Microsoft Causing Problems? Heck, No
July 14, 2023
![Vea4_thumb_thumb_thumb_thumb_thumb_t[1]](http://arnoldit.com/wordpress/wp-content/uploads/2023/07/Vea4_thumb_thumb_thumb_thumb_thumb_t1-27.gif "Vea4_thumb_thumb_thumb_thumb_thumb_t[1]")
Note: This essay is the work of a real and still-alive dinobaby. No smart software involved, just a dumb humanoid.
I cruised through the headlines my smart news system prepared for me. I noted two articles on different subjects. The two write ups were linked with a common point of reference: Microsoft Corp., home of the Softies and the throbbing heart of a significant portion of the technology governments in North America and Western Europe find essential.
“What’s the big deal?” asks Mr. Microsoft. “You have Windows. You have Azure. Software has bugs. Get used to it. You can switch to Linux anytime.” Thin interesting scene is the fruit of MidJourney’s tree of creativity.
The first article appeared in TechRadar. an online real news outfit. The title was compelling; specifically, “Windows 11 Update Is Reportedly Slowing Down PCs and Breaking Internet Connections.” The write up reports:
KB5028185, the ‘Moment 3’ update, is proving seriously problematic for some users … The main bones of contention with patch KB5028185 for Windows 11 22H2 are instances of performance slowdown – with severe cases going by some reports – and problems with flaky internet connections.
The second story appeared on cable “real” news. I tracked down the item titled “US and Microsoft Sound Alarm about China-Based Cybersecurity Threat.” The main idea seems to be:
The U.S. and Microsoft say China-based hackers, focused on espionage, have breached email accounts of about two dozen organizations, including U.S. government agencies.
Interesting. Microsoft seems to face two challenges: Desktop engineering and cloud engineering. The common factor is obviously engineering.
I am delighted that Bing is improving with smart software. I am fascinated by Microsoft’s effort to “win” in online games. However, isn’t it time for something with clout to point out that Microsoft may need to enhance its products’ stability, security, and reliability.
Due to many organizations’ and individuals’ dependence on Microsoft, the company seems to have a knack for creating a range of issues. Will someone step up and direct the engineering in a way that does not increase vulnerability and cause fiduciary loss for its customers?
Anyone? Crickets I fear. Bad actors find Microsoft’s approach more satisfying than a stream of TikTok moments.
Stephen E Arnold, July 14, 2023
Is This for Interns, Contractors, and Others Whom You Trust?
June 14, 2023
![Vea4_thumb_thumb_thumb_thumb_thumb_t[1]_thumb_thumb](http://arnoldit.com/wordpress/wp-content/uploads/2023/06/Vea4_thumb_thumb_thumb_thumb_thumb_t1_thumb_thumb-6.gif "Vea4_thumb_thumb_thumb_thumb_thumb_t[1]_thumb_thumb")
Note: This essay is the work of a real and still-alive dinobaby. No smart software involved, just a dumb humanoid.
Not too far from where my office is located, an esteemed health care institution is in its second month of a slight glitch. The word in Harrod’s Creek is that security methods at use at a major hospital were — how shall I frame this — a bit like the 2022-2023 University of Kentucky’s’ basketball team’s defense. In Harrod’s Creek lingo, this statement would translate to standard English as “them ‘Cats did truly suck.”
A young temporary worker looks at her boss. She says, “Yes, I plugged a USB drive into this computer because I need to move your PowerPoint to a different machine to complete the presentation.” The boss says, “Okay, you can use the desktop in my office. I have to go to a cyber security meeting. See you after lunch. Text me if you need a password to something.” The illustration for this hypothetical conversation emerged from the fountain of innovation known as MidJourney.
The chatter about assorted Federal agencies’ cyber personnel meeting with the institution’s own cyber experts are flitting around. When multiple Federal entities park their unobtrusive and sometimes large black SUVs close to the main entrance, someone is likely to notice.
This short blog post, however, is not about the lame duck cyber security at the health care facility. (I would add an anecdote about an experience I had in 2022. I showed up for a check up at a unit of the health care facility. Upon arriving, I pronounced my date of birth and my name. The professional on duty said, “We have an appointment for your wife and we have her medical records.” Well, that was a trivial administrative error: Wrong patient, confidential information shipped to another facility, and zero idea how that could happen. I made the appointment myself and provided the required information. That’s a great computer systems and super duper security in my book.)
The question at hand, however, is: “How can a profitable, marketing oriented, big time in their mind health care outfit, suffer a catastrophic security breach?”
I shall point you to one possible pathway: Temporary workers, interns, and contractors. I will not mention other types of insiders.
Please, point your browser to Hak5.org and read about the USB Rubber Ducky. With a starting price of $80US, this USB stick has some functions which can accomplish some interesting actions. The marketing collateral explains:
Computers trust humans. Humans use keyboards. Hence the universal spec — HID, or Human Interface Device. A keyboard presents itself as a HID, and in turn it’s inherently trusted as human by the computer. The USB Rubber Ducky — which looks like an innocent flash drive to humans — abuses this trust to deliver powerful payloads, injecting keystrokes at superhuman speeds.
With the USB Rubby Ducky, one can:
- Install backdoors
- Covertly exfiltrate documents
- Capture credential
- Execute compound actions.
Plus, if there is a USB port, the Rubber Ducky will work.
I mention this device because it may not too difficult for a bad actor to find ways into certain types of super duper cyber secure networks. Plus temporary workers and even interns welcome a coffee in an organization’s cafeteria or a nearby coffee shop. Kick in a donut and a smile and someone may plug the drive in for free!
Stephen E Arnold, June 14, 2023
AI Allegedly Doing Its Thing: Let Fake News Fly Free
June 2, 2023
![Vea4_thumb_thumb_thumb_thumb_thumb_t[1]](http://arnoldit.com/wordpress/wp-content/uploads/2023/06/Vea4_thumb_thumb_thumb_thumb_thumb_t1-2.gif "Vea4_thumb_thumb_thumb_thumb_thumb_t[1]")
Note: This essay is the work of a real and still-alive dinobaby. No smart software involved, just a dumb humanoid.
I cannot resist this short item about the smart software. Stories has appeared in my newsfeeds about AI which allegedly concluded that to complete its mission, it had to remove an obstacle — the human operator.
A number of news sources reported as actual factual that a human operator of a smart weapon system was annoying the smart software. The smart software decided that the humanoid was causing a mission to fail. The smart software concluded that the humanoid had to be killed so the smart software could go kill more humanoids.
I collect examples of thought provoking fake news. It’s my new hobby and provides useful material for my “OSINT Blindspots” lectures. (The next big one will be in October 2023 after I return from Europe in late September 2023.)
However, the write up “US Air Force Denies AI Drone Attacked Operator in Test” presents a different angle on the story about evil software. I noted this passage from an informed observer:
Steve Wright, professor of aerospace engineering at the University of the West of England, and an expert in unmanned aerial vehicles, told me jokingly that he had “always been a fan of the Terminator films” when I asked him for his thoughts about the story. “In aircraft control computers there are two things to worry about: ‘do the right thing’ and ‘don’t do the wrong thing’, so this is a classic example of the second,” he said. “In reality we address this by always including a second computer that has been programmed using old-style techniques, and this can pull the plug as soon as the first one does something strange.”
Now the question: Did smart software do the right thing. Did it go after its humanoid partner? In a hypothetical discussion perhaps? In real life, nope. My hunch is that the US Air Force anecdote is anchored in confusing “what if” thinking with reality. That’s easy for some younger than me to do in my experience.
I want to point out that in August 2020, a Heron Systems’ AI (based on Google technology) killed an Air Force “top gun” in a simulated aerial dog fight. How long did it take the smart software to neutralize the annoying humanoid? About a minute, maybe a minute and a half. See this Janes new item for more information.
My view is that smart software has some interesting capabilities. One scenario of interest to me is a hacked AI-infused weapons system? Pondering this idea opens the door some some intriguing “what if” scenarios.
Stephen E Arnold, June 2, 2023
NSO Group: How Easy Are Mobile Hacks?
April 25, 2023
I am at the 2023 US National Cyber Crime Conference, and I have been asked, “What companies offer NSO-type mobile phone capabilities?” My answer is, “Quite a few.” Will I name these companies in a free blog post? Sure, just call us at 1-800-YOU-WISH.
A more interesting question is, “Why is Israel-based NSO Group the pointy end of a three meter stick aimed at mobile devices?” (To get some public information about newly recognized NSO Group (Pegasus) tricks, navigate to “Triple Threat. NSO Group’s Pegasus Spyware Returns in 2022 with a Trio of iOS 15 and iOS 16 Zero-Click Exploit Chains.” I would point out that the reference to Access Now is interesting, and a crime analyst may find a few minutes examining what the organization does, its “meetings,” and its hosting services time well spent. Will I provide that information in a free blog post. Please, call the 800 number listed above.)
Now let’s consider the question regarding the productivity of the NSO technical team.
First, Israel’s defense establishment contains many bright people and a world-class training program. What happens when you take well educated people, the threat of war without warning, and an outstanding in-service instructional set up? The answer is, “Ideas get converted into exercises. Exercises become test code. Test code gets revised. And the functional software becomes weaponized.”
Second, the “in our foxhole” mentality extends once trained military specialists leave the formal service and enter the commercial world. As a result, individuals who studied, worked, and in some cases, fought together set up companies. These individuals are a bit like beavers. Beavers do what beavers do. Some of these firms replicate functionality similar to that developed under the government’s watch and sell those products. Please, note, that NSO Group is an exception of sorts. Some of the “insights” originated when the founders were repairing mobile phones. The idea, however, is the same. Learning, testing, deploying, and the hiring individuals with specialized training by the Israeli government. Keep in mind the “in my foxhole” notion, please.
Third, directly or indirectly important firms in Israel or, in some cases, government-assisted development programs provide: [a] Money, [b] meet up opportunities like “tech fests” in Tel Aviv, and [c] suggestions about whom to hire, partner with, consult with, or be aware of.
Do these conditions exist in other countries? In my experience, to some degree this approach to mobile technology exploits does. There are important differences. If you want to know what these are, you know the answer. Buzz that 800 number.
My point is that the expertise, insights, systems, and methods of what the media calls “the NSO Group” have diffused. As a result, there are more choices than ever before when it comes to exploiting mobile devices.
Where’s Apple? Where’s Google? Where’s Samsung? The firms, in my opinion, are in reactive mode, and, in some cases, they don’t know what they don’t know.
Stephen E Arnold, April 25, 2023
Has the Interior Magic of Cyber Security Professionals Been Revealed?
April 14, 2023
Note: This essay is the work of a real and still-alive dinobaby. No smart software involved, just a dumb humanoid.
The idea of “real” secrets is an interesting one. Like much of life today, “real” and “secret” depend on the individual. Observation changes reality; therefore, information is malleable too. I wonder if this sounds too post-Heisenberg for a blog post by a dinobaby? The answer is, “Yes.” However, I don’t care, particularly after reading “40% of IT Security Pros Say They’ve Been Told Not to Report a Data Leak.”
The write up states:
According to responses from large companies in the US, EU, and Britain, half of organizations have experienced a data leak in the past year with America faring the worst: three quarters of respondents from that side of the pond said they experienced an intrusion of some kind. To further complicate matters, 40 percent of IT infosec folk polled said they were told to not report security incidents, and that climbs to 70.7 percent in the US, far higher than any other country.
After reading the article, I thought about the “interior character” of the individuals who cover up cyber security weaknesses. My initial reaction is that individuals are concerned about their own aura of “excellence.” Money, the position each holds, the perception of others via a LinkedIn profile — The fact of the breach is secondary to this other, more important consideration. Upon reflection, the failure to talk about flaws may be a desire to prevent miscreants from exploiting what is a factual condition: Lousy cyber security.
What about those marketing assurances from cyber security companies? What about the government oversight groups who are riding herd on appropriate cyber security actions and activities?
Perhaps the marketing is better than the policies, procedures, software, and people involved in protecting information and systems from bad actors?
Stephen E Arnold, April 14, 2023
Cyber Security: A Modest Reminder about Reality
April 11, 2023
Note: This essay is the work of a real and still-alive dinobaby. No smart software involved, just a dumb humanoid.
If I participated in every webinar to which I am invited, I would have no time for eating, sleeping, and showing up at the gym to pretend I am working out like a scholarship chasing football player. I like the food and snooze stuff. The gym? Yeah, it is better than a visit to my “real” doctor. (Mine has comic book art on the walls of the office. No diplomas. Did I tell you I live in rural Kentucky, where comic books are considered literature.)
I read what to me was a grim article titled “Classified US Documents on Ukraine War Leaked: Report.” The publisher was Al Jazeera, and I suppose the editor could have slapped a more tantalizing title and subtitle on the article. (The information, according to Al Jazeera first appeared in the New York Times. Okay, I won’t comment on this factoid.)
Here’s the paragraph which caught my attention:
There was no explanation as to how the plans were obtained.
Two points come to my mind:
- Smart software and analytic tools appear to be unable to pinpoint the who, when, and where the documents originated. Some vendors make assertions that their real time systems can deliver this type of information. Maybe? But maybe not?
- The Fancy Dan cyber tools whether infused with Bayesian goodness or just recycled machine learning are not helping out with the questions about who, what, and where either.
If the information emerges in the near future, I will be pleased. My hunch is that cyber is a magic word for marketers and individuals looking for a high-pay, red-hot career.
The reality is that either disinformation or insiders make these cyber marketing assertions ring like a bell made of depleted uranium.
Stephen E Arnold, April 11, 2023
Google Goofs: Believing in the Myth of Googzilla and the Digital Delphi
March 27, 2023
I used the word “Googzilla” to help describe the digital Delphi located near what used to be Farmer’s Field. When I began work on “The Google Legacy” in 2002, it was evident to me and my research team that Google was doing the Silicon Valley hockey stick thing; that is, slow initial start, some desperation until the moment of insight about GoTo-Overture’s pay-to-play model, and a historical moment: Big growth and oodles of cash.
By 2002, the initial dorm cluelessness about how to raise money was dissipating, and the company started believing its own mythology. The digital Delphi had the answers to questions. Google knew how to engineer for success. Googlers were wizards, alcolytes of the digital Delphi itself. To enter the shrine the acolyte wizard-to-be had to do well in interviews, know about the comical GLAT or Google Labs Aptitude Test, or just know someone like Messrs. Brin and Page or a cluster of former Alta Vista computer types. A good word from Jeff Dean was a super positive in the wizardly walk to understanding.
What couldn’t Google do? Well, keep senior executives from dallying in the legal department and dying on yachts with specialized contractors to name two things. Now I would like to suggest another weakness: Security.
In a way, it is sad that Google acts as if it knows what it is doing and reality discloses some warts, flaws, bunions, and varicose veins. Poor, poor Googzilla 2023.
In September 2022, Google bought Mandiant, a darling of the cyber security community. The company brought its consulting, security, and incident response expertise to Google. The Google Cloud would be better. I think Google believed their own publicity. But believing and doing something other than selling ads and getting paid by any party to the transaction is different. It pains me to point out that despite craziness like “solving death,” “Loon balloons,” and more investment plays than I can count, the Google is about online ads. What about security?
Here’s an example.
I watched a painful video by a Canadian who makes high treble, jarring videos about technology. The video explains that his video channels were hacked and replaced by a smiling Elon and crypto baloney. You can watch the explanation at this link. And, yes, it has YouTube ads. For more information, navigate to “Linus Tech Tips Main YouTube Channel Hacked.”
I have one question: Google, is your security in line with your marketing collateral? Mandiant plus Google? Doesn’t that keep YouTube videos from being hijacked? Nope. The influential Linus and his sorrowful video makes clear that not even YouTube stars can relax knowing Google Mandiant et al are on the job.
Has the digital Delphi’s acolytes explained the issue? Has the security thing been remediated? What about Google Cloud backups? What about fail safe engineering? So many questions for the folks growing stunted oranges in Farmer’s Field. I want to believe in the myth of the once-indomitable Google. Now Googzilla could lose a claw in a harvesting machine. Even with a limp, Googzilla can sell ads like a champ. Is it enough? Not for some, I fear.
Stephen E Arnold, March 27, 2023
DarkTrace: A Cyber Security Star Makes an Analyst Bayes at the Moon
March 10, 2023
DarkTrace is a cyber security firm which used Sir Thomas Bayes’s math to thwart bad actors. “Fresh Clouds for Darktrace as New York Hedge Fund Claims Concerns Borne Out” states:
Quintessential Capital Management, which previously expressed its “fear that sales, margins, and growth rates may be overstated” today said: “Darktrace’s recent financial results are consistent with our thesis: growth, new customers, cash generation and profits are all shrinking fast.
Bayes works for some types of predictive applications. I think the disconnect between the technical methods of DarkTrace and the skeptical venture firm may be related to the distance between what smart software can do and what marketers say the smart software does. In that space are perched investors, stakeholders, employees, and customers.
What has caused a market downturn? The article says that it may be a consequence of ChatGPT? Here’s a statement I noted:
The cybersecurity business said ChatGPT “ may have helped increase the sophistication of phishing emails, enabling adversaries to create more targeted, personalized, and ultimately, successful attacks.” “Darktrace has found that while the number of email attacks across its own customer base remained steady since ChatGPT’s release, those that rely on tricking victims into clicking malicious links have declined, while linguistic complexity, including text volume, punctuation, and sentence length among others, have increased, the firm said.
Is this a case of DarkTrace’s smart software being outfoxed by smarter software? I still believe the marketers bear the responsibility. Knowing exactly how DarkTrace works and the specific results the system can deliver is important. Marketers rarely share my bias. Now the claims of the collateral writers are insufficiently robust to support the skepticism of tweeting analysts at Quintessential Capital Management.
Stephen E Arnold, March 10. 2023
Microsoft Security and the Azure Cloud: Good Enough?
January 27, 2023
I don’t know anything about the cyber security firm called Silverfort. The company’s Web site makes it clear that the company’s management likes moving icons and Microsoft. Nevertheless, “Microsoft Azure-Based Kerberos Attacks Crack Open Cloud Accounts” points out some alleged vulnerabilities in what Microsoft has positioned as its present and future money machine. The article says:
Silverfort disclosed the issues to Microsoft, and while the company is aware of the weaknesses, it does not plan to fix them, because they are not “traditional” vulnerabilities, Segal says. Microsoft also confirmed that the company does not consider them vulnerabilities. “This technique is not a vulnerability, and to be used successfully a potential attacker would need elevated or administrative rights that grant access to the storage account data,” a Microsoft spokesperson tells Dark Reading [the online service publishing the report].
So a nothingburger (wow, I detest that trendy jargon). I would view Microsoft’s product with a somewhat skeptical eye. Bad actors show some fondness for Microsoft’s approach to engineering.
Shift gears, the article “Microsoft Is Beating Google at Its Own Game.” I thought, “Advertising.” The write up has a different angle:
Following the news of Microsoft’s $10 billion investment, Wedbush analyst Daniel Ives wrote that ChatGPT is a “potential game changer” for Microsoft, and that the company was “not going to repeat the same mistakes” of missing out on social and mobile that it made two decades ago. Microsoft “is clearly being aggressive on this front and not going to be left behind,” Ives wrote.
Yep, smart software. I think the idea is that using OpenAI as a springboard, Microsoft will leapfrog into high clover. The announcement of Microsoft’s investment in OpenAI provides compute resources. If the bet pays off, Microsoft will get real money.
However, what happens when Microsoft’s “good enough” engineering meets OpenAI.
You may disagree, but I think the security vulnerabilities will continue to exist. Furthermore, it is impossible to know what issues will arise when smart software begins to think for Microsoft systems and users.
Security is a cat-and-mouse game. How quickly will bad actors integrate smart software into malware? How easy will it be for smart software to trawl through technical documents looking for interesting information?
The integration of OpenAI into Microsoft systems, services, and software may require more than “good enough” engineering. Now tell me again why I cannot print after updating Windows 11? Exactly what is Google’s game? Excitement about what people believe is the next big thing is one thing. Ignoring some here-and-now issues may be another.
Stephen E Arnold, January 27, 2023
Cyber Security: Is It Time for a Brazen Bull?
December 28, 2022
The cyber security industry has weathered Covid, mergers, acquisitions, system failures, and — excuse the lousy pun — solar winds. The flow of exploits with increasingly poetic names continues; for example, Azov, Zerobot, Killnet, etc. However, the cyber defense systems suffer from what one might call a slight misalignment. Bad actors find ways to compromise [a] humans to get user names and passwords, [b] exploit what is now the industry standard for excellence (MVP or minimal viable product, good enough engineering, and close-enough-for-horseshows technology), any gizmo or process connected to something connected to a public-facing network. The list of “bad” actors is a lengthy one. It includes bird-owning individuals in the UK, assorted government agencies hostile to the US, students in computer science class or hanging out in a coffee shop, and double agents with computing know how.
To add to the pain of cyber security, there are organizations which do great marketing but less great systems. “What’s in a PR Statement: LastPass Breach Explained” discusses a serious problem which underscores a number of issues.
LastPass is a product with a past reaching backwards more than a decade. The software made it easier for a user to keep track of what user name and password was whipped up to log into an online service or software. Over the years, PC Magazine found the password manager excellent. (Software can be excellent? Who knew?) Wikipedia has a list of “issues” the security software faced over the years. You can find that information here. More amusing is security expert Steve Gibson’s positive review of LastPass. Should you have the time, you can read about that expert’s conclusions in 2010 here.
But what does the PR statement article say? Here are a couple of snippets from the cited December 26, 2022, essay:
Snippet 1: Right before the holiday season, LastPass published an update on their breach. As people have speculated, this timing was likely not coincidental but rather intentional to keep the news coverage low. …Their statement is also full of omissions, half-truths and outright lies.
Harsh.
Snippet 2: Again, it seems that LastPass attempts to minimize the risk of litigation (hence alerting businesses) while also trying to prevent a public outcry (so not notifying the general public). Priorities…
My take on LastPass is that the company is doing what other cyber security firms do: Manage information about problems.
Let’s talk about cyber security on a larger stage. How does a global scale sound?
First, security is defined by [a] what bad actors have been discovered to do and [b] marketing. A breach occurs. A fix — ideally one enabled by artificial intelligence and chock full of predictive analytics — is created and marketed. Does the fix work? How about those Exchange Server exploits or those 24×7 phishing attacks? The point for me is that cyber security seems to be reactive; that is, dictated by what bad actors do.
Second, the “fix” is verified by whom and what? In the US there are Federal cyber groups. There are state cyber groups. There are cyber associations. There are specialty labs in fun places like Quantico. For a LastPass incident, which cowpoke moves the cow along? The point: Bureaucracy, friction, artificial barriers, time, expertise, money, and more.
Third, technical layoffs and time mean that cyber crime may be an attractive business opportunity for some.
Considering these three points, I want to hazard several observations:
- Cyber security may be an oxymoron
- Bad actors have the advantages granted by good enough software and systems, tools, talent, and time
- Users and customers who purchase security may be faced with a continual flow of surprises
What’s the fix? May I suggest that we consider bringing back the Bull of Phalaris aka the brazen bull.
The “bull” is fabricated of a suitable metal; for example, bronze. The inside of the bull is hollow. A trapdoor allows access to the interior space. When the trapdoor is closed, there is an opening from the interior to the bull’s nose. The malefactor — let’s say a venture firm’s managing director who is rolling up cyber security companies with flawed software — is placed inside the bull. A fire is built beneath the bull and the shouts and possible other noises are emitted from the opening in the bull’s head.
The use of the brazen bull for software developers pumping out “good enough” cyber security solutions can be an option as well. Once law enforcement snags the head of a notorious hacking gang, the bull will be pressed into duty. Keep in mind that Microsoft blamed 1,000 cyber warriors working in a country hostile to the US for the SolarWinds’ misstep. This would necessitate more bulls which would provide meaningful work to some.
I would advocate that marketer types who sell cyber security systems which don’t work be included in the list of individuals who can experience the thrill of the brazen bull.
My thought is that the use of the brazen bull with clips released as short videos would capture some attention.
What’s is going on now is not getting through? More robust measures are necessary. No bull.
Stephen E Arnold, December 28, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
