Does Medium Promote Stolen Software?
November 21, 2022
I read “Bigasoft Total Video Converter 6.4.2.8118 Crack with Serial Key 2023.” The main idea of the write up is that a reader of this Medium article can steal intellectual property. The tip off for a human subject matter expert reviewing content for appropriateness or smart software jazzed on Snorkelesque magic would probably note the word “crack” and the phrase “with Serial Key 2023.” The fact that this article appears on Medium is probably something will annoy the developers of Bigasoft’s video converter. My hunch is that a legal eagle may want to call this Medium oversight to the attention of a responsible adult at the zippy alternative to an old school magazine. What does this somewhat obvious invitation to steal software say? I quote:
Bigasoft Total Video Converter Keygen is compatible with all versions of Windows and runs smoothly on Mac….After reading the installation instructions below, you may install this application since it is effortless. You get TipuCrack from it….
Yeah, this seems clear. Am I missing something that makes this type of theft advocacy okay? I hope my link goes dead because that shows a modicum of ethical behavior.
Stephen E Arnold, November 21, 2022
Simplifying the Geometry of Conscience
November 14, 2022
My first brush with crypto currency was a request to include the topic in a lecture for an outfit running international training programs for law enforcement and intelligence professionals. In 2013, I was in my first year of retirement and interested in what I called CyberOSINT. My definition of the term pivoted on the companies providing tools and software to deal with was grouped under the category of cyber crime. A decade ago, cyber crime was big, but it was propelled by what now seems to have been bad actor minnows.
The hot topics were the Dark Web, forums offering tips and tricks for hacking, and CSAM (child sexual abuse material). Digital currency, specifically Bitcoin, was the lubricant for cyber crime. Therefore, my team and I had no choice but take a look at the Nakamoto white paper, poke into the universities in England beavering away on techniques to deanonymize individual transactions, and the early research efforts of everyone’s favorite online bookstore Amazon. We attended meet ups about digital currency and spoke with seemingly well meaning people who were excited about doing money things without annoying intermediaries and regulatory authorities.
It became clear at least to me and my team that digital currency would become a replacement for paper and coin currencies because [a] money costs a lot to produce, manage, and make counterfeit resistant and [b] values could be whipped up using the juices that bad actors, money launderers, and financial “innovators” have pumping through their veins.
Today digital currencies have become a big financial play. It works… for a while. Then like the tragedy of the commons, the open green field is trashed. I thought about the current big time mess a whiz kid has created. The scale of the fraud makes those early players look less like minnows and more like clueless paramecia with math skills. “Sam Bankman-Fried and the Geometry of Conscience” is an interesting essay. However, it is difficult for a simple and somewhat dull person like myself to understand.
The write up says (and I urge you to read the complete 1,400 word essay. I want to cite one passage, if I may:
On reflection, maybe I’d just try to convince SBF to weight money logarithmically when calculating expected utility (as in the Kelly criterion), to forsake the linear weighting that SBF explicitly advocated and that he seems to have put into practice in his crypto ventures. Or if not logarithmic weighing, then at least some concave utility function—something that makes, let’s say, a mere $1 billion in hand seem better than $15 billion that has a 50% probability of vanishing and leaving you, your customers, your employees, and the entire Effective Altruism community with less than nothing.
Interesting, right.
Here’s my take. The SBF innovator attended MIT. In theory, he was exposed to MIT thinking, which as you may recall, involved taking money from everyone’s favorite poster child for questionable behavior Jeffrey Epstein. Several questions:
- What’s up with an MIT education and inculcation of such quaint concepts as moral behavior?
- Why are individuals willing and able to commit financial fraud when it is comparatively easy to deanonymize some crypto activities?
- Do we need big thoughts like “linear and concave utilities” to explain criminal behavior?
My take. Effective altruism is word salad. Say crypto to me I think of cyber crime. End of story. No Hopf fibration or wordsmithing needed, thank you very much.
Stephen E Arnold, November 14, 2022
Medium and Software Fancy Dancing
October 19, 2022
I noted this link in my Medium email to this Medium published story: “CCleaner Pro 6.03.10002 Crack Plus Serial Key Latest Version.” The write up is allegedly by an entity with the handle Mubashirrana. What’s seems to be troubling is that the information in the write up provides a link to what appears to be a dicey Web site called Get Crack PC’s . No, I will not provide the link. You can get this information from the Medium story if the company has not taken it down. If you do visit the Get Crack PC Web site keep in mind that there may be a risk of risk malware or just breaking a law related to software theft. The write up says:
CCleaner Pro Key 6.03.10002 With Crack [All Editions Keys]
CCleaner Pro 6.03.10002 Crack For Windows computers is helpful software. That eliminates all the clutter over time, including broken shortcuts, temporary files, and other issues. It is the ideal cleaning pro crack for your PC, making your system operate quickly and smoothly. Additionally, it safeguards your privacy and secures your system. Your surfing history and temporary internet files are both cleaned. This program may boost your Internet security and make you less vulnerable to identity theft.
Several observations:
- Medium is outputting lists of suggested stories to people like me and you. One would assume that those suggested links would not publicize a Web site which appears to facilitate software theft
- Medium pesters me with requests to pay them money. Why would I want to pay money to read stories about software theft? Is Medium aware of my lectures to law enforcement and intelligence professionals and trying to help me out with case examples?
- The idea of allowing anyone to create content with the hope of making money is one thing. A failure to use common sense about what to publish is, in my book, another.
Net net: Silicon Valley think demonstrates what I would call a common-sense gap. Will anyone at Medium “care”? Maybe not. Will a Medium professional speak with Mubashirrana about acceptable content? I don’t know. The new digital publisher whiz kids may want to study how the dinobabies handled content selection. Just a thought.
Stephen E Arnold, October 19, 2022
Cyber Security: The Stew Is Stirred
October 12, 2022
Cyber security, in my opinion, is often an oxymoron. Cyber issues go up; cyber vendors’ marketing clicks up a notch. The companies with cyber security issues keeps pace. Who wins this cat-and-mouse ménage a trois? The answer is the back actors and the stakeholders in the cyber security vendors with the best marketing.
Now the game is changing from cyber roulette, which has been mostly unwinnable to digital poker.
Here’s how the new game works if the information in “With Security Revenue Surging, CrowdStrike Wants to Be a Broader Enterprise IT Player” is on the money. I have to keep reminding myself that if there is cheating in competitive fishing, chess, and poker, there might be some Fancy Dancing at the cyber security hoe down.
The write up points out that CrowdStrike, a cyber security vendor, wants to pull a “meta” play; that is, the company’s management team wants to pop up a level. The idea is that cyber security is a platform. The “platform” concept means that other products and services should and will plug into the core system. Think of an oil rig which supports the drill, the pumps, spare parts, and the mess hall. Everyone has to use the mess hall and other essential facilities.
The article says:
Already one of the biggest names in cybersecurity for the past decade, CrowdStrike now aspires to become a more important player in areas within the wider IT landscape such as data observability and IT operations…
Google and Microsoft are outfits which may have to respond to the CrowdStrike “pop up a level” tactic. Google’s full page ads in the dead tree version of the Wall Street Journal and Microsoft’s on-going security laugh parade may not be enough to prevent CrowdStrike from:
- Contacting big companies victimized by lousy security provided by some competitors (Hello, Microsoft client. Did you know….)
- Getting a group of executives hurt in the bonus department by soaring cyber security costs
- Closing deals which automatically cut into both the big competitors’ and the small providers’ deals with these important clients.
The write up cites a mid tier consulting firm as a source of high value “proof” of the CrowdStrike concept. The write up offers this:
IDC figures have shown CrowdStrike in the lead on endpoint security market share, with 12.6% of the market in 2021, compared to 11.2% for Microsoft. CrowdStrike’s growth of 68% in the market last year, however, was surpassed by Microsoft’s growth of nearly 82%, according to the IDC figures.
CrowdStrike’s approach is to pitch a “single agent architecture.” Is this accurate? Sure, it’s marketing, and marketing matters.
Our research suggests that cyber security remains a “reaction” game. Something happens or a new gaffe is exploited, and the cyber security vendors react. The bad actors then move on. The result is that billions in revenue are generated for cyber security vendors who sell solutions after something has been breached.
Is there an end to this weird escalation? Possibly but that would require better engineering from the git go, government regulations for vendors whose solutions are not secure, and stronger enforcement action at the point of distribution. (Yes, ISPs and network providers, I am talking about you.)
Net net: Cyber security will become a market sector to watch. Some darned creative marketing will be on display. Meanwhile as the English majors write copy, the bad actors will be exploiting old and new loopholes.
Stephen E Arnold, October 12, 2022
LinkedIn: What Is the Flavor Profile of Poisoned Data?
October 6, 2022
I gave a lecture to some law enforcement professionals focused on cyber crime. In that talk, I referenced three OSINT blind spots; specifically:
- Machine generated weaponized information
- Numeric strings which cause actions within a content processing system
- Poisoned data.
This free and public blog is not the place for the examples I presented in my lecture. I can, however, point to the article “Glut of Fake LinkedIn Profiles Pits HR Against the Bots.”
The write up states:
A recent proliferation of phony executive profiles on LinkedIn is creating something of an identity crisis for the business networking site, and for companies that rely on it to hire and screen prospective employees. The fabricated LinkedIn identities — which pair AI-generated profile photos with text lifted from legitimate accounts — are creating major headaches for corporate HR departments and for those managing invite-only LinkedIn groups.
LinkedIn is a Microsoft property, and it — like other Microsoft “solutions” — finds itself unable to cope with certain problems. In this case, I am less interested in “human resources”, chief people officers, or talent manager issues than the issue of poisoning a data set.
LinkedIn is supposed to provide professionals with a service to provide biographies, links to articles, and a semi-blog function with a dash of TikTok. For some, whom I shall not name, it has become a way to preen, promote, and pitch.
But are those outputting the allegedly “real” information operating like good little sixth grade students in a 1950s private school?
Nope.
The article suggests three things to me:
- Obviously Microsoft LinkedIn is unable to cope with this data poisoning
- Humanoid professionals (and probably the smart software scraping LinkedIn for “intelligence”) have no way to discern what’s square and what’s oval
- The notion that this is a new problem is interesting because many individuals are pretty tough to track down. Perhaps these folks don’t exist and never did?
Does this matter? Sure, Microsoft / LinkedIn has to do some actual verification work. Wow. Imagine that. Recruiters / solicitors will have to do more than send a LinkedIn message and set up a Zoom call. (Yeah, Teams is a possibility for some I suppose.) What about analysts who use LinkedIn as a source information?
Interesting question.
Stephen E Arnold, October 6, 2022
Amazon: An Ecosystem in Which Some Bad Actors Thrive
October 6, 2022
Wow! Who knew? I must admit that I have developed what I call a “Hypothetical Ecommerce Crime Ecosystem.” Because I am an old, dinobaby, I have not shared my musings in this semi entertaining Web log. I do relatively few “public” talks. I am careful not to be “volunteered” for a local networking meet up like those organized by the somewhat ineffectual “chamber of commerce” in central Kentucky. Plus, I am never sure if those with whom I speak are “into” ecosystems of crime. Sure, last week I gave a couple of boring lectures to a few law enforcement, crime analysts, and government senior officials. But did the light bulbs flashing during and after my talk impair my vision. Nah.
I did read a write up which nibbles around the edges of my diagram for my hypothetical crime ecosystem. “There’s an Underground Market Where Secondhand Amazon Merchant Accounts Are Bought and Sold for Thousands of Dollars” asserts as 100 percent actual factual:
An Insider investigation revealed a thriving gray market for secondhand Amazon seller accounts. On Telegram and forums like Swapd and PlayerUp, thousands of brokers openly sell accounts, with prices ranging from a few hundred bucks for a new account to thousands of dollars apiece for years-old accounts with established histories. … The accounts sometimes steal random people’s identities to disguise themselves, and sellers are using these fake credentials to engage in questionable behavior on Amazon, Insider found — including selling counterfeit textbooks. The people’s whose names and addresses are being stolen are sometimes then sent hundreds of returns by unhappy customers.
Is there other possibly inappropriate activity on the Amazon giant bookstore? The write up says:
Merchants have used shady tactics like submitting false fraud reports targeting rivals, or bribing Amazon employees to scuttle competitors. Others peddle counterfeit or shoddily produced wares. Amazon bans fraudulent sellers, along with other accounts they’re suspected of owning, and blacklists their business name, physical location, and IP address.
Okay, but why?
My immediate reaction is money. May I offer a few speculations about such ecosystem centric behavior? You say, No. Too bad. Here are my opinions:
- Amazon does basic cost benefit analyses. The benefit is the amount of money Amazon gets to keep. The cost is the sum of the time, effort, and direct outflow of cash required to monitor and terminate what might be called the Silicon Valley way. (Yeah, I know Amazon like Microsoft is in some state in the US Northwest, but the spirit of the dudes and dudettes in Silicon Valley knows no geographic boundaries. Did you notice the “con” in “silicon.” Coincidence?
- Bad actors know a thriving ecosystem when they see one. Buy stolen products from a trusted third party, and who worries to much about where the person in the white van obtained them. Pay the driver, box ‘em up, and ship out those razors and other goods easily stolen from assorted brick-and-mortar stores in certain US locations; for example, the Walgreen’s in Tony Bennett’s favorite city.
- The foil of third party intermediaries makes it easy for everyone in the ecosystem to say, “Senator, thank you for the question. I do not know the details of our firm’s business relationship. I will obtain the information and send a report to your office.” When? Well, maybe struggling FedEx or the Senate’s internal mail system lost the report. Bummer. Just request another copy, rinse, and repeat. The method has worked for a couple of decades. Don’t fix it if the system is not broken.
What’s interesting about my “Hypothetical Ecommerce Crime Ecosystem” in my opinion is:
- Plausible deniability is baked in
- Those profiting from exploitation of the Amazon money rain forest have zero incentive or downside to leave the system as it is. Change costs money and — let’s face it — there have been zero significant downsides to the status quo for decades. Yep, decades.
- Enforcement resources are stretched at this time. Thus, what I call “soft fraud” is easier than ever to set up and embed in business processes.
Is the cited article correct? Sure, I believe everything I read online, including Amazon reviews of wireless headphones and cheap T shirts.
Is my analysis correct? I don’t know. I am probably wrong and I am too old, too worn out, too jaded to do much more than ask, “Is that product someone purchased on Amazon an original, unfenced item?”
Stephen E Arnold, October 6, 2022
Seagal and Snowden: Pets of the Russian Federation or Just Pals?
October 5, 2022
I have not be a fan of Mr. Snowden since he leaked classified US government PowerPoints. I am less of a fan now that he has seen the Red Dawn like the now chubby, somewhat overwrought former movie star Steven Seagal. One of his cinematic achievements is “Above the Law.” Perhaps a remake is in the works starring two Eurasian brown bears. Baited and chained, the two luminaries provide an example for today’s conceived (believe it or not in Kiev) and enshrined in the mud of the Port of the Five Seas.
I read a trusted news report from Thomson Reuters called “Putin Grants Russian Citizenship to U.S. Whistleblower Snowden.” The write up points out that the poster boy for zero trust security is now a “real” Russian. The snap in the Reuters’ story shows the honorable Mr. Snowden without his eye glasses with a broken nose piece, a logo of the National Security Agency whose secrecy agreement he found irrelevant, or his Russian Independent Party pin. (I believe this is the political party of everyone’s favorite world leader, Vlad the Visionary Planner.)
I noted this sentence:
Snowden’s lawyer, Anatoly Kucherena, told RIA news agency that his client could not be called up because he had not previously served in the Russian army.
But what about Steven Seagal? He was a military type. He is a trained operator. Will he re-up for Mother Russia? I believe he became a Russian citizen in 2016. Perhaps Seagal and Snowden could team up for a podcast tentatively titled “Pets or Pals”.
Winner.
People who ignore confidentiality agreements and become citizens of nation states not friending the US.
Losers maybe?
Stephen E Arnold, October 5, 2022
Insider Threat: Worse Than Poisoned Open Source Code and Major Operating System Flaws?
October 5, 2022
Here’s a question for you.
What poses a greater threat to your organization? Select one item only, please.
[a] Flaws in mobile phones
[b] Poisoned open source code
[c] Cyber security and threat intelligence systems do not provide advertised security
[d] Insider threats
[e] Operating systems’ flaws.
If you want to check more than one item, congratulations. You are a person who is aware that most computing devices are insecure with some flaws baked in. Fixing up flawed hardware and software under attack is similar to repairing an L-29 while the Super Defin is in an air race.
Each day I receive emails asking me to join a webinar about a breakthrough in cyber security, new threats from the Dark Web, and procedures to ensure system integrity. I am not confident that these companies can deliver cyber security, particularly the type needed to deal with an insider who decides to help out bad actors.
“NSA Employee Leaked Classified Cyber Intel, Charged with Espionage” reports:
A former National Security Agency employee was arrested on Wednesday for spying on the U.S. government on behalf of a foreign government. Jareh Sebastian Dalke, 30, was arrested in Denver, Colorado after allegedly committing three separate violations of the Espionage Act. Law enforcement allege that the violations were committed between August and September of 2022, after he worked as a information systems security designer at the agency earlier that summer.
So what’s the answer to the multiple choice test above? It’s D. Insider breaches suggest that management procedures are not working. Cyber security webinars don’t address this, and it appears that other training programs may not be pulling hard enough. Close enough for horse shoes may work when selling ads. For other applications, more rigor may be necessary.
Stephen E Arnold, October 5, 2022
Cyber Crime and Automation: Bots, Bots, and More Bots
September 23, 2022
With tools now available at the cybercrime boutique Genesis Market, online theft, fraud, and extortion have become user-friendly. It is no wonder the problem is growing faster than ever. Insider spoke with someone who knows a thing or two about the topic and reports, “A Former Cybercriminal Who Once Worked with—and Betrayed—the Secret Service Says the Easy Access to Bots Is One of the Biggest Threats on the Internet Right Now.” Now rehabilitated, ex-hacker Brett Shannon Johnson now works at a fraud prevention company. Writer Samantha Delouya tells us:
“[Johnson] told Insider he worries that shady corners of the web, like bot marketplace The Genesis Market, have made it easier for inexperienced criminals to commit complicated financial crimes. ‘You’ve got sophisticated tools that 98% of cybercriminals simply don’t use, and what scares me right now is we’re seeing that change [to more use],’ Johnson said. Johnson says these bot marketplaces can deliver everything a low-level hacker would need to commit complicated financial crimes. ‘When you visit a Genesis Market, you can search for the target that you’re wanting to get. Chase, Bank of America, Google, Walmart …. you can search for the target. It will deliver the bots that are accessing credentials for that target… So I buy the bot, and the bot delivers everything that I need,’ Johnson added.”
Delouya notes cryptocurrencies have been an especially juicy target recently. With these tools at the ready, Johnson suspects, the challenging economy will motivate many otherwise law-abiding folks to try their hand at financial crimes. For the rest of us, let this be a reminder to stay on top of security best-practices. Have you changed your important passwords lately?
Cynthia Murrell, September 23, 2022
Is Fresh Thinking about ISPs and Network Providers Needed?
September 14, 2022
Today (September 14, 2022) I reviewed some of our research related to what I call the “new” Dark Web. Specifically, I called attention to Internet Service Providers and Network Providers who operate mostly as background services. What gets the attention are the amazing failures of high profile systems like Microsoft and Google Cloud, among others. When I hear talk about “service providers”, the comments fall into two categories:
- The giant regulated outfits some of which are government controlled and owned and others which are commercial enterprises with stakeholders and high profiles. The question, “Does cloud provider X allow its platform to deliver CSAM or phishing attacks?” is not top of mind.
- Local Internet operations which resell connectivity provided by outfits in Category 1 above or who operate servers or lease “virtual” servers on Category 1’s equipment. Most of these outfits have visibility in a specific geographic area; for example, Louisville, not far from my hovel in a hollow.
Are these two categories sufficient? Do bad actors actually do bad things on systems owned, operated and managed by Category 1 companies? Is that local company really hosting CSAM or delivering malware for a client in Hazard County, Kentucky?
The answer to these questions is, “Yes.” However, technology is available, often as open source or purpose built by some ISP/network providers to make it difficult to determine who is operating a specific “service” on third party equipment. Encryption is only part of the challenge. Basic security methods play a role. Plus, there are some specialized open source software designed to make it difficult for government authorities to track down bad actors. (I identified some of these tools in my lecture today, but I will not include that information in this free blog post. Hey, life is cruel sometimes.)
I mention the ISP/Network Provider issue because the stakes are rising and the likelihood of speeding up some investigative processes is decreasing. In this post, I want to point you to one article, which I think is important to read and think about.
Navigate to “Naver Z Teams Up with Thai Telecom Giant to Build Global Metaverse Hub.” Naver is in South Korea. True is in Thailand. South Korea has some interesting approaches to law enforcement. Thailand is one of the countries with a bureaucratic method that can make French procedures look like an SR 71 flying over a Cessna 172. (Yes, this actually happened when the SR 71 was moving at about three times the speed of sound and the Cessna 172 was zipping along at a more leisurely 120 knots.)
The write up states:
Naver Z, the metaverse unit of South Korean internet giant Naver, has partnered with Thai telecom conglomerate True to build a global metaverse hub for creators.
The new service will build on the Zepeto metaverse platform. Never heard of it? The service has 20 million monthly active users.
Here’s a key point:
The platform is particularly attractive for K-pop fans. Zepeto recently collaborated with Lisa, a member of the popular South Korean girl group Blackpink, to host a virtual event where her fans could take selfies with her avatar on Zepeto.
So what?
What if a CSAM vendor uses the platform to distribute objectionable materials? What if the bad actor operates from the US?
What type of training and expertise are required to identify the offending content, track the source of the data, and pursue the bad actor?
Keep in mind that these are two big outfits. The metaverse is a digital datasphere. Much of that environment will be virtualized and make use of distributed services. Obfuscation adds some friction to the investigative processes.
For those charged with enforcing the law, the ISPs/and Network Providers — whether large or small — will become more important factors in some types of investigations.
Is CSAM going to find its way into the “metaverse”?
I think you know the answer to the question. Now do you know what information is needed to investigate an allegation about possibly illegal behavior in Zepeto or another metaverse?
Think about your answer, please.
Stephen E Arnold, September 14, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
