Browse >
Home / Archive: December 2020
The cyber intelligence firm has merged with Alto Analytics. The new outfit will be called Constella Intelligence. The two companies’ technologies will allow organizations to “anticipate and defeat digital risk.” You can read about this tie up in “4iQ and Alto Analytics Merge and Rebrand as Constella Intelligence.” The new firm is in the cyber security business. According to the announcement the company
… will empower organizations and intelligence professionals with comprehensive digital risk protection that covers brand, executive, fraud, geopolitical and identity threats.
One phrase struck me as particularly interesting; specifically:
“Through successful 4iQ Series C funding and the powerful combination of two market-leading organizations, Constella has incredible tools and resources to tackle the fast-evolving security landscape…
The “market leading” adjectival appears to position 4iQ and Alto among the luminaries of cyber intelligence. However, 4iQ’s quirky name and its similarity to other Dark Web and social media indexing tools did not capture the same market buzz as Shadowdragon, for example. Alto Analytics competes in a the crowded data analytics space.
The two entities apparently will join to justify this description:
Constella Intelligence is a leading global Digital Risk Protection business that works in partnership with some of the world’s largest organizations to safeguard what matters most and defeat digital risk. Its solutions are broad, collaborative and scalable, powered by a unique combination of proprietary data, technology and human expertise—including the largest breach data collection on the planet, with over 100 billion attributes and 45 billion curated identity records spanning 125 countries and 53 languages.
The merger is almost coincident with the revelations about the failure of cyber security vendors’ products to detect the SolarWinds breach. More firms will be seeking ways to rebrand, reposition, and reinvigorate their sales of products and services. Will 1 + 1 = 3?
Sure in the marketing department. Those art history majors are optimists.
Stephen E Arnold, December 22, 2020
Wow, I had almost forgotten that IBM Watson was going to be a $1 billion business back in 2014. How quickly some forget that Lucene, home brew code, and acquisitions blended with science fiction? In 2017, the former Big Blue executive said in the Harvard Business Review:
“Watson will touch one billion people by the end of this year.”
Touch is not generate $1 billion and more in sustainable revenues. Nope, Watson failed in cancer, did zippo to fight Covid, and did create some memorable full page ads like the weird chemical structure thing in 2015:
Yeah, building blocks of cognitive software.
“IBM Sets Its NLP Ambitions High With New Capabilities In Watson” explains that IBM is making progress. Note this statement:
While recent announcements by IBM focus around language, explainability, and workplace automation, the update around its language capabilities include reading comprehension, FAQ extraction and improving interactions in Watson Assistant. All these products aim to bring resilience, productivity and value for enterprises.
I like the explainability. Why not explain why the supercomputer Covid drug analysis did not generate a usable output, defaulting to a long list of “maybe these will work drugs” for humans to figure out what would work and what would not. Helpful in a time of crisis.
I don’t want to dwell on the implications that IBM Watson can now understand what humanoids write, particularly in short, cryptic WhatsApp messages about an illegal transaction. Let me quote one dollop of pink confectioner’s sugar paste:
…the company also announced a new intent classification model in IBM Watson Assistant, which is aimed at understanding an end user’s goal or intent behind engaging with the virtual assistant. It will then be used to train the systems accordingly while enabling greater accuracy in virtual assistants.
With a new president, I thought that the old IBM over hyped cognitive PR squibs had been retired for Ms. Rometty to oversee.
Wrong.
IBM is back in the hyperbole game. Let’s ask Watson. On second thought, nah.
Stephen E Arnold, December 23, 2020
Written by Stephen E. Arnold · Filed Under IBM Watson, Marketing, News | Comments Off on IBM Watson: More Promises after Previous Promises. Will IBM Deliver This Time?
Maybe it was I? Maybe it was AMP? Google knows, of course. If you were trying to locate the December 15, 2020, DarkCyber video news program, the malformed url has been fixed. No more “Video not found” messages, at least for now. Since I was fully responsible and those AMP messages are ever so helpful, I was able to reform myself, obtain another copy of the video url from the ever reliable Google, and make this change. I’m off to don a hair shirt and a barbed wire undergarment to remind myself to improve. Oh, both garments have a Google logo. Inspiration at hand.
Stephen E Arnold, December 22, 2020
Written by Stephen E. Arnold · Filed Under DarkCyber, News, Video | Comments Off on DarkCyber Video News Link Fixed for 12-15-20 Video
I read “Thousands of Fraudsters Are Selling via Shopify, Analysis Finds.” I know Shopify has been a must mention platform by one of the New Age broadcast stars, or I think it is podcast stars now. Other than that hype hose, I know zero about the company. In the write up, I spotted an interesting factoid. If the datum is accurate, I have learned a great deal about the governance of the firm and its ethical compass. Herewith is the allegedly accurate factoid:
According to the ecommerce authentication service FakeSpot, which analyzed more than 120,000 Shopify sites, as many as 21 per cent posed a risk to shoppers.
Yowza.
Stephen E Arnold, December 22, 2020
Written by Stephen E. Arnold · Filed Under cybercrime, ECommerce, News | Comments Off on Shopify: Going with the Flow
I read “Expanding Our Global Footprint with New Cloud Regions.” I skipped most of the announcements about data centers and zoomed to this statement:
The cleanest cloud in the industry. We do all of this while operating the cleanest cloud in the industry, matching 100 percent of the electricity we use with renewable energy. This commitment to sustainability enables our customers to meet their own cloud computing needs with zero net carbon emissions. You can learn more about our global infrastructure, including new and upcoming regions, here.
Okay, clean cloud, no dolphin skin lesion causing actions, no birds into wind farm blades, and no hot exhaust to fricassee feathered friends.
I ran three Google searches on a system which I assume runs on the clean Google cloud. Here are the results of each query:
1. Vegas 18 crack. The clean Google cloud result:
2. Cannabis online. The clean Google cloud result:
3. Hand gun suppressor. The clean Google cloud result:
After running these three queries on the clean Google cloud, one of the researchers working for me, said, “I don’t think your interpretation of the word clean is what Google meant?”
I looked at the researcher and replied, “Clean is clean, right?”
What’s clean mean to you gentle reader, saving the planet with giant data centers or making it easy for anyone to locate stolen software, potential contraband, and silencers for weapons?
I remain baffled about the clean cloud phrase. Presumably Amazon, HP, IBM, and Microsoft are not clean. I am struggling. Time for more marketing from Googlers I assume.
Stephen E Arnold, December 22, 2020
Written by Stephen E. Arnold · Filed Under Google, Marketing, News | Comments Off on Google Outmarkets Cloud Competitors
I read “I Have Resigned from the Google AMP Advisory Committee.” The committee was chock full of brilliant individuals. They are a team. Now it seems that a committee member wants to let a wider variety of people serve the Google. (Does this mean people who are less than brilliant?)
Anyway whatever the interpersonal dynamics were, the write up contains a quote to note; herewith:
The stated goal of the AMP AC is to “make AMP a great web citizen.” I am concerned that – despite the hard work of the AC – Google has limited interest in that goal.
Okay, a great Web citizen now under investigation by multiple legal entities., A great Web citizen with the mindboggling mismanagement of a person’s journal article about bias in training data. A great Web citizen which seems to buy traffic from Apple and allegedly engages in fancy dancing with the estimable outfit Facebook.
Limited interest. Yep, I imagine the Google does. AMP up with the GOOG by ejecting from a committee. Okay. I wonder if the AMPers were aware that only three million hapless Googler users obtain malware from 28 malicious Edge extensions. How does this make the Web a better place? Does Google ignore certain malware to create issues for another firm? Has Google’s management system created an environment in which teams, committees, and outside experts work at cross purposes?
Stephen E Arnold, December 22, 2020
Just a suggestion for those who want to know what Peter Thiel finds financially interesting. Point your browser thing at “Here’s Where Peter Thiel Is Investing in Europe.” The write up includes some biographical details about one of Palantir’s founders. Then the guts of the write up is a list of companies in which Mr. Thiel’s funds have invested. The list is organized by country so one can see that Belgium has only one outfit with Thiel appeal, Topcompare.be. Germany and the ever interesting UK each have about a dozen hoped to be winners. One of Mr. Thiel’s UK investments is the money sucking Google DeepMind. There’s a pony in there somewhere at the digital stables.
Stephen E Arnold, December 22, 2020
I don’t want to make a big deal of what is common knowledge among those who are system administrators. My French bulldog does not worry about a person with root access. He chews his bone and barks at UPS trucks.
I, on the other hand, do know what system administrators can do and do do. After more than 50 years of professional work, I have learned first hand what unmanaged, poorly supervised, and careless watching of watchers can yield. Let me tell you: There’s quite a bit of excitement out in the real world.
But why listen to an old timer who should be ensconced in a Covid ridden old-age home?
Navigate to “Ex Zoom China Employee Faces US Dissident Censoring Charge.” To make the story short, a person with root access or access to functions of a system administrators censored customers’ information.
Is this important?
Yes, but not because Zoom is more or less like other successful high technology companies.
The action illustrates the inherent weakness of existing controls over systems access. The alleged perpetrator may have been acting due to personal beliefs. The individual could have been paid to block the content. The person with access could have been following orders.
The point is that a system administrator can do many things: Monitor a colleague, gather data in order to blackmail a person, alter information, block content, and define what is real and verifiable.
Let’s take another step. Read “Study Finds That Robots Can Pressure People to Do Risky Things.” Let’s assume that some people are more likely to respond to robot pressure. A robot can be either a Boston Dynamics type of mechanical reindeer or a software script. An engineer with root can instruct a software robot to deliver information of a specific type to people. Some of those people will respond and maybe do risky things. Other people will believe the outputs and make decisions within that information frame. Like goldfish in a bowl of water, the environment becomes that which is accepted. That’s what a system administrator can do if so inclined and operating without oversight.
Is the online information reality real, accurate, or shaped?
Stephen E Arnold, December 21, 2020
Written by Stephen E. Arnold · Filed Under Management, News, Security | Comments Off on What Can a System Administrator Do? The Zoom Example
Okay, okay, I am not sure if this story is accurate, but it certainly is interesting. Navigate to “Microsoft President Blames Israeli Company for Rash of Cyberattacks, Wants Biden to Intervene.” The write up reports:
Smith [the Microsoft president] has suggested that NSO Group and similar companies are “a new generation of private companies akin to 21st-century mercenaries” who generate “cyber-attack proliferation to other governments that have the money but not the people to create their own weapons. In short, it adds another significant element to the cybersecurity threat landscape.”
If accurate, Mr. Smith may want to validate that industrial strength cyber tools are available from code dumps from other specialized software vendors, downloadable via Microsoft’s own Github, penetration testing tool developers and the third parties creating add on kits to these software, and on certain fora on either encrypted messaging platforms or the handful of remaining Dark Web sites which allow authorized users to buy or download exploits.
In the galaxy of specialized software firms, NSO Group has been illuminated due to its emergence as a PR magnet and the business set up of the company itself. However, there are other specialized software vendors and there are other sources of code, libraries, and information to guide the would be bad actor.
Microsoft itself suffered a security breach and promptly (after five or six months) took action. The company published a report. Now Microsoft is acting to focus attention on a company which may or may not have had an impact on the supply chain matter involving SolarWinds and possibly other cyber security firms.
This Microsoft assertion is almost as interesting as the death star response to the incident.
But the kicker is this report form Techradar: “Microsoft Azure Breach Left Thousands of Customer Records Exposed.” If correct, this statement seems to suggest that Microsoft is into shifting blame:
Thanks to questionable security practices by an app developer, more than half a million sensitive documents of its customers were exposed on the Internet. The documents were housed in an unprotected Microsoft Azure blob storage and could be viewed by anyone with the direct address of the files, without any kind of authentication.
Okay.
Stephen E Arnold, December 21, 2020
Here’s an interesting question I asked on a phone call on Sunday, December 20, 2020: “How many cyber security firms rely on open source software?”
Give up?
As far as my research team has been able to determine, no study is available to us to answer the question. I told the team that based on comments made in presentations, at lectures, and in booth demonstrations at law enforcement and intelligence conferences, most of the firms do. Whether it is a utility function like Elasticsearch or a component (code or library) that detects malicious traffic, open source is the go-to source.
The reasons are not far to seek and include:
- Grabbing open source code is easy
- Open source software is usually less costly than a proprietary commercial tool
- Licensing allows some fancy dancing
- Using what’s readily available and maintained by a magical community of one, two or three people is quick
- Assuming that the open source code is “safe”; that is, not malicious.
My question was prompted after I read “How US Agencies’ Trust in Untested Software Opened the Door to Hackers.” The write up states:
The federal government conducts only cursory security inspections of the software it buys from private companies for a wide range of activities, from managing databases to operating internal chat applications.
That write up ignores the open source components commercial cyber security firms use. The reason many of the services look and function in a similar manner is due to a reliance on open source methods as well as the nine or 10 work horse algorithms taught in university engineering programs.
What’s the result? A SolarWinds type of challenge. No one knows the scope, no one knows the optimal remediation path, and no one knows how many vulnerabilities exist and are actively being exploited.
Here’s another question, “How many of the whiz kids working in US government agencies communicate the exact process for selecting, vetting, and implementing open source components directly (via 18f type projects) or from vendors of proprietary cyber security software?”
Stephen E Arnold, December 21, 2020
« Previous Page — Next Page »
