Open Source Is the Answer. Maybe Not?
October 24, 2022
In my last three lectures, I have amplified and explained what I call the open source frenzy and the concomitant blind spots. One senior law enforcement professional told me after a talk in September 2022, “We’re pushing forward with open source.” To be fair, that’s been the position of many government professionals with whom I have spoken in this year. Open source delivers high value software. Open source provides useful information with metatags. These data can be cross correlated to provide useful insight for investigators. Open source has even made it easier for those following Mr. Putin’s special action to get better information than those in war fighting hot spots.
Open source is the answer.
If you want a reminder about the slippery parts of open source information, navigate to “Thousands of GitHub Repositories Deliver Fake PoC Exploits with Malware.” The write up reports:
According to the technical paper from the researchers at Leiden Institute of Advanced Computer Science, the possibility of getting infected with malware instead of obtaining a PoC could be as high as 10.3%, excluding proven fakes and prankware.
Not a big deal, right?
Wrong. These data, even if the percentage is adrift, point to a vulnerability caused by the open source cheerleaders.
The write up does a good job of providing examples, which will be incomprehensible to most people. However, the main point of the write up is that open source repositories for software can be swizzled. The software, libraries, executables, and other bits and bobs can put some additional functions in the objects. If that takes place, the vulnerabilities rides along until called upon to perform an unexpected and possibly difficult to identify action.
Cyber security is primarily reactive. Embedded malware can be proactive, particularly if it uses a previously unknown code flaw.
The interesting part of the write up is this passage in my opinion:
The researchers have reported all the malicious repositories they discovered to GitHub, but it will take some time until all of them are reviewed and removed, so many still remain available to the public. As Soufian [a Dark Trace expert] explained, their study aims not just to serve as a one-time cleaning action on GitHub but to act as a trigger to develop an automated solution that could be used to flag malicious instructions in the uploaded code.
The idea of unknown or zero day flaws is apparently not on the radar. What’s this mean in practical terms? A “good enough” set of actions to deal with known issues is not going to be good enough.
This seems to set the stage for a remedial action that does not address the workflows and verification for open source. More significantly, should the focus be on code only?
The answer is, “No.” Think about injecting Fibonacci sequences into certain quantum computer operations. Can injection of crafted numerical strings into automated content processing systems throw a wrench into the works?
The answer to this question is, “Yes.”
Stephen E Arnold, October 24, 2022
TikTok: Tracking Humanoids? Nope, Never, Ever
October 21, 2022
I read “TikTok Denies It Could Be Used to Track US Citizens.” Allegedly linked to the cheerful nation state China, TikTok allegedly asserts that it cannot, does not, and never ever thought about analyzing log data. Nope, we promise.
The article asserts:
The social media giant said on Twitter that it has never been used to “target” the American government, activists, public figures or journalists. The firm also says it does not collect precise location data from US users.
Here’s a good question: Has notion of persistent cookies, geospatial data, content consumption analytics, psychological profiling based on thematics have never jived with TikTok data at the Surveillance Soirée?
The answer is, according to the Beeb:
The firm [TikTok] also says it does not collect precise location data from US users. It was responding to a report in Forbes that data would have been accessed without users’ knowledge or consent. The US business magazine, which cited documents it had seen, reported that ByteDance had started a monitoring project to investigate misconduct by current and former employees. It said the project, which was run by a Beijing-based team, had planned to collect location data from a US citizen on at least two occasions.
Saying is different from doing in my opinion.
Based on my limited experience with online, would it be possible for a smart system with access to log data to do some high-value data analysis? Would it be possible to link the analytics’ output with a cluster of users? Would be possible to cross correlate data so that individuals with a predicted propensity of a desired behavior to be identified?
Of course not. Never. Nation states and big companies are fountains of truth.
TikTok. Why worry?
Stephen E Arnold, October 21, 2022
Cy4Gate Named As Big Player In AI Industry
October 21, 2022
There are famous industry awards: Academy Award, Golden Globe, Emmy, Pulitzer, Newbery Award, Caldecott Medal, Nobel Prize, Peabody Award, etc. These are associated with entertainment, science, and literature. Lesser-known industry awards are hardly heard of outside of their relevant fields, but they still earn bragging rights. Cy4Gate recently won bragging rights in AI: “Cy4Gate Mentioned As A Representative Provided In 2022 Gartner innovation Insight For Composite AI Report.”
Gartner is a renowned research company and anyone who gets a compliment from them is at the top of their game. Cy4Gate won recognition in AI as a “Representative Provider for Composite Artificial Intelligence solutions. Composite artificial intelligence is a combination of several machine learning algorithms (i.e.e deep neural network, natural language processing, computer vision, and speech recognition) to make big data analysis more effective and efficient without the need for relevant computation capabilities. Cy4Gate earned this notoriety for its years of development and research in AI applications.
“Since its establishment, Cy4gate has considered as decisive the use of AI in innovative ways, to ensure its products the ability to perform at excellent levels even in highly complex, uncertain and ambiguous contexts. Within these application areas, the enormous amount of data generated by the consistent increase of interconnected devices can be profitably used to adopt appropriate and timely decisions, and to reduce margins of error.”
Cy4Gate’s products, specializing in cyber security and intelligence, are believed to have a competitive advantage over their rivals. Other AI companies in the cyber security and intelligence field rely on single AI algorithms instead of combining them into composite artificial intelligence. Based on their advances and recognition, Cy4Gate established a new division of the company: the Data and Artificial Intelligence Center of Competence. It is part of the engineering department.
Whitney Grace, October 21, 2022
The End of Cyber Crime with Web 3? Will Bad Actors Get the Memo?
October 17, 2022
My understanding of cyber crime is limited. I have done some research and learned one important thing:
Cat and mouse.
What’s this mean?
- Law enforcement take down Dark Web eCommerce sites
- Bad actors use end to end encrypted messaging to sell content to their customers
- Law enforcement take down E2EE schemes
- Bad actors create new types of messaging such as the little known lucidchat.co.uk service to thwart law enforcement.
What’s the end game? A China-style total network control approach like the one described in the Wall Street Journal story “Chinese Users Lose Access to WeChat” on October 15, 2022?
There is no way to stop cyber crime. Sorry, but the cat-and-mouse game exploits:
- Software and systems which have unknown flaws which bad actors seek and exploit
- Law enforcement and cyber security companies react to the bad actors
- Government bureaucracy slows some reactions giving bad actors a window of opportunity
- Insiders stand ready to be blackmailed, bribed, or threatened unless these individuals provide access
- A mismatch between the mental state of an employee and the corporation itself create whistle blowers like a certain American now residing in Moscow, doing significant damage to the United States.
- Big companies’ carelessness creates opportunities which span years; for example, hypervisor’s impaired vision with regard to Windows drivers.
When I read “Web3 Will Spell the End of Cybercrime. Here’s Why,” I hoped that the write up would provide an answer to the points I just shared about cats and mice. The write up states that two things will be much better when a Web 3 architecture is implemented:
- Log in security
- Financial control and monetization.
Say what? Will these new systems be flawless, a condition that is difficult for a software and systems company to deliver. Will insider threats just go away? Will the mice chew away at next generation systems and find a way to penetrate them?
Sorry. Web 3 may lessen certain types of cyber crime, but I wager that a humanoid somewhere will click on a phishing link or a mother desperate to pay for medical care for a child will listen to a bad actor’s pitch for access to a system.
How will Web 3 deal with these persistent security issues?
Stephen E Arnold, October 17, 2022
Microsoft Teams and Sensitive Information
October 13, 2022
I read a somewhat unusual analysis of Microsoft Teams security. “Microsoft Teams Users Are Using It for a Really Bad Reason, So Stop Now” presents some data about Teams’ users and their sending information over the system. Now the purpose of Teams and similar conferencing software is to exchange information. Therefore, access to Teams sessions and the data exchanged while using the using may have some value to certain individuals if such access were available.
Okay, now let’s look at some of the numbers in the write up:
- 45 percent of those in the sample (who knows how many were in the sample by the way?) “admit to sending confidential and sensitive information frequently via Microsoft Teams.” Now let’s think about this. Does this mean that 55 percent of those using Teams do not provide “confidential or sensitive information”? Is this a measure of productivity which Teams enhances?
- 51 percent were found to be “sharing business critical information.” I am not sure I understand the distinctioin between “sensitive” and “business critical. The idea that half of those using Teams don’t share important data.
- 56 percent believe training is needed.
Net net: Microsoft may have to do more than silence Teams’ blowhards. See “Microsoft Is Working Hard to Shut Up the Egotistical Blowhard on Your Team.”
Stephen E Arnold, October 15, 2022
Cyber Security: The Stew Is Stirred
October 12, 2022
Cyber security, in my opinion, is often an oxymoron. Cyber issues go up; cyber vendors’ marketing clicks up a notch. The companies with cyber security issues keeps pace. Who wins this cat-and-mouse ménage a trois? The answer is the back actors and the stakeholders in the cyber security vendors with the best marketing.
Now the game is changing from cyber roulette, which has been mostly unwinnable to digital poker.
Here’s how the new game works if the information in “With Security Revenue Surging, CrowdStrike Wants to Be a Broader Enterprise IT Player” is on the money. I have to keep reminding myself that if there is cheating in competitive fishing, chess, and poker, there might be some Fancy Dancing at the cyber security hoe down.
The write up points out that CrowdStrike, a cyber security vendor, wants to pull a “meta” play; that is, the company’s management team wants to pop up a level. The idea is that cyber security is a platform. The “platform” concept means that other products and services should and will plug into the core system. Think of an oil rig which supports the drill, the pumps, spare parts, and the mess hall. Everyone has to use the mess hall and other essential facilities.
The article says:
Already one of the biggest names in cybersecurity for the past decade, CrowdStrike now aspires to become a more important player in areas within the wider IT landscape such as data observability and IT operations…
Google and Microsoft are outfits which may have to respond to the CrowdStrike “pop up a level” tactic. Google’s full page ads in the dead tree version of the Wall Street Journal and Microsoft’s on-going security laugh parade may not be enough to prevent CrowdStrike from:
- Contacting big companies victimized by lousy security provided by some competitors (Hello, Microsoft client. Did you know….)
- Getting a group of executives hurt in the bonus department by soaring cyber security costs
- Closing deals which automatically cut into both the big competitors’ and the small providers’ deals with these important clients.
The write up cites a mid tier consulting firm as a source of high value “proof” of the CrowdStrike concept. The write up offers this:
IDC figures have shown CrowdStrike in the lead on endpoint security market share, with 12.6% of the market in 2021, compared to 11.2% for Microsoft. CrowdStrike’s growth of 68% in the market last year, however, was surpassed by Microsoft’s growth of nearly 82%, according to the IDC figures.
CrowdStrike’s approach is to pitch a “single agent architecture.” Is this accurate? Sure, it’s marketing, and marketing matters.
Our research suggests that cyber security remains a “reaction” game. Something happens or a new gaffe is exploited, and the cyber security vendors react. The bad actors then move on. The result is that billions in revenue are generated for cyber security vendors who sell solutions after something has been breached.
Is there an end to this weird escalation? Possibly but that would require better engineering from the git go, government regulations for vendors whose solutions are not secure, and stronger enforcement action at the point of distribution. (Yes, ISPs and network providers, I am talking about you.)
Net net: Cyber security will become a market sector to watch. Some darned creative marketing will be on display. Meanwhile as the English majors write copy, the bad actors will be exploiting old and new loopholes.
Stephen E Arnold, October 12, 2022
Gmail Is for the Googley
October 11, 2022
I spotted an interesting Twitter thread about Google and its beneficial two factor authentication system. You can in theory view the sequence of tweets at this url. The prime mover is Twitter user @chadloder.
The main point is that the Google requires account verification several times a year. Individuals who are in a life condition that pivots on free phones called Obamaphones in the string of tweets lose their account. The phones are lost, broken, stolen, and replaced in many cases. However, these phones often come with a different phone number.
The result is that these individuals cannot provide the “verification” that Google requires. One of @chadloder’s tweets states:
Not only do many of these benefits sites fail to function properly on mobile devices, but if you lose access to your GMail account, your caseworker will close your case for non-response and you have to start all over again.
Let’s look at this issue from a different point of view. I hypothesize the following:
- Google’s executives did not think about homeless Gmail users as individuals
- The optimal Gmail user consumes Google advertising
- Individuals who do not have a home are not the targets of Google’s advertising system
- Those who cannot verify are not part of the desired user cluster.
To sum up, when one is Googley, these problems do not manifest themselves. Advertisers want the plump targets with money to spend.
Stephen E Arnold, October 11, 2022
Russia: Inconsistent Cyber Attack Capabilities
October 7, 2022
Do you remember that Microsoft’s president Brad Smith opined that the SolarWinds’ misstep required about 1,000 engineers? I do. Let’s assume those engineers then turned their attention to compromising Ukraine as part of a special military operation.
“Failure of Russia’s Cyber Attacks on Ukraine Is Most Important Lesson for NCSC” presents information I found interesting about Mr. Smith’s SolarWinds’ remark. [The NCSC is the United Kingdom’s National Cyber Security Council.’
Here’s the key passage from the write up:
Ukrainian cyber defences, IT security industry support and international collaboration have so far prevented Russian cyber attacks from having their intended destabilising impact during Russia’s invasion of Ukraine.
The write up also points out that a cyber content marketing campaign designed to undermine Ukraine’s leadership was also not effective.
Okay, but, Mr. Smith said that Russia was able to coordinate the efforts of 1,000 individuals to breach SolarWinds’ security and create considerable distress among some in commercial enterprises and other organizations.
How could Ukraine resist this type of capable force? I have no idea. I prefer to flip the information around and ask, “Why did SolarWinds’ security yield so easily?” Did Russia put more effort into breaching SolarWinds than fighting a kinetic war? Yeah, sure it did.
Maybe the 1,000 programmer idea was hand waving and blame shifting? Microsoft cannot make printers work. Why would Microsoft security be much better?
Stephen E Arnold, September 2022
Insider Threat: Worse Than Poisoned Open Source Code and Major Operating System Flaws?
October 5, 2022
Here’s a question for you.
What poses a greater threat to your organization? Select one item only, please.
[a] Flaws in mobile phones
[b] Poisoned open source code
[c] Cyber security and threat intelligence systems do not provide advertised security
[d] Insider threats
[e] Operating systems’ flaws.
If you want to check more than one item, congratulations. You are a person who is aware that most computing devices are insecure with some flaws baked in. Fixing up flawed hardware and software under attack is similar to repairing an L-29 while the Super Defin is in an air race.
Each day I receive emails asking me to join a webinar about a breakthrough in cyber security, new threats from the Dark Web, and procedures to ensure system integrity. I am not confident that these companies can deliver cyber security, particularly the type needed to deal with an insider who decides to help out bad actors.
“NSA Employee Leaked Classified Cyber Intel, Charged with Espionage” reports:
A former National Security Agency employee was arrested on Wednesday for spying on the U.S. government on behalf of a foreign government. Jareh Sebastian Dalke, 30, was arrested in Denver, Colorado after allegedly committing three separate violations of the Espionage Act. Law enforcement allege that the violations were committed between August and September of 2022, after he worked as a information systems security designer at the agency earlier that summer.
So what’s the answer to the multiple choice test above? It’s D. Insider breaches suggest that management procedures are not working. Cyber security webinars don’t address this, and it appears that other training programs may not be pulling hard enough. Close enough for horse shoes may work when selling ads. For other applications, more rigor may be necessary.
Stephen E Arnold, October 5, 2022
Board Games at Microsoft? Maybe Corner Cutting?
September 30, 2022
I noted a write up called “Anonymous Lays Waste to Russian Message Board, Releases Entire Database Online.” The article describes what a merrie band of anonymous, distributed bad actors can do in today’s decentralized, Web 3 world of online games like Cat and Mouse. The article explains that Mr. Putin’s bureaucracy is a big, fat, and easy target to attack. One statement in the article caught my attention; to wit:
For all their reputation on cyber security and hacking, the Russians were careless…. KiraSec has taken down hundreds of Russian websites, Russian banks like alfabank, bank.yandex.ru, pro-Russian terror-leaning websites, Russian pedophile websites, Russian government websites, Russian porn sites and a lot more. The cyber activists also “hacked various Russian SCADAs and ICS, nuking their systems and completely destroying their industrial machines.”
I immediately thought about Microsoft’s Brad Smith suggesting that more than 1,000 programmers worked to make SolarWinds a household word. My thought was that Microsoft itself may share the systems engineering approach used to protect some Russian information assets. The key word is “careless.” Arrogance, indifference, and probably quite terrible management facilitated the loss of Russian data and the SolarWinds’ misstep.
I then spotted in my news headline stream this article from the UK online outfit The Register: “Excel’s Comedy of Errors Needs a New Script, Not New Scripting.” This article points out that Microsoft has introduced a new feature for Excel. I am not an individual who writes everything in Excel, including holiday greetings and lists of government officials names and email addresses. Some are.
Here’s the passage I circled after I printed out the write up on a piece of paper:
Excel is already the single most dangerous tool to give to civilians. You can get things wrong in Word and PowerPoint all day long, and while they have their own security fun you’re not getting things wrong through a series of tiny letterboxes behind which can live the company’s most important numerical data. The Excel Blunder is its own genre of corporate terror: it brings down companies, it breaches data like a excited whale seeking sunlight, it can make a mockery of pandemic control. And because Excel is the only universal tool most users get for organizing any sort of data, the abuses and perversions it gets put to are endless.
What’s the connection between bad actors hacking Russia, Microsoft’s explanation of the SolarWinds’ misstep, and Excel’s new scripting method?
Insecurity appears to be part of the core business process.
No big deal. Some bad actors and a few cyber security vendors will be happy. Others will be “careless” and maybe clueless. That’s Clue the board game, not the motion picture.
Stephen E Arnold, September 30, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
