FOGINT: Hong Kong: A Significant Crypto Wiggle
November 5, 2024
Hong Kong is taking steps to secure its place in today’s high-tech landscape. Blockonomi reports, “Hong Kong’s Bold Move to Become Asia’s Crypto Capital.” Tax breaks, regulations, and a shiny new virtual asset index underpin the effort. Meanwhile, the Virtual Asset Trading Platform regime launched last year is chugging right along. We suspect Telegram is likely to be the utility for messaging, sales, and marketing.
Writer Oliver Dale tells us:
“The Hong Kong Exchanges and Clearing Limited (HKEX) announced the launch of a Virtual Asset Index Series, scheduled for November 15, 2024. This new index will provide benchmark pricing for Bitcoin and Ether specifically tailored to Asia-Pacific time zones. The Securities and Futures Commission (SFC) is working to finalize a list of crypto exchanges that will receive full licenses by year-end. Eric Yip, executive director for intermediaries at the SFC, revealed plans to establish a consultation panel by early 2025 to maintain oversight of licensed exchanges. The regulatory framework extends beyond trading platforms. Hong Kong authorities are developing comprehensive guidelines for crypto-focused over-the-counter trading desks and custodians, with implementation expected in the coming year. For stablecoin issuers, new requirements are being introduced. Foreign fiat-referenced stablecoin providers will need to establish physical operations in Hong Kong and maintain reserves in local banks.”
Establishing a physical presence in the city is no small thing. Though Hong Kong is a culturally rich and vibrant city, we hear real estate is at a premium. That is ok, we are sure stablecoin geniuses can afford it.
Hong Kong is also working to bring AI tools to the financial sector, but there it is caught between a rock and a hard place. Though a part of China, the dense and wealthy city operates under a unique “one country, two systems” governance framework. As a result, it has limited access to both western AI platforms, like Chat GPT and Gemini, and services from Chinese firms like Baidu and ByteDance. To bridge the gap, local institutions like The Hong Kong University of Science and Technology are building their own solutions. Officials hope tax incentives will attract professional investment firms to the city.
The stablecoin policies should go into effect by the end of this year, while custodian regulations and consultation on over-the-counter trading are to be established some time in 2025.
Cynthia Murrell, November 5, 2024
FOGINT: ANKR and TON Hook Up
October 30, 2024
A humanoid wrote this essay. I tried to get MSFT Copilot to work, but it remains dead. That makes four days with weird messages about a glitch. That’s the standard: Good enough.
The buzzwords “DePIN” and “SNAS” may not be familiar to some cyber investigators. The first refers to an innovation which ANKR embraces. A DePIN is a decentralized physical infrastructure or a network of nodes. The nodes can be geographically distributed. Instead of residing on a physical server, virtualization makes the statement “We don’t know what’s on the hardware a customer licenses and configures.” There is no there there becomes more than a quip about Oakland, California. The SNAS is a consequence of DePIN-type architecture. The SNAS is a super network as a service. A customer can rent big bang systems and leave the hands on work to the ANKR team.
Why am I mentioning a start up operating in Romania?
The answer is that ANKR has cut a deal with The One Network Foundation. This entity was created after Telegram had its crypto plans derailed by the US Securities & Exchange Commission several years ago. The TONcoin is now “open” and part of the “open” One Network Foundation entity. TON, as of October 24, 2024, is directly accessible through ANKR’s Web3 API (application programming interface).
Telegram organization allows TONcoin to “run” on the Telegram blockchain via the Open Network Foundation based in Zug, Switzerland. The plumbing is Telegram; the public face of the company is the Zug outfit. With Mr. Durov’s remarkable willingness to modify how the company responds to law enforcement, there is pressure on the Telegram leadership to make TONcoin the revenue winner.
ANKR is an important tie up. It may be worth watching.
Stephen E Arnold, October 30, 2024
FOGINT: Telegram Game Surfs on an Implied Link: Musk, X, Crypto Game
October 29, 2024
Written by a humanoid dinobaby. No AI except the illustration.
The FOGINT team spotted a report from Decrypt.com. The article is “Why ‘X Empire’ Telegram Players Are Complaining to Elon Musk About the Airdrop.” If you don’t recognize the Crypto and Telegram jargon, the information in the Decrypt article will not make much sense.
For crypto folks, the X Empire Telegram game is news. According to the cited article:
Telegram tap-to-earn game X Empire will launch its X token on The Open Network (TON) on Thursday, but its reveal of airdrop allocations has drawn complaints from players who say they were deemed ineligible for a share of the rewards. And some of them are telling Elon Musk about it.
From the point of view of Telegram, X Empire is another entrepreneur leveraging the Telegram platform. With each popular egame, Telegram edges closer to its objective of becoming a very important player in what may be viewed as a Web3 service provider. In fact, when the potential payoff from its crypto interests, the craziness of some of the Group and Channel controversies becomes less important to the company. In fact, the hope for a Telegram initial public offering pay day is more important than refusing to cooperate with law enforcement. Telegram is working to appease France. Pavel Durov wants to get back to the 2024 and beyond opportunity with the Telegram crypto activities.
What is interesting to the FOGINT team are these considerations:
- Telegram’s bots and crypto linkages provide an interesting way to move funds and befuddle investigators
- Telegram has traction among crypto entities in Southeast Asia, and innovators operating without minimal regulatory oversight can use Telegram to extend their often illegal interests quickly and in a novel way
- Telegram’s bots or automated software embody a form of workflow automation which does not require getting involved with high profile, closely monitored organizations.
FOGINT wants to point out that Elon Musk is not involved in the X Empire play. However, Decrypt’s article suggests that some game players are complaining directly to him about the “earned” token policy. This is not a deep fake play. X Empire is an example of identity or entity surfing.
Investigators can make sense of some blockchain centric criminal activities. But the emergence of in game tokens, Telegram’s own STAR token, and their integration within the Telegram platform creates a one-stop shop for online crypto activities. Cyber investigators face another challenge: The non-US, largely unregulated Telegram operating as a virtual company with an address in Dubai. France took a bold step in detaining Pavel Durov. How will he adapt? It is unlikely he will be able to resist the lure of a big payoff from the innovations embodied in the Telegram platform.
Stephen E Arnold, October 29, 2024
AI Has An Invisible Language. Bad Actors Will Learn It
October 28, 2024
Do you remember those Magic Eyes back from the 1990s? You needed to cross your eyes a certain way to see the pony or the dolphin. The Magic Eyes were a phenomenon of early computer graphics and it was like an exclusive club with a secret language. There’s a new secret language on the Internet generated by AI and it could potentially sneak in malicious acts says Ars Technica: “Invisible Text That AI Chatbots Understand And Humans Can’t? Yep, It’s A Thing.”
The secret text could potentially include harmful instructions into AI chatbots and other code. The purpose would be to steal confidential information and conduct other scams all without a user’s knowledge:
“The invisible characters, the result of a quirk in the Unicode text encoding standard, create an ideal covert channel that can make it easier for attackers to conceal malicious payloads fed into an LLM. The hidden text can similarly obfuscate the exfiltration of passwords, financial information, or other secrets out of the same AI-powered bots. Because the hidden text can be combined with normal text, users can unwittingly paste it into prompts. The secret content can also be appended to visible text in chatbot output.”
The steganographic framework is built into a text encoding network and LLMs and read it. Researcher Johann Rehberger ran two proof-of-concept attacks with the hidden language to discover potential risks. He ran the tests on Microsoft 365 Copilot to find sensitive information. It worked:
“When found, the attacks induced Copilot to express the secrets in invisible characters and append them to a URL, along with instructions for the user to visit the link. Because the confidential information isn’t visible, the link appeared benign, so many users would see little reason not to click on it as instructed by Copilot. And with that, the invisible string of non-renderable characters covertly conveyed the secret messages inside to Rehberger’s server.”
What is nefarious is that the links and other content generated by the steganographic code is literally invisible. Rehberger and his team used a tool to decode the attack. Regular users are won’t detect the attacks. As we rely more on AI chatbots, it will be easier to infiltrate a person’s system.
Thankfully the Big Tech companies are aware of the problem, but not before it will probably devastate some people and companies.
Whitney Grace, October 28, 2024
FOGINT: FBI Nabs Alleged Crypto Swindlers
October 23, 2024
Nowhere does the phrase “buyer beware” apply more than the cryptocurrency market. But the FBI is on it. Crypto Briefing reports, “FBI Creates Crypto Token to Catch Fraudsters in Historic Market Manipulation Case.” The agency used its “NexFundAI” token to nab 18 entities—some individuals and also four major crypto firms: Gotbit, ZM Quant, CLS Global, and MyTrade. The mission was named “Operation Token Mirrors.” Snazzy. Writer Estefano Gomez explains:
“The charges stem from widespread fraud involving market manipulation and ‘wash trading’ designed to deceive investors and inflate crypto values. Working covertly, the FBI launched the token to attract the indicted firms’ services, which allegedly specialized in inflating trading volumes and prices for profit. The charges cover a broad scheme of wash trading, where defendants artificially inflated the value of more than 60 tokens, including the Saitama Token, which at its peak reached a market capitalization of $7.5 billion. The conspirators are alleged to have made false claims about the tokens and used deceptive tactics to mislead investors. After artificially pumping up the token prices, they would cash out at these inflated values, defrauding investors in a classic ‘pump and dump’ scheme. The crypto companies also allegedly hired market makers like ZM Quant and Gotbit to carry out these wash trades. These firms would execute sham trades using multiple wallets, concealing the true nature of the activity while creating fake trading volume to make the tokens seem more appealing to investors.”
If convicted, defendants could face up to two decades in prison. Several of those charged have already pled guilty. Authorities also shut down several trading bots used for wash trades and seized over $25 million in cryptocurrency. Assistant US Attorney Joshua Levy stresses that wash trading, long since illegal in traditional financial markets, is now also illegal in the crypto industry.
Cynthia Murrell, October 23, 2024
Pavel Durov and Telegram: In the Spotlight Again
October 21, 2024
No smart software used for the write up. The art, however, is a different story.
Several news sources reported that the entrepreneurial Pavel Durov, the found of Telegram, has found a way to grab headlines. Mr. Durov has been enjoying a respite in France, allegedly due to his contravention of what the French authorities views as a failure to cooperate with law enforcement. After his detainment, Mr. Durov signaled that he has cooperated and would continue to cooperate with investigators in certain matters.
A person under close scrutiny may find that the experience can be unnerving. The French are excellent intelligence operators. I wonder how Mr. Durov would hold up under the ministrations of Israeli and US investigators. Thanks, ChatGPT, you produced a usable cartoon with only one annoying suggestion unrelated to my prompt. Good enough.
Mr. Durov may have an opportunity to demonstrate his willingness to assist authorities in their investigation into documents published on the Telegram Messenger service. These documents, according to such sources as Business Insider and South China Morning Post, among others, report that the Telegram channel Middle East Spectator dumped information about Israel’s alleged plans to respond to Iran’s October 1, 2024, missile attack.
The South China Morning Post reported:
The channel for the Middle East Spectator, which describes itself as an “open-source news aggregator” independent of any government, said in a statement that it had “received, through an anonymous source on Telegram who refused to identify himself, two highly classified US intelligence documents, regarding preparations by the Zionist regime for an attack on the Islamic Republic of Iran”. The Middle East Spectator said in its posted statement that it could not verify the authenticity of the documents.
Let’s look outside this particular document issue. Telegram’s mostly moderation-free approach to the content posted, distributed, and pushed via the Telegram platform is like to come under more scrutiny. Some investigators in North America view Mr. Durov’s system as a less pressing issue than the content on other social media and messaging services.
This document matter may bring increased attention to Mr. Durov, his brother (allegedly with the intelligence of two PhDs), the 60 to 80 engineers maintaining the platform, and its burgeoning ancillary interests in crypto. Mr. Durov has some fancy dancing to do. One he is able to travel, he may find that additional actions will be considered to trim the wings of the Open Network Foundation, the newish TON Social service, and the “almost anything” goes approach to the content generated and disseminated by Telegram’s almost one billion users.
From a practical point of view, a failure to exercise judgment about what is allowed on Messenger may derail Telegram’s attempts to become more of a mover and shaker in the world of crypto currency. French actions toward Mr. Pavel should have alerted the wizardly innovator that governments can and will take action to protect their interests.
Now Mr. Durov is placing himself, his colleagues, and his platform under more scrutiny. Close scrutiny may reveal nothing out of the ordinary. On the other hand, when one pays close attention to a person or an organization, new and interesting facts may be identified. What happens then? Often something surprising.
Will Mr. Durov get that message?
Stephen E Arnold, October 21, 2024
Hey, France, Read Your Pavel-Grams: I Cooperate
October 18, 2024
Just a humanoid processing information related to online services and information access.
Did you know that Telegram has shared IPs since 2018. Do your homework!
Telegram is a favored message application, because it is supposed to protect user privacy, especially for crypto users. Not say, says Coin Telegraph in the article, “Telegram Has Been Disclosing User IPs Since 2018, Durov Says.” Before you start posting nasty comments about Telegram’s lies, the IPs the message is sharing belong to bad actors. CEO Pavel Durov shared on his Telegram channel that his company reports phone numbers and IP addresses to law enforcement.
The company has been disclosing criminal information to authorities since 2018, but only when proper legal procedure is followed. Telegram abides by formal legal requests when they are from relevant communication lines. Durov stressed that Telegram remains an anonymous centered app:
Durov said the news from last week showed that Telegram has been “streamlining and unifying its privacy policy across different countries.” He stressed that Telegram’s core principles haven’t changed, as the company has always sought to comply with relevant local laws ‘as long as they didn’t go against our values of freedom and privacy.’ He added: ‘Telegram was built to protect activists and ordinary people from corrupt governments and corporations — we do not allow criminals to abuse our platform or evade justice.”’
French authorities indicted Durov in August 2024 on six charges related to illicit activity via Telegram. He posted the $5.5 million bail in September, then revealed to the public how his company complies with legal requests after calling the charges misguided.
Kudos for Telegram disclosing the information to be transparent.
Whitney Grace, October 18, 2024
Deepfake Crime Surges With Scams
October 16, 2024
Just a humanoid processing information related to online services and information access.
Everyone with a brain knew that deepfakes, AI generated images, videos, and audio, would be used for crime. According to the Global Newswire, “Deepfake Fraud Doubles Down: 49% of Businesses Now Hit By Audio and Video Scams, Regula’s Survey Reveals.” Regula is a global developer of ID verification and forensic devices. The company released the survey: “The Deepfake Trends 2024” and it revealed some disturbing trends.
Regula’s survey discovered that there’s a 20% increase in deepfake videos from 2022. Meanwhile, fraud decision-makers across the globe reported a 49% increase encounter deepfakes and there’s also a 12% rise in fake audio. What’s even more interesting is that bad actors are still using old methods for identity fraud scams:
“As Regula’s survey shows, 58% of businesses globally have experienced identity fraud in the form of fake or modified documents. This happens to be the top identity fraud method for Mexico (70%), the UAE (66%), the US (59%), and Germany (59%). This implies that not only do businesses have to adapt their verification methods to deal with new threats, but they also are forced to combat old threats that continue to pose a significant challenge.”
Deepfakes will only get more advanced and worse. Bad actors and technology are like the illnesses: they evolve every season with new ways to make people sick while still delivering the common cold.
Whitney Grace, October 16, 2024
Flappy Bird Flutters to Life Thanks to the Power of the New Idol, Crypto
October 15, 2024
Just a humanoid processing information related to online services and information access.
Flappy Bird is coming out of retirement after a decade away. Launched in 2013, the original game was wildly popular and lucrative. However, less than a year later, its creator pulled it from app stores for being unintentionally addictive. Subsequently, players/addicts were willing to pay hundreds or thousands of dollars for devices that still had the game installed. Now it has reemerged as a Telegram crypto game. Much better. Decrypt reports, “What Is ‘Flappy Bird’ on Telegram? Iconic Game Returns with Crypto Twist.” Writer Ryan S. Gladwin tells us the game is basically the same as before, with a few additions just for crypto bros:
“Developed by the Flappy Bird Foundation, the Telegram game mixes in elements from other crypto games on the app, including the likes of Hamster Kombat, by allowing players to passively earn in-game points by obtaining upgrades. These are earned through a variety of ways, including watching ads and inviting friends.”
Naturally, a custom Flappy Bird token will be introduced. And, as with most of this year’s “tap-to-earn” games, it will reside on Telegram’s decentralized network, simply named The Open Network (TON). We learn:
"Yes, there will be a FLAP token launched in relation with the Telegram version of Flappy Bird. This has been confirmed in tweets from the official game account on Twitter (aka X), and the game will also offer staking rewards for the future token. Previously, The Flappy Bird Foundation said that it has plans to integrate The Open Network (TON)—the network that most tap-to-earn games launch tokens on. Notcoin, the tap-to-earn game that started the Telegram craze with the largest crypto gaming token launch of the year, is the ‘strategic publishing partner’ for Flappy Bird’s return. This partnership is set to help introduce The Open Network (TON) ecosystem to Flappy Bird with the game starting a ‘free mining event’ at launch called ‘Flap-a-TON.’ A mining event is usually a period of time in which players can make gameplay progress to get a cut of a future token airdrop.”
What a cutting-edge way to maximize engagement. If he was so upset about his game’s addictive qualities, why did creator Dong Nguyen sell it to an outfit that meant to crypto-tize it? In fact, he did not. After the game languished for four years, the trademark was deemed abandoned. A firm called Mobile Media Partners Inc. snapped up the languishing trademark and later sold it to one Gametech Holdings LLC, from whom the Flappy Bird Foundation bought it earlier this year. That must have been quite a surprise to the conscientious developer. Not only were Nguyen’s wishes for his game completely disregarded, he is receiving no compensation from the game’s reemergence. Classy.
Cynthia Murrell, October 15, 2024
FOGINT: UN Says Telegram Is a Dicey Outfit
October 14, 2024
The only smart software involved in producing this short FOGINT post was Microsoft Copilot’s estimable art generation tool. Why? It is offered at no cost.
One of my colleagues forwarded a dump truck of links to articles about a UN Report. Before commenting on the report, I want to provide a snapshot of the crappy Web search tools and the useless “search” function on the UN Web site.
First, the title of the October 2024 report is:
Transnational Organized Crime and the Convergence of Cyber-Enabled Fraud, Underground Banking and Technological Innovation in Southeast Asia: A Shifting Threat Landscape
I want to point out that providing a full title in an online article is helpful to some dinobabies like me.
Second, including an explicit link to a document is also appreciated by some people, most of whom are over 25 years in age, of above average intelligence, and interested in online crime. With that in mind, here is the explicit link to the document:
https://www.unodc.org/roseap/uploads/documents/Publications/2024/TOC_Convergence_Report_2024.pdf
Now let’s look briefly at what the 142 page report says:
Telegram is a dicey outfit.
Not bad: 142 pages compressed to five words. Let look at two specifics and then I encourage you to read the full report and draw your own conclusions about the quite clever outfit Telegram.
The first passage which caught my attention was this one which is a list of the specialized software and services firms paying attention to Telegram. Here is that list. It is important because most of these outfits make their presence known to enforcement and intelligence entities, not the TikTok-type crowd:
Bitrace
Chainalysis
Chainargos
Chainvestigate
ChongLuaDao (Viet Nam)
Coeus
Crystal Intelligence
CyberArmor
Flare Systems
Flashpoint
Group-IB
Hensoldt Analytics
Intel 471
Kela
Magnet Forensics
Resecurity
Sophos
SlowMist
Trend Micro
TRM Labs
Other firms played ball with the UN, but these companies may have suggested, “Don’t tell anyone we assisted.” That’s my view; yours may differ.
The second interesting passage in the document for me was:
Southeast Asia faces unprecedented challenges posed by transnational organized crime and illicit economies. The region is witnessing a major convergence of different crime types and criminal services fueled by rapid and shifting advancements in physical, technological, and digital infrastructure have have allowed organized crime networks to expand these operations.
Cyber crime is the hot ticket in southeast Asia. I would suggest that the Russian oligarchs are likely to get a run for their money if these well-groomed financial wizards try to muscle in on what is a delightful mix of time Triads, sleek MBAs, and testosterone fueled crypto kiddies with motos, weapons and programming expertise. The mix of languages, laws, rules, and special purpose trade zones add some zest to the run-of-the-mill brushing activities. I will not suggest that many individuals who visit or live in Southeast Asia have a betting gene, but the idea is one worthy of Stuart Kauffman and his colleagues at the Santa Fe Institute. Gambling emerges from chaos and good old greed.
A third passage which I circled addressed Telegram. By the way, “Telegram” appears more than 100 times in the document. Here’s the snippet:
Providing further indication of criminal activity, Kokang casinos and associated companies have developed a robust presence across so-called ‘grey and black business’ Telegram channels facilitating cross-border ‘blockchain’ gambling, underground banking, money laundering, and related recruitment in Myanmar, Cambodia, China, and several other countries in East and Southeast Asia.
The key point to me is that this is a workflow process with a system and method spanning countries. The obvious problem is, “Whom does law enforcement arrest?” Another issue, “Where is the Telegram server?” The answer to the first question is, “In France.” The second question is more tricky and an issue that the report does not address. This is a problematic omission. The answer to the “Where is the Telegram server?” is, “In lots of places.” Telegram is into dApps or distributed applications. The servers outside of Moscow and St Petersburg are virtual. The providers or enablers of Telegram probably don’t know Telegram is a customer and have zero clue what’s going on in virtual machines running Telegram’s beefy infrastructure.
The report is worth reading. If you are curious about Telegram’s plumbing, please, write benkent2020 at yahoo dot com. The FOGINT team has a lecture about the components of the Telegram architecture as well as some related information about the company’s most recent social plays.
Stephen E Arnold, October 14, 2024
-
- Subscribe to Beyond Search
Feature archive
News archive
-
