IBM Discloses Iranian Hacking: Was Watson on the Job?
July 30, 2020
We spotted an interesting nugget of information in “Iran-Linked Hackers Mistakenly Leak Videos of Their Operations in Action: Report.”
The story reveals that:
IBM’s X-Force security team acquired about five hours of video footage of hacking operations by APT35, a hacking group linked to the Iranian government…
Where did the video originate? The answer: Iran.
The IBM researchers got a hold of the footage due to “a misconfiguration of security settings on a virtual private cloud server they’d observed in previous APT35 activity,” the report said, adding that the files were uploaded to the exposed server over a few days in May, just as IBM was monitoring the machine. The APT35 hackers recorded their operations to demonstrate to junior team members how to handle hacked accounts, according to the report. The videos show the hackers how to download the contents of compromised Gmail and Yahoo Mail accounts.
The report does not mention Watson. Interesting.
Stephen E Arnold, July 29, 2020
Digital Shadows: Cyber Monitoring Inside
July 29, 2020
DarkCyber has pointed out in this blog and in the DarkCyber video news programs that cyber security generates hyperbole. Funding sources pump in cash. Companies buy not one cyber security system; big and mid-sized outfits buy news ones with each change of security professionals.
Why?
Most of the cyber security systems focus on what happened in the past. However, bad actors — some well funded by low profile operators — focus on the here and now.
Not surprisingly, competing claims, pricing plays, and fearful prospects keep the wheel spinning.
“Digital Shadows Announces Integration with Atlassian Jira” indicates that the stealthy Digital Shadows has moved inside an issue tracking and project tracking platform. Presumably the “SearchLight Inside” deal will deliver better security to Jira users. Will this tie up boost Atlassian stock?
DarkCyber assumes that other Dark Web and cyber threat indexing services will pursue similar “inside” deals.
The real test comes when licensees of these “inside” cyber threat solutions demonstrate they can avoid Garmin- and Twitter-type security breaches.
Stephen E Arnold, July 29, 2020
DarkCyber for July 28, 2020, Now Available
July 28, 2020
The July 28, 2020, DarkCyber is now available. You can view the program on YouTube or on Vimeo.
DarkCyber reports about online, cyber crime, and lesser known Internet services. The July 28, 2020, program includes six stories. First, DarkCyber explains how the miniaturized surveillance device suitable for mounting on an insect moves its camera. With further miniaturization, a new type of drone swarm becomes practical. Second, DarkCyber explains that the value of a stolen personal financial instrument costs little. The vendors guarantee 80 percent success rate on their stolen personally identifiable information or fullz. Third, SIM card limits are in place in South Africa. Will such restrictions on the number of mobile SIM cards spread to other countries or are the limits already in place, just not understood. Fourth, Coinbase bought a bitcoin deanonymization company. Then Coinbase licensed the technology to the US Secret Service. Twitter denizens were not amused. Fifth, Microsoft released a road map to a specific type of malware. Then two years later the story was picked up, further disseminating what amounts to a how to. DarkCyber explains where to download the original document. The final story presents DarkCyber’s view of the management lapses which made the Twitter hack a reality. Adult management is now imperative at the social media company doing its best to create challenges for those who value civil discourse and an intact social fabric.
The delay between our June 9, 2020, video about artificial intelligence composing “real” music and today’s program is easy to explain. Stephen E Arnold, the 76 year old wobbling through life, had the DarkCyber and Beyond Search team working on his three presentations at the US National Cyber Crime Conference. These programs are available via the NCC contact point in the Massachusetts’ Attorney General Office.
The three lectures were:
- Amazon policeware, which we pre-recorded in the DarkCyber format
- A live lecture about investigative software
- A live lecture about Dark Web trends in 2020.
Based on data available to the DarkCyber team, the septuagenarian reached about 500 of the 2000 attendees. Go figure.
Kenny Toth, July 28, 2020
The Cloud Becomes the New PC, So the Cloud Becomes the Go To Attack Vector
July 24, 2020
Cloud providers are not Chatty Cathies when it comes to some of their customers’ more interesting activities. Take malware, for example. Bad actors can use cloud services for a number of activities, including a temporary way station when deploying malware, delivering bogus or spoofed Web sites as part of a social engineering play, or just launching phishing emails. Major cloud providers are sprawling operations, and management tools are still in their infancy. In fact, management software for cloud operators are in a cat-and-mouse race. Something happens, and the cloud provider responds.
“Hackers Found Using Google Cloud to Hide Phishing Attacks” provides some information about the Google and its struggles to put on a happy face for prospects and regulators while some Googlers are reading books about dealing with stressful work.
The article reports:
Researchers at cybersecurity firm Check Point on Tuesday cited an instance when hackers used advanced features on Google Cloud Platform to host phishing pages and hide them. Some of the warning signs that users generally look out for in a phishing attack include suspicious-looking domains, or websites without a HTTPS certificate. However, by using well-known public cloud services such as Google Cloud or Microsoft Azure to host their phishing pages, the attackers can overcome this obstacle and disguise their malicious intent, improving their chances of ensnaring even security-savvy victims…
What’s the fix?
Obviously vendors of cloud management software, hawkers of smart cyber security systems, and bright young PhD track cyber specialists have ideas.
The reality may be that for now, there is no solution. Exposed Amazon S3 buckets, Google based endeavors, and Microsoft (no, we cannot update Windows 10 without crashing some machines) Azure vectors are here to stay.
Perhaps one should tweet this message? Oh, right, Twitter was compromised. Yeah.
Stephen E Arnold, July 24, 2020
Once Again: NSO Group Becomes a Magnet for Real Journalists
July 16, 2020
We spotted one of those “We don’t have or can’t tell you where we got this information” write ups. The article is “Source: Spain Is a Customer of NSO Group.” The main idea of the article is that a government licensed software developed for … wait for it … governments. According to the “source” with some inputs from other real news outfits like The Guardian and El Pais, the NSO Group’s specialized software was used to obtain information about … wait for it … politicians in Spain.
The write up states:
The cell phones of several politicians in Spain, including that of the president of one of the countries’ autonomous regional parliaments, were targeted with spyware made by NSO Group, an Israeli company that sells surveillance and hacking tools to governments around the world, according to The Guardian and El Pais . Motherboard confirmed the specifics with security researchers who investigated the attempted hack and a Facebook employee who has knowledge of the case.
Interesting. But a couple of questions come to mind:
- Was the alleged use of the software a complement to an investigation; for example, inciting civil unrest?
- Was the alleged use of the software gathering data on matter one and obtained information on a collateral or unrelated matter two?
- Why aren’t the sources identified? Policy or some special rules of “real” journalism that elude me?
The disclaimer “We cannot confirm whether these specific attempted hacks” does nothing to alter my perception of the article; to wit: The article wants to draw attention to a particular specialized software developer and connect that company to the alleged use of the software by a licensee of the software. How’s that work? Consider the manufacturer of a knife. The purchaser of the knife uses it to kill an intruder. Is the knife manufacturer responsible? What applies to companies which are in the business of developing specialized software tools is different from the knife manufacturer.
I want to point out the Bank Info Security reported that an Israeli court dismissed a complaint against the NSO Group. Amnesty International accused the NSO group of violating human rights. On the surface, it seems that the allegations of Amnesty International were found to be without much heft.
The real question is, “Why are outfits like Vice and Amnesty International chasing NSO Group?”
DarkCyber has some hunches about the “why”? For example:
- Companies which develop specialized services and operate in a classified or community environment populated by government customers are somehow offensive to the “real” journalists. Is this a factor? Sensibilities are activated.
- The “real” journalists are just now realizing that those charged with enforcing the laws of countries are using specialized tools for investigations or addressing challenges which in the opinion of the government customers threaten civil order. This “sudden discovery” is like a child’s getting a new toy for her birthday. By golly, that toy is going to get some attention because it is novel to the childish mind.
- The “real” journalists are trying to come up with “news” which is stale, routine, and institutionalized in government entities throughout the world. The focus, however, is one the producer of specialized software, not on the specific government entity licensing the software.
DarkCyber believes the truth is closer to the child’s fascination with what the child with its immature perception sees as mesmerizing.
News flash for the “real” journalists: Chasing vendors of specialized software may not be the revenue and attention magnet for which the publications hunger. Plus, there may be some unintended consequences of speculative writing about topics presented without context.
Stick with facts and identified sources. Could the NSO Group articles be converted into a Quibi program? Advance the “real” agenda with short video. Worth a shot? Sources may not be needed for a short form Quibi thing.
Stephen E Arnold, July 16, 2020
Google, TikTok, and Seriousness
July 15, 2020
Short form video is in the news. TikTok captivates millions of eyeballs. Many of these eyeballs belong to Americans. Most of these Americans choose not to understand several nuances of “free” 30 second videos created, transmitted, viewed, and forwarded via a mobile device; to wit:
- Software for mobile phones can covertly or overtly suck up data and send those data to a control node
- Those data can be cross correlated in order to yield useful insights about the activities, preferences, and information flowing into and out of a mobile device equipped with an application. Maybe TikTok does this too?
- Those digital data can be made available to third parties; for example, advertising analytics vendors and possibly, just maybe, a country’s intelligence services.
The Information published one of those “we can’t tell you where we got these data but by golly this stuff is rock solid” stories. This one is called “TikTok Agreed to Buy More Than $800 Million in Cloud Services From Google.” Let’s assume that this story about the Google TikTok deal is indeed accurate. We learn:
Last week, though, word surfaced of a buzzy new customer for Google Cloud—TikTok, the app for sharing short videos that is the year’s runaway social media hit. The deal is a lucrative one for Google Cloud, The Information has learned. In a three-year agreement signed in May 2019, TikTok committed to buying more than $800 million of cloud services from Google over that period…
What’s with the Google? Great or lousy business judgment? Does Google’s approach to a juicy deal include substantial discounts in order to get cash in the door? Is the deal another attempt by the Google to get at least some of the China market which it masterfully mishandled by advising the Chinese government to change its ways?
Nope. The new Google wants to grow by locking down multi year contracts. The belief is that these “big deals” will give the Google Cloud the protein shake muscles needed to deal with the Microsofties and the Bezos bulldozer.
New management, new thinking at the GOOG, and there will be more of the newness revealed with each tweak of a two decades old “system.”
At the same time as the Information “real” news story arrived in the DarkCyber news center, a pundit published MBA type write up popped into our “real news” folder. This write up is “The TikTok War.”
Unlike the Information’s story, the Stratechery essay is MBA consultant speak, which is different from “real news.” The point of the 3,900 word consultant report is:
I believe it is time to take China seriously and literally…
There you go: An MBA consulting revelation. One should take China seriously and literally.
Okay. Insight. Timely. Incisive.
From this conclusion, TikTok’s service is no longer appropriate in the US. Banning is probably a super duper idea if I understand the TikTok War. (How does one fight a war by banning digital information? Oh, well, irrelevant question. What’s that truism about ostriches putting their heads in the sand? Also irrelevant.)
Let’s step back and put these two different TikTok articles in a larger context.
The Information wants everyone to know that a mysterious “source” has said that Google has a three year deal with TikTok. This is a surprise? Nope. Google is on the hunt for cash because after Google’s own missteps, it is faced with hard to control costs and some real live “just like Google” competitors; namely, Amazon, Apple, Facebook, and Netflix. There’s also the mounting challenges of political and social annoyances to add some spice to the Googlers’ day.
The MBA consultant analysis points out that China has to be taken seriously. Prior to TikTok, China was not taken seriously? I suppose TikTok is the catalyst for seriousness. More likely, the TikTok thing evokes MBA consultant outputs to confirm what many people sort of intuit but have not been able to sum up with a “now is the time” utterance.
In my lecture yesterday for the National Cyber Crime Conference, I presented a diagram of how Chinese telecommunications and software systems can exfiltrate information with or without TikTok.
Banning an app is another one of those “Wow, the barn burned and Alibaba built a giant data center where the Milking Shorthorns once stood” moments.
Sourceless revelations about Google’s willingness to offer a deal to a China centric TikTok and MBA consultant revelations that one should take China seriously warrants one response: The ship sailed, returned, built a giant digital port, and has refueled for a return journey. Ban away.
Stephen E Arnold, July 15, 2020
Huawei and Its Sci-Fi Convenience Vision
July 9, 2020
One of the DarkCyber research team spotted what looked like a content marketing, rah rah article called “Huawei’s 1+8+N Strategy Will Be a Big Success in China As It Has No Competitors.”
We talked about the article this morning and dismissed its words as less helpful than most recycled PR. The gem in the write up is this diagram which was tough to read in the original. We poked around and came across a Huawei video which you can view on the Sparrow News Web site.
Here’s a version of the 1+8+N diagram. If you are trying to read the word “sphygmomanometer” means blood pressure gizmo. The term is shorthand for “smart medical devices”.
The idea is that the smartphone is the de facto surveillance device. It provides tags for the device itself and a “phone number” for the device owner. Burner phones registered to smart puppets require extra hoops, and government authorities are going to come calling when the identify of the burner phone’s owner is determined via cross correlation of metadata.
The diagram has three parts, right? Sort of. First, the “plus” sign in the 1+8+N is Huawei itself. Think of Huawei as the Ma Bell, just definitely very cozy with the Chinese government. The “plus” means glue. The glue unites or fuses the data from the little icons.
The focal point of the strategy is the individual.
From the individual, the diagram shows no phone computing devices. There are nine devices identified, but more can be added. These nine devices connected to an individual are all smart; that is, Internet of things, mobile aware, surveillance centric, and related network connected products.
The 1
The “1” refers to the smartphone.
The 8
The eight refers to the smart devices an individual uses. (The smartphone is interacting with these eight devices either directly or indirectly as long as there is battery and electrical power.)
Augmented / virtual reality “glasses”
Earphones
Personal computers
Speakers
Tablets
Televisions
Watches
Vehicles
The connection between and among the devices is enabled by Huawei HiLink or mobile WiFi, although Bluetooth and other wireless technologies are an option.
The N
The N like the math symbol refers to any number of ecologies. An ecology could be a person riding in a vehicle, watching a presentation displayed by a connected projector, a smart printer, a separate but modern smart camera, a Chinese Roomba type robot, a smart scale for weighing a mobile phone owner, a medical device connected or embedded in an individual, a device streaming a video, a video game played on a device or online, a digital map.
These use cases cluster; for example, mobile, smart home, physical health, entertainment, and travel. Other categories can, of course, be added.
Is 1+8+N the 21st Century E=MC^2?
Possibly. What is clear is that Huawei has done a very good job of mapping out the details of the Chinese intelligence and surveillance strategy. By extension, one can view the diagram as one that could be similar to those developed by the governments of Iran, North Korea, Russia, and a number of other nation states.
The smartphone delivers on its potential in the 1+8+N diagram, if the Huawei vision gets traction.
Observations
The 1+8+N equation has been around since 2019. Its resurfacing may have more to do with Huawei’s desire to be quite clear about what its phones and other products and services can deliver.
The company uses the phrase “full scene” instead of the American jargon of a 360 degree view.
Neither phrase captures the import of data in multiple dimensions. Tracking and analyzing data through time enables a number of interesting dependent features, services, and functions.
The 1+8+N may be less about math and more about intelligence than some of the write ups about the diagram discuss.
Stephen E Arnold, July 9, 2020
Consumers As Unwitting Data Conduits as Cyberware Flames
June 30, 2020
India and China are not friending one another. The issue I noted today concerns social media services designed — maybe targeted is a more appropriate word — at consumers.
Most users of apps like TikTok of 30 second video renown are not aware and do not want to know about data surveillance, known to some as data sucking or data hoovering. (A Hoover was a vacuum cleaner for DarkCyber readers unfamiliar with such a device.)
Information has been floating around that TikTok and other “authorized” apps available from the Google and from the would-be Intel-killer Apple allow the basic social media function to take place while the app gobbles a range of data. Put something on your clipboard? Those data are now in a server in Wuhan.
“India Bans TikTok As Tensions with China Escalate” reports:
India’s Ministry of Electronics and Information Technology said in a statement Monday that it had received many complaints about misuse and transmission of user data by some mobile apps to servers outside India.
Yes, another Captain Obvious insight. Is Captain Obvious working for one of India’s government services?
For those who have wandered the aisles of some interesting conferences, TikTok data is only the tip of the data iceberg.
In fact, I told one hip real news person that chasing some of the smaller data resellers was like understanding the global nature of agribusiness by talking to a quinoa farmer 20 miles from Cusco.
The information is interesting to DarkCyber for three reasons:
- The insight light bulb is flashing in some government units. That’s a start.
- India is recognizing that consumers going about their daily lives are providing an intelligence windfall of reasonably good size. Consumers use their mobile phones, consumers talk, and consumers enter secure facilities and check out craze dances in the break room.
- Cyber warfare is not just chewing away at juicy servers in Australia or Canada. Cyber warfare is wrapped up in those low cost, feature packed hardware devices which, according to the sticker on the box, are “smart.”
The current time period is one filled with interesting activities. What do you think, Captain Obvious?
Stephen E Arnold, June 30, 2020
AI Enables Cyber Attacks
June 4, 2020
Is it not wonderful that technology has advanced so much that we are closer to AI led cyberattacks? It is true that bad actor hackers already rely on AI to augment their nasty actions, but their AI is not on par with human intelligence yet. Verdict warns that AI powered cyberattacks will be on the rise in the future: “Leveling Up: How Offensive AI Will Augment Cyberattacks.”
A 2020 Forrester report stated that 88% of security leaders believe AI will be used in cyberattacks and over half thought an attack could occur sometime in the next twelve months. Cyber security professionals are already arming their systems with AI to combat bad actors using the same technology, but they cannot predict everything.
Bad actor hackers want AI capabilities, because it scales their operations, increases their profitability, provides an understanding of context, and makes attribution and detection harder. Verdict’s article breaks down a bad actor hacker’s attack strategy.
The first step would be reconnaissance, where chatbots interact with employees with AI generated photos. Once the chatbots gained the victims’ trust, CAPTCHA breakers are used for automated reconnaissance on the public Web site. The next step would be intrusion with spear-phishing attacks targeted at key employees.
Part three would follow with an attacker hacking the enterprise framework and blending in with regular business operations. The next phases would collect passwords another privileges as the hacker moved laterally to gather more targeted information while avoiding detection. The final phase would be where the AI shows its chops by pre-selecting information to steal instead of sifting through an entire system. The AI would get it, download the targeted data, and then get out, most likely without a trace.
“Offensive AI will make detecting and responding to cyberattacks far more difficult. Open-source research and projects exist today which can be leveraged to augment every phase of the attack lifecycle. This means that the speed, scale, and contextualization of attacks will exponentially increase. Traditional security controls are already struggling to detect attacks that have never been seen before in the wild – be it malware without known signatures, new command and control domains, or individualized spear-phishing emails. There is no chance that traditional tools will be able to cope with future attacks as this becomes the norm and easier to realize than ever before.”
The human element is still the surprise factor.
Whitney Grace, June 4, 2020
Microsoft and Cyber Security: Popping Up a Level?
May 15, 2020
Remember when Microsoft “invented” DOS? What happened to Gary? Nothing good.
Remember when Microsoft “invented” compression? What happened to those Stacker people? Poof.
Remember when Microsoft “reinvented” enterprise search? What happened to Fast Search & Transfer’s UNIX licensees? Hasta la vista, muchachos.
Now Microsoft seems to be preparing to convert the cyber security vendors into Microsoft partners. We noted “Microsoft Opens Up Coronavirus Threat Data to the Public.” Another virtue signaling story? Maybe.
The article reports/asserts:
Microsoft is making the threat intelligence it’s collected on coronavirus-related hacking campaigns public…
That seems useful. Here’s another piece of information presented as a quote from the head of the Cyber Security Alliance:
“Overall, the security industry has not seen an increase in the volume of malicious activity; however, we have seen a rapid and dramatic shift in the focus of that criminal activity,” Daniel, a former White House cybersecurity coordinator, told CyberScoop. “The bad guys have shifted their focus to COVID-19 related themes, trying to capitalize on people’s fears, the overall lack of information, and the increase in first-time users of many on-line platforms.”
The article points out:
The 283 threat indicators Microsoft has shared are available through Microsoft’s Graph Security API or Azure Sentinel’s GitHub page.
Open information. Github. Partnering. Fighting disease. — How much goodness can one services firm deliver?
DarkCyber believes that Microsoft is dropping apples that do not fall far from the DOS, Stacker, and Fast Search UNIX tree.
Microsoft wants to be in the thick of cyber security in order to surround and benefit from the money flowing into a starting-to-consolidate cyber sector.
Only this week, a Florida based vendor of investigative software started beating the bushes for a buyer. Consolidation has begun and is accelerating.
How can Microsoft benefit? Those cyber security outfits make darned good Microsoft partners. Installing, tuning, and customizing Microsoft services (on premises and in the cloud) makes good business sense.
Maybe DarkCyber is misinterpreting an act of sincere common good as a dark pattern?
On the other hand, we could ask Gary, a Stacker person, or a Fast Search UNIX licensee. Err, maybe not.
Stephen E Arnold, May 15, 2020
-
- Subscribe to Beyond Search
Feature archive
News archive
-
