Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

Mathew Ingram writes in Pressure increases on Bloomberg to verify its China hack story:

It was a certified bombshell: Bloomberg News reported on October 4 that the Chinese government had been able to infiltrate both Apple and Amazon’s hardware systems by putting hacked microchips into the third-party motherboards they used in their servers. But as the days following the report have turned into weeks, doubts about the validity of the story have continued to grow, while the amount of independent verification and/or supporting material proving such a hack actually occurred remains at zero.

In a column on Tuesday, Washington Post media critic Erik Wemple argued the chorus of voices in opposition to the allegations in the piece—including strenuous and detailed denials from the companies involved—have put the onus on Bloomberg to come up with additional verification, or else risk casting even more doubt on its scoop. “The relentlessness of the denials and doubts from companies and government officials obligate Bloomberg to add the sort of proof that will make believers of its skeptics,” Wemple wrote. “Assign more reporters to the story, re-interview sources, ask for photos and emails. Should it fail in this effort, it’ll need to retract the entire thing.” Wemple also criticized the news outlet for using a photo of a generic microchip on the cover of Bloomberg BusinessWeek magazine, despite the fact that the news outlet has no photos of the actual chip that was allegedly used in the hacks.
… (emphasis in original)

Ingram has collected links to a number of the posts and refutations of the original Bloomberg claims.

But you don’t need the protests of innocence and/or deep technical analysis to be wary of the Bloomberg story.

On the face of the original report, how many people do you think would “know” about the subversion of the motherboards?

1. Designers of the subversive chip
2. Motherboard designers to create a motherboard that uses the subversive chip
3. Development and testing staff for the chip and the motherboards
4. Users of capabilities offered by the subversive chips
5. Handlers of the intelligence produced by the subversive chips
6. Funders for #1 – #5

Would you concede those in the “know” about the chips would have to number in the thousands?

I ask because research on conspiracies estimates to keep a secret for five years, the maximum number of participants has an upper limit of 2521 agents. On the Viability of Conspiratorial Beliefs, David Robert Grimes, PLOS, Published: January 26, 2016, https://doi.org/10.1371/journal.pone.0147905.

On the face of it, the ‘China Hack’ more closely resembles the NASA Moon-landing conspiracy than technological legerdemain.

Especially given Bloomberg’s explanation for the absence of any motherboard with the “extra” chip:

…
In the three years since the briefing in McLean, no commercially viable way to detect attacks like the one on Supermicro’s motherboards has emerged—or has looked likely to emerge. Few companies have the resources of Apple and Amazon, and it took some luck even for them to spot the problem. “This stuff is at the cutting edge of the cutting edge, and there is no easy technological solution,” one of the people present in McLean says. “You have to invest in things that the world wants. You cannot invest in things that the world is not ready to accept yet.”

Failure to detect becomes evidence of the cleverness of these conspirators.

Looks like a conspiracy theory, walks like a conspiracy theory, talks like a conspiracy theory, the absence of evidence proves the conspiracy theory, all suggests Bloomberg’s “China Hack” is a conspiracy theory.

Why You Should Start Doing CTFs by Oryan De Paz.

From the post:

Capture The Flag (CTF) is a competition in the Information Security field. The main idea is to simulate different kinds of attack concepts with various challenges such as Reverse Engineering, Networks and Protocols, Programming, Crypto, Web Security, Exploits, etc.

All these challenges have one goal — capture the flag: solve the puzzle and use your skills in order to find a string that you can eventually type-in as your solution. If the solution is correct — you get the challenge points, which depend on the task difficulty. These days you can find CTF competitions in many of the infosec conferences.
…

De Paz has five (5) good reasons for doing Capture The Flag (CTF) exercises and pointers to additional resources.

De Paz mentions these reverse engineers as guideposts for her journey into CTF (in a Twitter thread on her post):

• @Baot_IL (Israeli community of women in R&D)
• @0xgalz
• @cbelle1234
• @Dafna_Mordechai
• @OphirHarpaz

Great advice and leads to exploring CTF for yourself!

Millions at risk from default webcam passwords

From the post:

…
The vulnerability lies in a feature called XMEye P2P Cloud, which is enabled on all Xiongmai devices by default. It lets people access their devices remotely over the internet, so that they can see what’s happening on their IP cameras or set up recording on their DVRs.

Using a variety of apps, users log into their devices via Xiongmai’s cloud infrastructure. This means that they don’t have to set up complex firewall port forwarding or UPnP rules on their home routers, but it also means that it opens up a hole in the user’s network. That places the onus on Xiongmai to make the site secure. But it didn’t.
…

The article goes on to point out how to locate these insecure devices, which are estimated at a population of 9 million around the world.

Suggestions on AI-assisted recognition software to distinguish baby pics from more interesting content?

Lesser Skilled Cybercriminals Adopt Nation-State Hacking Methods by Jai Vijayan.

From this long prose ad for CrowdStrike:

Relatively unskilled, criminally motivated hackers are increasingly adopting the tactics, techniques and procedures (TTPs) typically used by more sophisticated nation-stated backed adversaries.

New analysis by security vendor CrowdStrike’s Falcon OverWatch threat-hunting team of intrusion detection engagements at customer locations between January and June this year shows a continued blurring of lines between methods employed by criminals and known nation-state actors.

This trend spells trouble for enterprises because it means that no one is really safe from sophisticated attacks, says Jennifer Ayers, vice president of CrowdStrike’s OverWatch and security response team. “Sophisticated techniques are becoming a little more commoditized,” she says. “Anything goes. Anyone can be a target.”

One example is cybercriminals increasingly using TeamViewer software to gain remote access to targets. TeamViewer is a legitimate tool for connecting to remote computers for desktop sharing and collaboration and enabling remote support, among other uses.
…

In addition to being gratuitiously ugly to hackers who use tools developed by others, Vijayan includes CrowdStrike attributed remarks about Russian hackers, of course.

When you have no evidence to present, throw off on the Russians. At least this season. Not so long ago it was those masterminds of everything digital, the North Koreans. Then the Chinese, or is it now the Chinese?

Check with the ministry of truth, sorry, Department of Homeland Security to see who the current “enemy” and greatest cyberthreat is today. It changes.

You are very unlikely to have written your own compiler, debugger, or other tools you use in cybersecurity. Building on the work of others, even nation-states, carries no shame.

By analogy, you could claim people are “lesser skilled” drivers because they didn’t assemble their own cars. Try that in a bar and watch other patrons start to edge away from you. Keep it up long enough and you will have public accomodations for the night (jail).

Find, use, build upon and share any “…tactics, techniques and procedures (TTPs)…” that you find, nation-state or otherwise.

So will I.