Threats sneak up on us in the most unexpected ways

One day, I walked into a meeting that had been called to perfect one of the projects I was working on. In addition to obscure statistics that mean nothing (but we are data-driven, so they have to be there), conclusions on how to improve in the future were nothing more than a screenshot from ChatGPT.

They didn’t even have the decency to hide the fact that they were using artificial intelligence to tell me how to do better.

I’m not sure how common this seemingly bold practice is. Actually, I hear about quite the opposite trend. A consultant with Telia, a Swedish multinational communications giant, recently used an interesting term: "artificial intelligence smuggling," referring to employees secretly using AI tools that their employer hasn’t yet approved.

Why? First of all, workers are being pushed to be more productive, and AI tools simply let them achieve their goals faster. Second, many believe that management is lagging behind current trends amid the breakneck speed of innovation.

The most obvious reason why you shouldn’t use anything not approved by your company is that you don’t want to risk exposing your employer to data theft or breach. By installing third-party tools or inputting company-related data on your work machine, you risk both. As real-life examples teach us, threats sneak up on us in the most unexpected ways.

Recently, we’ve seen a series of reports highlighting how web and IP cameras act as key enablers of devastating cyberattacks. Did you know that criminals can deploy ransomware on your network via a webcam? It has happened before, and it will surely happen again.

But the scary part is that sometimes you don’t even need to click on anything to get infected. Governments around the world have made a habit of buying spyware and are increasingly targeting civilians.

The most sophisticated spyware tools – with Pegasus probably the most notorious example – are zero-click. This means that if your government wants to spy on you, it will, even if you have foolproof cyber hygiene habits.

When we talk about Pegasus, I believe we can discuss it in the context of WikiLeaks and other big spills of Western secrets. It’s not only oppressive regimes that track their citizens; it happens everywhere.

We are also increasingly aware that we are the ones inviting Big Brother to watch us in exchange for convenience. Hence, "deGoogling" has become quite a trend. We even conducted an experiment on how to detach yourself from Google. It is possible, but highly dependent on what you are willing to sacrifice.

We also tried the Murena tablet, which is marketed specifically to deGooglers. It went quite well, but, as always, there’s a catch.

As for the biggest stories of the week, we also brought you our months-long research into Apple Store apps. While Apple still retains a reputation for its robust security practices, our researchers discovered that simply by downloading an app, you are exposing yourself.

How? Well, third-party app developers, big and small alike, hardcode secrets. That means sensitive information is written directly into the app's code, which can be accessed by either good-faith researchers like us or threat actors.

While it depends from app to app, we learned that extremely sensitive data is being exposed in some cases, and it could end in a disaster such as identity theft, among other significant threats.