Monthly threat updates fromF-Secure
April 2023

Discover the latest
threat updates. Packedwith insights from theexperts at F-Secure.
Delivered every month.
Find out about the takedown of one of the biggest
criminal marketplaces on the web. Discover how
AI can be used to scam you. Get an inside look atApple’s latest security updates. And learn how tocharge your phone in public safely.

Monthly threat report from F-Secure | April 2023

2

Cyber crime superstore stopped
Hoai Duc Nguyen
Researcher
Helsinki, Finland

expert tip
Reduce the amount of data that criminals can accessand make it harder for them to abuse it. For instance,
don’t save critical login credentials or data to autofill inyour web browser. You’ll lose a little convenience, but
you gain a lot of safety.

“Genesis Market
had 80 million setsof credentials anddigital fingerprints
up for sale.”

An international effort called “Operation Cookie Monster” has seized theGenesis Market, a thriving dark web marketplace.
Law enforcement around the world
led by the FBI and the Dutch National
Police Corps had arrested more thana hundred people on the 4th of April,bringing down one of the world’s
biggest marketplaces for stolen data.

“It’s worth noting the number 80
million, which indicates large scaledata theft gathered through manycybercrime campaigns,” he said.

80 million!

Nguyen connected that the growthof dark web marketplaces is directly
related to the rise of infostealer
trojans, which were the mostcommon Windows threat of 2022,
according to a new F-Secure report.
“This sort of malicious software isboth tricky and effective,” he said.
“Users generally won’t notice aninfostealer being installed, as it
shares a lot of characteristics
with legitimate softwareand often disguises itself.”“Genesis Market had 80 million setsof credentials and digital fingerprints
up for sale,” said Hoai Duc Nguyen,a researcher at F-Secure. “Themarketplace also offered stolen
data including browser histories,
cookies, form autofills, and IP address
locations which allow attackers to log
into victims’ account without raisingsuspicion.”
Stolen Facebook, PayPal, andAmazon accounts were among thoseup for sale for as little as a $1 each.

As the name implies…

applications, shipping notices, andunpaid invoices.
“As the name implies, infostealers
access private data, such as browser
cookies, saved usernames, andpasswords, to suck it up,” Nguyen
added. “And the next thing you know,
your credentials end up for sale in amarketplace like Genesis.”
Which is why it’s very
good news that law
enforcement has
found ways to breakthrough the dark web
anonymity thathas kept thesecriminals inbusiness.

F-Secure has seen
this type of trojan
embedded into pirated3

AI’s risks get real

Abdullah AlMazed

ChatGPT has alerted the masses to the power of AI, but consumers alsoneed to be aware of its security risks.
The groundbreaking AI chatbot
ChatGPT from OpenAI has amassed
more than 100 million users since
it was opened to the public in
December of 2022.
While this and similar generative AI
tools are likely to transform fields
ranging from software to education to
health care, they will also give cybercriminals powerful new advantages.

A new era for phishingattacks
Generative AI is likely already
improving the effectiveness ofphishing scams, explained Abdullah
Al Mazed, F-Secure’s SeniorTechnical Product Manager, whose
expertise lies in creating solutions
that protect consumers against
emerging threats.
"You had probably seen somephishing emails or an SMS where

you could instantly detect the attack
because of a grammatical or spelling
mistake. Those days will be a thingof the past,” said Mazed. “ChatGPT
demonstrates how far the Natural
Language Processing field has
already gone and how easy it is towrite a very convincing mail or blog
post by just giving a few keywords.”And as AI advances, so will therisks. “Phishing attacks will only get
more sophisticated,” he said. “Soon,
you should expect an automatedmulti-step process where the firstcommunication will have no links
to a phishing page, no request
to do anything specific but justvery convincing texts that initiate aconversation.”

Take a pause?
AI tools also come with the same
sort of privacy concerns that arise

Senior Technical
Product Manager
Oulu, Finlandfrom most online services, along withsome unique issues of their own.
A data leak from ChatGPT forced
the company behind the chatbot,OpenAI, to take the tool down briefly.
And Samsung employees apparently
fed confidential company data tothe tool. These privacy issues haveprompted regulatory concerns frommany governments, including an
outright ban of the tool from the Italian
government that will lift if OpenAI
takes “useful steps.”
In addition, a group of tech leaders
and academics have called for “apause” in the development of AI toolsthat build on the existing models
available to the public.
But consumers shouldn’t expect thedevelopment of these tools to slow
down in any way. In fact, the power
and impact of these tools are likely toincrease dramatically.

expert tip
If you aren’t among the hundreds of millions that have
tried ChatGPT, take the time to try it out. When you
experience firsthand how convincing a conversation
you can have today with an AI, it will probably help you
be more careful when you engage in a chat with an
unknown party over the internet and help you avoid
potential phishing attacks.

“Phishing attacks
will only get moresophisticated.”

F Secured: your free
38-page guide to online
security in 2023
The F‑Secured guide provides a comprehensive overview of the cyber security threatsfacing consumers in 2023, featuring insight and advice from F‑Secure experts.
Whether you’re looking to get the low­down on malware; understand security and theconnected home; master your use of passwords; learn about the latest phishing threats;
or get the latest cyber security trends for 2023, the F‑Secured guide reveals everything
you need to know, including how to best protect yourself against emerging threats.
Download it now to find out more about:• Malware today and how to protect against it• Security and the smart home
• Cyber security CSI: 5 top threats• How to master your passwords• Trends and predictions for 2023

Download F‑Secured today

Monthly threat report from F-Secure | April 2023

5

Attackers target holes in Apple
Dylan Tham
ResearcherKuala Lumpur, Malaysia

expert tip
The days of thinking Apple devices are immune tomalware are long gone. Apple users should take these
updates as seriously as Apple does. It is crucial to keep
your operating system and applications up to datewith the latest security patches and updates.

“It is also possible
for an attacker tochain both thesevulnerabilities
together.”

The technology giant has released an update to plug two criticalvulnerabilities being exploited by attackers.
Apple released an important security
update in early April to address two
critical vulnerabilities. These fixes
have been pushed to all PCs running
macOS and mobile devices using
iOS, which powers the iPhone andiPad.

A rare weekend update“That Apple pushed these updates
out over the weekend, something thecompany rarely does, shows how
important they are,” said Dylan Tham,a researcher at F-Secure. “It appears
that attackers are actively exploiting
both vulnerabilities.”
The first is a vulnerability found inWebKit, an engine used by many
popular browsers, including Safari
and Google Chrome, across different
operating systems such as iOS andmacOS.

“The vulnerability in WebKit could
allow attackers to create maliciously
crafted web pages or HTML emails
that can trigger thevulnerability when loaded
in a vulnerable browser
or email client,” hesaid.
Tham addedthat once a victim
visits a site with themalicious code, theattacker could potentiallytake complete control of thedevice and access sensitive
data.

’Highest level’ ofaccess
The second vulnerability was
found in a technology usedin various applications suchas video processing and graphics
rendering.
“The exploitation of this vulnerability
can lead to an attacker gaining
the highest level of privileges onan operating system, allowing
direct control over hardware andmemory resources,” Tham said.
“That’s an attacker’s dreamcome true.”Tham noted that both attacks
can be introduced to a victim'smachine through various
methods such as phishingemails, social engineering
attacks, or malicious websites.
“It is also possible for an
attacker to chain both thesevulnerabilities together,” he said.

6

How to get a safe charge
The FBI has issued a warning about public phone charging stations. But therisks are minimal, and a better solution is obvious.
Avoid public charging stations. That’s
the gist of a new warning from the US
Federal Bureau of Investigation (FBI).
While she agrees with the advice,
Laura Kankaala, F-Secure’s ThreatIntelligence Lead, wants consumers
to know the risks that come from apublic charging station are relatively
minimal.

Trust this device?
Kankaala has demonstrated these
sorts of attacks before to different
audiences, such as in a Finnish TV
documentary and in keynotes. “Ingeneral, these USB charging port
attacks aim to steal information stored
on phones by mounting the internal
storage of the phone to a computer
they are connected to,” she said.
While charging wires do open thepossibility of direct access to a device,a full-blown compromise is not likely.

“Modern and up-to-date smartphones
prompt users to ‘trust’ the device uponconnection. Something you should
never do on a public charging stationin case it prompts you for it,” shesaid. “However, if your smartphone isreally old, it may lack these security
features and be far more
susceptible to all kinds ofattacks, including thosethat use a USB charging
port.”

Not amainstream
problem“All in all, it is unlikelythat these sorts ofattacks will become amainstream problem,because they require
someone physicallyaccessing the place where
the attack is carried out, making

Laura Kankaala
Threat Intelligence
LeadHelsinki, Finland

them quite targeted and not very
easily scalable,” she said.
Using your own charger to charge yourphone via a wall socket is the safest
option, but Kankaala advises that you
are far more likely to encounter far
more common threats.
“You’re almost certain
to face, for instance,
phishing messages to try
to lure you to download
bad Android apps
or insert yoursocial media
credentials to asite that steals
them,” sheconcluded.

expert tip
If you do need to use a public charging station, you
should use a USB data blocker.

“If your smartphone
is really old, it maylack these security
features and be far
more susceptible toall kinds of attacks.”

About F-Secure
F-Secure makes every digital moment more secure, for everyone.
We deliver brilliantly simple, frictionless security experiences thatmake life easier for the tens of millions of people we protect andour 180 partners.
For more than 30 years, we’ve led the cyber security industry,
inspired by a pioneering spirit born out of a shared commitment todo better by working together.
For more information visit f-secure.com today!