Getting hosed

Photo: author

Summer is my favourite time of year to gather stories for this blog. You travel to other countries and get a taste of other cultures. Those cultures aren't limited to good food, beautiful buildings, and friendly people. That's why a summer rarely goes by without me picking up something useful.

Take this so-called fire hose. I found it quite remarkable – a fire hose at a holiday home; I hadn't seen that before. Curious, I opened the fire hose cabinet. Inside was a kit: a few metres of garden hose tied together, a nozzle, and a couple of clips.

I can picture it already. A pan catches fire. You remember that red cabinet, sprint over, and discover that the “fire hose” is held together with three sturdy plastic straps. You dash back into the now-burning house to grab a knife or scissors. Coughing from the smoke, you manage to unroll the hose. You push the nozzle into one end and stare forlornly at the other. Your hands search in vain through the fire-engine-red cabinet for a coupling to connect the hose to the tap. Meanwhile, this fire cabinet is the only thing left of your holiday home. It all took too long. And around these parts, the fire brigade generally has a somewhat longer response time than back home, I'd imagine. [A quick aside: never attempt to put out a pan of oil or fat with water.]

Someone bought the product but neglected to install it. The IT equivalent of that is not (properly) configuring a product – that is, not adjusting the settings to your needs. Or to the organisation's security policies. That can result in every network port being wide open (creating a huge attack surface), or data ending up unchecked in the cloud, or a product never receiving updates, to sketch just a few doom scenarios.

Ah, that's something for IT people, I hear you think. That doesn't concern me as an ordinary user. But that's not entirely true – or maybe not true at all. Because as an end user, you too sometimes make choices that can affect the organisation. Because while a lot is locked down, plenty is still possible. And “if something can be done” doesn't mean “it's allowed.” You might be able to install an app for work use, but are you allowed to? And if you are, can you, for instance, choose between storing data in the cloud or locally on the device? And what's permitted in which situation? None of that is straightforward.

Regulations are constantly evolving, and sometimes they simply don't exist yet – for instance with new technology. We saw that with the rise of the cloud, and it happened again when consumer AI entered the stage. That obviously makes things extra tricky. For an organisation, it's then important that not everyone just does their own thing, because that gets messy (to avoid the word chaotic).

At home, too, it's worth taking a look at your devices' settings. Change a factory-set password to one of your own (which you naturally store in your password manager). Can the thing do something you never use? Do you, for example, have a NAS (a network drive) that's reachable from outside but that you never actually use that way? Then check whether that function is switched off. Because the fewer openings you offer hackers, the sooner they'll go looking for another victim.

 

And in the big bad world…

• phishers used remote-support software and Canadian tax forms in an international campaign.
• this website tracks AI mishaps and jailbreaks.
• cybercriminals skipped their summer holiday.
• a hacker who made heavy use of AI also left an audit report behind for his victim.
• Google turns out to host thousands of misleading ads, researchers discovered using a Google tool.
• an ethical hacker who got no response sent an email from an account belonging to that vulnerable company.
• hackers used AI guardrails to disable AI-based security tooling.
• one company actually offers removing AI guardrails as a service.
• AI has actually hacked companies on its own quite a few times already.
• fake CAPTCHAs are being used for social engineering.