Is China the New Los Angeles Trend Machine?
August 28, 2017
I was last in China in 2007 and then in Hong Kong in 2010. My information is, therefore, out of date. That’s no big whoop for me, since I am ready to tally 74 years in our thrilling world.
I read “In China You Now Have to Provide Your Real Identity If You Want to Comment Online.” The main point of the write up is that the free and open Internet is going the way of the dodo. The goal of “real name registration” is to make it easy for certain official to track down individuals without the expensive, time consuming, and sometimes messy “traditional” identity investigations.
I noted this passage:
So what exactly constitutes forbidden topics on the Chinese internet? An unnamed CAC official told a journalist the following when asked about the new rules (first translated by The Diplomat):
- opposing the principles of the constitution of China
- endangering national security, revealing state secrets, subverting state power, and undermining national reunification
- damaging national honor and interests
- inciting national hatred, ethnic discrimination, and undermining national unity
- undermining the state’s policies on religion or promoting cults and feudal superstitions
- spreading rumors or disrupting social order
- spreading obscenity, pornography, violence, or terror, or abetting a crime
- insulting or slandering others and infringing upon the lawful rights and interests of others
- violating any other laws and regulations
My reaction to the write up is that censorship, China-style, may be the latest trend to emerge from the Middle Kingdom. Once Los Angeles on the left coast generated the “in” fads which would then roll toward Harrod’s Creek.
My thought is that censorship may be the new black or whatever the hot color is for fall fashion. I am not particularly surprised because similar governmental actions seem to have emerged from the deliberative bodies in Russia, Turkey, and other countries. One African nation state just turned off the Internet, an Iran-style touch.
One idea struck me. Is now the time for individuals to generate an alternative or optional Internet identity. Creating a “legend” or an alternate Internet identity is important. Just ask the person who ran the illegal Dark Web site AlphaBay. The mistake that individual made was to use an identity which was not “clean.”
The procedure for setting up a legend or clean Internet identity is not easy. There are a number of steps. Human mistakes can render a clean identity traceable; that is, dirty. If you are able to verify that you are working for a recognized law enforcement or intelligence entity, you can obtain a legend from the Beyond Search Overflight team. This is our WITSEC Light bundle. More comprehensive legends are also available to qualified LE and intel professionals.
To explore this package which contains an alias, matching email address, and other necessary elements like a Walmart pay as you go phone, just write darkwebnotebook at yandex dot com. Remember. We verify that you have a legitimate LE or intel role prior to providing the legend, a workable biography, and summary of what one has to do to build out the legend.
Those who do not qualify will have to look elsewhere for a way to deal with censorship constraints in countries other than the US. If the China censorship trend moves outward from that country, more than one online identity may be needed for some operations.
Stephen E Arnold, August 28, 2017
Is Your Fish Tank Spying on You?
August 17, 2017
The search for information never ends. We learned in the Darktrace Global Threat Report about a hacked fish tank. A smart fish tank was compromised. The fish tank was hacked. Darktrace’s technology speared the attempt. The bad guys have not yet been been converted to sushi.
Stephen E Arnold, August 17, 2017
TechnoSecurity & Digital Forensics Conference Info
July 20, 2017
I am giving two talks about the Dark Web at the September 2017 TechnoSecurity & Digital Forensics Conference. With the take down of AlphaBay and the attentions Dark Web sources of synthetic drugs are getting in the main stream media, the sessions will be of particular relevance to law enforcement, security, and intelligence professionals. My first talk is a quick start basics lecture. My second presentation focuses on free an and source tools and the commercial services which can flip on the lights in the Dark Web.
The conference has emerged as one of the most important resources for corporate network security professionals, federal, state and local law enforcement digital forensic specialists, and cybersecurity industry leaders from around the world. The purpose is to raise international awareness of developments, teaching, training, responsibilities, and ethics in the field of IT security and digital forensics. The event will feature more than 70 speakers, 60 sessions, 20 new product demonstrations, and 25 sponsors and exhibits. exhibits. For full details and to register, please visit www.TechnoSecurity.us.
As a reader of Beyond Search, you qualify for a 30 percent discount. Just use the promotional code DKWB17 when you sign up online.
Stephen E Arnold, July 20, 2017
Darktrace Delivers Two Summer Sizzlers
July 17, 2017
Darktrace offers an enterprise immune system called Antigena. Based on the information gathered in the writing of the “Dark Web Notebook,” the system has a number of quite useful functions. The company’s remarkable technology can perform real time, in depth analyses of an insider’s online activities. Despite the summer downturn which sucks in many organizations, Darktrace has been active. First, the company secured an additional round of investment. This one is in the $75 million range. This brings the funding of the company to the neighborhood of $170 million, according to Crunchbase.
Details about the deal appear in this Outlook Series write up. I noted this statement:
The cyber security firm has raised a $75 million Series D financing round led by Insight Venture Partners, with participation from existing investors Summit Partners, KKR and TenEleven Ventures.
On another front, Darktrace has entered into a partnership with CITIC. This outfit plans to bring “next-generation cyber defense to businesses across Asia Pacific.” Not familiar with CITIC? You might want to refresh your memory bank. Beyond Search believes that this tie up may open the China market for Darktrace. If it does, Darktrace is likely to emerge as one of the top two or three cyber security firms in the world before the autumn leaves begin to fall.
Here in Harrod’s Creek we think about the promise of Darktrace against a background of erratic financial performance from Hewlett Packard. As you may recall, one of the spark plugs for Darktrace is Dr. Michael Lynch, the founder of Autonomy. HP bought Autonomy and found that its management culture was an antigen to its $11 billion investment. It is possible to search far and wide for an HP initiative which has delivered the type of financial lift that Darktrace has experienced.
Information about Darktrace is at www.darktrace.com. A profile about this company appears in the Dark Web Notebook in the company of IBM Analyst’s Notebook, Google/In-Q-Tel Recorded Future, and Palantir Technologies Gotham. You can get these profile at this link: https://gum.co/darkweb.
Stephen E Arnold, July 17, 2107
Android VPN App Security Analyzed
July 12, 2017
Here’s an important warning for users of mobile devices—beware VPN apps in the Google Play store. Thats the upshot of a white paper from Australian research organization CSIRO, “An Analysis of the Privacy and Security Risks of Android BPN Permission-Enabled Apps.” Researchers found, for example that 18% of VPN apps in the Google Play store do not actually encrypt anything, and 38% harbor malware of some sort.
The in-depth paper describes the investigation into four main areas of concern: third-party user tracking and permissions access; malware presence; traffic interception; and user awareness of potential risks. The researchers specify:
In this paper we provide a first comprehensive analysis of 283 Android apps that use the Android VPN permission, which we extracted from a corpus of more than 1.4 million apps on the Google Play store. We perform a number of passive and active measurements designed to investigate a wide range of security and privacy features and to study the behavior of each VPN-based app. Our analysis includes investigation of possible malware presence, third-party library embedding, and traffic manipulation, as well as gauging user perception of the security and privacy of such apps. Our experiments reveal several instances of VPN apps that expose users to serious privacy and security vulnerabilities, such as use of insecure VPN tunneling protocols, as well as IPv6 and DNS traffic leakage. We also report on a number of apps actively performing TLS interception. Of particular concern are instances of apps that inject JavaScript programs for tracking, advertising, and for redirecting e-commerce traffic to external partners.
The paper concludes by recommending Android revamp their VPN permission model. It also describes most users as “naïve” to the realities of mobile VPN security. For anyone wishing to educate themselves on the issue, this paper is a good place to turn.
Cynthia Murrell, July 12, 2017
Google and Indian Government Spar over Authenticity of Google Maps
July 12, 2017
The Indian government has rejected the authenticity of maps used by popular navigation app Google Maps terming them as technically inaccurate.
Neowin in an article titled Indian Government Calls Google Maps “Inauthentic”; Asks Citizens to Use Their Solution says:
In an attack against the service, Surveyor General of India, Swarna Subba Rao said that the maps used by Google weren’t “authentic” and were “unreliable” with limited accuracy. She also stressed on how Survey of India’s own mapping data was qualitatively more accurate.
The bone of the contention seems to be Google’s inaccurate mapping of Kashmir, the northern territory disputed by Pakistan. Google was also denied permissions to map the country at street levels for Street View citing security concerns.
Considering the fact that Google has the largest user base in India, this seems to be a setback for the company. An official of the Indian government is recommending the use of their own maps for better topographical accuracy. However, the government approved maps are buggy and do not have a great interface like Google Maps.
Vishal Ingole, July 12, 2017
Mistakes to Avoid to Implement Hadoop Successfully
July 7, 2017
Hadoop has been at the forefront of Big Data implementation methodologies. The journey so far has been filled with more failures than successes. An expert thus has put up a list of common mistakes to avoid while implementing Hadoop.
Wael Elrifai in a post titled How to Avoid Seven Common Hadoop Mistakes and posted on IT Pro Portal says:
Business needs specialized skills, data integration, and budget all need to factor into planning and implementation. Even when this happens, a large percentage of Hadoop implementations fail.
For instance, the author says that one of the most common mistakes that most consultants commit is treated Hadoop like any other database management system. The trick is to treat data lake like a box of Legos and start building the model with one brick at a time. Some other common mistakes include not migrating the data before implementation, not thinking about security issues at the outset and so on. Read the entire article here.
Vishol Ingole, July 7, 2017
Facebook to Tackle Terrorism with Increased Monitoring
July 5, 2017
Due to recent PR nightmares involving terrorism organizations, Facebook is revamping their policies and policing of terrorism content within the social media network. A recent article in Digital Trends, Facebook Fights Against Terrorist Content on Its Site Using A.I., Human Expertise, explains how Zuckerberg and his team of anti-terrorism experts are changing the game in monitoring Facebook for terrorism activity.
As explained in the article,
To prevent AI from flagging a photo related to terrorism in a post like a news story, human judgment is still required. In order to ensure constant monitoring, the community operations team works 24 hours a day and its members are also skilled in dozens of languages.” Recently Facebook was in the news for putting their human monitors at risk by accidentally revealing personal information to the terrorists they were investigating on the site. As Facebook increase the number of monitors, it seems the risk to those monitors also increases.
The efforts put forth by Facebook are admirable, yet we can’t help wonder how – even with their impressive AI/human team – the platform can monitor the sheer number of live-streaming videos as those numbers continue to increase. The threats, terrorist or otherwise, present in social media continue to grow with the technology and will require a much bigger fix than more manpower.
Catherine Lamsfuss, July 5, 2017
DoD and Textron Move Analytics to Cloud
July 3, 2017
Continuing in its efforts to become more cloud-based, the DOD has partnered with Textron to create a web-based intel program. This latest edition of intelligence gathering program has shifted the DOD away from software into cloud presence, one of the government’s goals for the future.
Defense Systems recently reported on this new collaboration:
Decreasing a hardware footprint by consolidating data-centers and servers is entirely consistent with the Pentagon’s push to move more services, applications, storage systems and functions to a cloud-based architecture; this is particularly relevant in light of DOD’s initiative to integrate more commercial IT systems and move more Joint Regional Security Stacks (JRSS) functions to the cloud.
The program itself streamlines data analysis and places it in the cloud for easier storage and access. This latest move showcases how technology across the board is shifting from traditional software and hardware driven data analytics and moving toward cloud-based.
Catherine Lamsfuss, July 3, 2017
Booz Boo Boo: Blue Chip? Maybe Not
June 1, 2017
I read “Booz Allen, NGA Probe Intel Leak.” Let’s assume that the information in the write up is “sort of” accurate. I suggest this because the article invokes the name of “Edward Snowden” and the name of “Hal Martin.” Both of these individuals allegedly behaved with a bit of professional “looseness.”
But the write up does more than remind me that the once highly regarded blue chip management consulting firm has become an example of how not to manage its own employees and contractors.
Too bad. I worked at Booz, Allen & Hamilton when the firm’s reputation was reasonably well regarded. Today I am not so sure I would place the Booz Allen outfit identified in the FCW article in my “I want to work their” Top 10.
The main point of the write up seems to me to be:
Edward Snowden, Hal Martin and now another Booz Allen Hamilton employee could be involved in the leak of sensitive intelligence data — though in the latest case, it appears it could be accidental.
The information, according the FCW, was sensitive. The error was a result of a misconfiguration error.
Nevertheless, a company charged with working within the constraints set forth by the client should have management procedures in place to prevent alleged security issues.
Booz, Allen & Hamilton once kept a low profile. Now the firm finds itself making headlines.
FCW is not the grocery store tabloid-type of “real news” outfit, of course. However, I ask myself, “Management or mismanagement?”
And from an outfit which once provided management consulting services to the world’s leading organizations.
Interesting.
Stephen E Arnold, June 1, 2017
-
- Subscribe to Beyond Search
Feature archive
News archive
-
