Microgoof of the Day: The Print Thing
July 9, 2021
I read “Microsoft’s Emergency PrintNightmare Pat Doesn’t actually Fix the Issue.” If this article is correct, it warrants a honk from the Beyond Search goose. The story was the inspiration for an irregular series of posts to be called “Microgoof of the Day.” The write up says without any stand up comedy joke writer:
…there are reports of new proof-of-exploit code that circumvents the fix altogether.
Well, well, well.
The write up nods to another publication with this passage:
Reporting on the findings of Benjamin Delpy, creator of popular post exploitation tool Mimikatz, The Register says that it’s how Microsoft checks for remote libraries in the PrintNightmare patch that offers an opportunity to work around the patch. “They did not test it for real,” Delpy bluntly told The Register, reportedly describing the issue as “weird from Microsoft.”
Weird from Microsoft? Hmmm.
Regardless of who’s right or wrong, PrintNightmare is a hoot in some circles. In others, maybe not so much. That’s the microgoof for you.
Stephen E Arnold, July 9, 2021
Want to Cash In on the TikTok AI?
July 8, 2021
If you want to license the artificial intelligence which chainsaws away IQ points, you can. The vendor is a company called BytePlus, and, yes, it is an official source of the TikTok goodness. Just bring cash and leave your concerns about having data from your use of the system and method winging its way to the land that won over Marco Polo.
“ByteDance Starts Selling TikTok’s AI to Other Companies” states (if you pay up to read the original write up in the weird orange newspaper):BytePlus offers businesses the chance to tap some of TikTok’s secret ingredient: the algorithm that keeps users scrolling by recommending them videos that it thinks they will like. They can use this technology to personalize their apps and services for their customers. Other software on offer includes automated translation of text and speech, real-time video effects and a suite of data analysis and management tools.
Just think you can hook your prospects on short videos about such compelling subjects as enterprise search, the MBA life, personnel management at Google, and cooking on a burning Tesla Plaid.
Stephen E Arnold, July 8, 2021
Microsoft and LinkedIn: How about That Security?
July 2, 2021
I spotted an interesting and probably made up post titled “New LinkedIn Data Leak Leaves 700 Million Users Exposed.” Isn’t this old news? I must be thinking about the 500 million names scraped earlier this year. (See “Reported LinkedIn Data Breach: What You Need to Know,” please.)
The write up states:
Since LinkedIn has 756 million users, according to its website, this would mean that almost 93% of all LinkedIn users can be found through these records.
I am eagerly awaiting Microsoft’s explanation. Will it be 1,000 programmers? Russia? China? A flawed update?
Excuses: Microsoft has offered a few. Is ineptitude in the quiver of rhetorical arrows? Perhaps it was an illusion?
Stephen E Arnold, July 2, 2021
DarkCyber for June 29, 2021, Now Available: Operation Trojan Shield Provides an Important Lesson
June 29, 2021
DarkCyber 13 discusses the Operation Trojan Shield sting. You can view the video at this link. The focus is on three facets of the interesting international takedowns not receiving much attention. The wrap up of the program is a lesson which should be applied to other interesting mobile device applications. If you are wondering how useful access to app data and its metadata are, you may find this 11 minute video thought provoking. DarkCyber is a production of Stephen E Arnold, a semi-retired consultant who dodges thumbtypers, marketers, and jargon lovers. Remember: No ads and no sponsors. (No, we don’t understand either but he pays our modest team like clockwork.)
Kenny Toth, June 29, 2021
Another Friday, More Microsoft Security Misstep Disclosures
June 28, 2021
I think Microsoft believes no one works on Friday. I learned in “Microsoft Warns of Continued Attacks by the Nobelium Hacking Group” that SolarWinds is the gift that keeps on giving. Microsoft appears to have mentioned that another group allegedly working for Mr. Putin has been exploiting Microsoft software and systems. Will a “new” Windows 11 and registering via a Microsoft email cure this slight issue? Sure it will, but I am anticipating Microsoft marketing jabber.
The write up states:
The Microsoft Threat Intelligence Center said it’s been tracking recent activity from Nobelium, a Russia-based hacking group best known for the SolarWinds cyber attack of December 2020, and that the group managed to use information gleaned from a Microsoft worker’s device in attacks. Microsoft said it “detected information-stealing malware on a machine belonging to one of our customer support agents with access to basic account information for a small number of our customers” and that “the actor used this information in some cases to launch highly targeted attacks as part of their broader campaign.” The affected customers were notified of the breach.
The applause sign is illuminated.
I spotted this remarkable statement in the write up as well:
It’s possible that successful attacks went unnoticed, but for now it seems Nobelium’s efforts have been ineffective.
Wait, please. There is more. Navigate to “Microsoft Admits to Signing Rootkit Malware in Supply-Chain Fiasco.” This smoothly executed maneuver from the Windows 11 crowd prompted the write up to state:
Microsoft has now confirmed signing a malicious driver being distributed within gaming environments.
This driver, called “Netfilter,” is in fact a rootkit that was observed communicating with Chinese command-and-control (C2) IPs.
The write up concludes:
This particular incident, however, has exposed weaknesses in a legitimate code-signing process, exploited by threat actors to acquire Microsoft-signed code without compromising any certificates.
Amazing. The reason cyber crime is in gold rush mode is due to Microsoft in my opinion. The high tech wizards in Redmond can do rounded corners. Security? Good question.
Stephen E Arnold, June 28, 2021
TikTok: No Risk You Think?
June 28, 2021
I snipped a segment from my most recent lecture about the new Dark Web as this week’s DarkCyber video. More information about the program will appear on Tuesday, June 28, 2021. For now, I want to highlight the “real” news outfit CNBC and its take on TikTok. Remember that TikTok is harmless at least according to one Silicon Valley pundit and aspiring CIA professional.
“TikTok Insiders Say Social Media Company Is Tightly Controlled by Chinese Parent ByteDance” reports as actual factual information instantly doubted by Silicon Valley pundits:
This recruiter, along with four other former employees, told CNBC they’re concerned about the popular social media app’s Chinese parent company, which they say has access to American user data and is actively involved in the Los Angeles company’s decision-making and product development. These people asked to remain anonymous for fear of retribution from the company.
Hey, how about a quote from Jack Ma about the wonderfulness of the Chinese business methodology?
The write up adds:
Most notably, one employee said that ByteDance employees are able to access U.S. user data. This was highlighted in a situation where an American employee working on TikTok needed to get a list of global users, including Americans, who searched for or interacted with a specific type of content — that means users who searched for a specific term or hashtag or liked a particular category of videos. This employee had to reach out to a data team in China in order to access that information. The data the employee received included users’ specific IDs, and they could pull up whatever information TikTok had about those users. This type of situation was confirmed as a common occurrence by a second employee.
If you are interested in the value of data from a mere app, check out the DarkCyber program for June 28, 2021.
Stephen E Arnold, June 28, 2021
Mitre and Its Mad Ave Inspired Naming
June 25, 2021
I keep a list of neologisms, jargon, and odd ball phrases. Examples include anting (crows which allow ants to clean up the feathery friends of horror movie script writers), industrial athlete (a Bezos bulldozer rah rah for warehouse workers who are sometimes allowed to visit the facilities), and pillbillies (residents of West Virginia and Kentucky who are addicted to opioids). I have others too including AIM (asymmetric information management) which I don’t understand at all.
Now I have a new one: ATT&CK. This is a coinage from a wordsmith at Mitre (the old MIT Research outfit) and its “Engenuity” unit. Those folks are heirs to assorted Boston poets I think. I am not sure what the letters mean, but here’s the explanation in “Tool Lets Users Supplement Mitre ATT&CK Knowledge Base with Their Own Threat Intel”:
Called ATT&CK Workbench, the free and open-source tool was designed to reduce the barriers preventing defenders from aligning their aggregated TTP intel with Mitre ATT&CK’s content. Officially announced today via press release and blog post, Workbench is a creation of Mitre Engenuity’s Center for Threat-Informed Defense, with contributions from Center members AttackIQ, HCA Healthcare, JPMorgan Chase, Microsoft and Verizon.
I want to point out that as far as my DarkCyber research team has been able determine, exactly none of the threat intelligence outfits alerted their customers to the SolarWinds’ misstep.
I have a buzzword for this in my collection too: Nonperformative. I think this means, “May not work.”
Stephen E Arnold, June 24, 2021
Clear Signals of Deeper, Less Visible Flaws, Carelessness, and Corner Cuts
June 21, 2021
I read “State of the Windows: How Many Layers of UI Inconsistencies Are in Windows 10?” I found the listing of visual anomalies interesting. I don’t care much about Windows. We run a couple of applications and upgrade to new versions once the point releases and bugs have been identified and mostly driven into dark holes.
The write up points out:
As you may know, Microsoft is planning on overhauling the UI of Windows with their “Sun Valley” update, which aims to unify the design of the OS. However, as we can see, Windows is one behemoth of an operating system. Will their efforts to finally make a cohesive user experience succeed?
My answer to this question is that Microsoft has embraced processes which tolerate inconsistencies. I see this as a strategic or embedded function of the company’s management attitude: Good enough. If a company cannot make interfaces consistent, what about getting security issues, software update processes, and code quality under control.
I want to mention the allegation that Microsoft may have been signing malicious drivers. For more on this interesting assertion, navigate to Gossi The Dog at this link. One hopes the information in this sequence of messages and screenshots is fabricated. But if there are on the money, well …
If you can’t see it, perhaps “good enough” becomes “who cares.” Obviously some at Microsoft hold both of these strategic principles dear.
Stephen E Arnold, June 21, 2021
DarkCyber for June 15, 2021, Now Available
June 15, 2021
DarkCyber is a video news program issued every two weeks. The June 15, 2021, show includes five stories:
- Pentest tools you can download and use today for free
- A free report that explains Britain’s cyber weaknesses
- Additional information about the E2EE revolution
- Another tip for finding flexible developers and programmers who will do exactly what you want done
- The FireScout, a drone with a 100 mile range and the ability to drop sonobuoys and other devices, perform surveillance, and remain aloft for up to 10 hours.
The DarkCyber video news program contains information presented in Stephen E Arnold’s lectures to law enforcement and intelligence professionals. His most recent lecture was the New Dark Web. He presented his most recent research findings to a group of more than 100 cyber fraud investigators working in Connecticut for a variety of LE and related organizations. The
The June 15, 2021, DarkCyber video program is available from Mr. Arnold’s blog splash page and can be viewed on YouTube. One important note: The video program does not contain advertisements or sponsored content. We know that’s unusual today, but the DarkCyber team prefers to operate without an invisible hand on the controls or an invisible foot on the team’s neck.
Kenny Toth, June 15, 2021
An Idea for American Top Dogs?
June 14, 2021
My hunch is that the cyber security breaches center of flaws in Microsoft Windows. The cyber security vendors, the high priced consultants, and even the bad actors renting their services to help regular people are mostly ineffectual. The rumors about a new Windows are interesting. The idea that Windows 10 will not be supported in the future is less interesting. I interpret the information as a signal that Microsoft has to find a fix. Marketing, a “new” Windows, and mucho hand waving will make the problem go away. But will it? Nope. Law enforcement, intelligence professionals, and security experts are operating in reactive mode. Something happens; people issue explanations; and the next breach occurs. Consider gamers. These are not just teenies. Nope. Those trying to practice “adulting” are into these escapes. TechRepublic once again states the obvious in “Fallout of EA Source Code Breach Could Be Severe, Cybersecurity Experts Say.” Here’s an extract:
The consequences of the hack could be existential, said Saryu Nayyar, CEO of cybersecurity firm Gurucul. “This sort of breach could potentially take down an organization,” she said in a statement to TechRepublic. “Game source code is highly proprietary and sensitive intellectual property that is the heartbeat of a company’s service or offering. Exposing this data is like virtually taking its life. Except that in this case, EA is saying only a limited amount of game source code and tools have been exfiltrated. Even so, the heartbeat has been interrupted and there’s no telling how this attack will ultimately impact the life blood of the company’s gaming services down the line.”
I like that word “existential.”
I want to call attention to this story in Today Online: “Japan’s Mizuho Bank CEO to Resign after Tech Problems.” Does this seem like a good idea? To me, it may be appropriate in certain situations. A new top dog at Microsoft would have a big job to do for these reasons:
- New or changed software introduces new flaws and exploitable opportunities.
- New products with numerous new features increase the attack surface; for example, Microsoft Teams, which is demonstrating the Word method of adding features to keep wolves like Zoom, Google, and others out of the hen house.
- A flood of marketing collateral, acquisitions, and leaks about a a new Windows are possible distractions for a very uncritical but influential observers.
But what’s the method in the US. Keep ‘em on the job. How is that working?
Stephen E Arnold, June 14, 2021
-
- Subscribe to Beyond Search
Feature archive
News archive
-
