How the internet undermines the value of talking

Nick Bilton writes: According to a producer in Hollywood, people have been staying clear of email and opting for cellphones over the past two weeks as studios have been bolstering firewalls and email systems. “Everyone has been doing business on their cellphone since this happened,” the person said, asking not to be named. “The reality is, every studio has emails in their system that would cause the [same] chaos if they came out.”

Or as Jenni Konner, a writer and executive producer for HBO’s “Girls,” said on Twitter Tuesday night: “The worst thing about the Sony hacks is people using the phone again.”

It’s not only people in Hollywood who are picking up the phone again in case of an email hack.

For the rest of us, the Sony hacking is just another example of how our emails are highly insecure. “Don’t put anything in an email that you wouldn’t want to see on the front page of The New York Times the next day,” said Brian Krebs, who specializes in cybercrime and operates the website Krebs on Security. “It’s like putting a postcard in the mail.”

“And you can’t unsay anything you’ve said on the Internet,” Mr. Krebs added.

What’s so terrible about having to use the phone?

I know — it requires that massively inconvenient social accommodation which requires people to share time.

Nowadays everyone thinks they should be able to control their own time without engaging in submissive forms of behavior like answering phone calls.

Text allows people to connect without sharing space or time.

The sacrifice however, is that text lacks the fluidity of speech. What is said can instantly be modified, modulated and shaped within the flow of conversation.

Instead of bemoaning the inconvenience of talking, maybe its time for everyone to reacquaint themselves with its value.

facebooktwittermail

FBI offers circumstantial evidence that North Korea is responsible for Sony hack

FBI statement: As a result of our investigation, and in close collaboration with other U.S. government departments and agencies, the FBI now has enough information to conclude that the North Korean government is responsible for these actions. While the need to protect sensitive sources and methods precludes us from sharing all of this information, our conclusion is based, in part, on the following:

  • Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks.
  • The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack.
  • Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea.

The emphasis above is mine.

It’s reasonable to assume that the hackers don’t want to get caught and thrown in jail. It’s also reasonable to assume that they would want to evade detection by disguising themselves as North Korean. An abundance of clues that this attack emanated from North Korean sources may just as likely indicate that it came from somewhere else.

Moreover, given that the U.S. government takes a firm position on refusing to pay ransoms for the release of hostages, why would they not have strongly advised Sony to refuse to capitulate in the face of implausible threats?

President Obama now says that Sony “made a mistake” by pulling the release of the film.

Hmmm… Maybe Sony will now reconsider its decision — they can pitch the release of The Interview as an appropriate form of retaliation and also take advantage of the most massive run of free publicity a movie has ever had.

Sony executives may honestly believe that this film is “desperately unfunny,” but at the end of the day, this isn’t about free speech — it’s about making money.

facebooktwittermail

Lessons from the Sony hack

Peter W. Singer and Allan Friedman write: The hack of Sony has often been lumped in with stories ranging from run of the mill online credit card theft to the Target, Home Depot and JP Morgan breaches to the time that Iranian-linked hackers allegedly “erased data on three-quarters of Aramco’s corporate PCs.” In fact, most of these crimes have little more in common than the fact that they were committed using computers. It’s a lot like lumping together every incident in New York that involves a gun, whether it’s a bank robbery, a murder or a football player accidentally shooting himself.

What made the Sony hack distinct is that it mixed an evidently organized effort, using advanced tools (what is known as an “advanced persistent threat”) that some have linked to the North Korean state, but with the goal of maximizing attention and embarrassment for the target. That is, they weren’t a few hackers phishing after any target, nor were they trying to keep quiet, so that they could continue to secretly exfiltrate data. Rather, they appear to have wanted to cause havoc — and make sure everyone knew.

Differentiating between these kinds of threats is critical, because different risks require different types of responses. The claims some have made that the Sony hack is an act of “cyberterrorism” are a case in point. The FBI definition of cyberterrorism requires “an act that results in violence,” which stealing scripts about James Bond carrying out acts of violence wouldn’t meet. This also applies to the recent threats by the hackers to create 9/11 style events at any movie theater that shows the film. Rapidly becoming an illustration on how not to handle online threats, virtually all the major U.S. theater companies have now said they won’t show the movie. Yet the ability to steal gossipy celebrity emails is clearly not the same as having the capacity to undertake physical attacks at thousands of movie theaters across the country. So, at least based on their actions so far, the “bitter fate” the hackers promised moviegoers is most likely to be the price they pay for popcorn. [Continue reading…]

facebooktwittermail

Hackers tell Sony ‘The Interview may release now’ — with edits

Ars Technica reports: In a message sent to company executives, someone claiming to represent the hacker group calling itself the Guardians of Peace has given Sony Pictures Entertainment the go-ahead to release the film The Interview — with some minor caveats. First of all, they want any death scene for Kim Jong-un dropped from the film.

“This is GOP. You have suffered through enough threats,” the message, which was also posted to Pastebin, read. “The interview may release now. But be careful. September 11 may happen again if you don’t comply with the rules: Rule #1: no death scene of Kim Jong Un being too happy; Rule #2: do not test us again ; Rule #3: if you make anything else, we will be here ready to fight.”

Sony dropped plans for the release of the film following the cancellation of screenings by major theater chains. [Continue reading…]

facebooktwittermail

Apple ‘failing to protect Chinese factory workers’

BBC News reports: Poor treatment of workers in Chinese factories which make Apple products has been discovered by an undercover BBC Panorama investigation.

Filming on an iPhone 6 production line showed Apple’s promises to protect workers were routinely broken.

It found standards on workers’ hours, ID cards, dormitories, work meetings and juvenile workers were being breached at the Pegatron factories.

Apple said it strongly disagreed with the programme’s conclusions.

Exhausted workers were filmed falling asleep on their 12-hour shifts at the Pegatron factories on the outskirts of Shanghai.

One undercover reporter, working in a factory making parts for Apple computers, had to work 18 days in a row despite repeated requests for a day off. [Continue reading…]

facebooktwittermail

Meet Alfreda Bikowsky, the senior officer at the center of the CIA’s torture scandals

Glenn Greenwald and Peter Maass report: NBC News yesterday called her a “key apologist” for the CIA’s torture program. A follow-up New Yorker article dubbed her “The Unidentified Queen of Torture” and in part “the model for the lead character in ‘Zero Dark Thirty.’” Yet in both articles she was anonymous.

The person described by both NBC and The New Yorker is senior CIA officer Alfreda Frances Bikowsky. Multiple news outlets have reported that as the result of a long string of significant errors and malfeasance, her competence and integrity are doubted — even by some within the agency.

The Intercept is naming Bikowsky over CIA objections because of her key role in misleading Congress about the agency’s use of torture, and her active participation in the torture program (including playing a direct part in the torture of at least one innocent detainee). Moreover, Bikowsky has already been publicly identified by news organizations as the CIA officer responsible for many of these acts. [Continue reading…]

facebooktwittermail

CIA analysis: ‘high-value targeting’ had limited effect against Taliban

The Washington Post reports: Raids, drone strikes and other military operations designed to capture or kill “high-value targets” in the Taliban have had little overall effect in part because of the militant group’s ability to replace leaders, according to a 2009 CIA analysis newly released by WikiLeaks.

The document, titled “Making High-Value Targeting Operations an Effective Counterinsurgency Tool,” is dated July 7, 2009, and was produced as the Obama administration grappled with whether to send additional U.S. troops into Afghanistan to launch widespread counterinsurgency operations and train the Afghan police and military. In December 2009, President Obama sent an additional 30,000 U.S. troops in to do just that, expanding the American military presence to more than 100,000 service members.

The CIA analysis released Thursday provides a new snapshot into the intelligence the White House and Pentagon were working with at the time. It acknowledges that “high-value targeting” had been conducted against the Taliban only on an intermittent basis at that point, with limited effect. Counterinsurgency operations conducted against the Taliban to that point had moderate effect, according to the report. The report also examined how the issue of targeting high-value enemy figures played out in other conflicts, including in Northern Ireland and Algeria. [Continue reading…]

facebooktwittermail

Backed by U.S. airstrikes, Kurds break ISIS siege of Mount Sinjar

The New York Times reports: Kurdish forces, backed by a surge of American airstrikes in recent days, recaptured a large swath of territory from Islamic State militants on Thursday, opening a path from the autonomous Kurdish region to Mount Sinjar in the west, near the Syrian border.

The two-day offensive, which involved 8,000 fighters, known as pesh merga, was the largest one to date in the war against the Islamic State, also known as ISIS and ISIL, according to Kurdish officials. It was also a successful demonstration of President Obama’s strategy for battling the extremist group: American air power combined with local forces doing the fighting on the ground.

A statement released Thursday night by the office of Masrour Barzani, the head of the Kurdistan Regional Security Council, called the operation “the single biggest military offensive against ISIS, and the most successful.” [Continue reading…]

facebooktwittermail

ISIS implicated in botched cyberattack

The Associated Press reports: A cyberattack aimed at unmasking Syrian dissidents has experts worried that ISIS is adding malicious software to its arsenal.

Internet watchdog Citizen Lab says an attempt to hack into systems operated by dissidents within the self-styled caliphate could be the work of hackers affiliated with ISIS.

Citizen Lab analyst John Scott-Railton said there is circumstantial evidence of the group’s involvement, and cautioned that if the group has moved into cyber-espionage, “the targets might not stop with the borders of Syria.”

The Nov. 24 attack came in the form of a booby-trapped email sent to an activist collective in Raqqa, Syria, that documents human rights abuses in ISIS’ de-facto capital. The activist at the receiving end wasn’t fooled and forwarded the message to an online safety group.

“We are wanted – even just as corpses,” the activist, whose name is being withheld to protect his safety, wrote in his message to cybersafety trainer Bahaa Nasr. “This email has a virus; we want to know the source.”

The message eventually found its way to Citizen Lab, based at the University of Toronto’s Munk School of Global Affairs. There, Scott-Railton and malware researcher Seth Hardy determined that it could act as a kind of electronic homing beacon by revealing a victim’s Internet Protocol address. [Continue reading…]

facebooktwittermail

I’m a soldier, I have no regrets, says ISIS Twitter promoter @ShamiWitness

The Times of India reports: “I’m a soldier and messenger. I don’t regret what I’ve done,” Mehdi Masroor Biswas, 24, told an advocate as a posse of policemen escorted him out of court hall 49, Civil Court Complex, Bengaluru, on Thursday.

Mehdi, arrested for operating a pro-ISIS Twitter handle, was remanded to 15 days in police custody by special judge Somaraju. One of the advocates asked Mehdi outside the courtroom, “Why did you do this, man?” Mehdi replied he had no regrets.

His parents were present in the courtroom. West Bengal-born Mehdi was as a management executive in an MNC, and allegedly worked as an ISIS propaganda activist, tweeting and retweeting thousands of messages. Arrested in the early hours of Saturday, Mehdi was produced before court on Thursday when his five-day police custody ended. [Continue reading…]

facebooktwittermail

Turkey’s emerging police state

Sinem Adar writes: When Recep Tayyip Erdogan was elected president this summer, the future of the Turkey seemed one of anxieties and unknowns. Since then, the political scene has been overwhelmed by growing despotic state power that functions through intense securitisation of state-society relations, on one hand, and an increasingly salient public discourse of morality that takes religion as its primary reference, on the other. The Justice and Development Party (AKP) government was shaken, one year ago by a corruption scandal. As of today, there has been no prosecution process over corruption allegations.

This massive corruption scandal was the peak point of the struggle between once-allies Erdogan and his cronies, on one hand, and the Islamic scholar Fethullah Gulen, whose name is associated with the leadership of the Hizmet movement. What followed was an extended crackdown on dissent, which is still going on.

The AKP government immediately responded to the corruption allegations by relocating and firing officers within the police force involved with the case. In addition, the public prosecutors working on the corruption lawsuits were relocated as well. [Continue reading…]

facebooktwittermail

The art of not trying

John Tierney writes: Just be yourself.

The advice is as maddening as it is inescapable. It’s the default prescription for any tense situation: a blind date, a speech, a job interview, the first dinner with the potential in-laws. Relax. Act natural. Just be yourself.

But when you’re nervous, how can you be yourself? How you can force yourself to relax? How can you try not to try?

It makes no sense, but the paradox is essential to civilization, according to Edward Slingerland. He has developed, quite deliberately, a theory of spontaneity based on millenniums of Asian philosophy and decades of research by psychologists and neuroscientists.

He calls it the paradox of wu wei, the Chinese term for “effortless action.” Pronounced “ooo-way,” it has similarities to the concept of flow, that state of effortless performance sought by athletes, but it applies to a lot more than sports. Wu wei is integral to romance, religion, politics and commerce. It’s why some leaders have charisma and why business executives insist on a drunken dinner before sealing a deal.

Dr. Slingerland, a professor of Asian studies at the University of British Columbia, argues that the quest for wu wei has been going on ever since humans began living in groups larger than hunter-gathering clans. Unable to rely on the bonds of kinship, the first urban settlements survived by developing shared values, typically through religion, that enabled people to trust one another’s virtue and to cooperate for the common good. [Continue reading…]

facebooktwittermail

Music: Bungalove — ‘Aphrodisiaco’

facebooktwittermail

Last year, the world pumped out more carbon pollution than ever before

Motherboard reports: Precisely at the moment that the climate depends on carbon pollution declining, worldwide emissions continue to boom. Case in point: 2013 saw yet another record carbon high, with 35.3 billion tons of CO2 entering the atmosphere.

That’s the finding of ​the European Union’s​ Joint Research Center, which released its annual report on global emissions today. The document tallies the emissions of fossil fuel power production—coal, oil, and gas—and emissions from industry, especially cement and metal manufacturing.

The record high was reached primarily thanks to developing, coal-hungry giants: “Sharp risers include Brazil (+ 6.2 percent), India (+ 4.4 percent), China (+ 4.2 percent) and Indonesia (+2.3 percent),” the report notes.

The US — the world’s largest historic greenhouse gas emitter — grew again after a brief pause, thanks to a return to coal. [Continue reading…]

facebooktwittermail

Who hacked Sony? It probably wasn’t North Korea

Regardless of who is responsible, the president views this as a serious national security matter — that is a very close paraphrase of White House Press Secretary Josh Earnest answering questions this afternoon about the Sony hacking.

OK. That’s it. The United States can now be declared certifiably insane!

The hacking may well have nothing to do with North Korea — it may indeed involve disgruntled Sony employees — and yet this is a serious national security matter?!

The only way that claim could marginally make sense would be if one fudged the definition of national security and said that it should include cybercrime committed by Americans targeting Americans — though by that definition, all crime would thence become an issue of national security.

Hollywood, the media, and the public all like stories. Narratives convey meaning in its most easily digestible form: a plot.

Sony Pictures made a movie, The Interview — a political action comedy which ends with the assassination of North Korean leader Kim Jong-un — and the North Koreans didn’t think it was funny. Indeed, they were so outraged they set about trying to make sure the movie would never be released. By yesterday afternoon they seemed to have succeeded.

The problem with this story is it’s probably a work of fiction — and maybe that shouldn’t be any surprise, given its source.

There’s one compelling reason to believe that the real story here has nothing to do with North Korea: in all likelihood the hackers were busy at work before anyone in the Democratic People’s Republic had even heard of Seth Rogen and James Franco.

Sebastian Anthony writes:

The hackers managed to exfiltrate around 100 terabytes of data from Sony’s network — an arduous task that, to avoid detection, probably took months. Given how long it would’ve taken to gain access to Sony Pictures, plus the time to exfiltrate the data, I think the wheels started turning long before North Korea heard about The Interview.

Even if we take the movie out of the equation, the hack just doesn’t feel like something that would be perpetrated by a nation state. The original warnings and demands feel like the attacker has a much more personal axe to grind — a disenfranchized ex employee, perhaps, or some kind of hacktivist group makes more sense, in my eyes.

So far, the sole purpose behind the Sony Pictures hack appears to be destruction — the destruction of privacy for thousands of employees, and the destruction of Sony’s reputation. Much in the same way that murder is a crime of passion, so was the hack on Sony Pictures. Bear in mind that the hackers gained access to almost every single piece of data stored on Sony’s network, including the passwords to bank accounts and other bits of information and intellectual property that could’ve been sold to the highest bidder. The hackers could’ve made an absolute fortune, but instead opted for complete annihilation. This all feels awfully like revenge.

Really, though, the biggest indicator that it was an inside job is that the malware used during the attack used hard-set paths and passwords — the attacker knew the exact layout of the Sony Pictures network, and had already done enough legwork to discover the necessary passwords. This isn’t to say that North Korea (or another nation state) couldn’t have done the legwork, but it would’ve taken a lot of time and effort — perhaps months or even years. A far more likely option is that the attack was carried out by someone who already had access to (or at least knowledge of) the internal network — an employee, a contractor, a friend of an employee, etc.

Before the hacking became public, Sony executives received what looked like a fairly straightforward extortion demand — a demand that made no reference to The Interview.

In the digital variant of a note pasted together from letters cut out of a newspaper, the extortion note came in broken English.

We’ve got great damage by Sony Pictures.
The compensation for it, monetary compensation we want.
Pay the damage, or Sony Pictures will be bombarded as a whole.
You know us very well. We never wait long.
You’d better behave wisely.
From God’sApstls

Maybe there are indeed some telltale signs in the syntax or maybe the author took advantage of Google and Bing’s translation-mangling capabilities by writing in English, translating in Korean (or any other language) and then translating back into English.

If the story here is really about extortion, then to recast it as political probably serves the interests of all parties — including North Korea.

No corporation wants to be publicly exposed as having capitulated to extortion demands — it would much rather hand over the money in secret while portraying itself as a political victim of the hostile foreign government. The North Koreans get the double reward of being credited with a hugely successful act of cyberwar while also getting removed from Hollywood’s list of favorite countries to target. And the Obama administration is able to sidestep a much larger a thornier issue: how to protect the American economy from the relentlessly growing threat of from global cybercrime whose points of origin are notoriously difficult to trace.

Finally, there is another theory about the real identity and motive of the hackers: they are Sony employees begging that no more Adam Sandler movies be made.

facebooktwittermail

Sony leaks reveal Hollywood is trying to break the internet

The Verge reports: Most anti-piracy tools take one of two paths: they either target the server that’s sharing the files (pulling videos off YouTube or taking down sites like The Pirate Bay) or they make it harder to find (delisting offshore sites that share infringing content). But leaked documents reveal a frightening line of attack that’s currently being considered by the MPAA: What if you simply erased any record that the site was there in the first place?

To do that, the MPAA’s lawyers would target the Domain Name System (DNS) that directs traffic across the internet. The tactic was first proposed as part of the Stop Online Piracy Act (SOPA) in 2011, but three years after the law failed in Congress, the MPAA has been looking for legal justification for the practice in existing law and working with ISPs like Comcast to examine how a system might work technically. If the system works, DNS-blocking could be the key to the MPAA’s long-standing goal of blocking sites from delivering content to the US. At the same time, it represents a bold challenge to the basic engineering of the internet, threatening to break the very backbone of the web and drawing the industry into an increasingly nasty fight with Google. [Continue reading…]

facebooktwittermail

Malware used to attack Sony was the software equivalent of a crude pipe bomb

Ars Technica reports: According to multiple reports, unnamed government officials have said that the cyber attack on Sony Pictures was linked to the North Korean government. The Wall Street Journal reports that investigators suspect the attack was carried out by Unit 121 of North Korea’s General Bureau of Reconnaissance, the country’s most elite hacking unit.

But if the elite cyber-warriors of the Democratic People’s Republic of Korea were behind the malware that erased data from hard drives at Sony Pictures Entertainment, they must have been in a real hurry to ship it.

Analysis by researchers at Cisco of a malware sample matching the MD5 hash signature of the “Destover” malware that was used in the attack on Sony Pictures revealed that the code was full of bugs and anything but sophisticated. It was the software equivalent of a crude pipe bomb.

Compared to other state-sponsored malware that researchers have analyzed, “It’s a night and day difference in quality,” said Craig Williams, senior technical leader for Cisco’s Talos Security Intelligence and Research Group, in an interview with Ars. “The code is simplistic, not very complex, and not very obfuscated.” [Continue reading…]

facebooktwittermail

North Korea is not funny

After The Interview got shelved, Adrian Hong writes: This film is not an act of courage. It is not a stand against totalitarianism, concentration camps, mass starvation, or state-sponsored terror. It is, based on what we know of the movie so far, simply a comedy, made by a group of talented actors, writers, and directors, and intended, like most comedies, to make money and earn laughs. The movie would perhaps have been better off with a fictitious dictator and regime; instead, it appears to serve up the latest in a long line of cheap and sometimes racism-tinged jokes, stretching from Team America: World Police to ongoing sketches on Saturday Night Live.

Humor can be a powerful tool for surviving in a closed society, and lampooning dictators can lend latent popular movements the confidence they need to challenge their oppressors. In Libya, dissidents heaped mockery on the Qaddafi family in the early stages of their Arab Spring revolution. In the Soviet Union, activists like Natan Sharansky employed dark humor to weather persecution and labor camps. In a “confrontation with evil,” Sharansky once observed, it is important “to take yourself and everything that’s happening very seriously, to understand that you are part of a very important historical process, and that’s why everything [that] you’ll say and do has tremendous importance for the future.” Nevertheless, he added, “it’s very important not to take anything seriously, to be able to laugh at everything, at the absurdity of this regime, at this KGB prison, and even at yourself.”

Yes, North Korea has long been ruled by an eccentric dynasty of portly dictators with bad haircuts. Yes, the propaganda the regime regularly trumpets to shore up its cult of personality is largely ridiculous. And yes, we on the outside know better, and can take comfort in pointing fingers and chuckling at the regime’s foibles.

But it takes no valor and costs precious little to joke about these things safely oceans away from North Korea’s reach. When a North Korean inmate in a political prison camp or a closely monitored Pyongyang apparatchik pokes fun at Kim Jong Un and the system he represents—that is an act of audacity. It very literally can cost the person’s life, and those of his or her family members. To pretend that punchlines from afar, even in the face of hollow North Korean threats, are righteous acts is nonsense. [Continue reading…]

facebooktwittermail