Microsoft and LinkedIn: How about That Security?
July 2, 2021
I spotted an interesting and probably made up post titled “New LinkedIn Data Leak Leaves 700 Million Users Exposed.” Isn’t this old news? I must be thinking about the 500 million names scraped earlier this year. (See “Reported LinkedIn Data Breach: What You Need to Know,” please.)
The write up states:
Since LinkedIn has 756 million users, according to its website, this would mean that almost 93% of all LinkedIn users can be found through these records.
I am eagerly awaiting Microsoft’s explanation. Will it be 1,000 programmers? Russia? China? A flawed update?
Excuses: Microsoft has offered a few. Is ineptitude in the quiver of rhetorical arrows? Perhaps it was an illusion?
Stephen E Arnold, July 2, 2021
DarkCyber for June 29, 2021, Now Available: Operation Trojan Shield Provides an Important Lesson
June 29, 2021
DarkCyber 13 discusses the Operation Trojan Shield sting. You can view the video at this link. The focus is on three facets of the interesting international takedowns not receiving much attention. The wrap up of the program is a lesson which should be applied to other interesting mobile device applications. If you are wondering how useful access to app data and its metadata are, you may find this 11 minute video thought provoking. DarkCyber is a production of Stephen E Arnold, a semi-retired consultant who dodges thumbtypers, marketers, and jargon lovers. Remember: No ads and no sponsors. (No, we don’t understand either but he pays our modest team like clockwork.)
Kenny Toth, June 29, 2021
Another Friday, More Microsoft Security Misstep Disclosures
June 28, 2021
I think Microsoft believes no one works on Friday. I learned in “Microsoft Warns of Continued Attacks by the Nobelium Hacking Group” that SolarWinds is the gift that keeps on giving. Microsoft appears to have mentioned that another group allegedly working for Mr. Putin has been exploiting Microsoft software and systems. Will a “new” Windows 11 and registering via a Microsoft email cure this slight issue? Sure it will, but I am anticipating Microsoft marketing jabber.
The write up states:
The Microsoft Threat Intelligence Center said it’s been tracking recent activity from Nobelium, a Russia-based hacking group best known for the SolarWinds cyber attack of December 2020, and that the group managed to use information gleaned from a Microsoft worker’s device in attacks. Microsoft said it “detected information-stealing malware on a machine belonging to one of our customer support agents with access to basic account information for a small number of our customers” and that “the actor used this information in some cases to launch highly targeted attacks as part of their broader campaign.” The affected customers were notified of the breach.
The applause sign is illuminated.
I spotted this remarkable statement in the write up as well:
It’s possible that successful attacks went unnoticed, but for now it seems Nobelium’s efforts have been ineffective.
Wait, please. There is more. Navigate to “Microsoft Admits to Signing Rootkit Malware in Supply-Chain Fiasco.” This smoothly executed maneuver from the Windows 11 crowd prompted the write up to state:
Microsoft has now confirmed signing a malicious driver being distributed within gaming environments.
This driver, called “Netfilter,” is in fact a rootkit that was observed communicating with Chinese command-and-control (C2) IPs.
The write up concludes:
This particular incident, however, has exposed weaknesses in a legitimate code-signing process, exploited by threat actors to acquire Microsoft-signed code without compromising any certificates.
Amazing. The reason cyber crime is in gold rush mode is due to Microsoft in my opinion. The high tech wizards in Redmond can do rounded corners. Security? Good question.
Stephen E Arnold, June 28, 2021
TikTok: No Risk You Think?
June 28, 2021
I snipped a segment from my most recent lecture about the new Dark Web as this week’s DarkCyber video. More information about the program will appear on Tuesday, June 28, 2021. For now, I want to highlight the “real” news outfit CNBC and its take on TikTok. Remember that TikTok is harmless at least according to one Silicon Valley pundit and aspiring CIA professional.
“TikTok Insiders Say Social Media Company Is Tightly Controlled by Chinese Parent ByteDance” reports as actual factual information instantly doubted by Silicon Valley pundits:
This recruiter, along with four other former employees, told CNBC they’re concerned about the popular social media app’s Chinese parent company, which they say has access to American user data and is actively involved in the Los Angeles company’s decision-making and product development. These people asked to remain anonymous for fear of retribution from the company.
Hey, how about a quote from Jack Ma about the wonderfulness of the Chinese business methodology?
The write up adds:
Most notably, one employee said that ByteDance employees are able to access U.S. user data. This was highlighted in a situation where an American employee working on TikTok needed to get a list of global users, including Americans, who searched for or interacted with a specific type of content — that means users who searched for a specific term or hashtag or liked a particular category of videos. This employee had to reach out to a data team in China in order to access that information. The data the employee received included users’ specific IDs, and they could pull up whatever information TikTok had about those users. This type of situation was confirmed as a common occurrence by a second employee.
If you are interested in the value of data from a mere app, check out the DarkCyber program for June 28, 2021.
Stephen E Arnold, June 28, 2021
Mitre and Its Mad Ave Inspired Naming
June 25, 2021
I keep a list of neologisms, jargon, and odd ball phrases. Examples include anting (crows which allow ants to clean up the feathery friends of horror movie script writers), industrial athlete (a Bezos bulldozer rah rah for warehouse workers who are sometimes allowed to visit the facilities), and pillbillies (residents of West Virginia and Kentucky who are addicted to opioids). I have others too including AIM (asymmetric information management) which I don’t understand at all.
Now I have a new one: ATT&CK. This is a coinage from a wordsmith at Mitre (the old MIT Research outfit) and its “Engenuity” unit. Those folks are heirs to assorted Boston poets I think. I am not sure what the letters mean, but here’s the explanation in “Tool Lets Users Supplement Mitre ATT&CK Knowledge Base with Their Own Threat Intel”:
Called ATT&CK Workbench, the free and open-source tool was designed to reduce the barriers preventing defenders from aligning their aggregated TTP intel with Mitre ATT&CK’s content. Officially announced today via press release and blog post, Workbench is a creation of Mitre Engenuity’s Center for Threat-Informed Defense, with contributions from Center members AttackIQ, HCA Healthcare, JPMorgan Chase, Microsoft and Verizon.
I want to point out that as far as my DarkCyber research team has been able determine, exactly none of the threat intelligence outfits alerted their customers to the SolarWinds’ misstep.
I have a buzzword for this in my collection too: Nonperformative. I think this means, “May not work.”
Stephen E Arnold, June 24, 2021
Clear Signals of Deeper, Less Visible Flaws, Carelessness, and Corner Cuts
June 21, 2021
I read “State of the Windows: How Many Layers of UI Inconsistencies Are in Windows 10?” I found the listing of visual anomalies interesting. I don’t care much about Windows. We run a couple of applications and upgrade to new versions once the point releases and bugs have been identified and mostly driven into dark holes.
The write up points out:
As you may know, Microsoft is planning on overhauling the UI of Windows with their “Sun Valley” update, which aims to unify the design of the OS. However, as we can see, Windows is one behemoth of an operating system. Will their efforts to finally make a cohesive user experience succeed?
My answer to this question is that Microsoft has embraced processes which tolerate inconsistencies. I see this as a strategic or embedded function of the company’s management attitude: Good enough. If a company cannot make interfaces consistent, what about getting security issues, software update processes, and code quality under control.
I want to mention the allegation that Microsoft may have been signing malicious drivers. For more on this interesting assertion, navigate to Gossi The Dog at this link. One hopes the information in this sequence of messages and screenshots is fabricated. But if there are on the money, well …
If you can’t see it, perhaps “good enough” becomes “who cares.” Obviously some at Microsoft hold both of these strategic principles dear.
Stephen E Arnold, June 21, 2021
DarkCyber for June 15, 2021, Now Available
June 15, 2021
DarkCyber is a video news program issued every two weeks. The June 15, 2021, show includes five stories:
- Pentest tools you can download and use today for free
- A free report that explains Britain’s cyber weaknesses
- Additional information about the E2EE revolution
- Another tip for finding flexible developers and programmers who will do exactly what you want done
- The FireScout, a drone with a 100 mile range and the ability to drop sonobuoys and other devices, perform surveillance, and remain aloft for up to 10 hours.
The DarkCyber video news program contains information presented in Stephen E Arnold’s lectures to law enforcement and intelligence professionals. His most recent lecture was the New Dark Web. He presented his most recent research findings to a group of more than 100 cyber fraud investigators working in Connecticut for a variety of LE and related organizations. The
The June 15, 2021, DarkCyber video program is available from Mr. Arnold’s blog splash page and can be viewed on YouTube. One important note: The video program does not contain advertisements or sponsored content. We know that’s unusual today, but the DarkCyber team prefers to operate without an invisible hand on the controls or an invisible foot on the team’s neck.
Kenny Toth, June 15, 2021
An Idea for American Top Dogs?
June 14, 2021
My hunch is that the cyber security breaches center of flaws in Microsoft Windows. The cyber security vendors, the high priced consultants, and even the bad actors renting their services to help regular people are mostly ineffectual. The rumors about a new Windows are interesting. The idea that Windows 10 will not be supported in the future is less interesting. I interpret the information as a signal that Microsoft has to find a fix. Marketing, a “new” Windows, and mucho hand waving will make the problem go away. But will it? Nope. Law enforcement, intelligence professionals, and security experts are operating in reactive mode. Something happens; people issue explanations; and the next breach occurs. Consider gamers. These are not just teenies. Nope. Those trying to practice “adulting” are into these escapes. TechRepublic once again states the obvious in “Fallout of EA Source Code Breach Could Be Severe, Cybersecurity Experts Say.” Here’s an extract:
The consequences of the hack could be existential, said Saryu Nayyar, CEO of cybersecurity firm Gurucul. “This sort of breach could potentially take down an organization,” she said in a statement to TechRepublic. “Game source code is highly proprietary and sensitive intellectual property that is the heartbeat of a company’s service or offering. Exposing this data is like virtually taking its life. Except that in this case, EA is saying only a limited amount of game source code and tools have been exfiltrated. Even so, the heartbeat has been interrupted and there’s no telling how this attack will ultimately impact the life blood of the company’s gaming services down the line.”
I like that word “existential.”
I want to call attention to this story in Today Online: “Japan’s Mizuho Bank CEO to Resign after Tech Problems.” Does this seem like a good idea? To me, it may be appropriate in certain situations. A new top dog at Microsoft would have a big job to do for these reasons:
- New or changed software introduces new flaws and exploitable opportunities.
- New products with numerous new features increase the attack surface; for example, Microsoft Teams, which is demonstrating the Word method of adding features to keep wolves like Zoom, Google, and others out of the hen house.
- A flood of marketing collateral, acquisitions, and leaks about a a new Windows are possible distractions for a very uncritical but influential observers.
But what’s the method in the US. Keep ‘em on the job. How is that working?
Stephen E Arnold, June 14, 2021
Chronic Cyber Insecurity
June 11, 2021
NPR has shared the transcript of an All Things Considered interview with former NSA general counsel Glenn Gerstell in, “USAID Hack: Former NSA Official Calls U.S. Cyber Insecurity a ‘Chronic Disease.’” The exchange is not reassuring. Host Michel Martin begins with the recent news of another breach, announced by Microsoft late last month. Once again the perpetrators appear to be Russian operatives, probably the same ones that were behind the SolarWinds attack. Not that Putin will admit as much when he is confronted, as he will likely be, by President Biden at their upcoming meeting in Geneva. We note this exchange:
“MARTIN: Why do you think these attacks keep happening despite the sanctions that the Biden administration has already imposed, you know, on Russia? And do you think the government’s doing enough to protect itself against these threats and also us, the public?
“GERSTELL: Well, your question is really the key one. And I think the lesson we learn from this is that this in some ways, our cyber insecurity in this regard, is a chronic disease for which we don’t have a single cure. It’s not an illness for which there’s a particular drug that we could take to get rid of it. So unfortunately, however, we’re at the beginning end of this chronic condition. This is going to get worse before it gets better. It will ultimately get better. But in the meantime, we have sophisticated attackers, nation states and criminals who can co-opt legitimate servers and companies and computers and softwares. And this proves, unfortunately, that our current scheme of deterrents simply isn’t working.”
What will work is the multi-billion dollar question. Martin wonders whether there are any plans to regulate crypto currency. Gerstell allows that is a step that might be taken, but it would do little to disrupt either spying or the sowing of chaos generated by these types of attacks. It could, however, curtail the sort of ransomware attack that recently shut down a pipeline on the East Coast and had some fools pumping gasoline into plastic bags and other unwise receptacles. That would be something, we suppose.
Cynthia Murrell, June 11, 2021
The Ultimate Insider Tool: Work Technology
June 10, 2021
“Many Staff Are Still Using Work Devices for Personal and Illegal Activities” explains something about insiders. Here’s the write up’s comment about something that I thought everyone knew:
Remote employees do not always consider cybersecurity risks.
This bears live in the woods statement is supported by thumbtyping research too. The write up reports:
The password security company [Yubico, a dongle outfit] surveyed 3,000 remote staff from around Europe and found that almost half (42%) use work-issued devices for personal tasks. Roughly a third of this group use corporate tech for banking and shopping, while 7% visit illegal streaming websites. What’s more, senior members of staff are among the worst offenders; 43% of business owners and 39% of C-level executives admit to misusing work devices, with many also dabbling in illegal activities online.
How do you like that ratio seven percent? I a government agency has 50,000 full time equivalents, 3,500 are off the reservation. An industrious bad actor could seek out one of these individuals in an effort to create some fun; for example, crafting a way to generate false passports, gaining access to a “secure” network, or fiddling with geo coordinates to make a border surveillance drone watch a McDonald’s, not the area around Organ Pipe Cactus near Lukeville, Arizona.
The write up quotes the cyber security vendor responsible for the original study as saying:
“With millions of workers focused on the pressures of completing tasks in varying and sometimes unusual circumstances, security best practices are often put on the backburner.”
What’s the fix? A Yubico key, of course. But wait. Aren’t there other factors to address? Nah. Time to let the dog out and make an iced coffee with almond milk and cinnamon.
Stephen E Arnold, June 10, 2021
-
- Subscribe to Beyond Search
Feature archive
News archive
-
