Microsoft Snags Cyber Criminal Gang: Enablers Finally a Target
December 14, 2023
This essay is the work of a dumb dinobaby. No smart software required.
Earlier this year at the National Cyber Crime Conference, we shared some of our research about “enablers.” The term is our shorthand for individuals, services, and financial outfits providing the money, services, and management support to cyber criminals. Online crime comes, like Baskin & Robbins ice cream, in a mind-boggling range of “flavors.” To make big bucks, funding and infrastructure are needed. The reasons include amped up enforcement from the US Federal Bureau of Investigation, Europol, and cooperating law enforcement agencies. The cyber crime “game” is a variation of a cat-and-mouse game. With each technological advance, bad actors try out the latest and greatest. Then enforcement agencies respond and neutralize the advantage. The bad actors then scan the technology horizon, innovate, and law enforcement responds. There are many implications of this innovate-react-innovate cycle. I won’t go into those in this short essay. Instead I want to focus on a Microsoft blog post called “Disrupting the Gateway Services to Cybercrime.”
Industrialized cyber crime uses existing infrastructure providers. That’s a convenient, easy, and economical means of hiding. Modern obfuscation technology adds to law enforcements’ burden. Perhaps some oversight and regulation of these nearly invisible commercial companies is needed? Thanks, MSFT Copilot. Close enough and I liked the investigators on the roof of a typical office building.
Microsoft says:
Storm-1152 [the enabler?] runs illicit websites and social media pages, selling fraudulent Microsoft accounts and tools to bypass identity verification software across well-known technology platforms. These services reduce the time and effort needed for criminals to conduct a host of criminal and abusive behaviors online.
What moved Microsoft to take action? According to the article:
Storm-1152 created for sale approximately 750 million fraudulent Microsoft accounts, earning the group millions of dollars in illicit revenue, and costing Microsoft and other companies even more to combat their criminal activity.
Just 750 million? One question which struck me was: “With the updating, the telemetry, and the bits and bobs of Microsoft’s “security” measures, how could nearly a billion fake accounts be allowed to invade the ecosystem?” I thought a smaller number might have been the tipping point.
Another interesting point in the essay is that Microsoft identifies the third party Arkose Labs as contributing to the action against the bad actors. The company is one of the firms engaged in cyber threat intelligence and mitigation services. The question I had was, “Why are the other threat intelligence companies not picking up signals about such a large, widespread criminal operation?” Also, “What is Arkose Labs doing that other sophisticated companies and OSINT investigators not doing?” Google and In-Q-Tel invested in Recorded Future, a go to threat intelligence outfit. I don’t recall seeing, but I heard that Microsoft invested in the company, joining SoftBank’s Vision Fund and PayPal, among others.
I am delighted that “enablers” have become a more visible target of enforcement actions. More must be done, however. Poke around in ISP land and what do you find? As my lecture pointed out, “Respectable companies in upscale neighborhoods harbor enablers, so one doesn’t have to travel to Bulgaria or Moldova to do research. Silicon Valley is closer and stocked with enablers; the area is a hurricane of crime.
In closing, I ask, “Why are discoveries of this type of industrialized criminal activity unearthed by one outfit?" And, “What are the other cyber threat folks chasing?”
Stephen E Arnold, December 14, 2023
Apple Harvests Old Bell Tel Ideas
December 14, 2023
This essay is the work of a dumb dinobaby. No smart software required.
I am not a Bell head. True, my team did work at Bell Labs. In mid project, Judge Green’s order was enforced; therefore, the project morphed into a Bellcore job. I had opportunities to buy a Young Pioneer T shirt. Apple’s online store has “matured” that idea. The computer platform was one of those inviolate things. Apple is into digital chastity belts too I believe. Lose your iTunes’ password, and you are instantly transferred back to the world of Bell Tel hell if you “lost” your Western Electric 202 handset.
So what?
I read “Apple Shutters Third-Party Apps That Enabled iMessage on Android.” In my opinion, the write up says, “Apple killed a cross platform messaging application.” This is no surprise to anyone who had the experience of attending pre-Judge Green meetings. May I illustrate? In one meeting in Manhattan, the firm with which I was affiliated attended a meeting to explain a proposal and the fee for professional services. I don’t recall what my colleagues and I were pitching, I just remember the reaction to the fee. I am a dinobaby, but the remark ran along this railroad line:
A Fruit Company executive visits a user. The visit is intended to make clear that the user will suffer penalties if she continues to operate outside the rules of the orchard. That MSFT Copilot. Only three tries today to get one good enough cartoon.
That’s a big number. We may have to raise the price of long-distance calls. But you guys won’t get paid until we get enough freight cars organized. We will deliver the payment in nickels, dimes, and quarters.
Yep, a Bell head joke, believe it or not. Ho, ho, ho. Railcars filled with coins.
The write up states:
The iPhone maker said in a statement it “took steps to protect our users by blocking techniques that exploit fake credentials in order to gain access to iMessage.” It added that “these techniques posed significant risks to user security and privacy, including the potential for metadata exposure and enabling unwanted messages, spam, and phishing attacks.” The company said it would continue to make changes in the future to protect its users.
If you remember the days when a person tried to connect a non-Western Electric device into the Bell phone system, the comments were generally similar. Unauthorized devices could imperil national security or cause people to die. There you go.
As a resident of Kentucky, I am delighted that big companies want to protect me. Those Kentuckians unfortunate enough to have gobbled a certain pharma company’s medications may not believe the “protect users” argument.
As a dinobaby, I see Apple’s “protect users” play as little more than an overt and somewhat clumsy attempt to kill cross platform messaging. The motives are easy to identify:
- Protect the monopoly until Apply-pleasing terms can be put in place
- Demonstrate that the company is more powerful than an upstart innovator
- Put the government on notice that it will control its messaging platform
Oh, I almost forget. Apple wants to “protect users.” Bell/AT&T thinking has fertilized the soil in the Apple orchard in my view. I feel more protected already even though a group fired mortars at a certain meeting’s attendees, causing me to hide in a basement until the supply of shells was exhausted.
Oh, yeah, there were people who were supposed to protect me and others at the meeting. How did that work out?
Stephen E Arnold, December 13, 2023
x
x
x
The Cloud Kids Are Not Happy: Where Is Mom?
December 13, 2023
This essay is the work of a dumb dinobaby. No smart software required.
An amusing item about the trials and tribulations of a cloud techno feudalists seems appropriate today. Navigate to the paywalled story “Microsoft Has Stranglehold on the Cloud, Say Amazon and Google.” With zero irony, the write up reports:
Amazon and Google have complained to the UK’s competition regulator that their rival, Microsoft, uses practices that restrict customer choice in the £7.5 billion cloud computing market.
What’s amusing is that Google allegedly said before it lost its case related to the business practices of its online store:
“These licensing practices are the only insurmountable barrier preventing competition on the merits for new customers migrating to the cloud and for existing workloads. They lead to less choice, less innovation, and increased costs for UK customers of all sizes.”
What was Amazon’s view? According to the article:
“Microsoft changed its licensing terms in 2019 and again in 2022 to make it more difficult for customers to run some of its popular software offerings on Google Cloud, AWS and Alibaba. To use many of Microsoft’s software products with these other cloud services providers, a customer must purchase a separate license even if they already own the software. This often makes it financially unviable for a customer to choose a provider other than Microsoft.”
How similar is this finger pointing and legal activity to a group of rich kids complaining that one child has all the toys? I think the similarities are — well — similar.
The question is, “What entity will become the mom to adjudicate the selfish actions of the cloud kids?”
Stephen E Arnold, December 13, 2023
Why Is a Generative System Lazy? Maybe Money and Lousy Engineering
December 13, 2023
This essay is the work of a dumb dinobaby. No smart software required.
Great post on the Xhitter. From @ChatGPT app:
we’ve heard all your feedback about GPT4 getting lazier! we haven’t updated the model since Nov 11th, and this certainly isn’t intentional. model behavior can be unpredictable, and we’re looking into fixing it
My experience with Chat GPT is that it responds like an intern working with my team between the freshman and sophomore years at college. Most of the information output is based on a “least effort” algorithm; that is, the shortest distance between A and B is vague promises.
An engineer at a “smart” software company leaps into action. Thanks, MSFT Copilot. Does this cartoon look like any of your technical team?
When I read about “unpredictable”, I wonder if people realize that probabilistic systems are wrong a certain percentage of the time or outputs. The horse loses the race. Okay, a fact. The bet on that horse is a different part of the stall.
But the “lazier” comment evokes several thoughts in my dinobaby mind:
- Allocate less time per prompt to reduce the bottlenecks in a computationally expensive system; thus, laziness is signal about crappy engineering
- Recognize that recycling results for frequent queries is a great way to give a user “something” close enough for horseshoes. If the user is clever, that user will use words like “give me more” or some similar rah rah to trigger another pass through what’s available
- The costs of system are so great, the Sam AI-Man system is starved for cash for engineers, hardware, bandwidth, and computational capacity. Until there’s more dough, the pantry will be poorly stocked.
Net net: Lazy may be a synonym for more serious issues. How does one make AI perform? Fabrication and marketing seem to be useful.
Stephen E Arnold, December 13, 2023
Google: Another Court Decision, Another Appeal, Rinse, Repeat
December 12, 2023
This essay is the work of a dumb dinobaby. No smart software required.
How long will the “loss” be tied up in courts? Answer: As long as possible.
I am going to skip the “what Google did” reports and focus on what I think is a quite useful list. The items in the list apply to Apple and Google, and I am not sure the single list is the best way to present what may be “clever” ways to dominate a market. But I will stick with what Echelon provided at this YCombinator link.
Two warring samurai find that everyone in the restaurant is a customer. The challenge becomes getting “more.” Thanks, MSFT Copilot. Good enough.
What does the list present? I interpreted the post as a “racket analysis.” Your mileage may vary:
Apple is horrible, but Google isn’t blameless.
Google and Apple are a duopoly that controls one of the most essential devices of our time. Their racket extends more broadly than Standard Oil. The smartphone is a critical piece of modern life, and these two companies control every aspect of them.
- Tax 30%
- Control when and how software can be deployed
- Can pull software or deny updates
- Prevent web downloads (Apple)
- Sell ads on top of your app name or brand
- Scare / confuse users about web downloads or app installs (Google)
- Control the payment rails
- Enforce using their identity and customer management (Apple)
- Enforce using their payment rails (Apple)
- Becoming the de-facto POS payment methods (for even more taxation)
- Partnering with governments to be identity providers
- Default search provider
- Default browser
- Prevent other browser runtimes (Apple)
- Prevent browser tech from being comparable to native app installs (mostly Apple)
- Unfriendly to repairs
- Unfriendly to third party components (Apple)
- Battery not replaceable
- Unofficial pieces break core features due to cryptographic signing (Apple)
- Updates obsolete old hardware
- Green bubbles (Apple)
- Tactics to cause FOMO in children (Apple)
- Growth into media (movie studios, etc.) to keep eyeballs on their platforms (Apple)
- Growth into music to keep eyeballs on their platforms
There are no other companies in the world with this level of control over such an important, cross-cutting, cross-functional essential item. If we compared the situation to auto manufacturers, there would be only two providers, you could only fuel at their gas stations, they’d charge businesses every time you visit, they’d display ads constantly, and you’d be unable to repair them without going to the provider. There need to be more than two providers. And if we can’t get more than two providers, then most of these unfair advantages need to be rolled back by regulators. This is horrific.
My team and I leave it to you to draw conclusions about the upsides and downsides of a techno feudal set up. What’s next? Appeals, hearings, trials, judgment, appeals, hearings, and trials. Change? Unlikely for now.
Stephen E Arnold, December 12, 2023
The Click Derbies: Strong Runners Take the Lead
December 12, 2023
This essay is the work of a dumb dinobaby. No smart software required.
Two unrelated reports about user behavior strike me as important.
The first is data from Pew Research about teens and social media. Are the data “new”? The phrase about “almost constant” usage is like the decision regarding Google as a monopoly. Obvious behavior is difficult to overlook.
“Teens, Social Media and Technology” reports some allegedly accurate data I find suggestive; for example:
- 90 percent of teenagers use YouTube. There are no data about what the teens watch; for example transparent clothing, how to be healthy, or videos about 19th century philosophers
- TikTok reaches 70 percent of teens in the 15 to 17 year old demographic. These are tomorrow’s leaders in business, technology, and medical research who will have fine tuned their attention spans to the world of short, jazzy video
- Facebook’s share of teens is now in the 30 percent range and the “improved” Twitter are apparently losing some of their magnetic appeal.
The surprising factoids concern the 20 percent of the teens in the sample who use TikTok and YouTube “almost constantly.” The share of teens who say they are online with social media almost constantly has almost doubled in the last seven years. How much time remains to do homework? That question is not answered, but test scores suggest, “Not too much” for some teens.
A young and sprightly Temu is making the older runners look like losers. Thanks, MSFT Copilot. Good enough again.
The research report states:
Larger shares of Black and Hispanic teens report being on YouTube, Instagram and TikTok almost constantly, compared with a smaller share of White teens who say the same. Hispanic teens stand out in TikTok and Snapchat use. For instance, 32% of Hispanic teens say they are on TikTok almost constantly, compared with 20% of Black teens and 10% of White teens.
Social media and social media access are essentially unregulated by parents, educational institutions, and the government. Allowing teens to immerse themselves in streams of digital content may have some short term and long term downsides. Perhaps it is too late to reverse the corrosive effects of these information streams? I don’t want to be a Negative Ned, so I will say, “Of course not.”
The second report is about Temu, which allegedly has some connections to the Middle Kingdom. “Shoppers Spend Almost Twice as Long on Temu App Than Key Rivals” contains data which may or may not be spot on. Nevertheless, let’s look at what the article reports from an outfit called Apptopia:
On average, users spent 18 minutes per day on the Temu app in the second quarter, compared with 10 minutes for Amazon and 11 minutes for Alibaba Group Holding Ltd.’s AliExpress, based on Apptopia’s device-level analysis. Among younger users, the time spent on Temu was 19 minutes, it said.
Let’s assume that the data characterize one behavior: Those in the sample spend more time on the Temu app than on the Amazon service. I want to point out that comparing app usage to the undefined “Amazon” is an issue. Nevertheless, one question pops up: “Amazon, what’s causing users to spend less time on your service?” Maybe Amazon has a better interface so a person can find a product more quickly. Maybe Amazon’s crazy quilt of prices turn people off? Maybe the magical “price changes” cause individuals like me to report that bait-and-witch methods are possibly in use? Maybe people see an Amazon price for something manufactured somewhere far from Toledo, and think, “I will look elsewhere, get a better price, and ignore Toledo (a charming city).
The article points to a different reason; to wit:
The addictive app is core to the strategy. It allows users to play games to win rewards, including spinning a roulette-like wheel to win a coupon — which goes up in value if you buy something within 10 minutes. The Temu app is available in more than 40 countries, though none have taken to it like customers in the US, where it’s Apple Inc.’s top app most days this year and sales have well and truly surpassed bargain-shopping giant Shein.
I interpret this to mean: Amazon is behind the times, overly bureaucratic, reacting to AI by trying to support every AI solution, and worrying about its regulator friends in Washington and Brussels.
Net net: On one hand we have an ideal conduit to deliver weaponized information to young people. On the other, we have once-nimble US companies watching Temu score goals.
Stephen E Arnold, December 12, 2023
Redefining Elite in the Age of AI: Nope, Redefining Average Is the News Story
December 12, 2023
This essay is the work of a dumb dinobaby. No smart software required.
Business Insider has come up with an interesting swizzle on the AI thirst fest. “AI Is the Great Equalizer.” The subtitle is quite suggestive about a technology which is over 50 years in the making and just one year into its razzle dazzle next big thing with the OpenAI generative pre-trained transformer.
The teacher (the person with the tie) is not quite as enthusiastic about Billy, Kristie, and Mary. The teacher knows that each is a budding Einstein, a modern day Gertrude Stein, or an Ada Lovelace in the eyes of the parent. The reality is that big-time performers are a tiny percentage of any given cohort. One blue chip consulting firm complained that it had to interview 1,000 people to identify a person who could contribute. That was self-congratulatory like Oscar Meyer slapping the Cinco Jota label on a pack of baloney. But the perceptions about the impact of a rapidly developing technology on average performers is are interesting but their validity is unknown. Thanks, MSFT Copilot, you have the parental pride angle down pat. What inspired you? A microchip?
In my opinion, the main idea in the essay is:
Education and expertise won’t count for as much as they used to.
Does this mean the falling scores for reading and math are a good thing? Just let one of the techno giants do the thinking: Is that the message.
I loved this statement about working in law firms. In my experience, the assertion applies to consulting firms as well. There is only one minor problem, which I will mention after you scan the quote:
This is something the law-school study touches on. “The legal profession has a well-known bimodal separation between ‘elite’ and ‘nonelite’ lawyers in pay and career opportunities,” the authors write. “By helping to bring up the bottom (and even potentially bring down the top), AI tools could be a significant force for equality in the practice of law.”
The write up points out that AI won’t have much of an impact on the “elite”; that is, the individuals who can think, innovate, and make stuff happen. The write up says about company hiring strategies contacted about the impact of AI:
They [These firms’ executives] are aiming to hire fewer entry-level people straight out of school, since AI can increasingly take on the straightforward, well-defined tasks these younger workers have traditionally performed. They plan to bulk up on experts who can ace the complicated stuff that’s still too hard for machines to perform.
The write up in interesting, but it is speculative, not what’s happening.
Here’s what we know about the ChatGPT-type revolution after one year:
- Cyber criminals have figured out how to use generative tools to increase the amount of cyber crime requiring sentences or script generation. Score one for the bad actors.
- Older people are either reluctant or fearful of fooling around with what appears to be “magical” software. Therefore, the uptake at work is likely to be slower and probably more cautious than for some who are younger at heart. Score one for Luddites and automation-related protests.
- The younger folk will use any online service that makes something easier or more convenient. Want to buy contraband? Hit those Telegram-type groups. Want to write a report about a new procedure? Hey, let a ChatGPT-type system do it? Worry about its accuracy or appropriateness? Nope, not too much.
Net net: Change is happening, but the use of smart outputs by people who cannot read, do math, or think about Kant’s ideas are unlikely to do much more than add friction to an already creaky bureaucratic machine. As for the future, I don’t know. This dinobaby is not fearful of admitting it.
As for lawyers, remember what Shakespeare said:
“The first thing we do is, let’s kill all the lawyers.”
The statement by Dick the Butcher may apply to quite a few in “knowledge” professions. Including some essayists like this dinobaby and many, many others. The rationale is to just keep the smartest ones. AI is good enough for everything else.
Stephen E Arnold, December 12, 2023
Big Tech, Big Fakes, Bigger Money: What Will AI Kill?
December 7, 2023
This essay is the work of a dumb dinobaby. No smart software required.
I don’t read The Hollywood Reporter. I did one job for a Hollywood big wheel. That was enough for me. I don’t drink. I don’t take drugs unless prescribed by my comic book addicted medical doctor in rural Kentucky. I don’t dress up and wear skin bronzers in the hope that my mobile will buzz. I don’t stay out late. I don’t fancy doing things which make my ethical compass buzz more angrily than my mobile phone. Therefore, The Hollywood Reporter does not speak to me.
One of my research team sent me a link to “The Rise of AI-Powered Stars: Big Money and Risks.” I scanned the write up and then I went through it again. By golly, The Hollywood Reporter hit on an “AI will kill us” angle not getting as much publicity as Sam AI-Man’s minimal substance interview.
Can a techno feudalist generate new content using what looks like “stars” or “well known” people? Probably. A payoff has to be within sight. Otherwise, move on to the next next big thing. Thanks, MSFT Copilot. Good enough cartoon.
Please, read the original and complete article in The Hollywood Reporter. Here’s the passage which rang the insight bell for me:
tech firms are using the power of celebrities to introduce the underlying technology to the masses. “There’s a huge possible business there and I think that’s what YouTube and the music companies see, for better or for worse
Let’s think about these statements.
First, the idea of consumerizing AI for the masses is interesting. However, I interpret the insight as having several force vectors:
- Become the plumbing for the next wave of user generated content (USG)
- Get paid by users AND impose an advertising tax on the USG
- Obtain real-time data about the efficacy of specific smart generation features so that resources can be directed to maintain a “moat” from would-be attackers.
Second, by signing deals with people who to me are essentially unknown, the techno giants are digging some trenches and putting somewhat crude asparagus obstacles where the competitors are like to drive their AI machines. The benefits include:
- First hand experience with the stars’ ego system responds
- The data regarding cost of signing up a star, payouts, and selling ads against the content
- Determining what push back exists [a] among fans and [b] the historical middlemen who have just been put on notice that they can find their future elsewhere.
Finally, the idea of the upside and the downside for particular entities and companies is interesting. There will be winners and losers. Right now, Hollywood is a loser. TikTok is a winner. The companies identified in The Hollywood Reporter want to be winners — big winners.
I may have to start paying more attention to this publication and its stories. Good stuff. What will AI kill? The cost of some human “talent”?
Stephen E Arnold, December 7, 2023
Will TikTok Go Slow in AI? Well, Sure
December 7, 2023
This essay is the work of a dumb dinobaby. No smart software required.
The AI efforts of non-governmental organizations, government agencies, and international groups are interesting. Many resolutions, proclamations, and blog polemics, etc. have been saying, “Slow down AI. Smart software will put people out of work. Destroy humans’ ability to think. Unleash the ‘I’ll be back guy.'”
Getting those enthusiastic about smart software is a management problem. Thanks, MSFT Copilot. Good enough.
My stance in the midst of this fearmongering has been bemusement. I know that predicting the future perturbations of technology is as difficult as picking a Kentucky Derby winner and not picking a horse that will drop dead during the race. When groups issue proclamations and guidelines without an enforcement mechanism, not much is going to happen in the restraint department.
I submit as partial evidence for my bemusement the article “TikTok Owner ByteDance Joins Generative AI Frenzy with Service for Chatbot Development, Memo Says.” What seems clear, if the write up is mostly on the money, is that a company linked to China is joining “the race to offer AI model development as a service.”
Two quick points:
- Model development allows the provider to get a sneak peak at what the user of the system is trying to do. This means that information flows from customer to provider.
- The company in the “race” is one of some concern to certain governments and their representatives.
The write up says:
ByteDance, the Chinese owner of TikTok, is working on an open platform that will allow users to create their own chatbots, as the company races to catch up in generative artificial intelligence (AI) amid fierce competition that kicked off with last year’s launch of ChatGPT. The “bot development platform” will be launched as a public beta by the end of the month…
The cited article points out:
China’s most valuable unicorn has been known for using some form of AI behind the scenes from day one. Its recommendation algorithms are considered the “secret sauce” behind TikTok’s success. Now it is jumping into an emerging market for offering large language models (LLMs) as a service.
What other countries are beavering away on smart software? Will these drive in the slow lane or the fast lane?
Stephen E Arnold, December 7, 2023
Just for the Financially Irresponsible: Social Shopping
December 7, 2023
This essay is the work of a dumb dinobaby. No smart software required.
Amazon likes to make it as easy as possible for consumers to fork over their hard-earned cash on a whim. More steps between seeing a product and checking out means more time to reconsider a spontaneous purchase, after all. That is why the company has been working to integrate purchases into social media platforms. Payment-platform news site PYMNTS reports on the latest linkage in, “Amazon Extends Social Shopping Efforts with Snapchat Deal.” Amazon’s partnership with Meta had already granted it quick access to eyeballs and wallets at Facebook and Instagram. Now users of all three platforms will be able to link those social media accounts to their Amazon accounts. We are told:
“It’s a partnership that lets both companies play to their strengths: Amazon gets to help merchants find customers who might not have actively sought out their products. And Meta’s discovery-based model lets users receive targeted ads without searching for them. Amazon also has a deal with Pinterest, signed in April, designed to create more shoppable content by enhancing the platform’s offering of relevant products and brands. These partnerships are happening at a moment when social media has become a crucial tool for consumers to find new products.”
That is one way to put it. Here is another: The deals let Amazon take advantage of users’ cognitive haze: scrolling social media has been linked to information overload, shallow thinking, reduced attention span, and fragmented thoughts. A recipe for perfect victims. I mean, customers. We wonder what Meta is getting in exchange for handing them over?
Cynthia Murrell, December 7, 2023
-
- Subscribe to Beyond Search
Feature archive
News archive
-
