Need a Human for Special Work? Just Buy One Maybe?
December 29, 2022
Is it possible to purchase a person? Judging from the rumors I have heard in rural Romania, outside the airport in Khartoum, and in a tavern in Tirana — I would suggest that the answer is “possibly.” The Times of London is not into possibilities if the information in “Maids Trafficked and Sold to Wealthy Saudis on Black Market” is accurate. Keep in mind that I am mindful of what I call open source information blindspots. Shaped, faked, and weaponized information is now rampant.
The article focuses on an ecommerce site called Haraj.sa. The article explains:
[The site] Saudi Arabia’s largest online marketplace, through which a Times investigation shows that hundreds of domestic workers are being illegally trafficked and sold to the highest bidders.
Furthermore, the Times adds:
The app, which had 2.5 million visits last year — more than Amazon or AliExpress within the kingdom — is still available on the Apple and Google Play stores despite being criticised by the UN’s Special Rapporteurs in 2020 for facilitating modern slavery.
If true, the article is likely to make for some uncomfortable days as the world swings into 2023; specifically:
- The Saudi government
- Apple
- Assorted law enforcement professionals.
If the information in the write up is accurate, several of the newspaper’s solicitors will be engaged in conversations with other parties’ solicitors. I assume that there will be some conversations in Mayfair and Riyadh about the article. Will Interpol become curious? Probably.
Let’s step back and ask some different questions. I am assuming that some of the information in the article is “correct”; that is, one can verify screenshots or chase down the source of the information. Maybe the lead journalist will consent to an interview on a true crime podcast. Whatever.
Consider these questions:
- Why release the story at the peak of some countries’ holiday season? Is the timing designed to minimize or emphasize the sensitive topic of alleged slavery, the Kingdom’s conventions, or the apparent slipshod app review process at controversial US high technology companies?
- What exactly did or does Apple and Google know about the app for the Haraj marketplace? If the Times’ story is accurate, what management issue exists at each of these large, but essential to some, companies?
- Is the ecommerce site operating within the Kingdom’s cultural norms or is the site itself breaking outside legal guidelines? What does Saudi Arabia say about this site?
To sum up, human trafficking is a concern for many individuals, government entities, and non-governmental organizations. I keep coming back to the question “Why now?” The article states:
Apple said: “We strictly prohibit the solicitation or promotion of illegal behaviour, including human trafficking and child exploitation, in the App Store and across every part of our business. We take any accusations or claims around this behaviour very seriously.” Google declined to comment. Haraj, Saudi Arabia’s human rights commission and the government have been contacted for a response.
Perhaps taking more time to obtain comments would have been useful? What’s the political backstory for the disclosure of the allegedly accurate information during the holiday season? Note that the story is behind a paywall which further limits its diffusion.
Net net: Many questions have I.
Stephen E Arnold, December 29, 2022
Cyber Security: Is It Time for a Brazen Bull?
December 28, 2022
The cyber security industry has weathered Covid, mergers, acquisitions, system failures, and — excuse the lousy pun — solar winds. The flow of exploits with increasingly poetic names continues; for example, Azov, Zerobot, Killnet, etc. However, the cyber defense systems suffer from what one might call a slight misalignment. Bad actors find ways to compromise [a] humans to get user names and passwords, [b] exploit what is now the industry standard for excellence (MVP or minimal viable product, good enough engineering, and close-enough-for-horseshows technology), any gizmo or process connected to something connected to a public-facing network. The list of “bad” actors is a lengthy one. It includes bird-owning individuals in the UK, assorted government agencies hostile to the US, students in computer science class or hanging out in a coffee shop, and double agents with computing know how.
To add to the pain of cyber security, there are organizations which do great marketing but less great systems. “What’s in a PR Statement: LastPass Breach Explained” discusses a serious problem which underscores a number of issues.
LastPass is a product with a past reaching backwards more than a decade. The software made it easier for a user to keep track of what user name and password was whipped up to log into an online service or software. Over the years, PC Magazine found the password manager excellent. (Software can be excellent? Who knew?) Wikipedia has a list of “issues” the security software faced over the years. You can find that information here. More amusing is security expert Steve Gibson’s positive review of LastPass. Should you have the time, you can read about that expert’s conclusions in 2010 here.
But what does the PR statement article say? Here are a couple of snippets from the cited December 26, 2022, essay:
Snippet 1: Right before the holiday season, LastPass published an update on their breach. As people have speculated, this timing was likely not coincidental but rather intentional to keep the news coverage low. …Their statement is also full of omissions, half-truths and outright lies.
Harsh.
Snippet 2: Again, it seems that LastPass attempts to minimize the risk of litigation (hence alerting businesses) while also trying to prevent a public outcry (so not notifying the general public). Priorities…
My take on LastPass is that the company is doing what other cyber security firms do: Manage information about problems.
Let’s talk about cyber security on a larger stage. How does a global scale sound?
First, security is defined by [a] what bad actors have been discovered to do and [b] marketing. A breach occurs. A fix — ideally one enabled by artificial intelligence and chock full of predictive analytics — is created and marketed. Does the fix work? How about those Exchange Server exploits or those 24×7 phishing attacks? The point for me is that cyber security seems to be reactive; that is, dictated by what bad actors do.
Second, the “fix” is verified by whom and what? In the US there are Federal cyber groups. There are state cyber groups. There are cyber associations. There are specialty labs in fun places like Quantico. For a LastPass incident, which cowpoke moves the cow along? The point: Bureaucracy, friction, artificial barriers, time, expertise, money, and more.
Third, technical layoffs and time mean that cyber crime may be an attractive business opportunity for some.
Considering these three points, I want to hazard several observations:
- Cyber security may be an oxymoron
- Bad actors have the advantages granted by good enough software and systems, tools, talent, and time
- Users and customers who purchase security may be faced with a continual flow of surprises
What’s the fix? May I suggest that we consider bringing back the Bull of Phalaris aka the brazen bull.
The “bull” is fabricated of a suitable metal; for example, bronze. The inside of the bull is hollow. A trapdoor allows access to the interior space. When the trapdoor is closed, there is an opening from the interior to the bull’s nose. The malefactor — let’s say a venture firm’s managing director who is rolling up cyber security companies with flawed software — is placed inside the bull. A fire is built beneath the bull and the shouts and possible other noises are emitted from the opening in the bull’s head.
The use of the brazen bull for software developers pumping out “good enough” cyber security solutions can be an option as well. Once law enforcement snags the head of a notorious hacking gang, the bull will be pressed into duty. Keep in mind that Microsoft blamed 1,000 cyber warriors working in a country hostile to the US for the SolarWinds’ misstep. This would necessitate more bulls which would provide meaningful work to some.
I would advocate that marketer types who sell cyber security systems which don’t work be included in the list of individuals who can experience the thrill of the brazen bull.
My thought is that the use of the brazen bull with clips released as short videos would capture some attention.
What’s is going on now is not getting through? More robust measures are necessary. No bull.
Stephen E Arnold, December 28, 2022
Online and Brick Crime Ecosystem: Not Just Surviving, It Is Thriving
December 28, 2022
For some US cities, looting has become a daily occurrence. Retailers in San Francisco are left helpless as their merchandise is stolen. Looting happens when things become violent during protests centered on ethnicity or politics. It appears looting is a victimless crime, because thieves are hitting up large retail chains and luxury stores. Yahoo! Finance details how Target is facing a huge profit loss because of shoplifting and it is the same for other stores too: “Target: ‘Organized Retail Crime’ Has Driven $400 Million In Extra Profit Loss This Year.”
Target has lost $400 million in gross profit in compared to last year’s third-quarter results and the CEO projects a $600 million loss for all of 2022. Target attributes profit shrinkage to “organized retail crime.” Why are more people stealing these days than before? The Yahoo Finance Editor-In-Chief Andy Serwer summed it up as a zeitgeist issue:
“”Why are people stealing these days? That’s a tough one. To some degree it’s a reflection of our times. Simply put, America’s social contract is straining. Until recently we’ve been able to lay out goods—often in mammoth, big box stores with only a handful of employees. When our social contract is strong—i.e people are getting a fair shake—it’s a model that works. Now it seems more people are stealing instead. (BTW, our stressed social contract may be capping how far we can push this people-light, technology-heavy model. Last month Wegman’s ended its scan-and-go shopping app. Why? Shrinkage, of course.)”
Other factors include a widening wealth gap, companies failing to pay workers a living wage, shoppers being violent toward employees, external thefts, and post-COVID mentalities. The article, however, failed to mention how easy it is to fence stolen products. Online commerce Web sites such as Amazon, eBay, Mercer, Swappa, the Real Real, and social media marketplaces are teaming with stolen goods. It is a little harder to drop luxury items, but everyday products like electronics, baby formula, diapers, toys, and alcohol go quickly. These Web sites do little to vet the sellers, although Amazon has some blocks and eBay scans for “counterfeit goods” and limits the sale of certain items.
These prevention measures do little to stop thieves from hawking their stolen
merchandise online.
Whitney Grace, December 28, 2022
Are Bad Actors Working for Thrills?
December 27, 2022
Nope, some bad actors may be forced to participate in online criminal behavior. Threats, intimidation, a beating or two, or worse can focus some people to do what is required.
The person trying to swindle you online might be doing so under duress. “Cyber Criminals Hold Asian Tech Workers Captive in Scam Factories,” reports Context. The article begins with the story of Stephen Wesley, an Indian engineer who thought he was taking a graphic design job in Thailand. Instead he found himself carted off to Myanmar, relieved of his passport and phone, and forced to work up to 18 hours a day perpetuating crypto currency scams. This went on for 45 days, until he and about 130 others were rescued from such operations by Indian authorities. Reporters Anuradha Nagaraj and Nanchanok Wongsamuth reveal:
“Thousands of people, many with tech skills, have been lured by social media advertisements promising well-paid jobs in Cambodia, Laos and Myanmar, only to find themselves forced to defraud strangers worldwide via the internet. … The cybercrime rings first emerged in Cambodia, but have since moved into other countries in the region and are targeting more tech-savvy workers, including from India and Malaysia. Authorities in these countries and United Nations officials have said they are run by Chinese gangsters who control gambling across southeast Asia and are making up for losses during the pandemic lockdowns. The experts say the trafficked captives are held in large compounds in converted casinos in Cambodia, and in special economic zones in Myanmar and Laos. ‘The gangs targeted skilled, tech-savvy workers who had lost jobs during the pandemic and were desperate, and fell for these bogus recruitment ads,’ said Phil Robertson, deputy director for Asia at Human Rights Watch. ‘Authorities have been slow to respond, and in many cases these people are not being treated as victims of trafficking, but as criminals because they were caught up in these scams.'”
A long-game tactic typically used by these outfits is eloquently named “pig butchering,” wherein the operator builds trust with each victim through fake profiles on social media, messaging apps, and dating apps. Once the mark is hooked, the involuntary con artist pressures them to invest in phony crypto or trading schemes. Beware virtual suitors bearing unique investment opportunities.
Sadly, recent tech layoffs are bound to accelerate this trend. Bad actors are not going to pass up a chance to get talent cheaply. Myanmar’s current government, which seized power in February 2021, declined to comment. After months of denying the problem existed, we are told, Cambodian officials are finally cracking down on these operations. The article states thousands of workers are still trapped.
Business is business as the saying goes.
Cynthia Murrell, December 27, 2022
Researchers Exploit Conti Data Leak to Analyze APJ Ransomware Attacks
December 23, 2022
A recent report from cybersecurity firm Akamai examines a pattern of ransomware attacks in the Asia-Pacific and Japan (APJ) region. Researchers took advantage of a recent document leak from major ransomware-as-a-service outfit Conti to paint a picture of that organization’s methods, attack patterns by country, and average ill-gotten gains per attack. India’s NewsPatrolling discusses the findings in, “Akamai APJ Ransomware Report H1 2022—Summary.” Writer Mahender emphasizes the leaked data does not include all of Conti’s attempted attacks. We learn:
“[Akamai’s] analysis of the vertical distribution of attacks revealed that business services was the top victimized industry in APJ. Successful attacks on this vertical can be concerning because of the risk of supply chain cyber attacks. Cybercriminals could breach a third party, such as business services companies, to gain a foothold on high-value targets. One such example is a Taiwanese company and supplier/contractor for a high-end automobile manufacturer, and a consumer electronics company, among others that suffered a Conti attack in 2022. Despite 1,500 servers being encrypted, the attack reportedly impacted only noncritical systems. It is crucial to highlight here the security risks that third-party companies could potentially introduce to their affiliated organizations.”
True. Then there are attacks that pose a more direct threat. Though APJ was third in attack frequency, after North America and EMEA (Europe, Middle East, and Africa), many of the targets Conti chose there especially concerning:
“The APJ region also shows a significantly larger number of critical infrastructure attacks as compared with other regions. Attacks on these verticals could have catastrophic, real-world implications. Case in point: One of the largest electricity providers in Australia was hit by a Conti ransomware attack in 2021. Although the attack did not disrupt their services, it’s not hard to imagine the detrimental effects if it did.”
Retail and hospitality companies were the second-most attacked verticals—what ransomware collection would be complete without sources of credit card numbers and other lucrative personal data? The report also found Conti targeting a victim sweet spot: businesses big enough to pay a worthwhile ransom yet too small to have significant cybersecurity resources. Check out the report itself for all the details.
Cynthia Murrell, December 23, 2022
Are Smart Meters A Hacker Wonderland?
December 21, 2022
One reason to not upgrade your entire life to the digital cloud is an increased risk of hacking vulnerability. Interior and exterior security cameras, particularly baby monitors, are prone to hacking, but did you ever think smart meters for electricity and heating would be a target? Yahoo News reports that British households are being hacked by energy companies: “Switch By Stealth’: Alarming Rise In Homes With Smart Meters Being Cut Off Remotely.”
Smart meters are digital readers that monitor the amount of electricity a household uses, then sends the information back to the energy company. Smart meters provide energy companies with better information about energy consumption and billing. Smart meters also allow energy companies to remotely switch a customer’s payment method. The payment method is switched from debit payments to an expensive prepayment method.
What is worse is that when all the funds from the prepayment method are used up, the energy company will shut off the energy leaving a household without electricity and heating.
The British government is listening, but not acting quickly enough:
“It comes amid the worsening cost-of-living crisis, with the average yearly energy bill reaching £2,500 in October – a record high, and almost double the price it was last year. And energy bills are set to rise again in April, with estimates the average yearly bill could hit £3,500 per year. Campaigners are urging the government to honour their pledge to uprate benefits with inflation in the autumn statement next week, warning millions of low income households are already being forced into destitution without more support.”
It is understandable energy companies need to earn money to pay their employees, purchase energy, and keep the lights on, but why would they harm their customers? It would not be surprising if some bad actors wearing a white hat hack the smart meters and assist the people about to have their energy cut off.
Whitney Grace, December 21, 2022
Need Holiday Cash? Some Gotchas Exist
December 19, 2022
Perhaps one’s mobile device is not the best place to turn when shopping for a loan. The Dailyhunt shares, “Nearly 300 Predatory Loan Apps Circulating on Google, Apple Stores: Report,” originally published at India.com. The brief write-up cites a recent report from Lookout, stating:
“Nearly 300 loan apps are circulating on Google Play and the Apple App Store that exhibit predatory behaviour, such as exfiltrating excessive user data from mobile devices and harassing borrowers for repayment, a new report has revealed. According to cloud security company Lookout, these loan apps exploit victims’ desire for quick cash to trap borrowers into predatory loan contracts and require them to grant access to sensitive information such as contacts and SMS messages. Some victims have reported that their loans were accompanied by hidden fees, high-interest rates, and repayment terms that were not as favourable as advertised. Lookout also found evidence that data exfiltrated from devices were sometimes used to pressure borrowers for repayment, which is a common threat tactic to disclose a borrower’s debt to their networks. Researchers at Lookout discovered 251 Android apps that had been downloaded over 15 million times. On the Apple App Store, the researchers discovered 35 apps that ranked among the top 100 finance apps in their regional stores.”
High interest rates, hidden fees, and bait-and-switch terms are problematic enough. Stealing personal information for more effective threats and harassment is next-level abuse brought to us by modern technology. It is not as if the companies are unaware there’s a problem. We learn Google recently removed over 2,000 personal loan apps from its Indian Play Store and ordered loan apps in Kenya to submit proof of licensing. It seems, though, more comprehensive measures may be required. Borrower beware.
Cynthia Murrell, December 19, 2022
Using Microsoft? Lucky You in 2023
December 14, 2022
Several days ago, I had a meeting with an executive representing a financial services firm. In the course of confirming the meeting, the person told me, “We use only Microsoft Teams. Our security group has banned our use of Zoom and other video chat services.”
That’s why I found myself sitting at a sticky table in a coffee shop talking with this executive about a notification procedure which caught my attention. In that meeting, I mentioned that for each email sent to my official email by this person I received a notice that the individual was out of the office until mid-September 2022. Since we were meeting in the first week of December 2022, I found the emails from this person confusing.
I asked, “Why are you sending me an email and when I reply, I receive a notification from your corporate email system which tells me you are out of the office until September 2022.”
The response was, “Really? I will get IT to help me.”
Wow. Really.
Many organizations have embraced Microsoft systems and services. My hunch is that people want to use Excel. With full time employees in corporate information technology departments getting crushed by fixes, user issues, and software which does not do what the IT professional expects, companies want an fix.
Enter the cloud, certified consultants who can arrive like Wonder Woman, and big time engineers from a regional office to make everything work. Perfect. What could go wrong?
I read an article which may be accurate or may be presenting an incomplete report. Let’s proceed assuming that there is a kernel of truth in “Ransomware Discovered Carrying Legitimate Windows Certificates.” The write up states:
Cyber security company Sophos has issued a warning over antivirus-nullifying malware it discovered bearing legitimate digital certificates, including signatures from Microsoft’s own digital verification service.
The drivers, found paired with a ‘loader’ executable that was used to install the driver, carried the digital signature of Windows Hardware Compatibility Program (WHCP), and appeared to be specially designed to limit the functions of endpoint detection and response (EDR) security programs. Code signatures are cryptographic certificates that indicate a program has not been altered since its release by its manufacturer. WHCP signatures are only intended to be given to software that Microsoft has checked over and given its personal seal of approval, and therefore seen as trustworthy files to run by Windows systems. Researchers say that the find shows that threat actors are working harder to move up the ‘trust chain’, employing increasingly sophisticated methods to sign malware with legitimate cryptographic signatures so that it can be installed on systems without detection.
The article is in my opinion content marketing; that is, the information is designed to cause someone to license Sophos technology.
The idea is that bad actors can exploit systems and methods set up my Microsoft to make certain their systems are secure. People have struggled with getting Windows to print; others have found that Exchange Server (probably the email system which baffled the financial executive) vulnerabilities have caused some sleepless nights.
Several observations are warranted in my view:
- Microsoft like Google is a Leviathan. It is a target, and is may be that the Softies are in over their heads. Perhaps too big to make secure?
- Users are baffled with fairly simple operations of widely used software. What interesting security issues does this pose? Phishing works for a reason: Users click without th8inking.
- Corporations perceive their decisions to be good ones. The continuing increase in cyber aggression is not something people want to discuss in a meeting of suits, sales professionals, and worker bees.
Net net: Good enough software and systems, PowerPoint presentations from certified partners, and customer cluelessness suggest an exciting 2023. Legitimate Windows Certificates? Oxymoron maybe?
Stephen E Arnold, December 14, 2022
On the Path of a Super App for Crime
December 14, 2022
I know I am in the minority. In fact, I may the only person in Harrod’s Creek, Kentucky, thinking about Telegram and its technical evolution. From a humble private messaging service, Telegram has become the primary mechanism for armchair experts to keep track of Russia’s special operation, send secret messages, and engage in a range of interesting pursuits. Is it possible to promote and sell CSAM via an encrypted messaging app like Telegram? Okay, that’s a good question.
I noted another Telegram innovation which has become public. “No-SIM Signup, Auto-Delete All Chats, Topics 2.0 and More” explains that a person can sign up for the encrypted messaging service without having a SIM card and its pesky identifiers tagging along. To make sure a message about a special interest remains secret, the service allegedly deletes messages on a heartbeat determined by the Telegram user. The Telegram group function makes it possible for those who join a group to discuss a “special” interest to break up a group into sub groups. The idea is that a special interest group has special special interests. I will leave these to your imagination in the event you are wondering where some of the i2p and Tor accessible content has gone in the last few years.
As Telegram approach super app status for certain types of users, keep in mind that even the Telegram emoji have some new tricks. That little pony icon can do much more.
Stephen E Arnold, December 14, 2022
Super Apps: A Useful Discussion
December 7, 2022
Super apps are the equivalent of popping up a level. Think about Microsoft Word. Word became part of Office. Then Office became Office 365 and includes video functions and a number of baby apps like games. (Great for productivity, right?) The idea is that umbrellas are built to make multiple apps into one big, seamless app. The objective is to make life easier, faster, and cheaper. No one says, “Pick any two.” Few raise questions about centralization, monopolization, or termination of innovation.
“Could We Have One App for Everything? We Ask an Expert” does raise a handful of interesting points. Among the topics addressed are [a] Chinese vendors’ interest in super apps, [b] risk of centralization of large amounts of personal data, and [c] the appeal of convenience.
I want to focus on one point in the cited article. The write up quotes Esther Dyson who allegedly said, “The last example of successful convergence was the clock radio. Everything else has been a bad compromise.”
But what’s been lost? The write up does not probe Ms. Dyson’s thought. How about a few ideas?
- Meta plays can generate oodles of cash because the appeal of new, improved, and easy are what some call “thirst traps.” Meta makes the modern world go round because monopolies are good.
- More information means more opportunities to monetize user information. Money is good.
- Super apps facilitate concentration. Concentration means engineering efficiency. Efficiency yields alleged cost savings. Money is good.
Based on my understanding of the meta play benefits, super apps are inevitable. Now think about a Telegram-type service just for cyber crime.
Stephen E Arnold, December 7, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
