Malwarebytes has research on Bing and its AI Chatbot being leveraged by threat actors to deliver ads with malicious links. In short, it’s a malvertizing campaign in which attackers take over the ad accounts of legitimate businesses to create targeted malicious ads:
Ads can be inserted into a Bing Chat conversation in various ways. One of those is when a user hovers over a link and an ad is displayed first before the organic result. In the example below, we asked where we could download a program called Advanced IP Scanner used by network administrators. When we place our cursor over the first sentence, a dialog appears showing an ad and the official website for this program right below it:
Users have the choice of visiting either link, although the first one may be more likely to be clicked on because of its position. Even though there is a small ‘Ad’ label next to this link, it would be easy to miss and view the link as a regular search result.
Upon clicking the first link, users are taken to a website (mynetfoldersip[.]cfd) whose purpose is to filter traffic and separate real victims from bots, sandboxes, or security researchers. It does that by checking your IP address, time zone, and various other system settings such as web rendering that identifies virtual machines.
Real humans are redirected to a fake site (advenced-ip-scanner[.]com) that mimics the official one while others are sent to a decoy page. The next step is for victims to download the supposed installer and run it.
The MSI installer contains three different files but only one is malicious and is a heavily obfuscated script:
Upon execution, the script reaches out to an external IP address (65.21.119[.]59) presumably to announce itself and receive an additional payload.
Lovely.
Emily Phelps, Director, Cyware had this comment:
“With advancing technologies and a rapidly evolving digital landscape, threat actors are able to exploit human trust in established entities at scale. Addressing these risks requires more than awareness training and traditional security controls. End users must understand the risks and proceed with caution, but platforms must also bolster their security posture to adapt to these threats. It’s critical to employ continuous and rigorous testing to ensure they remain a step ahead of potential online adversaries.”
Add this to the attack surface that you have to defend yourself against as I didn’t have “malware delivered by ads on an AI chatbot” on my cybersecurity BINGO card. But I should have expected it as threat actors are getting very crafty these days.
Bell Class Action Lawsuit In Regards To Their Door To Door Sales Practices Allowed To Proceed
Posted in Commentary with tags Bell on September 30, 2023 by itnerdBell has been known for having “shady” door to door sales practices. CBC a few years ago caught them doing really shady things by going undercover. And there was this story where an ex Bell sales rep said that they were trained to lie to customers when they went door to door. This is a main reason why I have suggested to my clients that you need to call Bell directly if you want to sign up with them. This might be about to change as a class action lawsuit in Quebec has been allowed to proceed:
Quebec’s Court of Appeal has on Friday denied Bell’s request to appeal a ruling that authorized a class action against the company for alleged inappropriate door-to-door sales practices.
The lower class action certification court approved in July a class of plaintiffs to take Bell to court over allegations it violated the province’s Consumer Protection Act by instigating a service sales using a door-to-door salesman but concluding the contract over the phone.
Bell alleged that the evidence in front of the certification court meant that there was less than a simple possibility that the plaintiffs would win the case.
But the appeal court sided with the trial judge.
“Perhaps the hearing on the merits will make it possible to demonstrate that the respondent does not meet its burden of proof of the alleged facts and offenses; similarly, perhaps the hearing on the merits will make it possible to demonstrate that the composition of the group must be restricted and that certain types of contracts are not covered by the request for collective action: this is the aim of the defense and hearing on the merits,” the appeal court said.
“However, given the simple filtering role of the request for authorization and the even more restricted role of the judge responsible for authorizing appeals of judgments authorizing collective action, the applicant does not convince that the judge has, on the face of it judgment, erred in a manifest and decisive manner or committed a simple error of law,” it added.
Here’s the thing. If telcos in Canada want to be seen as something other than companies who take advantage of their customers whenever possible, this is the sort of behaviour that needs to stop. While Bell is seen as the worst at this sort of behaviour, all Canadian telcos do door to door sales and they all do it in a way that is suspect as best. If they all either stopped doing this, or did it in a way that doesn’t result in people wanting to sue them, they would be seen in a slightly better light. Then they can work on lowering their prices to something reasonable and having better customer service.
Leave a comment »