Are Smart Meters A Hacker Wonderland?
December 21, 2022
One reason to not upgrade your entire life to the digital cloud is an increased risk of hacking vulnerability. Interior and exterior security cameras, particularly baby monitors, are prone to hacking, but did you ever think smart meters for electricity and heating would be a target? Yahoo News reports that British households are being hacked by energy companies: “Switch By Stealth’: Alarming Rise In Homes With Smart Meters Being Cut Off Remotely.”
Smart meters are digital readers that monitor the amount of electricity a household uses, then sends the information back to the energy company. Smart meters provide energy companies with better information about energy consumption and billing. Smart meters also allow energy companies to remotely switch a customer’s payment method. The payment method is switched from debit payments to an expensive prepayment method.
What is worse is that when all the funds from the prepayment method are used up, the energy company will shut off the energy leaving a household without electricity and heating.
The British government is listening, but not acting quickly enough:
“It comes amid the worsening cost-of-living crisis, with the average yearly energy bill reaching £2,500 in October – a record high, and almost double the price it was last year. And energy bills are set to rise again in April, with estimates the average yearly bill could hit £3,500 per year. Campaigners are urging the government to honour their pledge to uprate benefits with inflation in the autumn statement next week, warning millions of low income households are already being forced into destitution without more support.”
It is understandable energy companies need to earn money to pay their employees, purchase energy, and keep the lights on, but why would they harm their customers? It would not be surprising if some bad actors wearing a white hat hack the smart meters and assist the people about to have their energy cut off.
Whitney Grace, December 21, 2022
Need Holiday Cash? Some Gotchas Exist
December 19, 2022
Perhaps one’s mobile device is not the best place to turn when shopping for a loan. The Dailyhunt shares, “Nearly 300 Predatory Loan Apps Circulating on Google, Apple Stores: Report,” originally published at India.com. The brief write-up cites a recent report from Lookout, stating:
“Nearly 300 loan apps are circulating on Google Play and the Apple App Store that exhibit predatory behaviour, such as exfiltrating excessive user data from mobile devices and harassing borrowers for repayment, a new report has revealed. According to cloud security company Lookout, these loan apps exploit victims’ desire for quick cash to trap borrowers into predatory loan contracts and require them to grant access to sensitive information such as contacts and SMS messages. Some victims have reported that their loans were accompanied by hidden fees, high-interest rates, and repayment terms that were not as favourable as advertised. Lookout also found evidence that data exfiltrated from devices were sometimes used to pressure borrowers for repayment, which is a common threat tactic to disclose a borrower’s debt to their networks. Researchers at Lookout discovered 251 Android apps that had been downloaded over 15 million times. On the Apple App Store, the researchers discovered 35 apps that ranked among the top 100 finance apps in their regional stores.”
High interest rates, hidden fees, and bait-and-switch terms are problematic enough. Stealing personal information for more effective threats and harassment is next-level abuse brought to us by modern technology. It is not as if the companies are unaware there’s a problem. We learn Google recently removed over 2,000 personal loan apps from its Indian Play Store and ordered loan apps in Kenya to submit proof of licensing. It seems, though, more comprehensive measures may be required. Borrower beware.
Cynthia Murrell, December 19, 2022
Using Microsoft? Lucky You in 2023
December 14, 2022
Several days ago, I had a meeting with an executive representing a financial services firm. In the course of confirming the meeting, the person told me, “We use only Microsoft Teams. Our security group has banned our use of Zoom and other video chat services.”
That’s why I found myself sitting at a sticky table in a coffee shop talking with this executive about a notification procedure which caught my attention. In that meeting, I mentioned that for each email sent to my official email by this person I received a notice that the individual was out of the office until mid-September 2022. Since we were meeting in the first week of December 2022, I found the emails from this person confusing.
I asked, “Why are you sending me an email and when I reply, I receive a notification from your corporate email system which tells me you are out of the office until September 2022.”
The response was, “Really? I will get IT to help me.”
Wow. Really.
Many organizations have embraced Microsoft systems and services. My hunch is that people want to use Excel. With full time employees in corporate information technology departments getting crushed by fixes, user issues, and software which does not do what the IT professional expects, companies want an fix.
Enter the cloud, certified consultants who can arrive like Wonder Woman, and big time engineers from a regional office to make everything work. Perfect. What could go wrong?
I read an article which may be accurate or may be presenting an incomplete report. Let’s proceed assuming that there is a kernel of truth in “Ransomware Discovered Carrying Legitimate Windows Certificates.” The write up states:
Cyber security company Sophos has issued a warning over antivirus-nullifying malware it discovered bearing legitimate digital certificates, including signatures from Microsoft’s own digital verification service.
The drivers, found paired with a ‘loader’ executable that was used to install the driver, carried the digital signature of Windows Hardware Compatibility Program (WHCP), and appeared to be specially designed to limit the functions of endpoint detection and response (EDR) security programs. Code signatures are cryptographic certificates that indicate a program has not been altered since its release by its manufacturer. WHCP signatures are only intended to be given to software that Microsoft has checked over and given its personal seal of approval, and therefore seen as trustworthy files to run by Windows systems. Researchers say that the find shows that threat actors are working harder to move up the ‘trust chain’, employing increasingly sophisticated methods to sign malware with legitimate cryptographic signatures so that it can be installed on systems without detection.
The article is in my opinion content marketing; that is, the information is designed to cause someone to license Sophos technology.
The idea is that bad actors can exploit systems and methods set up my Microsoft to make certain their systems are secure. People have struggled with getting Windows to print; others have found that Exchange Server (probably the email system which baffled the financial executive) vulnerabilities have caused some sleepless nights.
Several observations are warranted in my view:
- Microsoft like Google is a Leviathan. It is a target, and is may be that the Softies are in over their heads. Perhaps too big to make secure?
- Users are baffled with fairly simple operations of widely used software. What interesting security issues does this pose? Phishing works for a reason: Users click without th8inking.
- Corporations perceive their decisions to be good ones. The continuing increase in cyber aggression is not something people want to discuss in a meeting of suits, sales professionals, and worker bees.
Net net: Good enough software and systems, PowerPoint presentations from certified partners, and customer cluelessness suggest an exciting 2023. Legitimate Windows Certificates? Oxymoron maybe?
Stephen E Arnold, December 14, 2022
On the Path of a Super App for Crime
December 14, 2022
I know I am in the minority. In fact, I may the only person in Harrod’s Creek, Kentucky, thinking about Telegram and its technical evolution. From a humble private messaging service, Telegram has become the primary mechanism for armchair experts to keep track of Russia’s special operation, send secret messages, and engage in a range of interesting pursuits. Is it possible to promote and sell CSAM via an encrypted messaging app like Telegram? Okay, that’s a good question.
I noted another Telegram innovation which has become public. “No-SIM Signup, Auto-Delete All Chats, Topics 2.0 and More” explains that a person can sign up for the encrypted messaging service without having a SIM card and its pesky identifiers tagging along. To make sure a message about a special interest remains secret, the service allegedly deletes messages on a heartbeat determined by the Telegram user. The Telegram group function makes it possible for those who join a group to discuss a “special” interest to break up a group into sub groups. The idea is that a special interest group has special special interests. I will leave these to your imagination in the event you are wondering where some of the i2p and Tor accessible content has gone in the last few years.
As Telegram approach super app status for certain types of users, keep in mind that even the Telegram emoji have some new tricks. That little pony icon can do much more.
Stephen E Arnold, December 14, 2022
Super Apps: A Useful Discussion
December 7, 2022
Super apps are the equivalent of popping up a level. Think about Microsoft Word. Word became part of Office. Then Office became Office 365 and includes video functions and a number of baby apps like games. (Great for productivity, right?) The idea is that umbrellas are built to make multiple apps into one big, seamless app. The objective is to make life easier, faster, and cheaper. No one says, “Pick any two.” Few raise questions about centralization, monopolization, or termination of innovation.
“Could We Have One App for Everything? We Ask an Expert” does raise a handful of interesting points. Among the topics addressed are [a] Chinese vendors’ interest in super apps, [b] risk of centralization of large amounts of personal data, and [c] the appeal of convenience.
I want to focus on one point in the cited article. The write up quotes Esther Dyson who allegedly said, “The last example of successful convergence was the clock radio. Everything else has been a bad compromise.”
But what’s been lost? The write up does not probe Ms. Dyson’s thought. How about a few ideas?
- Meta plays can generate oodles of cash because the appeal of new, improved, and easy are what some call “thirst traps.” Meta makes the modern world go round because monopolies are good.
- More information means more opportunities to monetize user information. Money is good.
- Super apps facilitate concentration. Concentration means engineering efficiency. Efficiency yields alleged cost savings. Money is good.
Based on my understanding of the meta play benefits, super apps are inevitable. Now think about a Telegram-type service just for cyber crime.
Stephen E Arnold, December 7, 2022
FTX: What Does B Stand For?
December 2, 2022
I am not a krypto kiddie. After the mysterious Nakamoto white paper became available, I made an informed judgment: Bad actors will love this crypto thing. My hunch was correct. The meltdown of a crypto wizard and his merry band of tea totaling worker bees have demonstrated that cyber fraud can be entertaining.
I read “Does B Stand for Bankman-Fried or Bankruptcy?” The write up asks a simple question. I noted this passage from the “real” Silicon Valley write up:
SBF said FTX failed on risk management and he didn’t “knowingly co-mingle funds.”
There you go.
Now what does B stand for? Here are my suggestions:
bamboozle – to rip off, fool, or deceive
bane – a source or ruin, harm, or evil
baseborn – a nice way to question one’s family position in society
bebotherer – one who brings trouble
besotted – drunk and incoherent
bonkers — a few cans short of a six pack
brock—a nasty, little, furred creature
I am leaning toward bamboozle but I think brock has a certain charm. Perhaps a combo; to wit:
The brock bamboozled himself and others.
Close enough for horseshoes as the “we’re not talking” analytics folks like to say among friends at lunch.
Stephen E Arnold, December 2, 2022
Why Did Smart People Fall For The FTX Scam? Uh, Maybe Greed?
November 29, 2022
When we hear how people fall for scams, we tell ourselves that we are too smart and will never become a victim of one. Despite our intelligence, we all become scam victims at some point in our lives. Hopefully, the aftermath is no more devastating than broken pride and a well-learned lesson. Unfortunately, investors in the FTX crypto currency have lost everything like people in the 1930s Depression. The Guardian expresses why FTX lured so many people: “Why Were So Many Smart People So Dumb About FTX? Did They Seriously Just Like Sam Bankman-Fried’s Vibe?”
Area Mahdawi wrote the editorial about crypto currencies and she immediately rips into Sam Bankman-Fried’s unprofessionalism. The FTX inventor played videogames during business meetings. That does not inspire confidence. Large investors threw money at him and he was described as the “next Warren Buffett” and it was believed he could become the world’s first trillionaire.
Behind the proverbial curtain, Bankman-Fried was pulling a typical scam: shifting funds from FTX to his other company, Alameda Research. He then made risky risky trades and lost billions! His net worth fell from $16.2 billion to $3. Bankman-Fried lived a luxurious life a lá Anna Delvey in the Bahamas with his nine employees and they all had various romantic relationships with each other.
Mahdawi thinks people fell for Bankman-Fried for two reasons:
- They didn’t understand what he was selling, so that meant he was a genius.
- They liked his charisma.
Some investors were impressed that Bankman-Fried played videogames during meetings. Why? Maybe he conveyed an autistic savant vibe that appeared he could crunch the numbers and do magic tricks. Mahdawi said this would not have happened to other people, especially women:
“I don’t know about you, but I’m having one of those want-to-tear-my-hair-out-with-frustration moments right now. Can you imagine a woman playing video games in a meeting and being handed billions by investors? That would never happen. Last year, female founders secured only 2% of venture capital in the US and I’ll bet you everything I have that those founders were as buttoned-up as you can get. I’ll bet you they didn’t get a billion dollars because people “just liked their vibe”.”
She’s right, but also wrong. It depends on the person handing out the loans and the office politics. As to why the people invested their money with the scam artist, they wanted to make more money. Chalk it up to simple greed. Greed is good too.
Whitey Grace, November 30, 2022
Europol Take Down Despite a Bad Actor Haven, Encryption, and Modern Business Methods
November 28, 2022
First, Europol and a group of investigators shut down a drug operation. “Operation Desert Light: Europol Take Down Massive Cocaine Super Cartel” reported:
…49 people were arrested across six European countries, the EU’s police agency, Europol, said.
The somewhat terse news story referenced a couple of factoids that I found interesting:
- The article mentioned that there were six senior criminals running the operation. This to me suggests what I call in my lectures to law enforcement and intelligence professionals “industrialized crime.” The idea is that the precepts and methods are ones widely used by successful businesses. Just as the ideas about engineering efficiency and MBA profit maximization have diffused in legitimate enterprises, bad actors have been good students and implementers.
- One bad actor fled Europe and operated from Dubai. Dubai has, for some including this particular bad actor, has become a destination of choice for some pursued by authorities representing other countries. What makes Dubai a possible safe haven? What additional steps are needed to reduce the appeal of Dubai and certain other countries?
- The article mentions “encrypted phones.” In my lectures, I discuss the Teflon effect of secure mobile devices and digital currencies which I describe as Bitcoin or variants.
Net net: More direct action by governments is necessary to [a] speed up investigations and [b] remove barriers to appropriate surveillance by direct and indirect methods. Crime is an emergent feature of online systems and services. To prevent criminal activity from becoming the dominant feature of online, a rethink of systems and methods may provide fruitful.
Just my opinion.
Stephen E Arnold, November 28, 2022
AI: Technology Is Neutral, Right?
November 28, 2022
AI technology can be a boon to many—including cybercriminals. The SmartData Collective describes “3 Ways AI Has Led to Horrifying Cybersecurity Threats.” Writer Alexander Bekker warns:
“The last thing you want is to be hacked by cybercriminals and have your company’s and customers’ data fall into the wrong hands. In order to prevent this from happening, it is important to be aware of any current digital security threats. Sadly, AI technology is only making cybersecurity threats worse than ever. Bob Violino wrote an article in CNBC that said both cybersecurity experts and black hat hackers are using AI technology. However, cybercriminals seem to be benefiting the most from AI, which means that cybersecurity experts need to be more diligent and innovative to use it effectively. With this in mind, let’s start by looking at three of the top current digital threats that are becoming worse due to AI technology, as well as how to prevent them from happening to your company:”
At the top of the list is ransomware, an already robust threat which can be turbocharged with AI automation. Most ransomware attacks begin with phishing emails, so companies must train workers to recognize those tricks. Regular backups will ensure a firm can recover data if someone does slip up. Bekker also mentions credential stuffing, wherein hackers acquire credentials stolen from one company and use them to access another. Machine learning algorithms help criminals make connections between organizations much faster than before. To guard against these attacks, companies should require multi-factor authentication and make sure no one reuses passwords for different websites. This advice brings us to the final culprit, poor cyber hygiene. Some algorithms specialize in pinpointing targets with weak security practices. We are reminded:
“To help improve cyber hygiene, start by requiring two-factor authentication, use a password manager program, and ask that employees not use personal devices for work. Also, to help ensure that hackers will not be able to gain access to usable information, it is important to make sure that your company SSL certificates are current.”
As these bad bots continue to grow more sophisticated, best security practices become even more important. Even if they do not become any less tedious.
Cynthia Murrell, November 28, 2022
Is This FTX Math?
November 21, 2022
I recall hearing or reading that the top dog of Aurora, the FTX affiliated entity, thought that running a crypto outfit required basic math skills. I read “FTX Owes more than $3 Billion to Top 50 Crypto Creditors.” The write up points out:
Roughly 1 million customers unable to withdraw funds from crypto currency exchange
Okay, let’s do some modern day basic math. Follow along:
- 50 kind hearted and understanding creditors
- $3 billion in US dollars or a suitable equivalent like Teslas or designer bags
- One Enron experienced super manager.
Now the math:
50 times $3 billion equals 20 years
I will get a middle school student to check my math. I may be off a few years with the prison sum.
Stephen E Arnold, November 21, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
