TikTok: Is It a Helpful Service for Bad Actors?
August 9, 2022
Do you remember the Silicon Valley cheerleaders who said, “TikTok is no big deal. Not to worry.” Well, worry.
“TikTok: Suspected Gangs Tout English Channel Migrant Crossings on Platform” states:
The Home Office [TikTok] said posts which “promote lethal crossings” were unacceptable, but there are calls for more to be done to stop people-smuggling being advertised online.
TikTok is allegedly taking the position that such criminal promotions “have no place” on the China-linked service. The BBC report includes this statement:
A spokesman for TikTok said: “This content has no place on TikTok. We do not allow content that depicts or promotes people smuggling…and have permanently banned these accounts. “We work closely with UK law enforcement and industry partners to find and remove content of this nature, and participate in the joint action plan with the National Crime Agency to help combat organized immigration crime online.”
I am skeptical about TikTok for these reasons:
- Data collection
- Analyses which permit psychological profiling so that potential “insiders” can be identified
- Injection of content which undermines certain social concepts; that is, weaponized information.
Net net: Delete the app and restrict access to the system. Harsh? Maybe too little too late, cheerleaders.
Stephen E Arnold, August 9, 2022
Commercializing Cyber Crime with Search and Retrieval
July 14, 2022
I read “Ransomware Gangs Offer Ability to Search Stolen Data.” The write up reports:
Bleeping Computer reported today that the ALPHV/BlackCat ransomware gang was the first to offer the feature, announcing that they have created a searchable database with leaks from nonpaying victims. The hackers said that their stolen data had been fully indexed and that the search feature included support for finding information by filename or by content available in documents and images. The BlackCat ransomware gang claims it is offering the search service to make it easier for cybercriminals to find passwords or other confidential information.
Other alleged bad actors are offering a search function as well. These are Lockbit and Karakurt.
Several observations:
- Commercialization of cyber crime has been a characteristic of some of the more forward-leaning bad actors
- The availability of open source search makes it easy to add functionality
- More productization is inevitable; for example, subscriptions to Crime as a Service.
Net net: The focus of crime analysts and investigators may have to embrace enablers like Internet Service Providers, cloud services, and open source code repositories.
Stephen E Arnold, July 14, 2022
Indonesia: Good Actors and Bad Actors May Be Interested
June 30, 2022
I am not sure how the “new” visa described in “Indonesia Is Offering A Special Visa To Remote Workers, Allowing Them To Stay There For 5 Years Tax-Free, Including The Dream Destination, Bali.” The write up reports:
Freelancers and remote workers will soon be able to work tax-free in Indonesia, including the island of Bali, as the country’s tourism minister Sandiaga Uno announced the five-year ‘digital nomad visa’…
I did not know that Indonesia had a slogan; namely, “sun, sea and sand.” The proposed visa will shift the emphasis about 180 degrees to “serenity, spirituality and sustainability.” Got it? Sure.
The write up notes:
Living tax-free isn’t always a guarantee if you’re granted a digital nomad visa. For example, Americans will still have to file taxes if they’re granted one, because the US taxes citizens based on citizenship itself, rather than their residence.
The write up points out “there are snakes in Indonesia. If the visa plan becomes a reality, a few digital snakes may enliven daily life. Bad actors with a laptop may appear to be Silicon Valley wizards eager to avoid the rigors of work elsewhere. No Zooms when the surfs up.
Stephen E Arnold, June 30, 2022
Amazon and Counterfeit Products: Are They Really Are Here to Stay?
June 9, 2022
Counterfeit products once took some effort to locate. A quick trip to Orchard Street in lower Manhattan might yield some interesting finds. How about a $10 Rolex. A jaunt through a side street in Wuhan? A visit to a certain store in a shopping center in Bangkok? A journey to a jeweler located in a suburb of San Antonio?
But the Disneyland of counterfeits is the wonderful, clickable world of ecommerce. And who is the ageing Big Daddy of ecommerce?
Yep, Amazon, it seems to me, adopts the policy of Big Daddy Pollitt in Cat on a Hot Tin Roof: “I don’t want to talk about that.”
However, “Amazon Sees Dip in Sellers Signing Up to Sell Counterfeits” makes it clear that Amazon is talking or possibly PR’ing.
The article states:
Amazon said it ramped up investments in 2021 to keep counterfeit products off its retail site and saw signs its efforts are working, according to an annual brand protection report it released Wednesday [June 8, 2022]. The company spent more than $900 million on its anti-counterfeit programs and employed over 12,000 people focused on the problem in 2021. That’s up from $700 million and 10,000 people in the prior year.
But the important point in my opinion appears in this statement:
The increasing investment of money and manpower from Amazon is necessary, said Mary Beth Westmoreland, vice president of technology at Amazon. “That unfortunately speaks to the fact the problem of counterfeit isn’t going away,” Westmoreland said, adding, “it’s an industry-wide problem.”
The PR-ish write up explains that Amazon is using smart software and lines of communication so bad actors can be … what? … Well, Amazon sues and it relies on Chinese authorities to raid a warehouse with fraudulent good.
Does Amazon’s posture indicate that persistent crime is now part of the Amazon experience. I recall the fascinating process of explaining to Amazon that one of its “merchants” shipped me a pair of big red panties instead of an AMD 5900x cpu. Yep, lines of communication. Fraud.
Perhaps Amazon should step away from its third party merchants with made up words, vendors identified by customers as shipping interesting but mostly faux products, and deals with aggregating merchants working from apartments in Hong Kong, Shanghai, and other exotic locations?
Just a thought because the PR’ing seems to be similar to certain big tech companies’ thanking senators for a question.
Stephen E Arnold, June 9, 2022
NFT Fakery? No! Impossible!
June 2, 2022
It is smart to never believe everything you watch or read on the Internet, especially when it comes to non-fungible tokens (NFTs). If you were not aware, NFTS are digital pieces of property with a value determined by their scarcity and creator. Weird ape portrait NFTs went viral when they made their creator a billionaire. We believed the ape NFTs had drifted into meme history, when a news story about an ever weirder dating app surfaced. Buzzfeed explains the details in, “The Bored Ape Dating That Shut Down Because No Women Signed Up Was Just a Prank, Folks.”
The Twitter user @y4kxyz tweeted that the dating app for owners of Bored Ape Yacht Club NFTs was shut down because of the disproportional amount of men to women who signed up. It perpetuated the idea that NFTs are only valued by stereotypical lonely males and it was funny. The entire dating app was a joke, but it appeared real enough that some news outlets ran the story:
“Sadly, it isn’t true. It was all a joke. The app never existed in the first place, so it couldn’t have been shut down because there were no women. It was a funny prank — a good joke, a great one, even. The confirmation bias that NFTs are for sad men is strong enough that this tricked a few news outlets into reporting it as if it were real.”
The Buzzfeed article author believed the NFT dating app was a fake and contacted the creator for information. A few months passed, then the joke story about the app shutting down went viral. The dating app creator and the author spoke with the former more or less confirming the entire thing was a prank.
NFT fans were not the only targets. The others were people with a “right-clicker mentality,” referring to how Windows users can simply right click on an image to save a copy.
The Bored Ape Yacht Club dating app was not a bad prank. No one was hurt. It did not start a social justice warrior war. It did not break the Internet and one rioted in the street.
Whitney Grace, June 2, 2022
App Tracking? Sure, Why Not?
May 4, 2022
Big tech companies, including Google, Facebook, and Apple, are supposed to cut back on the amount of data they collect from users via apps. Despite the lip service to users, apps are still collecting data and it appears these companies will not stop anytime soon. Daiji World explains how much data apps are still gathering in: “Apps Still tracking Users’ Data On Apple App Store.”
A University of Oxford research term investigated 1759 Apple IOS apps in the United Kingdom App Store. The team monitored these apps before and after Apple implemented new tracking policies that supposedly make it harder to track users. Unfortunately, these apps are still tracking users as well as collecting user fingerprinting. The team found hard evidence of user tracking:
“The researchers found real-world evidence of apps computing a mutual fingerprinting-derived identifier through the use of “server-side code” — a violation of Apple’s new policies and highlighting the limits of Apple’s enforcement power as a privately-owned data protection regulator. ‘Indeed, Apple itself engages in some forms of user tracking and exempts invasive data practices like first-party tracking and credit scoring from its new privacy rules,’ claimed Konrad Kollnig, Department of Computer Science, University of Oxford.”
Apple’s Privacy Nutrition Labels are also inaccurate and are in direct conflict with Apple’s marketing claims. It is a disappointment that Apple is purposely misleading its users. Enforcing user privacy laws is sporadic, and tech companies barely follow what they set for themselves. Apple has its own OS, so they have a closed technology domain that they control:
“ ‘Apple’s privacy efforts are hampered by its closed-source philosophy on iOS and the opacity around its enforcement of its App Store review policies. These decisions by Apple remain an important driver behind limited transparency around iOS privacy,” [the research team] emphasised.”
Does this come as a surprise for anyone? Nope.
Apple can d whatever it wants because it is a prime technology company and it develops everything in-house. The only way to enforce privacy laws is transparency, but Apple will not become crystal clear because it will mean the company will lose profits.
Whitney Grace, May 4, 2022
Apple and Stalking? The Privacy Outfit?
May 3, 2022
Here is a tale of unintended, though not unanticipated, consequences. Engadget tells us “Police Reports Suggest a Larger Pattern of AirTag Stalking.” A few isolated cases of bad actors using Apple AirTags to facilitate stalking or car theft have come to light since the device was released in April 2021. To learn how widespread the problem is, Motherboard requested any records mentioning the technology from dozens of police departments around the country. Writer K. Holt summarizes:
“Motherboard received 150 reports from eight police departments and found that, in 50 cases, women called the cops because they received notifications suggesting that someone was tracking them with an AirTag or they heard the device chiming. (An AirTag will chime after it has been separated from its owner for between eight and 24 hours.) Half of those women suspected the tags were planted in their car by a man they knew, such as a current or former romantic partner or their boss. The vast majority of the reports were filed by women. There was just one case in which a man made a report after suspecting that an ex was using an AirTag (which costs just $29) to stalk him. Around half of the reports mentioned AirTags in the contexts of thefts or robberies. Just one instance of AirTag-related stalking would be bad enough. Fifty reports in eight jurisdictions in eight months is a not insignificant number and there are likely other cases elsewhere that haven’t been disclosed.”
Apple was aware the product had the potential to be abused, which is why the alerts cited by victims were built into it from the start. The company has since made some tweaks to make it more obvious if its product has been slipped into one’s belongings, like chiming sooner or making those notification messages clearer. At first the notifications only worked on iOS devices, leaving Android users in the dark. An Android app has since been released, but those users must be aware of the problem, and remember to manually scan for potential AirTag-alongs, for it to be of any use. Google is reportedly working on OS-level detection, which would be some consolation.
And the bad actors? Probably beavering away.
Cynthia Murrell, May 3, 2022
Infrared Tags Hide Information Like Magic: Will Bad Actors Respond?
April 26, 2022
A trope in fantasy stories is when an object is enchanted with information and will only reveal it to the “chosen hero” or under specific circumstances. A famous example of this trope is from Tolkien’s The Hobbit when Elrond reads the Thrór’s Map at Rivendell. Humans have found ways to hide information for centuries using chemistry, physics, and physical/pictorial illusions.
These hiding tricks are described as magical, but it is really human ingenuity that casts the true spell. Wonderful Engineering explains a new way to render information invisible: “These New Infrared Tags Can Embed ‘Invisible’ Info Within 3D-Printed Objects.”
Ph.D. candidate Mustafa Doga Dogan heads a MIT team working on “Infrared Tags.” Essentially these Infrared Tags will contain all the same information as a barcode, but instead of being unattractive or coming off an item they are hidden. The Infrared Tags are invisible to human eyesight, but are visible with an infrared camera. The Infrared Tags can be printed within any object and can be manufactured in two ways:
“MIT team has developed the tags, that seem like regular barcodes, using an infrared-transmitting filament interspersed with air gaps. Such filament appears opaque in visible light but looks translucent in Infrared Light. It was printed inside the walls of the 3D object. One approach involves carving a pattern of tiny air gaps out of a layer of plastic, covered with a smooth protective layer. These gaps represent ones and zeroes, so they can be read like binary code by an IR Camera. There is another approach as well. It involves the utilization of a second plastic. Such plastic is opaque to IR light to create more traditional QR codes. These are covered with an outer layer of the main plastic.”
The Infrared Tags are actually built into the item. It makes an object more appealing, because a barcode is not printed on it. The tags are also more durable as they cannot be removed through physical means.
If mobile devices are built with infrared cameras, then these tags would return design to pre-barcode days. Barcodes contain an extraordinary amount of information, especially for entertainment mediums, retail, and organization systems. What would it mean if they were rendered invisible? The proper magical device may inspire bad actors. The digital sword of Damocles is swinging.
Whitney Grace, April 26, 2022
Dark Patterns and Possible Digital Roach Motels
April 22, 2022
Online subscriptions are a convenient way to receive goods and services, from streaming media to household staples. They are easy to sign up for and, as long as there are adequate funds in one’s account, easy to continue enjoying month after month without lifting a finger. Ending a subscription, on the other hand, can be a calculated nightmare. CNet examines how and why “Canceling Online Subscriptions is Confusing, Difficult, and Absurd… by Design.”
Reporter Attila Tomaschek begins with the saga of cancelling his family’s meal-kit subscription, an ordeal that, he writes, involved a confusing maze of “surveys, guilt trips, oversized green buttons prompting me to stay on board and tiny gray cancellation confirmation links that I had to scroll seemingly endlessly to find.” Such tactics rely on customer retention through exasperation, and they are part of a devious set of techniques called dark patterns. The term refers to steering or tricking users into taking certain actions, like divulging personal data or agreeing to charges one never intended to incur. Or abandoning the quest to cancel a subscription, a sub pattern known as the roach motel. Tomaschek notes:
“And it’s not just the small-time players that are resorting to these tactics. Have you ever tried canceling your Amazon Prime account? Good luck figuring out how to do it — and actually getting through the process without wanting to tear all your hair out. Want to cancel your New York Times subscription? Make sure you have 8 minutes to spare as you wait for a live chat representative to do it for you. This type of dark pattern is sometimes referred to as a roach motel — a design that makes it easy to sign up for a service but outrageously difficult to cancel that service. The cancellation funnel is typically a multi-step process that includes intentionally confusing language and ambiguous navigation buttons. Companies may also sprinkle in cancellation buttons that say things like ‘I don’t care about losing premium features,’ or ‘I don’t like saving money,’ for good measure — preying on the fear of missing out to keep their customers. Then, once the customer has finally navigated the cancellation funnel, they’ll often have to call a phone number or send an email or contact a support agent via chat to finalize the process, adding yet another step to an already lengthy process.”
Not all online subscription providers stoop to this level. Some make the cancellation process easy and transparent, relying on customer satisfaction for customer retention. Imagine that! The hugely successful streaming service Netflix and popular online collaboration platform Basecamp are two examples. For those that do treat would-be former users like roaches, a scant few have faced legal consequences. Examples include the children’s learning platform ABCmouse and weight loss app Noom. Those cases are not the norm, though, as legislation has yet to catch up to the very concept of dark patterns. Until it does, Tomaschek suggests readers examine a company’s cancellation procedure before subscribing to any online service. If it is clear as mud, one would be wise not to set foot in that potential labyrinth.
Cynthia Murrell, April 22, 2022
Is This a Wake Up Call for Cyber Crime Experts?
April 20, 2022
Do you want to be an in-demand cyber expert? You can. You can learn what you need by watching, downloading, or paying for online courses. Then go for the real money: Consulting, training, and explaining to law enforcement, intelligence, and security professionals. Easy, right.
Just be selective about your customers.
“U.S. Hacker Sentenced to Five Years Following Crypto Lessons in North Korea” reports an actual factual situation involving “expert knowledge.” The write up states:
… crypto currency expert and hacker Virgil Griffith was sentenced to five years in prison this Tuesday for aiding North Korea in avoiding U.S. sanctions. The sentence comes in wake of his participation in a crypto currency-focused conference held in North Korea’s capital city, Pyongyang in April 2019, which the U.S. citizen attended even after being denied a travel permit for the purpose. Griffith pled guilty to conspiracy last year, which accelerated his sentencing.
The original article provides additional information. I just want to focus on the risks of not keeping information confidential and out of certain channels. The issues related to incidents associated with FinFisher, Hacking Team, NSO Group, and other companies have not had much impact on specialized software and services never intended for a nation state at odds with the US or not created for commercial use.
The cyber crime training sector is booming. But certain information can blow up in one’s face. One can recover after five years of rest I suppose. But where was the fabric of clear decision making? In a Pyongyang relaxation spa? Perhaps with McKinsey & Company in Paris, a fave destination for some North Koreans?
Stephen E Arnold, April 20, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
