ZeroFox Daily Intelligence Brief - March 16, 2023

ZeroFox Daily Intelligence Brief - March 16, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Safety Concerns Over OpenAI’s Large Language Model, GPT-4
• U.S. Justice Department Investigation Leads to Takedown of Darknet Cryptocurrency Mixer
• Healthcare Provider Data Breach Puts Personal Information of 4.2 Million at Risk
• WhatsApp Agrees to Implement European Union Rules to Improve Transparency
• Guidance Released on Managing Legacy Medical Tech Security
• Data of 300,000 Customers of Latitude Financial Stolen in a Cyberattack

Safety Concerns Over OpenAI’s Large Language Model, GPT-4

OpenAI has launched the latest iteration of its multimodal large language model, called GPT-4 (Generative Pre-trained Transformer 4), and its accomplishments—including acing the U.S. Bar Exam, LSAT, SAT, and GRE—and potential applications have enthralled internet users. However, ZeroFox Intelligence has observed concerns among security researchers about the risk assessments and mitigation measures employed in the model’s architecture. The technical report accompanying the latest release describes how the enhanced capabilities of GPT-4 introduces new risk surfaces as compared to previous iterations. The report further states that GPT-4 provided potentially dangerous and harmful answers during training, such as detailed responses to queries on synthesizing dangerous chemicals using commonly available supplies, killing people with the investment of just a dollar of cash, procuring cheap cigarettes, performing self-harm, and even manufacturing a bomb; many such prompts have been disallowed prior to launch. The System Card released by OpenAI also discloses that GPT-4 has the potential to be used to attempt to identify private individuals when augmented with outside data, thereby posing threats to individual privacy and security.

Recommendations:

• To learn more about GPT-4 operations, please refer to the official OpenAI Technical Report (https://cdn.openai.com/papers/gpt-4.pdf) and System Card (https://cdn.openai.com/papers/gpt-4-system-card.pdf)
• Users are advised to be cautious when using the language model in high-stakes contexts, as it is prone to “hallucinate” (i.e., to provide incorrect, untruthful, and nonsensical responses).
• Users should be aware that the language model can occasionally provide harmful and hateful responses and can potentially showcase bias towards certain groups of people. Therefore, adequate manual quality control and oversight are recommended when publishing content or performing other operational tasks leveraging results from GPT-4.

U.S. Justice Department Investigation Leads to Takedown of Darknet Cryptocurrency Mixer

A multinational law-enforcement operation has led to the takedown of ChipMixer, a cryptocurrency mixing service that laundered over USD 3 billion worth of cryptocurrency since 2017. During the operation, officials captured servers, darknet websites, a GitHub account, and over USD 46 million in cryptocurrency from the criminal group, which was reportedly involved in ransomware, fraud, cryptocurrency theft, and identity theft. ChipMixer worked as a cryptocurrency tumbler—allowing users to deposit cryptocurrency (occasionally gained through illicit means), to mix cryptocurrency received from various users, and to send the depositors equivalent amounts in potentially untraceable or “untainted” cryptocurrency.

The takedown of ChipMixer follows the Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury’s August 2022 blacklisting of the most popular crypto-tumbling service, the open-source and decentralized Tornado Cash; Tornado Cash developer Alexey Pertsev was subsequently arrested. Although the blacklisting was applauded in security and law-enforcement circles, privacy advocates and cryptocurrency enthusiasts decried the move, calling the sanctioning of an open-source technology (“smart contract”) rather than an individual an overreach of the OFAC’s jurisdiction and potentially unconstitutional.

Recommendations:

• Follow ZeroFox Intelligence (https://cloud.zerofox.com/intelligence/search) for the latest cybersecurity and threat intelligence-related news from across the world.
• Law enforcement officials can utilize chain-analysis services to track illicit transfer of cryptocurrencies gained from criminal activities. The takedown of popular tumbler services makes it harder for cybercriminals to hide their digital footprints—increasing the likelihood of their finances being successfully tracked via chain analysis.

Healthcare Provider Data Breach Puts Personal Information of 4.2 Million at Risk

A Miami-based healthcare administration and managed care solutions provider, Independent Living Systems (ILS), suffered a data breach that impacted over four million individuals. This makes it the largest data breach in the healthcare sector so far in 2023. The threat actors may have accessed sensitive personal information, including medical and health insurance details and Social Security numbers. ILS completed its internal review over six months after the breach and has begun notifying affected individuals.

Recommendations:

• Affected customers should utilize the identify-protection services being offered by ILS.
• ILS customers should be alert for any phishing or social engineering attacks by threat actors using the breached data.
• Healthcare organizations should conduct regular security audits to identify potential vulnerabilities and implement multi-factor authentication to reduce the risk of unauthorized access.

WhatsApp Agrees to Implement European Union Rules to Improve Transparency

In the face of pressure by the European Commission, WhatsApp has agreed to implement the European Union Rules to make its messaging platform more transparent. Following the agreement, WhatsApp will give a clear privacy policy to the end user and make it easier for users to reject updates, as well as provide clearer explanations of when rejecting new privacy policies will mean the user can no longer use the service. WhatsApp has also confirmed it will not share personal data with other Meta family companies like Facebook and Instagram. WhatsApp will also allow users to dismiss or delay notifications about any updates and will not send recurring notifications. WhatsApp will be subject to monitoring of its privacy policy updates by the Consumer Protection Consumer (CPC) Network, which initiated the agreement with messaging platform. Any violation of the EU rules may subject WhatsApp to fines.

Recommendations:

• WhatsApp customers should review and understand the company’s privacy policies and determine if its protections are adequate before using this messaging platform.
• WhatsApp must ensure it is following the EU rules going forward to avoid any future fines.

Guidance Released on Managing Legacy Medical Tech Security

To address the growing challenges of known medical device vulnerabilities and to avert any cyberattacks by threat actors, the Healthcare and Public Health Sector Coordinating Council (HSCC) and Cybersecurity Working Group (CWG) recently released guidance titled “Health Industry Cybersecurity-Managing Legacy Technology Security (HIC-MaLTS).” The guidance aims to help medical device manufacturers and healthcare organizations manage the uptick in risk associated with unpatched legacy medical devices, which are often easy targets for cyberattacks due to their outdated software and poor security features. The guidance highlights four key elements of a legacy technology cyber risk management program: governance, communications, cyber risk management, and future proofing.

Recommendations:

• Healthcare delivery organizations (HDO) should follow their established procedures for verifying, validating, or assessing the impact of patches and device functionality, and these procedures should engage information technology/security and clinical staff to ensure device security and functionality.
• Follow ZeroFox Intelligence (https://cloud.zerofox.com/intelligence/search) to remain up-to-date on emerging threats.

Data of 300,000 Customers of Latitude Financial Stolen in a Cyberattack

The personal information of 300,000 customers of Latitude Financial, a non-bank consumer loan company in Australia and New Zealand, has been breached. The hackers stole 103,000 identity documents, 97 percent of which were drivers’ licenses from a single provider, and 225,000 customer records from a second service provider. Cybersecurity experts have expressed concern that the stolen data may be used to take out fraudulent loans in the victims’ names. Latitude claims the cyberattack started from one of its back-end infrastructure provider vendors; the hackers then obtained the login details of a Latitude employee. Those credentials were then used to steal identity documents from two of Latitude’s service providers.

Recommendations:

• Latitude Financial customers should change their passwords to something unique they have not used on other accounts.
• Affected Latitude Financial customers should monitor their credit reports for any indications their data has been used to take out unauthorized loans be wary of any phishing or social engineering attempts using the breached data.
• Organizations dealing with user data should follow basic cyber hygiene: deploying software updates, following the principle of least privilege information access, and using a strong password policy with periodic changes, as well as enabling multi-factor authentication (MFA).