An Epi Special Investigation on the scam political ads plaguing X users in the UK. Over four days, we detected 425 unique malicious ads, generating over 2.3 million impressions. From 1 to 4 July, I observed 425 distinct malicious ads that exploited the studio brand of the BBC Radio 4 Today programme and the likeness of Emily Maitlis. 1 July: 82 ads with 816,950 views 2 July: 95 ads with 433,808 views 3 July: 169 ads with 781,802 views 4 July: 79 ads with 319,412 views Total 1–4 July: 2,351,972 views (avg: 5,534 views/ad) Some individual ads reported over 70,000 impressions. The vast majority of the 425 ads matched one-to-one with individual X accounts; ie. around 400 separate X accounts were used for 425 ads. Interestingly, a large proportion of the accounts were created between 2009 and 2014, with a peak in 2011, and many of their initial tweets posted are scams and malicious links. This tells me that these Twitter accounts have not been recently created or hijacked, but are persistent scam accounts controlled and traded by organised criminals over long periods — decades, in fact. Ads were published by X accounts originating from 89 countries, most of which X indicates are using VPNs, which obscure their true geographic location. The ad origins include exotic and unusual countries such as: Afghanistan, Belarus, Mongolia, Palestine, Pakistan, Russia, Somalia, South Sudan, Ukraine, Uzbekistan and Venezuela. Some important questions that need answers: Why is X allowing ads from a such an exotic variety of countries to reach British users with UK political inspired ads? Why does X let ads be published from accounts hiding behind VPNs, particularly when they acknowledge their use? What are the banks and jurisdictions of the credit cards used to pay for the ads? Why is X permitting ads from regions in active conflict zones, and most concerningly, from countries under comprehensive and targeted US and UK sanctions — including: Afghanistan, Belarus, Russia, Somalia, South Sudan and Venezuela. Since this investigation, I have observed malicious ads exploiting the likeness of Nick Robinson on the Today programme. Funnily enough, I will be on the Today programme on BBC Radio 4 on Wednesday morning at 06:50 to discuss my findings. I hope you join me as one of six million listening! On your radio, on BBC Sounds, or on catchup. UK: Wed 6:50am US Eastern: Wed 1:50am US Pacific: Tue 10:50pm Sydney: Wed 3:50pm @epiapp @episecurity

NeW MaCBoOk wHaT shOUld I iNsTaLL fIRsT?

the luxury mat makes it look like an expensive watch or piece of jewellery

my next dev machine

This is very interesting. The good news for defenders fighting browser-in-the-browser (BITB) phishing attacks is that you can still base all of the user's trust at the top-level browsing level. If the top URL is bad, the page is not trusted, and child URLs are also bad. Tools can still check actual URLs and domains in realtime, and block malicious sites in the browser, proxy or DNS. In this example, for the attacker to have full control, they can't run the phishing page on dropbox•com, so tools and users can detect the exfil site. For users, it depends on them seeing the top URL before looking at the fake login window popup showing a supposedly legitimate masqueraded URL. That's a big if! Good tools can still defeat BITB attacks like this!