Cambridge Analytica Alum: Social Media Is Like Bad, You Know

April 4, 2020

A voice of (in)experience describes how tech companies can be dangerous when left unchecked. Channel News Asia reports, “Tech Must Be Regulated Like Tobacco, says Cambridge Analytica Whistleblower.” Christopher Wylie is the data scientist who exposed Cambridge Analytica’s use of Facebook data to manipulate the 2016 presidential election, among others. He declares society has yet to learn the lesson of that scandal. Yes, Facebook was fined a substantial sum, but it and other tech giants continue to operate with little to no oversight. The article states:

“Wylie details in his book how personality profiles mined from Facebook were weaponised to ‘radicalise’ individuals through psychographic profiling and targeting techniques. So great is their potential power over society and people’s lives that tech professionals need to be subject to the same codes of ethics as doctors and lawyers, he told AFP as his book was published in France. ‘Profiling work that we were doing to look at who was most vulnerable to being radicalised … was used to identify people in the US who were susceptible to radicalisation so that they could be encouraged and catalysed on that path,’ he said. ‘You are being intentionally monitored so that your unique biases, your anxieties, your weaknesses, your needs, your desires can be quantified in such a way that a company can seek to exploit that for profit,’ said the 30-year-old. Wylie, who blew the whistle to British newspaper, The Guardian, in Mar 2018, said at least people now realise how powerful data can be.”

As in any industry, tech companies are made up of humans, some of whom are willing to put money over morality. And as in other consequential industries like construction, engineering, medicine, and law, Wylie argues, regulations are required to protect consumers from that which they do not understand.

Cynthia Murrell, April 4, 2020

NSO: Back in the News Again

April 3, 2020

Let’s assume that the Beeb is on the money. “Coronavirus: Israeli Spyware Firm Pitches to Be Covid 19 Saviors” is a bit of British snark. First, the word “coronavirus” is newsy, and it is clickbait. Second, “Israeli spyware pitches” converts the use of specialized software into a carnival barker’s shout. (One might ask, “Why?” I think I know the answer. The British Cervantes is on the gallop perhaps?)

The point of the story which contains some loaded words like “controversial” is that NSO has technology which can assist governments in gathering useful information about the virus. The write up states after the Beeb explains that Facebook and NSO are in a legal wrestling match:

NSO says its employees will not have access to any data, but its software will work best if a government asks local mobile phone operators to provide the records of every subscriber in the country. Each person known to be infected with Covid-19 could then be tracked, with the people they had met and the places they had visited, even before showing symptoms, plotted on a map.

Scary, ominous, Orwellian, something that British government agencies would never, ever in a million years consider.

The reality is that monitoring a population is happening in quite a few countries. Perhaps even merrie olde Land of the Angles?

A news story is okay. Shading the coverage to advance the agenda “NSO is just not such a fine piece of British wool” is unsettling — possibly more so than specialized service firms’ software.

Stephen E Arnold, April 3, 2020

Google Android: Simple Explanations Ring True

February 14, 2020

I read “Why Google Did Android.” The author of the article is Tim Bray (OpenText, Sun Micro, Google, etc.) The answer in the write up is:

“The iPhone is really good. The way things are going, Apple’s going to have a monopoly on Internet-capable mobile devices. That means they’ll be the gatekeepers for everything, including advertising, saying who can and can’t, setting prices, taking a cut. That’s an existential threat to Google. Android doesn’t have to win, to win. It just has to get enough market so there’s a diverse and competitive mobile-advertising market.”

The person providing the answer is from Vic Gundotra, former Googler and now ex CEO of AliveCor.

The answer suggests to me that Google wanted to go from A to B in a pragmatic way. That’s what Google engineers try to do: Be pragmatic, logical.

Does this suggest that using Java was the logical way to make the journey from fear of the iPhone to Android? Maybe Oracle’s dogged pursuit of a legal resolution is more than a matter of principle? What’s the catchphrase about asking for forgiveness?

Stephen E Arnold, February 14, 2020

Acronym Shadow: Good Enough Presages the Future of US Technical Capabilities

February 6, 2020

Apps are nothing but drag and drop programming. The database stuff? A no brainer for Shadow. What other half informed generalizations contributed to the technical, managerial, and political issues with the Iowa caucus app. The New York Times, definitely a paragon of technical acumen, analyzed the situation. Navigate to “The App That Broke the Iowa Caucus.” Remember the NYT was the outfit that fumbled its original online play, ably directed my Jeff Pemberton—what, 40 years ago?—and then lost revenue by pulling its “exclusive” from the LexisNexis service a few years later. Now the NYT is a techno master, happily pointing out that failure took place.

There was no mini failure. Maybe some underhanded activity, maybe some carelessness, and maybe some “we’re experts and know what to do” thinking going on.

DarkCyber believes that the misstep, if that’s what it was, was a reminder that technical expertise and excellence are not as easy as writing a proposal, pulling some influence strings, or assuming that code actually works in the real world.

Nope, the good enough approach is operating.

But the larger message is that if the US expects to maintain a place among technology leaders, a different mind set is needed.

What is that mind set? For starters, big thinkers and MBA types must recognize that planning, attention to detail, quality checks, live tests, and making software usable are necessary.

A failure in a core democratic process is a signpost. For anyone who believes the baloney manufactured about artificial intelligence, natural language processing, and advanced analytics—good enough is not.

Is this a bright signal that American technologists cannot deliver when it matters and when those who seek to disrupt America are getting the clown show of a lifetime.

Stephen E Arnold, February 5, 2020

About the Bezos Mobile Matter: Who Can Speculate? Everyone

January 22, 2020

I received a couple of communications about the mobile phone allegedly operated by Jeff Bezos, a tireless worker and high profile wealthy genius. A British newspaper suggested that Mr. Bezos’s mobile was compromised. Then the ever reliable Internet began passing along the story. A few moments ago (it is now 0704 am US Eastern on January 22, 2020) I spotted “Saudi Dismisses Reports It Is Behind Hacking of Amazon Boss Bezos’ Phone.”

The write up states:

“Recent media reports that suggest the Kingdom is behind a hacking of Mr Jeff Bezos’ phone are absurd. We call for an investigation on these claims so that we can have all the facts out,” Saudi’s US embassy said in a message posted on Twitter.

First, how many countries’ intelligence agencies have access to specialized software tuned to compromise a mobile device? The correct answer is, “No one is supposed to know.” DarkCyber estimates that specialized tools are available to many countries. Some using software from Europe; others using software from the East; and others relying on basement methods. Zerodium pays for mobile exploits for a reason. Companies like NSO Group want to maintain a low profile for a reason. IBM does not talk about the CyberTap technology it acquired years ago. The list could be expanded, but you will have to attend one of my law enforcement and intelligence lectures to get more information.

Second, how easy is it to spoof one mobile for another? Not as easy as performing other interesting acts. However, there are companies providing a range of hardware and software tools to make this type of spoofing possible. If you want the names of these outfits, that information will not appear in a free blog post. But these outfits are doing business and providing certain unique services. The customers are usually governments, but friends of friends are a reality. Where can these spoofs take place? Think in terms of a coffee shop or a communications control facility.

Third, who did it? The list of possible actors is long. With Amazon’s increasing success in Bahrain, Saudi Arabia, and United Arab Emirates, there are a number of possibles. Would one of these countries attempt to access Mr. Bezos’ mobile? DarkCyber suggests having some facts before disseminating allegations. Certain types of chatter can have interesting downstream consequences; for example, Mr. Snowden’s ability to enjoy the weather in the south of France and Mr. Greenwald’s interactions with the current Brazilian authorities.

Several observations:

  1. The message is that mobiles are targets
  2. A high profile individual can be made the center of an international media magnet
  3. Work is needed to work backwards to determine if a compromise took place, who did it, and why?

In the meantime, there are security gaps everywhere. S3 buckets expose information. Complex systems generate vulnerabilities. Assumptions about cyber access are often wrong.

Where was Amazon’s chief technology officer? At Mr. Bezos’ side? Probably not. That individual was grilling a Facebook executive about access to personal data in Germany.

Perhaps someone is sending a message to Amazon? Who is paying attention? Probably journalists, high profile mobile phone users, and individuals with leverageable information.

Stephen E Arnold, January 22, 2020

BOB: A Blockchain Phone

November 29, 2019

Remember the comment by some FBI officials about going dark. The darkness is now spreading. “Meet BOB, World’s First Modular Blockchain-Powered Smartphone” reports that a crypto currency centric phone may become more widely available.

The write up states:

BOB runs on Function X OS, which is an open-source operating system. As it uses the blockchain ecosystem, every task on the phone, be it sending texts, making calls, browsing the web, and file sharing, all happen on a decentralized network, making it highly encrypted and thus secure. Each unit of the BOB is a node that supports the entire Function X blockchain system.

DarkCyber thinks that Mr. Comey was anticipating these types of devices as well as thinking about Facebook’s encrypted message systems.

For more details, consult the TechRadar article.

One important point: The BOB has a headphone jack. Even those concerned about privacy and secrecy like their tunes.

Stephen E Arnold, November 29, 2019

Remounting the Pegasus Named NSO

November 15, 2019

Those who care about security will want to check out the article, “Pegasus Spyware: All You Need to Know” from the Deccan Herald. Approximately 1,400 smartphones belonging to activists, lawyers, and journalists across four continents suffered cyber attacks that exploited a WhatsApp vulnerability, according to a statement from that company. They say the attacks used the Pegasus software made by (in)famous spyware maker NSO Group. Though the Israeli spyware firm insists only licensed government intelligence and law enforcement agencies use their products, WhatsApp remains unconvinced; the messaging platform is now suing NSO over this.

The article gives a little history on Pegasus and the investigation Citizen Lab and Lookout Security undertook in 2016. We learn the spyware takes two approaches to hacking into a device. The first relies on a familiar technique: phishing. The second, and much scarier, was not a practical threat until now. Writer David Binod Shrestha reports:

“The zero-click vector is far more insidious as it does not require the target user to click or open a link. Until the WhatsApp case, no example of this was seen in real-world usage. Zero-click vectors generally function via push messages that automatically load links within the SMS. Since a lot of recent phones can disable or block push messages, a workaround has evidently been developed. WhatsApp, in its official statement, revealed that a vulnerability in their voice call function was exploited, which allowed for ‘remote code execution via specially crafted series of packets sent to a target phone number.’ Basically, the phones were infected via an incoming call, which even when ignored, would install Pegasus on the device. The data packets containing the spyware code were carried via the internet connection and a small backdoor for its installation was immediately opened when the phone rang. The call would then be deleted from the log, removing any visible trace of infection. The only way you will know if your phone has been infected in the recent attacks is once WhatsApp notifies you via a message on the platform.”

Pegasus itself targets iPhones, but Android users are not immune; a version Google has called Chrysaor focuses on Android. Both versions immediately compromise nearly all the phone’s data (like personal data and passwords) and give hackers access to the mike and camera, live GPS location, keystroke logging, and phone calls. According to the Financial Times, the latest version of Pegasus can also access cloud-based accounts and bypass two-factor authentication. Perhaps most unnerving is the fact that all this activity is undetectable by the user. See the article for details on the spyware’s self-destruct mechanism.

Shrestha shares a list of suggestions for avoiding a Pegasus attack. They are oft-prescribed precautions, but they bear repeating:

“*Never open links or download or open files sent from an unknown source

*Switch off push SMS messages in your device settings

*If you own an iPhone, do not jailbreak it yourself to get around restrictions

*Always install software updates and patches on time

*Turn off Wi-Fi, Bluetooth and locations services when not in use

*Encrypt any sensitive data located on your phone

*Periodically back up your files to a physical storage

*Do not blindly approve app permission requests”

For those who do fall victim to Pegasus, Citizen Lab suggests these remedies—they should delink their cloud accounts, replace their device altogether, change all their passwords, and take security more seriously on the new device. Ouch! Best avoid the attacks altogether.

Cynthia Murrell, November 15, 2019

Mobile Phone Privacy?

September 13, 2019

Mobile devices are supposed to contain the best, reliable technology at the hands of an individual’s fingertips. Along with this great technology, we believe that our privacy and information are protected. The reason being is that we shell out huge amounts for the technology, pay a monthly bill, and expect the security to match the investment. Hackaday explains that is not the truth with the newest 5G technology in the article, “5G Cellphones Location Privacy Broken Before It’s Even Implemented.”

Our location information is one of the top things that is supposed to be secure on mobile devices, but the Authentication and Key Agreement (AKA) protocol has been broken at the most basic level since 3G, 4G, and 5G inceptions. What? Once upon a time when 3G was the latest craze, it was expensive to spoof cell phone towers and so difficult that that a device’s International Mobile Subscriber Identity (IMSI) was transmitted unencrypted. The new 5G does have a more secure version with asymmetric encryption and a challenge response protocol with sequential numbers to prevent replay attacks. However, there is a way to override this:

“This hack against the AKA protocol sidesteps the IMSI, which remains encrypted and secure under 5G, and tracks you using the SQN. The vulnerability exploits the AKA’s use of XOR to learn something about the SQN by repeating a challenge. Since the SQNs increment by one each time you use the phone, the authors can assume that if they see an SQN higher than a previous one by a reasonable number when you re-attach to their rogue cell tower, that it’s the same phone again. Since the SQNs are 48-bit numbers, their guess is very likely to be correct. What’s more, the difference in the SQN will reveal something about your phone usage while you’re away from the evil cell.”

Perhaps burner phones are a possible solution to some alleged 5G privacy issues?

Whitney Grace, September 13, 2019

Palantir: Did ICE Paid $60 Million for an App

August 2, 2019

DarkCyber spotted a short article in Counterpunch. The title?

Records Show Palantir Made $60 Million Contracting with ICE for Mobile App

The write up said:

A critical July 2019 exposé from WNYC based on documents obtained via FOIA request shows how Palantir’s proprietary software, in this case the FALCON mobile app, is essential to the removal operations of ICE and related agencies. As WNYC explained, “FALCON mobile allows agents in the field to search through a fusion of law enforcement databases that include information on people’s immigration histories, family relationships, and past border crossings.”

Counterpunch then shared its own research findings:

Counterpunch has learned that since 2016, Palantir has made more than $60 million in contract awards from ICE for access to FALCON and for Operations & Maintenance (O&M) for the mobile application. This, of course, is solely for FALCON and related services, and likely just scratches the surface of the true scope of Palantir’s profits from collaboration with ICE, to say nothing of Palantir’s lucrative relations with other government agencies such as CIA, DoD, etc.

The write up covers some other information about Palantir. DarkCyber finds the $60 million for an app interesting.

Stephen E Arnold, August 2, 2019

Mobile Phone: Tips for Addicts

May 28, 2019

Metro, a UK tabloid, reported about a study conducted at the University of Washington. The idea the researchers probed related to “triggers” which keep a person glued to his or her mobile device. “How to Resist the Four Triggers Which Keep You Addicted to Your Smartphone” reveals the tricks. The sample was 39 people aged from 14 to 64. Now I don’t want to get mathy, but the sample would get some frowns from an online Statistics 101 adjunct professor from a no name school in North Carolina. At a juicier institution, like the University of Washington, the sample is right sized.

With this cutting edge research, the secrets have been revealed; to wit:

  1. An unoccupied moment, the smartphone is there for you and me.
  2. As a break when one is working on a difficult task such as calculating or looking up in a table the sample size for a research project into “hooks” used to addict a person to a mobile phone.
  3. As a deflection action when an actual human who has taken several classes in statistics wants to engage a person like a researcher in a conversation about sample sizes.
  4. When one anticipates an email or other communication from an academic institution eager to hire a cracker jack researcher and data wrangler.

From my reading, I have gleaned some other information about the ways to make a person 14 to 64 become an addict. I offer these to suggest that the Metro’s summary of the research does not capture the scope of the subject. Here are some other addictive tricks:

  1. Approval from perceived “friends” or “persons whom one wishes to be a pal”
  2. Sex hook ups, images, etc.
  3. Rewards delivered via gameification
  4. Sex hook ups, images, etc.
  5. Desire to expand one’s contacts when looking for a job in statistics.
  6. Sex hook ups, images, etc.

Perhaps the team form the University of Washington will expand their research. On the other hand, why bother? A sample of 39 is just so right.

Oh, and the secret to breaking the addiction? Turn off the gizmo.

Stephen E Arnold, May 28, 2019

Next Page »

  • Archives

  • Recent Posts

  • Meta