PSA: Twitter Wants You to Pay for SMS Authentication. Here Are the Alternatives
Twitter is moving its SMS-based Two-Factor Authentication (or 2FA) behind the paywall of Twitter Blue. The change means starting March 20th, only those users who pay the $8 subscription fee can use what is arguably one of the easiest — but also least secure — forms of authentication. If you’ve decided not to subscribe to Twitter Blue or would prefer to move to a more secure system, here we will look into the alternatives and guide you on how to set them up.
In an episode that underscores the vulnerability of global computer networks, hackers got ahold of login credentials for data centers in Asia used by some of the world’s biggest businesses, a potential bonanza for spying or sabotage, according to a cybersecurity research firm. The previously unreported data caches involve emails and passwords for customer-support websites for two of the largest data center operators in Asia: Shanghai-based GDS Holdings Ltd. and Singapore-based ST Telemedia Global Data Centres, according to Resecurity, which provides cybersecurity services and investigates hackers. About 2,000 customers of GDS and STT GDC were affected. Hackers have logged into the accounts of at least five of them, including China’s main foreign exchange and debt trading platform and four others from India, according to Resecurity, which said it infiltrated the hacking group.
Generative AI is coming for the lawyers
David Wakeling, head of London-based law firm Allen & Overy’s markets innovation group, first came across law-focused generative AI tool Harvey in September 2022. He approached OpenAI, the system’s developer, to run a small experiment. A handful of his firm’s lawyers would use the system to answer simple questions about the law, draft documents, and take first passes at messages to clients. The trial started small, Wakeling says, but soon ballooned. Around 3,500 workers across the company’s 43 offices ended up using the tool, asking it around 40,000 queries in total. The law firm has now entered into a partnership to use the AI tool more widely across the company, though Wakeling declined to say how much the agreement was worth. According to Harvey, one in four at Allen & Overy’s team of lawyers now uses the AI platform every day, with 80 percent using it once a month or more. Other large law firms are starting to adopt the platform too, the company says.
Employees at Gaming Giant Activision Hit by SMS Phishing Attack
Researchers have disclosed details of a data breach due to SMS phishing attack targeting the world’s prominent game publisher, Activision. According to VX-Underground researchers on Twitter, unidentified hackers managed to breach Activision’s security and steal internal company data. There has been a recent rise in SMS phishing, also known as smishing, which is a form of social engineering attack in which an attacker sends a text message to a victim with the goal of tricking them into revealing sensitive information or downloading malware onto their device. For example, Reddit, Coinbase, Zendesk, Twilio, DoorDash, and Namecheap, among several others, suffered SMS phishing attacks directed toward employees of these companies.
The CSA is addressing smart home data privacy, and it’s about damn time
Do you wish you could see exactly what data your smart thermostat collects and how it uses that information? Would you like to know what your video doorbell knows about who visits your home and when? Are you interested in who can see that map of your bedroom your robot vacuum generated? Or would you at least like to be reassured that no one else knows these intimate details? Today, the Connectivity Standards Alliance (CSA), the group behind Matter, announced the formation of a new Data Privacy Working Group. The group will develop a global “Alliance Data Privacy Specification” to certify the data privacy of smart devices and the services they use as well as provide information about how that data is used in a clear, digestible manner — that is, without requiring you to wade through thousands of words in privacy policies or simply trusting companies like Amazon, Google, Samsung, and others with that data.
New S1deload Malware Hijacking Users’ Social Media Accounts and Mining Cryptocurrency
An active malware campaign has set its sights on Facebook and YouTube users by leveraging a new information stealer to hijack the accounts and abuse the systems’ resources to mine cryptocurrency. Bitdefender is calling the malware S1deload Stealer for its use of DLL side-loading techniques to get past security defenses and execute its malicious components. “Once infected, S1deload Stealer steals user credentials, emulates human behavior to artificially boost videos and other content engagement, assesses the value of individual accounts (such as identifying corporate social media admins), mines for BEAM cryptocurrency, and propagates the malicious link to the user’s followers,” Bitdefender researcher Dávid ÁCS said.
