NordVPN: Mostly Ironclad Privacy
February 3, 2022
Panama-based VPN provider NordVPN swore in 2017 that it would refuse requests from any foreign government to release customer data. In the wake of what happened to VPNLab after its tussle with Europol, however, TechRadar Pro reports, “NordVPN Will Now Comply with Law Enforcement Data Requests.” The firm still promises privacy—unless and until the legal eagles appear. We learn NordVPN recently revised the original, 2017 blog post in which it promised unwavering privacy to reflect the new reality. Reporter Anthony Spadafora writes:
“Now though, the original blog post has been edited and the post now reads: ‘NordVPN operates under the jurisdiction of Panama and will only comply with requests from foreign governments and law enforcement agencies if these requests are delivered according to laws and regulations.’ [Emphasis mine.] The revised blog post also goes a bit further in regard to NordVPN’s zero-logs policy by explaining that the company will log a user’s VPN activity if there is a court order to do so: ‘We are 100% committed to our zero-logs policy – to ensure users’ ultimate privacy and security, we never log their activity unless ordered by a court in an appropriate, legal way.’ Meanwhile, the company updated its privacy policy back in July of last year with a new section that contains further details on information requests. A NordVPN spokesperson explained in an email to TechRadar Pro that the sole reason it changed its blog post in the first place was to dissociate its company from bad actors following PCMag’s original article on the matter.”
Spadafora points out the now shuttered VPNLab mostly catered to cybercriminals—a very different outfit from NordVPN. He also emphasizes that, despite the new language, NordVPN still offers a no-logs VPN, so there would be little to no pre-existing data for the company to relinquish even if law enforcement did come knocking. At this point, such a request is purely hypothetical—the firm notes it has yet to receive a single national security letter, gag order, or warrant from government organizations asking for user information since it was founded in 2012. We suspect they hope that streak continues.
Cynthia Murrell, February 2, 2022
NSO Group Factoids: Dominoes Game Underway
February 2, 2022
I read “The Company Trying to Give Cyber Intel a Good Name.” The somewhat lofty goal of the write up is to put a bit of lipstick on what is now a somewhat unattractive blobfish. I don’t have an animal in the fight, although the image of squabbling blobfish strikes me as amusing. Maybe a cyber version of “Animal Farm”?
The article contains what I thought were interesting factoids and, as is my wont, I shall capture these gems:
- NSO Group is still for sale with a valuation of about $1.0 billion US.
- NSO Group technology “makes it possible, at the push of a button, to take over a telephone remotely, record conversations via its microphone, film via its camera, or determine its location, without its owner knowing.”
- Israeli police have been criticized for its use of technology like NSO Group’s.
- “Crime organizations use encrypted communications, on apps such as Telegram and Signal, and in countries like Russia and China the problem has been solved very simply: giant US companies like Google and Meta, and Chinese ones like WeChat and Weibo, provide the authorities with the key to read chat or listen to voice calls on their apps without having to break the encryption.”
- “… European countries were pioneers of planting Trojan horses and developing vulnerabilities for hacking telephones, among them Italian company Hacking Team, which was shut down and re-emerged as Memento Labs, and Amesys…”
- Germany “bought a system from NSO”
- “Israeli company Quadream is selling to Middle Eastern and African countries systems with capabilities similar to those of NSO, in collaboration with a Cypriot sales company InReach Technologies, while Cognyte, formerly the offensive cyber division of Verint, is already developing the next generation of its Trojan horses in a secret division called Ace Labs.”
- “One company trying to adapt to the new era is Paragon Solutions, an offensive cyber company founded two-and-a-half years ago by former IDF intelligence unit 8200 commander Ehud Schneerson, and Idan Nurick and Igor Bogudlov, who served in the unit, together with former prime minister Ehud Barak.”
- Paragon will sell to customers in 39 countries which have to be “enlightened democracies”.
- Paragon has “American DNA” and money from Battery Ventures
- Paragon “has grown to 110 employees, most of them people recently demobilized from the IDF who served in 8200’s cyber units, and the rest former employees of companies like NSO, Check Point, Cobwebs Technologies, and Cyberbit.”
Now what is that game again? Oh, right: Dominoes, a blocking game, right?
Stephen E Arnold, February 2, 2022
Russia Taps the Google PEZ Dispenser for Petty Cash
February 2, 2022
Tass, the Russian News Agency, published “Google Fined over $50,000 for Links to Radicals, Drug Trafficking.” The write up disseminates this information:
magistrate court in Moscow fined the Google search engine 4 mln rubles ($51,408) for providing links to the websites with content banned in Russia including the promotion of drugs, radical Islam, nationalism, as well as the kasparov.ru website, banned in the country.
The emission continued:
Google has not stopped issuing links to websites with child pornography, information about drug trafficking, nationalist organizations in Russia and Ukraine, and the activities of the Hizb-ut-Tahrir group outlawed in Russia, the document says.
My hunch is that the practice suggests that Moscow does sees plenty of PEZ in the mechanism with the Googley decoration.
Stephen E Arnold, February 2, 2022
Machine Learning: Compare and Contrast
February 2, 2022
For machine learning pros looking to choose a framework, Analytics India Magazine examines one of the most prominent options alongside a new contender in, “TensorFlow Vs PyCaret: A Comparison of Machine Learning Frameworks.” The article takes us through an informative juxtaposition of the two open source frameworks, but it looks like neither option overwhelmingly comes out on top. Writer Sreejani Bhattacharyya begins:
“As companies are deploying more and more machine learning models into their systems, a variety of frameworks (some open-source, some not) have come up over the years to make this deployment faster and more efficient. Some of the popular frameworks include TensorFlow, Amazon SageMaker, IBM Watson Studio, Google Cloud AutoML, and Azure Machine Learning Studio, among others. Tensorflow, by far, takes one of the top spots when it comes to machine learning frameworks that technologists depend on. Recently, PyCaret, a low-code machine learning library in Python, has also become increasingly popular among ML practitioners. Let us take a look at how both of them work and what makes them different from each other.”
Bhattacharyya reminds us Google-developed TensorFlow recently celebrated its sixth birthday. At first it was designed for internal Googler use, but was later released under the Apache License, Version 2.0. Since then, a wealth of tools and libraries have grown up around the framework. TensorFlow works with several programming languages, including Python, C++, JavaScript, and Java and can be run on multiple CPUs and GPUs running macOS, Windows, Android, iOS, or 64-bit Linux. The most recent version 2.7.0 improved several features, like debugging, public convolution, and data service auto-sharding.
So why even consider a newcomer like PyCaret, which launched just last November? Code efficiency. We learn:
“Also open source in nature, PyCaret is a low-code machine learning library in Python. It helps data scientists perform end-to-end experiments efficiently. It allows them to move from preparing data to deploying their model within minutes. … Pycaret is rising in popularity in comparison to other ML libraries, as it provides an alternate low-code library that can perform complex machine learning tasks with only a few lines of code. It is built around several machine learning libraries and frameworks such as scikit-learn, XGBoost, Microsoft LightGBM, and spaCy, among others.”
The write-up goes on to describe the working areas of each framework and concludes with a summary of the advantages of each. In a nutshell, TensorFlow excels in performance, scalability, and library management. PyCaret has the edge in productivity and being business-ready. Bhattacharyya found both easy to deploy. Both of these ML frameworks are good options—the choice really comes down to one’s needs and preferences.
Cynthia Murrell, February 2, 2022
Google Docs: Exploit or Exploited?
February 2, 2022
Real-time collaboration has been a boon for teams working remotely over the last couple of years. For Google Docs, however, the feature has opened the door to a hazardous vulnerability. Security Boulevard reports on a “‘Massive Wave’ of Hackers Exploiting Comments in Google Docs.” Writer Teri Robinson tells us:
“It seems like users are now paying the price for Google not fully closing or mitigating a vulnerability in the comment feature of Google Docs—since December a ‘massive wave’ of hackers have exploited the flaw through impersonation and phishing to send malicious content to those using email—primarily Outlook—and Google Docs, according to researchers at Avanan. The targets? Just about any end user. Taking advantage of the ‘seamless nature’ of Google Docs that lets employees collaborate in real-time around the globe, the hackers simply add a comment to a Google Doc that mentions the target with an @. ‘By doing so, an email is automatically sent to that person’s inbox. In that email, which comes from Google, the full comment, including the bad links and text, is included,’ Avanan researchers wrote in a blog post. ‘Further, the email address isn’t shown, just the attackers’ name, making this ripe for impersonators.’ Avanan observed the hackers hitting more than ‘500 inboxes across 30 tenants … using over 100 different Gmail accounts.’”
The hackers’ efforts were helped by the fact their content was delivered directly by Google, which raises flags for neither most users nor their junk filters. That senders’ email addresses are hidden makes it that much harder to spot imposters. (Though, it should be noted, even if an address checks out it could be coming from a compromised account.) As many of our readers know, it just takes one worker falling for the trick to compromise an entire organization. Avanan researchers advise us not to reflexively trust messages just because they come through a trusted platform. Be sure to hover over links before clicking to confirm they will send you to an expected destination. And, as Robinson concludes:
“If users are unsure that a sender is on the up-and-up, they should contact the legitimate sender for confirmation that they sent a document, Avanan said.”
Yep, Google Docs, now mostly for fee thrills.
Cynthia Murrell, February 2, 2022
Microsoft Defender: Are There Other Winners?
February 1, 2022
I believe everything I read on the Internet, of course. One of the fascinating aspects of being old and doing the 21st century equivalent of clipping coupons is coming across “real” research studies. I read “Still Think Microsoft Defender Is Bad? Think Again, Says AV-TEST.”
The write up in Make Use Of Dot Com believes in Windows Defender. It article states:
A recent report by AV-TEST revealed that not only does Microsoft Defender perform well, it actually outperforms many highly-recommended antiviruses
The article included a link to the AV-Test December 2021 Report, and I downloaded it. The AV Test outfit is “the independent IT security institute.” The investment firm Triton owns Swiss IT Security, which is the outfit which “owns” AV-Test.
What does Swiss IT Security Group AG do? Security, consulting, the cloud, and related services.
What does the SITS Group care about Microsoft and its assorted products? With Microsoft’s wide use in organizations, SITS Group probably has an above average keenness for the Redmond wizards’ constructs.
What does this mean for the victory of the Windows Defender system in the AV-TEST Report? For me, I formulated several hypotheses:
- Windows Defender is now able to deal with the assorted threats directed at Microsoft operating systems? Rest easy. Malware popping up on a Windows device is obviously something that is unlikely to occur. Thank goodness.
- Cheerleading for Windows Defender probably makes Microsoft’s security team feel warm and fuzzy which will allow their efforts to deal with Exchange Server issues a more pleasant experience.
- Bad actors will have to rethink how to compromise organizations with Microsoft software. Perhaps some of these individuals will give up criminal activity and join the Red Cross or its equivalent.
For me, institutes which do not reveal their ownership are interesting outfits. But how many antivirus vendors achieved the lofty rank of Windows Defender, according to the report dated December 2021? Here they are:
Avira
Bull Guard
ESET
F Secure
Kaspersky
McAfee
Norton 360
Total Security
Viper.
Windows Defender makes 10 “winners.”
Now of these 10 which is the one that will make SolarWinds, ransomware, compromised Outlook emails, and Azure Cosmos excitement a thing of the past? Another question: “Which of these sort of work in the real world?” And, “If there is a best, why do we need the nine others?”
These are questions one can ask Triton / Swiss IT Security Group AG / AV Test to answer?
Net net: Marketing.
Stephen E Arnold, February 1, 2022
The Gray Lady Rides the NSO Group Pegasus
February 1, 2022
Quite an image right? The New York Times, the flabby dowager of real news, is riding the Pegasus. ‘”FBI Secretly Bought Israeli Spyware and Explored Hacking US Phones” reveals that like most investigative units in the world tested the specialized software and services available from organizations once shrouded in secrecy. No more. It seems that NSO Group’s secrets are more widely shared that Minnie Mouse’s hip new blue jump suit.
The Gray Lady states:
The F.B.I., in a deal never previously reported, bought the spyware in 2019, despite multiple reports that it had been used against activists and political opponents in other countries. It also spent two years discussing whether to deploy a newer product, called Phantom, inside
the United States.
Are you frightened yet? I am not. I expect government agencies to acquire, test, and implement tools necessary to obtain mission objectives. Most of the tested specialized software and systems is discontinued. Some useful tools are never used because the budget no longer permits assigning a full time employee to remain current on a system.
The write up is less about the research done by government agencies and more about the outrage that some feel. My hunch is that the Gray Lady’s “real news” professionals are among the most put upon by what is a routine function.
And the news? The Gray Lady wants to ride the Pegasus, but the tired, old, beaten down Pegasus is not able to get the flaccid passenger aloft.
Stephen E Arnold, February 01, 2022
Palantir Technologies: Will the Company Soar?
February 1, 2022
Palantir is an intelware company that specializes in search technology with consulting services layered on top. According to Seeking Alpha, Palantir might not do well in 2022: “Palantir Stock: Bullish, But Downward Pressure On Price.”
Palantir’s stock has dropped considerably in the past six months. People who purchased stocker before October 2020 are doing all right, but November 2020 buyers lost their money. Palantir is projected to have growth an that appears to be the only bright spot at the moment.
The stock market is experiencing inflation and it is suspected to last longer than six months. Value stocks will benefit the most in this market, while growth stocks, like Palantir, will suffer. Macroeconomic factors will impact growth stocks. Palantir might not be doing too well, but it is doing better than it was last year.
Also there is more positive news:
“What’s especially good is that PLTR continues to “weave” itself into very large organizations. Obviously there are the military partners, which most investors know about. But PLTR is getting closer with commercial partners, left, right, and center. For example, IBM (NYSE:IBM), Amazon (NASDAQ:AMZN) and Rio Tinto (NYSE:RIO).
Quite importantly, this news isn’t just flowing from PLTR press releases. Sure, some of the distribution is fluff, hype and related PR. However, what gets me excited is that these tie-ups are showing in presentations, case studies, earnings reports, and much more. Again, PLTR is becoming a critical part of the fabric, not just simple player, or dashboard provider.
Third, PLTR regularly provides real-world updates, useful research, plus case studies. This is a strong positive for hiring, and keeping the talent pool aware of PLTR, but it’s also good for designers and developers in other companies that could be doing business with PLTR.
Palantir is definitely going to see upheavals in 2022, but search and intelware technology has always been a challenging sell when repositioned for business use cases.
Whitney Grace, February 1, 2022
Coalesce: Tackling the Bottleneck Few Talk About
February 1, 2022
Coalesce went stealth, the fancier and more modern techno slang for “going dark,” to work on projects in secret. The company has returned to the light, says Crowd Fund Insider with a robust business plan and product, plus loads of funding: “Coalesce Debuts From Stealth, Attracts $5.92M For Analytics Platform.”
Coalesce is run by a former Oracle employee and it develops products and services similar to Oracle, but with a Marklogic spin. That is one way to interpret how Coalesce announced its big return with its Coalesce Data Transformation platform that offers modeling, cleansing, governance, and documentation of data with analytical efficiency and flexibility. Do no forger that 11.2 Capital and GreatPoint Ventures raised $5.92 million in seed funding for the new data platform. Coalesce plans to use the funding for engineering functions, developing marketing strategy, and expanding sales.
Coalesce noticed that there is a weak link between organizations’ cloud analytics and actively making use of data:
“ ‘The largest bottleneck in the data analytics supply chain today is transformations. As more companies move to the cloud, the weaknesses in their data transformation layer are becoming apparent,’ said Armon Petrossian, the co-founder and CEO of Coalesce. “Data teams are struggling to keep up with the demands from the business, and this problem has only continued to grow with the volumes and complexity of data combined with the shortage of skilled people. We are on a mission to radically improve the analytics landscape by making enterprise-scale data transformations as efficient and flexible as possible.’”
Coalesce might be duplicating Oracle and MarkLogic, but if they have discovered a niche market in cloud analytics then they are about to rocket from their stealth. Hopefully the company will solve the transformation problem instead of issuing marketing statements as many other firms do.
Whitney Grace, February 1, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
