While you might not think of it as a traditional infosec story with hacks, malware, or compromised PCs, the Jensen Huang affair is absolutely a security topic. Remember, folks: The weak link in the security chain is always the human factor. While all the threats your company makes you read about in security trainings are definitely real, sometimes the easiest way to steal confidential information is through a compromised individual.
Granted, Nvidia says it doesn’t think any sensitive information was compromised, but let’s be honest: You don’t have an affair with the CEO of a company that’s partially responsible for a country’s massive spending on AI (close to 2% of US GDP, according to some estimates) and not learn some things the company probably wouldn’t tell the general public. And considering one of the people Huang had an affair with could have been a Chinese spy, let’s just say that while he may be out, the investigation is just beginning.
That said, there were also plenty of traditional hacks this week, including one at the toilet paper subscription company Who Gives a Crap (yes, that’s the name). As usual, the lost data includes information such as names, email addresses, physical addresses, and phone numbers. That’s going to be an interesting one to pop up on the dark web when it’s eventually leaked.
In more serious news, a British soldier participating in a training exercise near the Russian border in Estonia found himself in the crosshairs of hackers last week after he neglected to remove his personal SIM cards and use a VPN to encrypt his communications before going to the front. Hackers targeted him, identified him on social media, obtained nudes from his device, and demanded money not to leak them. He even paid the hackers once, but after they demanded more money, he reported the issue to his platoon commander. The punishment was severe, with the soldier demoted, given a reduced salary, and ordered to serve 10 months in military detention. It’s not the first time hackers have targeted military personnel abroad in the hopes of finding good blackmail targets or obtaining useful information.
Speaking of state-sponsored hacks, French government authorities have linked the September and October attacks on refrigeration systems to Iranian hackers working for the country’s Revolutionary Guard, and said the attacks caused at least 15 fires and resulted in tens of millions of euros in food waste and other losses. Cyberwarfare is, in many ways, the new front line, considering how easy it is to engage in, and how easy it can be to obfuscate who’s actually responsible for an attack.
Now then, let’s see what else is going on in infosec this week.
That Viral Advent Calendar Might Not Exist
The holiday shopping season is in full swing, early Black Friday deals are here, and my social feeds are full of fancy advent calendars from companies I’ve never heard of featuring treats from coffee and candy to spices and tinned fish. But thankfully, the folks at the Malwarebytes Blog have a timely warning for anyone interested in picking one up: Watch out. AI-generated images and false brand partnerships make it easy to promote phantom products that look great in a TikTok or Instagram reel, but are sold by questionable shops, and the odds are low that you’ll ever get what you paid for.
They also offer plenty of tips to help you identify fake online shops and sellers, like watching out for deals that always seem to be “ending today” or have countdown clocks associated with them, and double-checking the products they claim to sell actually exist by looking for them on other shops, or through the company they claim to have a licensing deal with (which is important if you’re buying a themed advent calendar from your favorite TV show, movie, or other brand). They also recommend checking the warranty and the fine print, just to make sure that those documents actually refer to the product you’re looking to buy–unscrupulous sellers will throw up boilerplate warranties they’ve found online, not expecting a shopper to look too closely. Finally, they recommend that, no matter what, you pay with a method that offers buyer protection, such as a credit card rather than a debit card or direct debit from your bank account.
Hackers Give Maersk 30 Days to Pay $5 Million
In case you’re only familiar with the company name because of that whole “ship stuck in the Suez Canal” back in 2021, Maersk is an absolutely massive global shipping company with equally massive ships at its disposal. The firm owns about 700 large container ships and is responsible for over 13% of global shipping traffic, and last year reported $54 billion in revenue and close to $3 billion in profit. So $5 million in ransom for 100GB of stolen data should be pocket change to them, right? That’s what the ransomware group WhiteArmor is now asking for, after the company confirmed a data breach, according to Bleeping Computer.
Maersk itself says that the breach has been isolated, that the company is investigating, that it doesn’t believe any sensitive data has been disclosed, and further points out that none of the company’s operations have been affected by the breach. WhiteArmor, on the other hand, specifically identified LG Logistics as the target firm and stated that LG handles fulfillment for many of the world’s biggest consumer brands. The group gave Maersk 30 days to pay up, in bitcoin, of course, or else it’ll release the stolen data. The group claims the data includes details such as driver records, passwords, “super_admin” accounts, delivery receipts, purchase orders, and shipping notices, as well as mobile device logs that include phone numbers, emails, and device identifiers. Time will tell whether it gets the money, or the data lands on the dark web for sale.
35,000 Grok-Built Apps Are Wide Open, and Some Are Leaking Passwords
If your organization uses Grok for AI development, you might want to double-check the security of the tools it created for you. Some AI tools are built with security as a first principle, but many aren’t, and according to security researchers at Claroc and reported by The Hacker News, tens of thousands of apps built using the tool were easily found online, with the vast majority of them being open to anyone without signing in first, and many of those were more than happy to hand over sensitive information about the people and companies that built them. The researchers found 37,571 Grok-built apps, of which 35,578 were open for anyone to use. Among those, some contained confidential data, such as new-hire onboarding information, an ad proposal for a US government agency (marked confidential), and sales territory maps for another company. Another included a hospital group’s searchable employee directory, a patient’s medical data at a different hospital, a fire department’s shirt board, and even one contractor’s entire timesheet–with every employee’s password stored in plain text inside.
The researchers did note that most of the apps were simple things like games, landing pages, and other uncomplicated utilities, but the ones that did contain sensitive information were significant enough that they would, in the wrong hands, be considered significant security breaches. Part of the problem is Grok’s sharing settings, which are somewhat similar to Google Docs: You can set a Grok-built app to be sharable to specific invited users, only you, or “anyone with a link,” but unlike Google Docs, Grok app URLs are easily searchable by pattern. Oops.
Ask Our Expert: Will Ditching Google Make You Safer?
Do you have a question about online privacy or security? I’m here to help! You can submit your question here, and I may answer it in an upcoming SecurityWatch column and newsletter. If you’re not subscribed to the newsletter, head here to sign up, and check back each week for the latest updates from PCMag’s security team. Now, on to this week’s question!
Recommended by Our Editors
Lisa M asks: “With AI and other threats, how safe am I using Google products, like Chrome for web browsing and a Pixel as my smartphone?”
Hi Lisa, thanks for your question! In the security world, there’s an old adage that security through obscurity is no security at all. That means that sure, it might make you feel better to use products and services that aren’t as popular because they’re less likely to be targeted by hackers, but that doesn’t actually make them more secure; it just means you’re a smaller target. This is why Mac users, for example, still need to be security-conscious and still need antivirus protection. Sure, they may be a less popular target, but they’re still a target.
I mention all of this because your question makes me think that you’re worried about being too big of a target, and maybe you should switch to something else to protect yourself. That’s an option, but don’t mislead yourself into thinking that if you switch from Chrome to another browser, it’ll make you more secure by default. First, many popular web browsers use Google’s Chromium engine, including alternatives like Edge, Opera, and Vivaldi. Switching from Chrome to one of those may offer different features and benefits, but in many cases, similar vulnerabilities. Even switching to a browser that uses its own engine, like Firefox or Safari, doesn’t mean you’re necessarily safer, because the web’s worst vulnerabilities work regardless of the browser you use.
The same is true with Pixel phones. I love my Pixel, but at its core, it’s still an Android device. It’s susceptible to the same vulnerabilities that target any Android device, no matter who made it. While our devices don’t have the Android market share Samsung does, the operating system can still be hit with the same attacks. And switching to an iPhone doesn’t necessarily mean you’re safer, because now you’re the biggest target in the room. Remember the DarkSword iPhone attack? You didn’t even need to install anything for it to work; just visit a malicious web page. iOS is, on paper, more secure than Android, mostly because iOS is heavily controlled and Android is more open, but even that is changing.
The bottom line is that no platform, product, or company is completely secure, and you have to consider the trade-off between security and convenience. Some products are certainly better than others, and there’s no disputing that Apple generally builds with security in mind, but the company’s control over its devices and software comes at the cost of flexibility and customization. The convenience of Chrome and its extensions, or of Android and its open development, comes with the drawback of vulnerabilities and risks. The best you can do is use the tools that suit your needs, keep them as secure as possible, and stay security-minded while you use them.
About Our Expert
Alan Henry
Managing Editor, Security
Experience
I’ve been writing and editing stories for almost two decades that help people use technology and productivity techniques to work better, live better, and protect their privacy and personal data. As managing editor of PCMag’s security team, it’s my responsibility to ensure that our product advice is evidence-based, lab-tested, and serves our readers.
I’ve been a technology journalist for close to 20 years, and I got my start freelancing here at PCMag before beginning a career that would lead me to become editor-in-chief of Lifehacker, a senior editor at The New York Times, and director of special projects at WIRED. I’m back at PCMag to lead our security team and renew my commitment to service journalism. I’m the author of Seen, Heard, and Paid: The New Work Rules for the Marginalized, a career and productivity book to help people of marginalized groups succeed in the workplace.
Leave a Reply