interaction between technical and human links. Put simply: if a system gives an alert but the user dismisses it as irrelevant while something is really happening, then you have a serious rust spot.

So, are humans the strongest link? When I first heard that claim, I was surprised, because the weakest‑link theory was widely accepted then. But I have changed my mind since. Nowadays, I tell my audiences that they are indeed the strongest link. The user is my last line of defense — when all technical systems have failed, the human is the only remaining safeguard. At least, for the kinds of trouble in which the user plays a role.

Stupidity is almost never the issue, I wrote. Almost. So does that mean sometimes it is? Yes. It happens that people have a bad feeling — for example, they don’t trust a certain email. And then they still click the link or open the attachment. Just to see what happens. Because they’re curious. Or because they think: well, this isn’t for real, right? That’s not smart. Just follow the simple rule: when in doubt, assume it’s malicious.

And in the big bad world…

• See where a successful phishing attack (in this case by phone) can lead.
• A security company has uncovered a network of North Korean infiltrators.
• Hackers also use regular management software.
• You could park for free in Perm thanks to a DDoS attack.
• It’s better not to brag about running on a ship.
• Attacks on iPhones are no longer limited to high-value targets.
• You may be attacked by invisible code.
• Belgian civil servants will now message using Beam. [DUTCH]

 

 

WhatsApp and Signal hacked? No!

 

Image from Unsplash

Last Monday, Dutch broadcaster NOS ran the headline: ‘Russia hacks WhatsApp and Signal of government employees, intelligence services say.’ Let me explain why I label this as ‘devaluation.’

First, a reassurance: neither WhatsApp nor Signal has been hacked. At least, not if you use the common meaning of hacking: gaining unauthorized access to a computer system (not a formal definition, but the way I see it). In this case, the computer system would be the service as provided by WhatsApp and Signal. Your individual account is not the target.

Let’s pretend for a moment that these chat services really were hacked. That would mean a hacker had broken into their servers and done all sorts of things that many people would not appreciate; all – or at least many – customers would have been affected because their data had been compromised.

But that’s not what happened here at all. The actor (a polite term for perpetrator) targeted individual accounts of specific types of officials. These people received a message that appeared to come from Signal’s chatbot; it looked like an official warning from the service provider about suspicious activity. It also claimed that data might have leaked and that attempts had been detected to access private information. You could prevent this, the message said, by completing the verification process.

So what is actually happening? The actor wants to log in to your Signal account. The app then asks for a code, which is sent by SMS to the phone number Signal knows: yours. The actor needs that code, and your self‑chosen PIN, to log in. Hence the message they send you. The idea is to make you panic so that you quickly complete the ‘verification process’, which really is a trap. If you fall for it, the actor can take over your entire account and even change the linked phone number to their own. They now have access to your contacts and can read new chat messages (both one‑to‑one and in groups). They can even send messages as you. You lose access to your account, but you can create a new one and get your chat history back – because it is stored on your device. Great, no problem, nice that they helped me so well, you might think.

In another variant, they have you scan a QR code or click a link. They make you believe you are being added to a WhatsApp or Signal group chat, but in reality the attacker’s device becomes linked to your account. The actor can now see all your chats, often including chat history. You notice nothing. In this attack as well, they can read new messages and send messages on your behalf.

Now, back to the term hacking and why I think it is being devalued. From the 1960s onward, a hack was a clever technical trick in the (American) computer and model railway club world, and a hacker was an exceptionally smart programmer. In the 1980s, the term was used for people who conducted in‑depth research into computer systems and networks. If they bypassed security, it was out of curiosity and in order to test things. There were also crackers, their malicious counterparts. From the 1990s onward, the distinction faded and hackers came to be seen as criminals in general. See my personal definition above.

The NOS headline suggests that WhatsApp and Signal have been hacked, while the cyber advisory from Dutch intelligence services explicitly emphasizes that this is not the case. Apparently, NOS was reprimanded, or the editorial team corrected the intern, because later that day the headline changed to: ‘Intelligence services: Russian hackers access WhatsApp and Signal accounts of civil servants.’ And the article gained a paragraph titled: ‘No breach in the messaging service itself.’ In the original version, ‘hacking’ seemed to refer to pretty much all computer‑related trouble coming from the outside. As described above, the term was already significantly devalued, but this was simply misleading.

What actually happened here is called social engineering. In this technique, it is not the computer but the human behind the computer that is attacked. If they succeed in getting you to share a code or scan a QR code, their mission is accomplished. Social engineering is also known as hacking the human – which, ironically, is accurate.

 

And in the big bad world…

• Trolls are influencing our elections. [DUTCH]
• Pro‑Iranian hackers have attacked the medical technology company Stryker.
• Many video doorbells store their recordings for too long. [DUTCH]
• European digital sovereignty is no longer just talk.
• IoT devices are not supposed to log in as admin.
• Cybercriminals also make use of AI – just like their adversaries.
• The automotive sector is the next victim of ransomware gangs.
• A U.S. government employee took data on a USB stick to his new job.

 

Poor crisis communication

Photo by author

It is not my habit to blog about the same topic two weeks in a row. But this time, they really asked for it.

Yes, I'm talking about the data theft at Odido again. Last week I wrote that the press mainly portrayed Odido as a victim: they were hacked, so they must be pitied. But they weren't ‘hardcore hacked’ at all: the criminals got in through phishing combined with other forms of social engineering. They simply walked through the front door and downloaded all that data. That victim narrative is becoming less and less tenable, and the press has now picked up on that as well. Odido is facing increasing scrutiny.

The company is in crisis, and that requires solid communication. So how are they doing on that front? Well, not great. Let me be clear: I’m not an expert in crisis communication. A teammate of mine is – he completed a training program in crisis management and crisis communication. Do you know the first thing he said when I asked him about the essence of good crisis communication? Openness and transparency. Followed by speed, honesty, and taking initiative.

Earlier this week I spoke with people from various organizations. What I heard was not encouraging. One company had been told that only the data of administrators with an account on Odido’s business portal had been affected. But shortly after, employees began complaining, and it turned out that the data of several thousand employees had been leaked. People also grumbled about the very poor and sometimes simply incorrect information coming from the telecom company.

On February 13, I received an email from Odido stating that my data, as a former customer, had been leaked. I was a T-Mobile customer until 2019, the predecessor of Odido. The company wrote: ‘Odido retains – according to our privacy statement – your contact details for up to 2 years after termination of the contract and switching to another provider. Because you switched less than 2 years ago, your details were still in the system, and that is why you received this email.’ A quick calculation shows that something doesn’t add up.

The same email also stated: ‘What has not been leaked: Identification data: number and validity of your passport or driver's license.’ However, on the company’s information page – which is still difficult to find – it does state that this information has been leaked. But apparently that wasn’t important enough to send a follow-up email.

On March 1, haveibeenpwned.com notified me that my data had been leaked via Odido, and three days later my VPN provider sent a similar notification. They had even more information: through their Dark Web Monitor they could specify precisely which data had been leaked. This included the number of an ID card – the card shown here – which was valid until 2016. I had missed Odido’s email because it was sent to an account I rarely check; I only just found it. You can imagine my shock that such an old ID card surfaced while (I believed) Odido had not informed me at all. It shows at the very least that Odido does not comply with its own privacy statement. Let alone the GDPR, which explicitly states that personal data must not be retained longer than necessary. Holding data belonging to someone who was a customer of their legal predecessor seven years ago is absurd.

My knowledgeable colleague said that good communication can actually strengthen your position during a crisis, by showing honesty and integrity. These qualities are in short supply at Odido. What doesn’t help is that the company’s spokesperson badly mispronounced ‘cybercriminals’ in an interview with the Dutch public broadcaster NOS. That level of cluelessness and lack of interest is downright embarrassing. My colleague also noted (thanks, Rico) that it is far more effective to present yourself not as a victim, but as a problem-solver. I’m seeing very little of that so far. Their communication about not paying the ransom – which is a defensible choice – comes down to three sentences on that hard-to-find information page: ‘We have made a careful assessment. Leading experts and government bodies have urgently advised us not to engage with this criminal group. This advice is based on extensive experience with this specific group.’ There is no trace of empathy toward customers. Again, I don’t need them to pay, but I do expect them to clearly explain why they are not paying.

The day before yesterday, I wanted to ask my bank something. The first question their chatbot asked me was: ‘Are you chatting with us because of the recent cyberattack at Odido?’ The chatbot explained that my bank account was safe and provided additional information about data breaches in general. Now that is smart communication.

 

And in the big bad world…

• The FBI has been hacked.
• AI hallucinates when translating Wikipedia articles.
• South Korea’s tax authority accidentally included the password of a seized crypto wallet in a photo – to make it stand out more.
• Hacked traffic cameras helped track down the ayatollah.
• AI can surprisingly accurately identify who is behind a pseudonym.
• AI can also be very mean.
• Your car’s tire-pressure sensors can reveal your location.
• The EU has once again pushed chat control off the table.
• This blogger also links everyday life to security.