Google: Managing Staff a Challenge
September 24, 2019
DarkCyber is not sure about the accuracy of “Exclusive: Google Insider Turns Over 950 Pages Of Docs And Laptop To DOJ.” The story appeared on Saraacarter.com (the second “a” is a middle initial). Ms. Carter’s about page states:
Sara A. Carter is a national and international award-winning investigative reporter whose stories have ranged from national security, terrorism, immigration and front line coverage of the wars in Afghanistan and Iraq. Sara A. Carter is currently an investigative reporter and Fox News Contributor. Her stories can be found at saraacarter.com. She formerly worked as a senior national security correspondent for Circa News.
The write up asserts that:
A former Google insider claiming the company created algorithms to hide its political bias within artificial intelligence platforms – in effect targeting particular words, phrases and contexts to promote, alter, reference or manipulate perceptions of Internet content – delivered roughly 950 pages of documents to the Department of Justice’s Antitrust division Friday.
The story is dated August 13, 2019, and DarkCyber spotted the link on September 23, 2019. In August 2019, Project Veritas revealed that the alleged Google insider is / was Zachary Vorhies.
Project Veritas does have a Google Document Dump page. You can view the files and download them at this link. A representative document is “Algorithmic Discrimination from and Environmental Psychology Perspective: Str5ee-Inducing Differential Treatment.”
The write up is an academic review of findings which, upon reflection, are mostly common sense. Manipulation can be accomplished via stress causing and stress relieving.
What struck DarkCyber as interesting is that the cache of documents has not made much of a splash in the last few weeks.
Other observations include:
- Unlike the now long-offline Google research papers which I cited in my 2003 Google Legacy monograph, the documents in this cache are more touchy-feely.
- Google’s ability to control its confidential documents appears to have some gaps.
- The “insider” turned canary reveals that Google is not generating happy Xooglers.
Net net: The high school science club approach to management may need some upgrades.
Stephen E Arnold, September 24, 2019
Emailing Phishing: Yes, It Works
September 19, 2019
Phishing scams aka spam are arguably the oldest Internet scam. One would think that after almost thirty years with the Internet and email, people would have wised up to phishing scams, but no. People still fall for them and ZDNet has an article that explains why, “Phishing Emails: Here’s Why We Are Still Getting Caught After All These Years.” Here is an interesting fact, phishing emails are actually the first stage in security and data hacks within the past few years.
Google blocks more than 100 million scam emails a day and 68% of the messages are new variations of ones already blocked. What is even more interesting is who the phishing campaigns target. Enterprise users are five times more likely than a regular Gmail user to be targeted, while education users are two times more likely, government workers are three times likely, and non-profits have a 3.8 more likelihood than regular consumers. The scams only last a certain length of time to avoid detection, sometimes they last hours or only a few minutes. The scams mask themselves:
“While bulk phishing campaigns only last for 13 hours, more focused attacks are even more short lived; what Google terms as a ’boutique campaign’ — something aimed at just a few individuals in a company — lasts just seven minutes. In half of all phishing campaigns, the email pretends to have come from the email provider, in a quarter it claims to be from a cloud services provider; after that it’s most likely masquerading as a message from a financial services company or ecommerce site.”
An even scarier fact is that 45% of the Internet does not understand phishing scams. The phishing bad actors play on the naiveté and use psychological tricks, such as urgency and fear, to get people to comply.
People need to wise up and be aware of Internet scams and phishing attacks. Be aware that a reputable company will never ask for your password and always check the email address to see if it appears suspicious. If it has lot of numbers and letters and does not come from the company’s official domain, it is a scam.
Whitney Grace, September 19, 2019
Understanding Social Engineering
September 6, 2019
“Quiet desperation”? Nope, just surfing on psychological predispositions. Social engineering leads to a number of fascinating security lapses. For a useful analysis of how pushing buttons can trigger some interesting responses, navigate to “Do You Love Me? Psychological Characteristics of Romance Scam Victims.” The write up provides some useful insights. We noted this statement from the article:
a susceptibility to persuasion scale has been developed with the intention to predict likelihood of becoming scammed. This scale includes the following items: premeditation, consistency, sensation seeking, self-control, social influence, similarity, risk preferences, attitudes toward advertising, need for cognition, and uniqueness. The current work, therefore, suggests some merit in considering personal dispositions might predict likelihood of becoming scammed.
Cyberpsychology at work.
Stephen E Arnold, September 6, 2019
MAGA: Making Android Great Again?
August 30, 2019
My feeds were stuffed with references to Google’s announcement that Apple’s iPhone security sucks. Here’s a sampling of the headlines I spotted:
Google reveals years-long ‘indiscriminate’ iPhone hack. Most of the vulnerabilities targeted were found in the iPhone’s default Safari web browser. Source: The National
Google discovered ‘sustained attacks’ over at least two years against iPhone users. Source: Neowin.net
Google says hacked websites were attacking iPhones for years. Now-fixed exploits were used to install monitoring implants. Source: TechSpot
And there are more. The Guardian, Inquirer, PocketLint, MIT Technology Review, and others.
DarkCyber does not want to think negative thoughts about Google’s discovery. Apple addressed the issue promptly. On the plus side of the ledger, Google could have made the announcement after the US holiday weekend. Why now?
DarkCyber wants to point out that another article, this one about Google Chrome, offered this headline: “A major Google Chrome bug could let criminals attack your PC remotely.”
Not too much coverage of this item compared with the damning revelation that iPhones. Are. Insecure!
DarkCyber suggests that the information presented at CVE Details may be of interest. This site presents a possibly accurate list of Google Android security issues.
DarkCyber wants to point out:
- If a device is any place other than a Faraday cage, unplugged, and behind a security perimeter, that device may be vulnerable
- Mass market devices are compromisable because users have “interesting behaviors.” Curious about that to which DarkCyber refers? Check out this link.
- Hardened devices which are “black” are not popular because they are [a] expensive to produce and keep up to date, [b] more difficult to use than a consumer phone, [c] expensive, and [d] also vulnerable.
Security exposés capture headlines. Vendors of cyber security services and products make these types of revelations part of their standard operating procedure.
Capturing headlines informs bad actors that there are vulnerabilities to be discovered. “Hey, why not check out this method” publicity is an interesting approach. Is Google grandstanding?
Plus, Google may introduce its own MAGA hat. A “Make Android Great Again” chapeau could knock the famous Google flashing lapel pin off its top spot in the Google collectible hall of fame.
Stephen E Arnold, August 30, 2019
CafePress: Just 23 Million Customer Details May Have Slipped Away
August 6, 2019
I read “CafePress Hacked, 23M Accounts Compromised. Is Yours One Of Them?” Several years ago I participated in a meeting at which a senior officer of CafePress was in the group. The topic was a conference at which I was going to deliver a lecture about cyber security. I recall that the quite confident CafePress C suite executive pointed out to me that the firm had first rate security. Interesting, right?
The write up in the capitalist tool said:
According to that HIBP notification, the breach itself took place on Feb 20 and compromised a total of 23,205,290 accounts. The data was provided to Troy Hunt at HIBP from a source attributed as JimScott.Sec@protonmail.com.
I thought that an outfit with first rate security would not fall to a bad actor. I also assumed that the company would have reported the issue to customers promptly. It seems as though the breach took placed more than five months ago. (February 2019 and today is August 5, 2019.)
What’s DarkCyber’s take on this?
- The attitude of a CafePress executive makes clear that confidence and arrogance are poor substitutes for knowledge.
- The company looks like it needs a security and management health check.
- A failure to act more quickly suggests significant governance issues.
How about a T shirt with the CafePress logo and the phrase “First Rate Security” printed on the front?
Stephen E Arnold, August 6, 2019
Capital One, Amazon, Cats, and the Common Infrastructure Play
July 31, 2019
I read “Hacking Suspect Acted Oddly Online.” (Note: the online story is paywalled by Rupert Murdoch. You may be able to get a peek at the dead tree version of this story in the Wall Street Journal for July 31, 2019.) Yep, Internet cat angle, self incrimination, and public content dissemination. That’s a plot hook which may make a great Lifetime or Netflix program. Amazon is likely to pass on funding the film version of this now familiar story.
Here’s the plot:
There’s the distraught financial institution, in this case, the lovable Capital One. This is the outfit known for “what’s in your pocket”? Good question. The financial outfit teamed up with Amazon in 2015, and according to the “real news” outfit:
In 2015, Capital One Chief Information Officer Rob Alexander said, “The financial services industry attracts some of the worst cyber criminals. So we worked closely with the Amazon team to develop a security model, which we believe enables us to operate more securely in the public cloud than we can even in our own data centers.”
That sounds darned good, but data affecting about 100 million people was breached. That number has not been verified to my satisfaction, and DarkCyber awaits additional data. But 100 million is a good enough number for the story.
Next we have a protagonist with some employment history at Amazon. Remember that this is the cloud service which was in the chain of data compromise. But — and this is important — Amazon was not at fault. The security problem was a is configured bit of “infrastructure.” Plus, the infrastructure which was the point of weakness is “common to both cloud and on premises data center environments.”
The story ends with a suspect. If the program becomes a mini series, we will follow the protagonist with empathy for cats through a trial, and perhaps a variation on the story weaving of “Orange Is the New Black.”
What’s missing from the analysis in the “real news” outlets? Here in Harrod’s Creek, Kentucky, we think of Amazon as an outfit with nifty white Mercedes Benz vans and fast moving van drivers.
But a couple of the pundits lounging in the convenience story / tavern floated some ideas:
- Why is Amazon not providing a system to address misconfiguration? It seems that 100 million people are now aware of this dropped ball.
- Why is an Amazon person, presumably with Amazon expertise, behaving in a manner that appears problematic? If the person was hired, what’s the flaw in the Amazon hiring process? If the person was terminated for a germane reason, why was the person not given appropriate “support” to make the transition from Amazonian to a person with unusual online activities? How does Amazon prevent information from being used by a former employee? What can be improved? Are there other former Amazon employees who are able to behave in an allegedly problematic way?
- Why is the problem “common” to use Capital One’s alleged word quoted in the WSJ story? There are dozens upon dozens of firms which are marketing themselves as cyber safeguard providers. Are these services used by Amazon, or is Amazon relying on home grown solutions. There are indeed Amazon’s own security tools. But are these findable, usable, reliable, and efficacious? Security may be lost in the thicket of proliferating Amazon products, services, and features. In effect, is it possible that Amazon is not doing enough to prevent such security lapses associated closely with its cloud solutions.
Stepping back, let’s think about this incident in a cinematic way:
- A giant company offering services which are so complex that problems are likely to result from component interactions, blundering customers, and former employees with a behavior quirk.
- A financial services firm confident of its technical competence. (Note that this financial firm with a previous compliance allegation which seemed to pivot on money laundering and ended with a $100 million fine. See “Compliance Weaknesses Cost Capital One $100M”, October 23, 2018. You will have to pay to view this allegedly accurate write up.
- A protagonist who seemed to send up distress flags via online communication channels.
What’s the big story?
Maybe there’s a “heart of darkness” with regard to security within the Amazon jungle.
To which jungle was Joseph Conrad, author of the “Heart of Darkness” referring?
“Nowhere did we stop long enough to get a particularized impression, but the general sense of vague and oppressive wonder grew upon me. It was like a weary pilgrimage amongst hints for nightmares.”
Psychological, digital, or financial? With the JEDI contract award fast approaching, will the procurement officials interpret the Capital One breach as a glimpse of the future. Maybe Oracle is correct in its view of Amazon?
Stephen E Arnold, July 31, 2019
Cyber Threats from Semi Insiders
July 24, 2019
I was thrilled to learn that the New York Times (which quoted me on Sunday, July 21, 2019) concluded that I had no work for the last 40 years. Well, I least I don’t rely on a SNAP card, sleep under the overpass, and hold a sign which says, “Will analyze data for food.”
What did I do in those four decades which the NYT fact checkers couldn’t find? I worked as a rental. Yep, a contractor. A semi insider.
I did what I was paid to do, delivered by now routine “This is what I think, not what you want me to think” reports, and muddled forward.
For some outfits for which I worked, I was a regular. I did projects for years, decades even. For some government agencies, it may seem as if I never left because my son is working on the projects now.
I suppose the phrase “semi insider” explains this relationship. One is “around” long enough that people assume you are part of the furniture or the break room.
I thought of this “semi insider” phrase when I read “Siemens Contractor Pleads Guilty to Planting Logic Bomb in Company Spreadsheets.” The guts of the write up strikes me as:
But while Tinley’s files worked for years, they started malfunctioning around 2014. According to court documents, Tinley planted so-called “logic bombs” that would trigger after a certain date, and crash the files. Every time the scripts would crash, Siemens would call Tinley, who’d fix the files for a fee.
So the idea was sell more work.
My view is that this practice is more widespread than may be recognized.
How does one deal with a situation in which a company’s management and regular “professionals” are so disconnected from the semi insiders’ work that no one knows there’s a scheme afoot?
How does a zip zip zip modern outfit hire individuals who can be trusted, often over a span of years?
How does an organization verify that its semi insiders have not planted a bug, malware, or some other malicious “thing” in a system?
The answer is that today’s cyber security tools will not be much help. Most organizations lack the expertise and resources to verify that what semi insiders do is a-okay.
There’s a lot of chatter about identifying and tracking insider threats. The story makes clear that semi insiders are a risk as well. Considering that Snowden and others who have acted improperly and outside the bounds of their secrecy and other agreements makes crystal clear:
Semi insider threats are a significant risk.
And as the “expertise” of many technical professionals decreases, the risks just go up.
In short, today’s cyber security solutions, cyber governance methods, and day to day management techniques are ineffective, not addressed by cyber security solutions which are essentially reactive, and not well understood.
Siemens may have gotten the memo. It only took two years to arrive.
Stephen E Arnold, July 23, 2019
NSO: More PR Excitement, Facts, or Bloomberg Style Reporting?
July 20, 2019
I read the Financial Times’ write up about NSO Group. The title is a show stopper: “Israeli Group’s Spyware Offers Keys to Big Tech’s Cloud.” (Note: You may have to pay money to view the orange newspaper’s online “real” news write up.
There’s a diagram:
There’s a reminder that NSO is owned by an outfit called “Q Cyber.” There’s information contained in a “pitch document.” There’s a quote from Citizen Lab, a watchdog outfit on cyber intelligence firms and other interesting topics.
What’s missing?
- Information from a Q Cyber or NSO professional. A quote or two would be good.
- Statements from an entity which has used the method and obtained the desired results; for example, high value intel, a person of interest neutralized, the interruption of an industrialized crime operation, or something similar
- Scanned images of documents similar to the Palantir Gotham how to recently exposed by Vice, a zippy new news outfit.
Think about the PR problem the revelations create: NSO gets another whack on the nose.
Think about the upside: Visibility and in the Financial Times no less. (Does NSO need more visibility and semantic connections to Amazon, Apple, or any other “in the barrel” high tech outfit?)
Outfits engaged in cyber intelligence follow some unwritten rules of the road:
First, these outfits are not chatty people. Even at a classified conference where almost everyone knows everyone else, there’s not much in the way of sales tactics associated with used car dealers.
Second, documentation, particularly PowerPoints or PDFs of presentations, are not handed out like chocolate drops for booth attendees who looked semi alert during a run through of a feature or service. Why not whip out a mobile device with a camera and snap some of the slides from the presentation materials or marketing collateral? The graphic is redrawn and quite unlike the diagrams used by NSO type cyber intel outfits. Most trained intelligence professionals are not into “nifty graphics.”
Third, cyber intel companies are not into the media. There are conference organizers who snap at people who once worked as a journalist and made the mistake of telling someone that “before I joined company X, I worked at the ABC newspaper.” Hot stuff New York Times’ stringers are stopped by security guards or police before getting near the actual conference venue. Don’t believe me. Well, try to gate crash the upcoming geo spatial conference in Washington, DC, and let me know how this works out for you.
Fourth, why is NSO acting in a manner so different from the other Israel-influenced cyber intelligence firms? Is Voyager Labs leaking details of its analytic and workflow technology? What about Sixgill’s system for Dark Web content analysis? What’s Webhose.io doing with its content and expanding software suite? What’s Verint, a public company, rolling out next quarter? NSO is behaving differently, and that is an item of interest, worthy of some research, investigation, and analysis.
For the established cyber intel firms like NSO, assertions are not exactly what sells licenses or make BAE Systems, IBM, or Raytheon fear that their licensees will terminate their contracts. How many “customers” for NSO type systems are there? (If you said a couple of hundred, you are getting close to the bull’s eye.) Does publicity sell law enforcement, security, and intelligence systems? Search engine optimization specialists are loco if they think cyber intel firms want to be on the first page of a Google results page.
Consider this series of bound phrases:
Cat’s paw. Bloomberg methods. Buzzfeed and Vice envy. A desire to sell papers. Loss of experienced editors. Journalists who confuse marketing with functioning software?
These are the ideas the DarkCyber team suggested as topics an investigator could explore. Will anyone do this? Unlikely. Too arcane. Too different from what problems multiple systems operating on a global scale present for one method to work. Five Eyes’ partners struggle with WhatsApp and Telegram messages. “Everything” in Amazon or Apple? Really?
Net net: Great assertion. How about something more?
Stephen E Arnold, July 20, 2019
A Partial Look: Data Discovery Service for Anyone
July 18, 2019
F-Secure has made available a Data Discovery Portal. The idea is that a curious person (not anyone on the DarkCyber team but one of our contractors will be beavering away today) can “find out what information you have given to the tech giants over the years.” Pick a social media service — for example, Apple — and this is what you see:
A curious person plugs in the Apple ID information and F-Secure obtains and displays the “data.” If one works through the services for which F-Secure offers this data discovery service, the curious user will have provided some interesting data to F-Secure.
Sound like a good idea? You can try it yourself at this F-Secure link.
F-Secure operates from Finland and was founded in 1988.
Do you trust the Finnish anti virus wizards with your user names and passwords to your social media accounts?
Are the data displayed by F-Secure comprehensive? Filtered? Accurate?
Stephen E Arnold, July 18, 2019
Crashing Teslas: No Dark Web Inputs Needed
June 21, 2019
Do you want to interfere with a Tesla’s electronics? You don’t need to prowl the Regular Web for hacking forums. You don’t need to fire up Tor and visit Dark Web sites. A quick search of Bing and Google delivers a link to “Tesla Model 3 Spoofed Off the Highway.” The information in the write up is a summary of an experiment. DarkCyber understands that.
The products and methods disclosed in the write up will make it easier for some vendors of intelligent driver assistant systems to improve their products. The publicity generated by the listing of the off-the-shelf products used in this experiment will benefit the manufacturers. DarkCyber anticipates a spate of high school science fair projects which present the results of potential engineers’ experiments.
We learned in the write up:
Yonatan Zur, Regulus Cyber CEO and Co-Founder, emphasized this goes way beyond Regulus Cyber and Tesla: “We designed a product to protect vehicles from GNSS spoofing because we believe it is a real threat. We have ongoing research regarding this threat as we believe it’s an issue that needs solving. These new semi-autonomous features offered on new cars place drivers at risk and provides us with a dangerous glimpse of our future as passengers in driverless cars. By reporting and sharing incidents such as this we can ensure the autonomous technology will be safe and trustworthy. “
The purpose of the research is to inform people about vulnerabilities and to boost sales of Regulus anti-spoofing technology. The company will provide a curious person with a free research summary — in exchange for an email address.
DarkCyber is not sure whether to thank Regulus for making the vulnerabilities of autonomous technology to hacks and spoofs or whether to suggest the firm a less sensational way to publicize the results of their experiments.
If you own a Tesla or other vehicle with certain types of assist mechanisms, those systems may be vulnerable. Bad actors and frisky high school science club students are likely to do some experimenting.
Will Regulus’ research results have the sales impact the company wants? Will other impacts be observable? Have US government oversight agencies pursued similar research into security and safety issues for smart vehicles?
Tough questions to answer.
Stephen E Arnold, June 21, 2019
-
- Subscribe to Beyond Search
Feature archive
News archive
-
