Centennial Man: 2017-10-22

Saturday, October 28, 2017

For your consideration.

How Government Propaganda Is Undermining Your Online Security

… When we hear the term propaganda, it often conjures images of manipulative politicians aiming to control us. However, the origin of the term comes from the Catholic church, when in 1622 they created the Congregatio de Propaganda Fide (or Congregation for Propagating the Faith). Propaganda is a means of spreading a message, but by its very nature it is trying to influence you and is biased towards a particular viewpoint.

… The internet ... removed the prohibitive cost barriers to entry that many would have faced when hoping to spread their ideas. In effect, the internet gave everyone a mouthpiece. Almost overnight, anyone could set up a Geocities page and put their thoughts in writing for people across the world to read instantaneously.

… In a world where the President of the United States conducts his affairs via Twitter, it’s easy to see that the digital has a real world impact. The last few Presidential elections have been won not on front lawns but online — through social media, and advertising alongside traditional media. Grassroots campaigns and online activism have also contributed to the politicisation of the internet. In 2010, the Arab Spring demonstrated just how much impact the digital world could have on politics.

(Related). A TED talk.

We're building a dystopia just to make people click on ads | Zeynep Tufekci

We're building an artificial intelligence-powered dystopia, one click at a time, says technosociologist Zeynep Tufecki. In an eye-opening talk, she details how the same algorithms companies like Facebook, Google and Amazon use to get you to click on ads are also used to organize your access to political and social information. And the machines aren't even the real threat. What we need to understand is how the powerful might use AI to control us -- and what we can do in response.

I’ve been recommending this for years!

https://hothardware.com/news/san-francisco-seattle-citywide-fiber-internet-networks-to-bury-cable-monopolies

San Francisco, Seattle Planning To Launch Citywide Fiber Networks To Bury Telecom Monopolies

When you think of the availability of high-speed internet access in the United States, not many people have a wide range of options to choose from. You might have one large cable provider (i.e. Comcast, Charter) to choose from, and if you're lucky (if you can call it that) a second-tier option like AT&T DSL. Customers would like choice when it comes to internet service providers, but big telecoms coupled with local and state governments often get in the way of those aspirations.

Seattle mayoral candidate Cary Moon is pushing hard for municipal internet as part of her campaign platform, and she wants equal access for residents (treating it as another public utility like power or water).

… “Municipal broadband is one of those issues where we know the right thing to do and we keep not doing it because of power and money,” Moon added

… Not surprisingly, telecom companies are not thrilled about the potential for a kumbaya moment with respect to municipal internet. In fact, telecom companies including Comcast and CenturyLink have funneled $50,000 in campaign contributions to Moon's opponent, Jenny Durkan, for the mayoral seat.

Any dynamic field could use this technique. Is there also a way to automatically pull new information into an online repository?

https://hbr.org/2017/10/surgeons-are-using-social-media-to-share-and-learn-new-skills

Surgeons Are Using Social Media to Share and Learn New Skills

Government is becoming opaque. You don’t have to explain, defend, discuss, or even pretend to know about things that are not published?

https://fivethirtyeight.com/features/the-first-fbi-crime-report-issued-under-trump-is-missing-a-ton-of-info/

The First FBI Crime Report Issued Under Trump Is Missing A Ton Of Info

… according to an analysis by FiveThirtyEight, the 2016 Crime in the United States report — the first released under President Trump’s administration — contains close to 70 percent fewer data tables1 than the 2015 version did, a removal that could affect analysts’ understanding of crime trends in the country.

Perspective.

https://www.theverge.com/2017/10/27/16550640/verge-tech-survey-amazon-facebook-google-twitter-popularity

The Verge Tech Survey

… This survey, conducted from September 28th to October 10th, included 1,520 people nationally representative of the US, based on 2016 US Census estimates. The margin of error is ±3 percent, with a confidence level of 95 percent.

The findings are fascinating: respondents trusted Facebook less than Google, and “trust” was a primary factor for individuals who abstained from using Facebook overall. Respondents trusted Amazon almost as much as their own bank. Of all the companies named in our survey, respondents were most likely to recommend services from Amazon to their family and friends. Twitter sits on the opposite side of the spectrum: a quarter of respondents said they are probably, or not at all likely, to recommend the service.

Perspective. Some interesting quotes…

http://knowledge.wharton.upenn.edu/article/whats-behind-the-hype-about-artificial-intelligence-separating-myth-from-reality/

What’s Behind the Hype About Artificial Intelligence?

… now computers are able to transcribe human speech better than humans.

… It is natural for people to project the recent successes in specific domains into the future. Some are even projecting the present into domains where deep learning has not been very effective, and that creates a lot of misconception and also hype. AI is still pretty bad in how it learns new concepts and extending that learning to new contexts.

Suspicions confirmed.

http://knowledge.wharton.upenn.edu/article/economics-technical-labor-markets/

Does Investing in Cutting-edge Tech Attract Better Workers?

… One of the findings in that paper is that firms on the frontier that are trying to attract developers who are really interested in learning the newest technologies tend to compete not just on wages but also on the kinds of technologies they offer and allow these workers to work with. We know that workers come in, work with these new technologies and learn something. That’s valuable because they can go to their next job and take those skills with them. So, firms that want to attract workers who really are on the frontier of new technologies have to offer an environment and not just a good job in the traditional sense in terms of benefits and wages, but also a work context in which they can really learn about new technologies and ramp up their skills.

An Infographic.

http://www.smartinsights.com/internet-marketing-statistics/happens-online-60-seconds/attachment/what-happens-online-in-60-seconds/

What happens online in 60 seconds

Friday, October 27, 2017

I keep repeating this to my Computer Security students: Most breaches are due to a simple failure.

https://motherboard.vice.com/en_us/article/ne3bv7/equifax-breach-social-security-numbers-researcher-warning

Equifax Was Warned

Months before its catastrophic data breach, a security researcher warned Equifax that it was vulnerable to the kind of attack that later compromised the personal data of more than 145 million Americans, Motherboard has learned. Six months after the researcher first notified the company about the vulnerability, Equifax patched it—but only after the massive breach that made headlines had already taken place, according to Equifax's own timeline.

As an Auditor, these reports always catch my eye.

https://www.nao.org.uk/report/investigation-wannacry-cyber-attack-and-the-nhs/

Investigation: WannaCry cyber attack and the NHS

“The WannaCry cyber attack had potentially serious implications for the NHS and its ability to provide care to patients. It was a relatively unsophisticated attack and could have been prevented by the NHS following basic IT security best practice. There are more sophisticated cyber threats out there than WannaCry so the Department and the NHS need to get their act together to ensure the NHS is better protected against future attacks.”

Amyas Morse, head of the National Audit Office, 27 October 2017

Gee, It’s not always the Russians?

https://www.bespacific.com/technology-firms-shape-political-communication-the-work-of-microsoft-facebook-twitter-and-google-with-campaigns-during-the-2016-u-s-presidential-cycle/

Technology Firms Shape Political Communication: The Work of Microsoft, Facebook, Twitter, and Google With Campaigns During the 2016 U.S. Presidential Cycle

by Sabrina I. Pacifici on Oct 26, 2017

Technology Firms Shape Political Communication: The Work of Microsoft, Facebook, Twitter, and Google With Campaigns During the 2016 U.S. Presidential Cycle. Daniel Kreiss & SHANNON C. MCGREGOR. Journal of Political Communication. Pages 1-23 | Published online: 26 Oct 2017. http://dx.doi.org/10.1080/10584609.2017.1364814.

“This article offers the first analysis of the role that technology companies, specifically Facebook, Twitter, Microsoft, and Google, play in shaping the political communication of electoral campaigns in the United States. We offer an empirical analysis of the work technology firms do around electoral politics through interviews with staffers at these firms and digital and social media directors of 2016 U.S. presidential primary and general election campaigns, in addition to field observations at the 2016 Democratic National Convention. We find that technology firms are motivated to work in the political space for marketing, advertising revenue, and relationship-building in the service of lobbying efforts. To facilitate this, these firms have developed organizational structures and staffing patterns that accord with the partisan nature of American politics. Furthermore, Facebook, Twitter, and Google go beyond promoting their services and facilitating digital advertising buys, actively shaping campaign communication through their close collaboration with political staffers. We show how representatives at these firms serve as quasi-digital consultants to campaigns, shaping digital strategy, content, and execution. Given this, we argue that political communication scholars need to consider social media firms as more active agents in political processes than previously appreciated in the literature.”

Perspective.

https://techcrunch.com/2017/10/27/india-second-largest-smartphone-market/

India overtakes the US to become the world’s second largest smartphone market

Move over America, India is now the world’s second largest smartphone market.

That’s according to a new report from Canalys which claims smartphone shipments in India crossed the 40 million mark for the first time in Q3 2017 courtesy of 23 percent annual growth. That means that India has overtaken the U.S. on sales with only China ahead of it.

Perspective. Soon, everyone will work for Jeff Bezos.

https://www.geekwire.com/2017/amazon-tops-500k-employees-swallowing-whole-foods-13-7b-deal/

Amazon tops 540K employees after swallowing Whole Foods in $13.7B deal

I wish I could spell chutzpah.

Hacker Wants $50K From Hacker Forum or He’ll Share Stolen Database With the Feds

Catalin Cimpanu reports:

Extortion can also be funny when it happens to the bad guys, and there’s one extortion attempt going on right now that will put a big smile on your face.

The victim is Basetools.ws, an underground hacking forum that allows users to trade stolen credit card information, profile data, and spamming tools. The site boasts to have over 150,000 users and over 20,000 tools listed in its forums.

Thursday, October 26, 2017

Hacker Economics: As the ratio of Supply to Demand increases, prices fall.

Dark web vendors are selling remote access to corporate PCs for as little as $3

Danny Palmer reports:

Dark Web marketplaces are selling remote access to desktop PCs for as little as $3, allowing criminals to spy on firms without resorting to malware.

[…]

One of the most popular underground stores selling access is ‘Ultimate Anonymity Services’. Founded in early 2016, UAS offers over 35,000 RDP credentials for sale in a variety of countries and for a variety of Windows operating systems, from Windows XP to Windows 10.

Wednesday, October 25, 2017

Here we go again.

http://www.firstpost.com/tech/news-analysis/cyber-attack-using-malware-badrabbit-hit-russia-ukraine-bulgaria-turkey-and-japan-4173071.html

Cyber attack using malware 'BadRabbit' hit Russia, Ukraine, Bulgaria, Turkey and Japan

Cyber attacks using malware called “BadRabbit” hit Russia and other nations on Tuesday, affecting Russian Interfax news agency and causing flight delays at Ukraine’s Odessa airport.

… The attacks are disturbing because attackers quickly infected critical infrastructure, including transportation operators, indicating it was a “well-coordinated” campaign, said Robert Lipovsky, a researcher with cyber firm ESET.

More than half the victims were in Russia, followed by Ukraine, Bulgaria, Turkey and Japan, according to ESET.

The FBI’s 2 page Ransomware Brochure: https://www.ic3.gov/media/Ransomware_Trifold_e-version.pdf

Bad Rabbit Ransomware Sweeps Across Europe And Russia Infecting Media Outlets, Airports

… Kaspersky's Alex Perekalin writes, "According to our findings, the attack doesn’t use exploits. It is a drive-by attack: Victims download a fake Adobe Flash installer from infected websites and manually launch the .exe file, thus infecting themselves.

Protecting corporate secrets: perhaps you should not tell the CEO what R&D is working on?

http://www.securityweek.com/thirty-percent-ceo-email-accounts-exposed-breaches-study

Thirty Percent of CEO Email Accounts Exposed in Breaches: Study

Thirty percent of CEOs from the world's largest organizations have had their company email address and password stolen from a breached service. Given the continuing tendency for users to employ simple passwords and reuse the same passwords across multiple accounts, the implication is that at least some of these CEOs are at risk of losing their email accounts to cyber criminals or foreign nation state hacking groups.

The statistic comes from a report (PDF) published today by F-Secure, whose researchers checked the email addresses of 200 CEOs from the world's largest organizations against a database of leaked credentials. It notes that the 30% figure increases to 63% for tech companies.

Didn’t we recently have another breach on lawyers in a tax haven? You don’t suppose the IRS has a team of hackers, do you? We’ll know if they offer an ‘amnesty.’

Bermuda cyber hack: Offshore law firm data hack leaves super-rich bracing for their financial details to be leaked

Ryan Wilkinson reports:

A leading offshore law firm with clients including the super-rich and international corporations has revealed it suffered a “data security incident” that may result in customers’ private information being leaked.

Bermuda-based Appleby, which has offices in a number of British overseas territories, said some of its data had been “compromised” in the 2016 cyber incident.

The firm issued a statement after it was contacted by a group of investigative journalists probing allegations concerning its “business and the business conducted by some of our clients”.

Tuesday, October 24, 2017

Fishing matches the fly to what the fish are biting. Phishing matches the lure the same way.

http://www.securityweek.com/russian-spies-lure-targets-nato-cybersecurity-conference

Russian Spies Lure Targets With NATO Cybersecurity Conference

A cyber espionage group linked to Russia has been trying to deliver malware to targeted individuals using documents referencing a NATO cybersecurity conference, Cisco’s Talos research team reported on Monday.

… The campaign was apparently aimed at individuals interested in the CyCon U.S. conference organized by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in collaboration with the Army Cyber Institute at West Point on November 7-8 in Washington, D.C. The hackers created malicious documents with information that was copied from the official CyCon U.S. website.

The topic used as bait in this attack suggests that the threat actor targeted individuals with an interest in cyber security.

Tales of future greed?

http://www.bbc.com/news/technology-41733119

Facebook's News Feed experiment panics publishers

So, an experiment under way in a few countries, where the social media giant appears to be making it harder for users to see news stories, has caused something akin to panic.

The new feature Facebook is trying out is called Explore. It offers all sorts of stories it thinks might interest you, a separate news feed encouraging you to look further afield than just at what your friends are sharing.

Meanwhile, for most people, the standard News Feed remains the usual mixture of baby photos and posts from companies or media organisations whose pages you have liked.

Sounds fine, doesn't it? Except that in six countries - Sri Lanka, Bolivia, Slovakia, Serbia, Guatemala, and Cambodia - the experiment went further.

For users there, the main News Feed was cleared of everything but the usual stuff from your friends and sponsored posts – in other words, if you wanted to have your material seen in the place most users spend their time you had to pay for the privilege.

In a Medium post entitled "Biggest drop in organic reach we've ever seen", a Slovakian journalist Filip Struharik documented the impact. Publishers in his country had seen four times fewer interactions since the change, he said – what had become a vital and vibrant platform for them was emptying out fast.

How to analyze a Tweet?

https://fivethirtyeight.com/features/the-worst-tweeter-in-politics-isnt-trump/

The Worst Tweeter In Politics Isn’t Trump

So we should be learning more about government data requests?

https://venturebeat.com/2017/10/24/microsoft-drops-lawsuit-after-doj-revises-data-request-transparency-rules/?google_editors_picks=true

Microsoft drops lawsuit after U.S. government revises data request transparency rules

Microsoft said it will drop a lawsuit against the U.S. government after the Department of Justice (DoJ) changed data request rules on alerting internet users about agencies accessing their information.

The new policy limits the use of secrecy orders and calls for such orders to be issued for defined periods, Microsoft Chief Legal Officer Brad Smith said in a blog post on Monday.

… The suit argued that the government’s actions were in violation of the Fourth Amendment, which establishes the right for people and businesses to know if the government searches or seizes their property, and the company’s First Amendment right to free speech.

Interesting tool.

https://venturebeat.com/2017/10/24/primer-uses-ai-to-understand-and-summarize-mountains-of-text/?google_editors_picks=true

Primer uses AI to understand and summarize mountains of text

A startup emerging out of stealth today wants to help companies understand massive stores of text data using AI. The company is called Primer, and it uses machine learning techniques to help parse and collate a large number of documents across several languages in order to facilitate further investigation.

Here’s how it works: Users feed Primer’s software a stream of documents, and it automatically summarizes what it determines to be the most important information out of that haystack of data. Users are then able to filter by topic, event, and other categories to drill down into the information Primer collected so they can go beyond the automatically generated headlines.

The idea is that Primer will augment work done by the human analysts who would ordinarily be tasked with the job of wading through many sources and collating them into a report.

… Primer has a contract with In-Q-Tel, an organization that helps connect the U.S. intelligence community with new technology through investment and contracting.

https://primer.ai/

Some of these Apps might be fun projects for my students.

http://www.marketwatch.com/story/the-future-of-grocery-shopping-is-all-about-data-2017-10-24?reflink=MW_GoogleNews&google_editors_picks=true

The future of grocery shopping is all about data

… Working from a small host of research facilities beyond the sleek downtown headquarters and a lab tucked away in a suburban strip mall, Kroger’s app developers and data scientists are mining consumer information to devise the grocery store of the future. They are testing apps for shoppers’ mobile devices that will highlight sales based on whether the customer eats meat or needs help finding recipes for chicken, for example. Want to make fish tacos tonight? Another app will populate a user’s digital shopping list with the necessary ingredients available at the store.

For store managers, meanwhile, a program is in the works to allow them to literally see how products are selling in a given aisle, using augmented-reality apps on their phones that show the prices and sales figures for the products found there.

… Kroger has invested billions over the past decade and a half to hire engineers out of leading universities and away from companies recruiting talent with the same kinds of specialized skills—including data analytics, logistics and app-development. Recent innovations developed in Kroger’s labs include infrared sensors that monitor the number of customers in a store and automatically deploy checkout clerks as the number grows. This tool alone, Kroger says, has reduced wait times by several minutes across its stores.

For my students.

https://www.nytimes.com/2017/10/22/technology/artificial-intelligence-experts-salaries.html

Tech Giants Are Paying Huge Salaries for Scarce A.I. Talent

… Tech’s biggest companies are placing huge bets on artificial intelligence, banking on things ranging from face-scanning smartphones and conversational coffee-table gadgets to computerized health care and autonomous vehicles. As they chase this future, they are doling out salaries that are startling even in an industry that has never been shy about lavishing a fortune on its top talent.

Typical A.I. specialists, including both Ph.D.s fresh out of school and people with less education and just a few years of experience, can be paid from $300,000 to $500,000 a year or more in salary and company stock, according to nine people who work for major tech companies or have entertained job offers from them.

More popular than Steven King? Certainly less well understood.

http://www.cambridge-news.co.uk/news/cambridge-news/university-website-crashes-readers-clamour-13803545

University website crashes as readers rush to read Stephen Hawking's 1966 thesis

When an unknown physics student submitted his completed PhD thesis in 1966 he had no idea thousands would still be clamouring to read it more than 50 years later.

But when Stephen Hawking’s Properties of Expanding Universes was published yesterday (October 23) as part of Open Access Week 2017 – an annual event which aims to open up academic resources to the masses.

Cambridge University’s Open Access system reportedly kept crashing throughout the day as servers struggled to cope with demand from readers.

And the problems appear to be persisting today.

… Professor Hawking’s 1966 doctoral thesis ‘Properties of expanding universes’ is available in Apollo at https://doi.org/10.17863/CAM.11283 or in high resolution on Cambridge Digital Library at https://cudl.lib.cam.ac.uk/view/MS-PHD-05437/1

Monday, October 23, 2017

Update.

http://www.securityweek.com/nearly-100-whole-foods-locations-affected-card-breach

Nearly 100 Whole Foods Locations Affected by Card Breach

Amazon-owned Whole Foods Market informed customers last week that a recent hacker attack aimed at its payment systems affected nearly 100 locations across the United States.

Whole Foods has set up a webpage where customers are being provided some details about the breach. The page allows users to check if the store they made purchases in has been hit.

According to the company, cybercriminals may have stolen payment cards used at taprooms and full table-service restaurants in various cities in Alabama, Arizona, Arkansas, California, Colorado, District of Columbia, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Kansas, Maine, Michigan, Minnesota, Missouri, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, Ohio, Oregon, Pennsylvania, Tennessee, Texas, Virginia, Washington and Wisconsin. The largest number of affected locations is in California.

Whole Foods said it had learned of unauthorized access to some payment systems on September 23 and replaced affected point-of-sale (PoS) devices by September 28. However, the investigation conducted by the firm in collaboration with cybersecurity forensics experts revealed that hackers had gained access to some stores in as early as March 10.

… The supermarket chain pointed out that the incident only impacted payment systems at taprooms and restaurants within stores

A different approach, but possibly not the best one.

Computer hacking victims to receive up to £6,000 compensation for ‘distress’ caused by cyber crime, under new plans

Not the most technical/legal explanation of the new EU regs, but this Daily Mail piece by Ben Ellery does convey some of what is concerning businesses:

Computer hacking victims will be able to claim thousands of pounds in compensation under new laws – even if they do not lose any money.

The ‘distress’ they suffer will be enough to qualify for a payout regardless of whether their accounts have actually been raided.

And with the potential damages as high as £6,000 per person, companies with millions of customers could be left crippled by a cyber-attack.

Sunday, October 22, 2017

New technology, same security learning curve.

https://hothardware.com/news/iotreaper-botnet-ready-strike-millions-device-zombies?google_editors_picks=true

IoT_reaper Botnet Looms Ready To Strike With Millions Of Zombie Devices At Its Disposal

A security firm is warning of a new botnet targeting IoT (Internet of Things) devices that is on the move. Dubbed IoT_reaper, the new botnet borrows some of the source code from Mirai, which took down the popular security blog KrebsOnSecurity with a massive DDoS attack, ultimately forcing Brian Krebs, the security expert in charge of the blog, to find a new hosting company and seek shelter behind Google Shield for DDoS protection. Unfortunately, it is believed that this new strain called Reaper could be even more virulent than Mirai.

Whereas Mirai was able to spread by cracking weak passwords on IoT devices that oftentimes were never changed from their defaults, Reaper looks for multiple vulnerabilities to exploit, making it potentially capable of spreading to even more devices. Reaper is far more aggressive in this manner—it is actively hacking devices based on multiple security holes, versus simply inputting default or easy-to-guess passwords

… Reaper is quickly evolving to exploit an increasing number of vulnerabilities in IoT devices, including wireless IP cameras by companies such as GoAhead, D-Link, AVTech, Netgear, MikroTik, Linksys, Synology, and others. There are patches available for many of the affected devices, but when its comes to IoT devices, consumers are not in the same habit as applying security updates as they are for PCs. As such, Check Point has found Reaper doling out attacks from 60 percent of the corporate networks it tracks.

Interesting that piggybacking on widely used tools is being presented as a new idea…

How Russian Firm Might Have Siphoned Tools From the NSA

Kaspersky Lab has come under intense scrutiny after its antivirus software was linked to the breach of an NSA employee’s home computer in 2015 by Russian government hackers; U.S. government sources, quoted in news reports, suggested the Moscow-based company colluded with the hackers to steal classified documents or tools from the worker’s machine, or at least turned a blind eye to this activity. The Department of Homeland Security banned Kaspersky products from civilian government systems, and Best Buy has removed the software from computers it sells based on concerns that the software can be used to spy on customers.

But a closer look at the allegations and technical details of how Kaspersky’s products operate raises questions about the accuracy of the narrative being woven in news reports and suggests that U.S. officials could be technically correct in their statements about what occurred, while also being incorrect about collusion on the part of Kaspersky.

Hackers exist on every side of any political question. So, anything and everything can trigger a reaction like this.

Cyber hackers target Spain’s top court as Catalonia’s leader is threatened with 30 years in prison if he declares independence

Hacktivism is alive and well in Spain. Joshua Taylor reports:

Spain’s most senior court fell victim to a massive cyber attack as hackers launched an “Operation Free Catalonia” campaign.

The country’s constitutional court said unknown hackers had accessed its computer systems on Friday.

The Spanish National Security Department said the hack was part of a recent campaign to flood government websites with slogans in support of independence for the Spanish region of Catalonia.

Centennial Man

Saturday, October 28, 2017

Friday, October 27, 2017

Thursday, October 26, 2017

Wednesday, October 25, 2017

Tuesday, October 24, 2017

Monday, October 23, 2017

Sunday, October 22, 2017

Search This Blog

Followers

Blog Archive

Links

About Me