Data Centers As Sitting Ducks
April 6, 2026
Another dinobaby post. No AI unless it is an image. This dinobaby is not Grandma Moses, just Grandpa Arnold.
Those in the data center business with structures in the Iran war zone realize that when rockets or other kinetics strike the roof, problems ensue. A well-placed round can disable a critical piece of the electrical or cooling equipment as well. Now there is another possible threat. “Iran’s Revolutionary Guards Just Named 18 US Tech Firms as Military Targets. The Age of the Civilian Data Centre Is Over.” The write up reported on March 31, 2026:
The Islamic Revolutionary Guard Corps published a statement on its official Sepah News channel naming 18 US firms, from Apple and Microsoft to Nvidia and Palantir, as “legitimate targets” in retaliation for what it described as their role in enabling American and Israeli assassination operations inside Iran. The list reads like a roll call of the Nasdaq’s most valuable constituents. Microsoft, Apple, Alphabet, Meta, Amazon, Nvidia, Intel, Cisco, Oracle, Dell, HP, IBM, JPMorgan Chase, Tesla, General Electric, Boeing, and Palantir all appear alongside Spire Solutions and G42, the Abu Dhabi-based AI firm that has become a linchpin of the Gulf’s artificial intelligence ambitions.
Some people are aware of potential supply disruptions in gasoline and helium, but the idea that the financial operations of certain countries could be disrupted is problematic. One cannot go to the local automatic teller machine and conduct a hundred million euro transaction.
Thanks, Venice.ai. I appreciate that you excluded the missile. Good enough.
I know that data centers in the Ashburn, Virginia area are hardened. However, I am not so sure that the data centers not far from the special economic zones in Dubai are constructed to what I think of AT&T milspecs. From what I have observed, direct missile strikes were not part of the actual construction.
The write up said:
The threat is extraordinary in its specificity. Rather than targeting military installations or government buildings, the IRGC has identified private-sector technology infrastructure as the mechanism through which, it alleges, the United States has been locating and killing senior Iranian officials. The statement declared that American ICT and AI companies are “the key element in designing and tracking terror targets,” and that “for every assassination and terrorist act in Iran, one facility or unit belonging to these companies will face destruction.”
What’s interesting is that the Ukraine-style asymmetric warfare is making explicit the companies whose infrastructure is at risk. The threats may be idle, but the vulnerability exists. One cannot pile sandbags on a roof of a typical data center. I assume that’s why the subtitle to the cited article makes the point “the age of the civilian data center is over.”
The more practical knock on effect of this threat is that the costs of retro-fitting a data center are not in the budget for the current quarter. New data centers will have to have some additional thought put into their construction method.
Data centers are sitting ducks. There are numerous points of vulnerability. Just “bury data centers” is easy to say. Using existing caves, old mine digs, or more exotic ideas like putting data centers in orbit present some challenges as well. There are some notable caves. I know from my work with the hard rock mining engineering firm Robinson & Robinson that suitable mine shafts exist if they are not filled with water or sealed to prevent some exciting environmental events from becoming noticeable to bunnies and people. The data center in space works if one has rockets that don’t explode on launch. For one firm, exploding rockets suggest the company should consider switching to the production of war munitions.
The write up pointed out:
The exposure is enormous. Microsoft has committed $15 billion to expanding its operations in the UAE by 2029. Amazon has pledged $5 billion to an AI hub in Riyadh. Oracle, Cisco, and Nvidia announced a partnership with OpenAI to build an AI campus in the UAE. Google and Amazon Web Services are constructing dedicated cloud regions in Saudi Arabia scheduled to launch this year. According to analysts at TD Cowen, hyperscaler capital expenditure is forecast to exceed $600 billion in 2026, with roughly 75 per cent tied to AI infrastructure. A substantial portion of that money is flowing into the very region the IRGC is now threatening.
I have confidence that the bean counters and MBAs at the high-tech super companies have the problem solved. These folks have their own brains and the unfettered power of AI without guardrails. Obviously for these BAIT (big AI technology) companies the data center threat is a no brainer. I assume these BAIT outfits know who will ensure their data centers too. I admire forward thinking and the use of agentic AI to solve problems. For example, what if an adversary strikes a data center in Fremont on the way to San Jose?
Stephen E Arnold, April 6, 2026
Bad Actors Have Smart Software and Use It… a Lot
March 26, 2026
Another dinobaby post. No AI unless it is an image. This dinobaby is not Grandma Moses, just Grandpa Arnold.
Hacking requires a certain tech know-how that goes beyond normal technology troubleshooting…or at least it used to. Futurism shares that hackers aren’t just the smart kids anymore: “AI Tools Are Supercharging Hackers.” AI can be transformed into the ultimate hacker’s Swiss army knife. A hacker used a jailbreak version of Anthropic’s Claude to find security vulnerabilities in Mexican government networks. The bad actor got away with 150 GB of sensitive data that contained 195 million Mexican taxpayers.
Amazon’s security research team reported:
“Last month, Amazon’s security research team revealed that hackers — or perhaps just one — had broken into more than 600 firewall systems across dozens of countries while armed with commercially available AI tools, overpowering weak security measures, and extracting credential databases, and possibly setting the stage for future ransomware deployment. ‘It’s like an AI-powered assembly line for cybercrime, helping less skilled workers produce at scale,’ said Amazon security engineering and operations lead CJ Moses in a statement."
IBM released a report that discovered a 44% year-over-year increase in public software and systems applications exploitation and a 50% rise in ransomware groups. Bad actors aren’t reinventing the hacking wheel, instead they’re advancing and adapting their tricks with AI.
Several thoughts and questions cross my mind:
- Is there an end game for this weaponized use of smart software? Right now, the answer seems to be, “Are you kidding me?”
- Smart software creates applications that may be more vulnerable than software created by humans the old-fashioned way. If humans are not in the loop, the escalation is baked into this “smart” and “efficient” approach to developing applications.
- Do bad actors get the upper hand when human coding errors and smart software’s mistakes combine in distributed applications?
Pondering these three points gives me pause.
Whitney Grace, March 26, 2026
Palantir Technologies: What Is with Kim Dotcom?
February 16, 2026
Another dinobaby post. No AI unless it is an image. This dinobaby is not Grandma Moses, just Grandpa Arnold.
I walk the dog and I check out some newsfeeds. The Pinboard.in service provided a snip that said “Palantir was allegedly hacked.” The linked showed me a segment of a Kim Dotcom tweet. When I returned to my office with a happy dog, I clicked the linked again. Nope. Not valid. I poked around on X.com and my Russian language feed. X.com said, “Something has gone wrong.” Okay, no surprise.
I have zero clue if the story is true. If it is, it strikes me that some government cyber professionals will verify the validity or the inaccuracy of Kim Dotcom’s post. Here is the original, which I tracked down using some of my old-fashioned, dinobaby methods:
The original tweet asserts as actual factual:
Peter Thiel and Alex Karp commit mass surveillance of world leaders and titans of industry on a massive scale.
In my experience, I am not sure this lines up 100 percent with what Palantir actually does do. But Kim Dotcom doesn’t call me to learn about the right click wheel, the tie up with Microsoft, or the firm’s Wall Street Journal ads which said the company was an artificial intelligence outfit. Firms in the intelware business have a bit of a dual personality: There is the software and what it can do right now with a particular data set. Then there is the software presented in a demo in a trade show booth. Sometimes the two worlds are slightly different.
Mr. Dotcom asserts as the shining truth these factoids:
Palantir is creating nuclear and bio weapon capabilities for Ukraine and is working closely with the CIA to defeat Russia. They [sic] believe they [sic] are one year away. They [sic] plan to achieve this by keeping Russia busy with meaningless peace negotiations.
There you go. A curious mind might ask, “Who is keeping whom busy?”
I found this statement intriguing:
Palantir is an arm of the CIA and all data from international is copied into a CIA spy cloud.
I ran a few queries on the Web search systems’ “news” sites. I checked one of my favorite Russian sources PCnews.ru and the Yandex.com system. I did not poke around on Telegram. I don’t have my “Telegram only” device with me, but I will check this evening when I leave my cave like office in rural Kentucky.
One Russian link resolved, and I was able to read courtesy of a free online translation system this article: “Dotcom Reported Hacking of the Software Developer for the CIA Palantir. ” That write up said:
“According to reports, Palantir has been subjected to a hacker attack. Artificial intelligence was used to gain access with superuser rights,” he wrote on his page on the social network X (ex. Twitter).
Palantir is an AI company, the WSJ ad told me this. How could one AI fool another AI? I assume exactly the same way malware centric Chrome extensions make life interesting for users of Google Chrome, a product of the Mandiant and Deepseek technologies. Stuff happens.
Several observations are warranted in my opinion:
- Either Kim Dotcom has been hacked and an entity is using him as a convenient vector for fakery or Kim Dotcom is telling the truth and adding some fighter jet illumination to the back of his T shirt
- The link problem raises some interesting thoughts as well. How can Pinboard.in users react so quickly to a post and then take down that post. Pinboard.in is a stable service, but it is definitely not spoof proof. I routinely report porn spammers, SEO wonks, and the lohita outfit to Pinboard. It does take action sometimes, but not at what I would call hopping bunny rabbit speed. The speed of disappearance is fascinating.
- The assertions are quite remarkable. They are presented without evidence. I do know that Palantir when it first first birthed in that fertile Silicon Valley spirit sold a project to a three letter agency. I do not know if Palantir enjoys insider status with the freedom to pump global data into a government system. Maybe, but perhaps this seems inflammatory, not informative.
Net net: This is an interesting use of social media. One tweet got me moving. If something interesting comes out of this demonstration of social media’s “value,” we will post it. For now. I just have questions. Oh, we love the right click wheel thing.
Stephen E Arnold, February 16, 2026
Are NoKos Scam Phisher Champs?
January 26, 2026
When you think about scams, do you immediately think about Nigeria or Russian females who really want to meet an amerikos ? hat African nation is one of the scam capitals of the world. Russia is pretty capable in this department. But does North Korea hold the title of Scam King? Probably not. But some experts want people to believe that North Korean bad actors are the top phishers of men. Tech Radar explains the authoritarian country’s latest scam: “North Korean Hackers Using Malicious QR Codes In Spear Phishing, FBI Warns.”
North Korean bad actors are preying own academia, think tanks, and US government institutions with sophisticated QR codes called “quishing” attacks. Their goal is to obtain credentials for VPNs, Okta, or Microsoft 365. The FBI issued a warning about quishing attacks. The attacks are sent from “Kimusky,” who sends out convincing emails with complicated QR codes that bypass protections.
The FBI says that QR codes are easily scanned with mobile devices. Here’s how the scam works:
“When the victim scans the code, they are sent through multiple redirectors that collect different information and identity attributes, such as user-agent, operating system, IP address, locale, and screen size. This data is then used to land the victim on a custom-built credential-harvesting page, impersonating Microsoft 365, Okta, or VPN portals.
If the victim does not spot the trick and tries to log in, the credentials would end up with the attackers. What’s more – these attacks often end with session token theft and replay, allowing the threat actors to bypass multi-factor authentication (MFA) and hijack cloud accounts without triggering the usual “MFA failed” alert.”
Mobile devices aren’t managed as readily as desktop and laptop computers. They’re extremely vulnerable to this QR code scam! The smart thing to do is: Don’t scan strange QR codes. Some outfits hire coders, use their scam software, and just provide more phish to be trawled. Hey, restaurant owner, am I talking about you?
Whitney Grace, January 26 , 2026
From the Ostrich Watch Desk: A Signal for Secure Messaging?
December 4, 2025
![green-dino_thumb_thumb[1]](https://www.arnoldit.com/wordpress/wp-content/uploads/2025/11/green-dino_thumb_thumb1.gif "green-dino_thumb_thumb[1]")
Another dinobaby post. No AI unless it is an image. This dinobaby is not Grandma Moses, just Grandpa Arnold.
A dinobaby is not supposed to fraternize with ostriches. These two toed birds can run. It may be time for those cyber security folks who say, “Signal is secure to run away from that broad statement.” Perhaps something like sort of secure if the information presented by the “please, please, please, send us money” newspaper company. (Tip to the Guardian leadership. There are ways to generate revenue some of which I shared in a meeting about a decade ago.)
Listening, verifying, and thinking critically are skills many professionals may want to apply to routine meetings about secure services. Thanks, Venice.ai. Good enough.
The write up from the “please, please, please, donate” outfit is “The FBI Spied on a Signal Group Chat of Immigration Activists, Records Reveal.” The subtitle makes clear that I have to mind the length of my quotes and emphasize that absolutely no one knows about this characteristic of super secret software developed by super quirky professionals working in the not-so-quirky US of A today.
The write up states:
The FBI spied on a private Signal group chat of immigrants’ rights activists who were organizing “courtwatch” efforts in New York City this spring, law enforcement records shared with the Guardian indicate.
How surprised is the Guardian? The article includes this statement, which I interpret as the Guardian’s way of saying, “You Yanks are violating privacy.” Judge for yourself:
Spencer Reynolds, a civil liberties advocate and former senior intelligence counsel with the DHS, said the FBI report was part of a pattern of the US government criminalizing free speech activities.
Several observations are warranted:
- To the cyber security vice president who told me, “Signal is secure.” The Guardian article might say, “Ooops.” When I explained it was not, he made a Three Stooges’ sound and cancel cultured me.
- When appropriate resources are focused on a system created by a human or a couple of humans, that system can be reverse engineered. Did you know Android users can drop content on an iPhone user’s device. What about those how-tos explaining the insecurity of certain locks on YouTube? Yeah. Security.
- Quirky and open source are not enough, and quirky will become less suitable as open source succumbs to corporatism and agentic software automates looking for tricks to gain access. Plus, those after-the-fact “fixes” are usually like putting on a raincoat after the storm. Security enhancement is like going to the closest big box store for some fast drying glue.
One final comment. I gave a lecture about secure messaging a couple of years ago for a US government outfit. One topic was a state of the art messaging service. Although a close hold, a series of patents held by entities in Virginia disclosed some of the important parts of the system and explained in a way lawyers found just wonderful a novel way to avoid Signal-type problems. The technology is in use in some parts of the US government. Better methods for securing messages exist. Open source, cheap, and easy remains popular.
Will I reveal the name of this firm, provide the patent numbers in this blog, and present my diagram showing how the system works? Nope.
PS to the leadership of the Guardian. My recollection is that your colleagues did not know how to listen when I ran down several options for making money online. Your present path may lead to some tense moments at budget review time. Am I right?
Stephen E Arnold, December 4, 2025
First WAP? What Is That? Who Let the Cat Out of the Bag?
October 21, 2025
This essay is the work of a dumb dinobaby. No smart software required.
Ageing in rural Kentucky is not a good way to keep up with surveillance technology. I did spot a post on LinkedIn. I will provide a url for the LinkedIn post, but I have zero clue if anyone reading this blog will be able to view the information. The focus of the LinkedIn post is that some wizards have taken inspiration from NSO Group-type of firms and done some innovation. Like any surveillance technology, one has to apply it in a real life situation. Sometimes there is a slight difference between demonstrations, PowerPoint talks, and ease of use. But, hey, that’s the MBA-inspired way to riches or at least in NSO Group’s situation, infamy.
Letting the cat out of the bag. Who is the individual? The president, an executive, a conference organizer, or a stealthy “real” journalist. One thing is clear: The cat is out of the bag. Thanks, Venice.ai. Good enough.
The LinkedIn post is from an entity using the handle OSINT Industries. Here is the link, dutifully copied from Microsoft’s outstanding social media platform. Don’t blame me if it doesn’t work. Microsoft just blames users, so just look in the mirror and complain: https://www.linkedin.com/posts/osint-industries_your-phone-is-being-tracked-right-now-ugcPost-7384354091293982721-KQWk?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAACYEwBhJbGkTw7Ad0vyN4RcYKj0Su8NUU
How’s that for a link. ShortURL spit out this version: https://shorturl.at/x2Qx9.
So what’s the big deal. Cyber security outfits and an online information service (in the old days a printed magazine) named Mother Jones learned that an outfit called First WAP exploited the SS7 telecom protocol. As i understand this signal switching, SS7 is about 50 years old and much loved by telephony nerds and Bell heads. The system and method acts like an old fashioned switchyard operator at a rail yard in the 1920s. Signals are filtered from voice channels. Call connections and other housekeeping are pushed to the SS7 digital switchyard. Instead of being located underground in Manhattan, the SS7 system is digital and operates globally. I have heard but have no first hand information about its security vulnerabilities. I know that a couple of companies are associated with switching fancy dancing. Do security exploits work? Well, the hoo-hah about First WAP suggests that SS7 exploitation is available.
The LinkedIn post says that “The scale [is] 14,000+ phone numbers. 160 countries. Over 1 million location pings.
A bit more color appears in the Russian information service ? FrankMedia.ru’s report “First WAP Empire: How Hidden Technology Followed Leaders and Activists.” The article is in Russian, but ever-reliable Google Translate makes short work of one’s language blind spots. Here are some interesting points from Frank Media:
- First WAP has been in business for about 17 or 18 years
- The system was used to track Google and Raytheon professionals
- First WAP relies on resellers of specialized systems and services and does not do too much direct selling. The idea is that the intermediaries are known to the government buyers. A bright engineer from another country is generally viewed as someone who should not be in a meeting with certain government professionals. This is nothing personal, you understand. This is just business.
- The system is named Altamides, which may be a variant of a Greek word for “powerful.”
The big reveal in the Russian write up is that a journalist got into the restricted conference, entered into a conversation with an attendee at the restricted conference, and got information which has put First WAP in the running to be the next NSO Group in terms of PR problems. The Frank Media write up does a fine job of identifying two individuals. One is the owner of the firm and the other is the voluble business development person.
Well, everyone gets 15 minutes of fame. Let me provide some additional, old-person information. First, the company’s Web address is www.1rstwap.com. Second, the firm’s alleged full name is First WAP International DMCC. The “DMCC” acronym means that the firm operates from Dubai’s economic zone. Third, the firm sells through intermediaries; for example, an outfit called KCS operating allegedly from the UK. Companies House information is what might be called sparse.
Several questions:
- How did a non-LE or intel professional get into the conference?
- Why was the company to operate off the radar for more than a decade?
- What benefits does First WAP derive from its nominal base in Indonesia?
- What are the specific security vulnerabilities First WAP exploits?
- Why do the named First WAP executives suddenly start talking after many years of avoiding an NSO-type PR problem?
Carelessness seems to be the reason this First WAP got its wireless access protocol put in the spotlight. Nice work!
To WAP up, you can download the First WAP encrypted messaging application from… wait for it… the Google Play Store. The Google listing includes this statement, “No data shared with third parties.” Think about that statement.
Stephen E Arnold, October 21, 2025
Desperate Much? Buying Cyber Security Software Regularly
September 16, 2025
Bad actors have access to AI, and it is enabling them to increase both speed and volume at an alarming rate. Are cybersecurity teams able to cope? Maybe—if they can implement the latest software quickly enough. VentureBeat reports, “Software Commands 40% of Cybersecurity Budgets ad Gen AI Attacks Execute in Milliseconds.” Citing IBM’s recent Cost of a Data Breach Report, writer Louis Columbus reports 40% of cybersecurity spending now goes to software. Compare that to just 15.8% spent on hardware, 15% on outsourcing, and 29% on personnel. Even so, AI-assisted hacks now attack in milliseconds while the Mean Time to Identify (MTTI) is 181 days. That is quite the disparity. Columbus observes:
“Three converging threats are flipping cybersecurity on its head: what once protected organizations is now working against them. Generative AI (gen AI) is enabling attackers to craft 10,000 personalized phishing emails per minute using scraped LinkedIn profiles and corporate communications. NIST’s 2030 quantum deadline threatens retroactive decryption of $425 billion in currently protected data. Deepfake fraud that surged 3,000% in 2024 now bypasses biometric authentication in 97% of attempts, forcing security leaders to reimagine defensive architectures fundamentally.”
Understandable. But all this scrambling for solutions may now be part of the problem. Some teams, we are told, manage 75 or more security tools. No wonder they capture so much of the budget. Simplification, however, is proving elusive. We learn:
“Security Service Edge (SSE) platforms that promised streamlined convergence now add to the complexity they intended to solve. Meanwhile, standalone risk-rating products flood security operations centers with alerts that lack actionable context, leading analysts to spend 67% of their time on false positives, according to IDC’s Security Operations Study. The operational math doesn’t work. Analysts require 90 seconds to evaluate each alert, but they receive 11,000 alerts daily. Each additional security tool deployed reduces visibility by 12% and increases attacker dwell time by 23 days, as reported in Mandiant’s 2024 M-Trends Report. Complexity itself has become the enterprise’s greatest cybersecurity vulnerability.”
See the writeup for more on efforts to improve cybersecurity’s speed and accuracy and the factors that thwart them. Do we have a crisis yet? Of course not. Marketing tells us cyber security just works. Sort of.
Cynthia Murrell, September 16, 2025
Supermarket Snitches: Old-Time Methods Are Back
September 5, 2025
So much for AI and fancy cyber-security systems. One UK grocery chain has found a more efficient way to deal with petty theft—pay people to rat out others. BBC reports, “Iceland Offers £1 Reward for Reporting Shoplifters.” (Not to be confused with the country, this Iceland is a British supermarket chain.) Business reporter Charlotte Edwards tells us shoplifting is a growing problem for grocery stores and pharmacies. She writes:
“Victims minister Alex Davies-Jones told BBC Radio 4’s Today programme on Monday that shoplifting had ‘got out of hand’ in the UK. … According to the Office for National Statistics, police recorded 530,643 shoplifting offences in the year to March 2025. That is a 20% increase from 444,022 in the previous year, and the highest figure since current recording practices began in 2002-03.”
Amazing what economic uncertainty will do. In response, the government plans to put thousands more police officers on neighborhood patrols by next spring. Perhaps encouraging shoppers to keep their eyes peeled will help. We learn:
“Supermarket chain Iceland will financially reward customers who report incidents of shoplifting, as part of efforts to tackle rising levels of retail theft. The firm’s executive chairman, Richard Walker, said that shoppers who alert staff to a theft in progress will receive a £1 credit on their Iceland Bonus Card. The company estimates that shoplifting costs its business around £20m each year. Mr Walker said this figure not only impacts the company’s bottom line but also limits its ability to reduce prices and reinvest in staff wages. Iceland told the BBC that the shoplifters do not necessarily need to be apprehended for customers to receive the £1 reward but will need to be reported and verified.”
How, exactly, they will be verified is left unexplained. Perhaps that is the role for advanced security systems. Totally worth it. Walker emphasizes customers should not try to apprehend shoplifters, just report them. Surely no one will get that twisted. But with one pound sterling equal to $1.35 USD, we wonder: is that enough incentive to pull the phone out of one’s pocket?
Technology is less effective than snitching.
Cynthia Murrell, September 5, 2025
Cyber Security: Evidence That Performance Is Different from Marketing
August 20, 2025
This blog post is the work of an authentic dinobaby. Sorry. No smart software can help this reptilian thinker.
In 2022, Google bought a cyber security outfit named Mandiant. The firm had been around since 2004, but when Google floated more than $5 billion for the company, it was time to sell.
If you don’t recall, Google operates a large cloud business and is trying diligently to sell to Microsoft customers in the commercial and government sector. A cyber security outfit would allow Google to argue that it would offer better security for its customers and their users.
Mandiant’s business was threat intelligence. The idea is that Mandiant would monitor forums, the Web, and any other online information about malware and other criminal cyber operations. As an added bonus, Mandiant would blend automated security functions with its technology. Wham, bam! Slam dunk, right?
I read “Google Confirms Major Security Breach After Hackers Linked To ShinyHunters Steal Sensitive Corporate Data, Including Business Contact Information, In Coordinated Cyberattack.” First, a disclaimer. I have no idea if this WCCF Tech story is 100 percent accurate. It could be one of those Microsoft 1,000 Russian programmers are attacking us” plays. On the other hand, it will be fun to assume that some of the information in the cited article is accurate.
With that as background, I noted this passage:
The tech giant has recently confirmed a data breach linked to the ShinyHunters ransomware group, which targeted Google’s corporate Salesforce database systems containing business contact information.
Okay. Google’s security did not work. A cloud customer’s data were compromised. The assertion that Google’s security is better than or equal to Microsoft’s is tough for me to swallow.
Here’s another passage:
As per Google’s Threat Intelligence Group (GTIG), the hackers used a voice phishing technique that involved calling employees while pretending to be members of the internal IT team, in order to have them install an altered version of Salesforce’s Data Loader. By using this technique, the attackers were able to access the database before their intrusion was detected.
A human fooled another human. The automated systems were flummoxed. The breach allegedly took place.
Several observations are warranted:
- This is security until a breach occurs. I am not sure that customers expect this type of “footnote” to their cyber security licensing mumbo jumbo. The idea is that Google should deliver a secure service.
- Mandiant, like other threat intelligence services, allows the customer to assume that the systems and methods generally work. That’s true until they don’t.
- Bad actors have an advantage. Armed with smart software and tools that can emulate my dead grandfather, the humans remain a chink in the otherwise much-hyped armor of an outfit like Google.
What this example, even if only partly accurate, makes it clear than cyber security marketing performs better than the systems some of the firms sell. Consider that the victim was Google. That company has touted its technical superiority for decades. Then Google buys extra security. The combo delivers what? Evidence that believing the cyber security marketing may do little to reduce the vulnerability of an organization. What’s notable is that the missteps were Google’s. Microsoft may enshrine this breach case and mount it on the walls of every cyber security employees’ cubicles.
I can imagine hearing a computer-generated voice emulating Bill Gates’, saying, “It wasn’t us this time.”
Stephen E Arnold, August 20, 2025
Thanks, Google: Scam Link via Your Alert Service
July 20, 2025
This blog post is the work of an authentic dinobaby. Sorry. No smart software can help this reptilian thinker.
July 20, 2025 at 926 am US Eastern time: The idea of receiving a list of relevant links on a specific topic is a good one. Several services provide me with a stream of sometimes-useful information. My current favorite service is Talkwalker, but I have several others activated. People assume that each service is comprehensive. Nothing is farther from the truth.
Let’s review a suggested article from my Google Alert received at 907 am US Eastern time.
Imagine the surprise of a person watching via Google Alerts the bound phrase “enterprise search.” Here’s the landing page for this alert. I received this message:
The snippet says “enterprise search platform Shenzhen OCT Happy Valley Tourism Co. Ltd is PRMW a good long term investment [investor sentiment]. What happens when one clicks on Google’s AI-infused message:
My browser displayed this:
If you are not familiar with Telegram Messenger-style scams and malware distribution methods, you may not see these red flags:
- The link points to an article behind the WhatsApp wall
- To view the content, one must install WhatsApp
- The information in Google’s Alert is not relevant to “Nova Wealth Training Camp 20”
This is an example a cross service financial trickery.
Several observations:
- Google’s ability to detect and block scams is evident
- The relevance mechanism which identified a financial scam is based on key word matching; that is, brute force and zero smart anything
- These Google Alerts have been or are now being used to promote either questionable, illegal, or misleading services.
Should an example such as this cause you any concern? Probably not. In my experience, the Google Alerts have become less and less useful. Compared to Talkwalker, Google’s service is in the D to D minus range. Talkwalker is a B plus. Feedly is an A minus. The specialized services for law enforcement and intelligence applications are in the A minus to C range.
No service is perfect. But Google? This is another example of a company with too many services, too few informed and mature managers, and a consulting leadership team disconnected from actual product and service delivery.
Will this change? No, in my opinion.
Stephen E Arnold, July 20, 2025
-
- Subscribe to Beyond Search
Feature archive
News archive
-
