Category Archives: Security

Cyberwar and Drugwar: “Metaphors We Live By”, by Lakoff and Johnson

The book “Metaphors We Live By” was published in 1980 and required linguistics reading when I attended college many years ago.

It’s been coming up a lot lately, as people start to realize that disinformation is an area of security thousands of years old.

Here’s a quick explanation of the book’s thesis:

One of the most useful applications of this old book for me has been to explain how a rhetoric of war is overused in information security. It undermines a practice of computer security as a science.

Technology giants and governments pour time and money into loose concepts of “cyber war” yet remain mostly unprepared for even the most banal and predictable integrity issues (e.g. “deep fakes“).

As another example the “war on drugs” has even more documentation of failure. It was a concealed racist metaphor initiated by President Nixon to silence American political speech and incarcerate Blacks on false pretense.

The Nixon campaign in 1968, and the Nixon White House after that, had two enemies: the antiwar left and black people. You understand what I’m saying? We knew we couldn’t make it illegal to be either against the war or black, but by getting the public to associate the hippies with marijuana and blacks with heroin, and then criminalizing both heavily, we could disrupt those communities. We could arrest their leaders, raid their homes, break up their meetings, and vilify them night after night on the evening news. Did we know we were lying about the drugs? Of course we did.

This has been widely discussed by historians so shouldn’t surprise anyone. Technology giants and government in the 1960s used drugs as a metaphor for Blacks, turning the country backwards into President Wilson’s (KKK) race war platform of the 1910s.

If that fact surprises anyone, they’re probably going to be angry they have been taught lies due to some “Young Turks”.

Gerald Ford became President of the United States after he rose to prominence in a right-wing group called “Young Turks” and Nixon chose him as VP. Donald Rumsfeld also was a “Young Turk”.

The “war” on drugs was initiated and waged by a radical Republican faction known as “Young Turks“. Although it now frequently is declared “lost”, as drugs are more widely sold and used in America than ever I don’t know anyone who brings the loss back to those who came up with the metaphor.

In 1960 he was mentioned as a possible Vice Presidential running mate for Richard Nixon. In 1963 a group of younger, more progressive House Republicans—the “Young Turks”—rebelled against their party’s leadership, and Mr. FORD defeated Charles Hoeven of Iowa for chairman of the House Republican Conference, the number three leadership position in the party. In 1963 following the assassination of President John F. Kennedy, President Johnson appointed GERALD FORD to the Warren Commission that investigated the crime. […] In the wake of Goldwater’s lopsided defeat at the hands of Lyndon Johnson, GERALD FORD was chosen by the Young Turks to challenge Charles Halleck for the position of minority leader of the House. With the help of then- Congressmen Donald Rumsfeld and Bob Dole, Mr. FORD narrowly upset Halleck.

Despite all the “Young Turk” leadership driving over-militarized U.S. interventions to incarcerate or assassinate non-whites and silence political opposition, they instead turned military bases into a “symbol of our definitive loss“.

Get-tough measures on part of police and prosecutors have done nothing to reduce the demand for narcotics, and demand will always beget supply. The 50-year history of the failed War on Drugs has taught nothing if not that. Perhaps there is no greater symbol of our definitive loss in that interminable war than Fort Bragg itself. From this flagship base, the beating heart of the U.S. special-operations complex, the military apparatus behind the global War on Drugs deploys to the far corners of the world. Green Berets train security forces in countries like Colombia, El Salvador, and Honduras. Delta Force reportedly took part in the anti-cartel operations that killed Pablo Escobar and captured El Chapo Guzmán. Yet drive down Bragg Boulevard into the Bonnie Doone neighborhood of Fayetteville, and in between the storage facilities, mobile-home dealerships, and tattoo parlors, you will find roach motels full of addicts, indigent veterans camped out beneath bridges, and strung-out junkies hanging around boarded-up trap houses. The dismal tide of synthetic opioids and amphetamines has penetrated Fort Bragg’s high-security gates, permeated through to the lowliest privates’ barracks, and caused at least a dozen overdose deaths in just the last year. These dead soldiers, who far outnumber combat casualties, are clearer proof of the United States’ unequivocal defeat in its longest-running international military campaign than a white flag run up over the main parade field. As the old saying goes: The War on Drugs is over — drugs won.

See the problem with the metaphor?

A “war” to criminalize an “antiwar left” and Black Americans never really intended to stop drugs. Assassinating non-white leaders considered “too left” did basically nothing to end a drug crisis because that’s obviously not how anyone would go about reducing production and use of drugs, especially since white leaders are heavily involved in the drug crisis too yet escape justice.

Unfortunately it still gets talked about in terms of drugs instead of politics and race because the metaphor became so ingrained.

How many white Americans hate non-white immigrants? Far more today than if there had not been a “war” trying to convince them non-whites are drug users.

Thus returning to the early 1900s race war (e.g. Red Summer) by another name is what really came from the metaphor — turning Americans into a mindless militant crusade against other Americans — and so you still see today a rhetoric from the Republican extremists about drug this and that when they really mean non-whites.

In that sense Nixon, Ford, Rumsfeld, Reagan… were all really a sad repeat of Prohibition-era racism, which also worked too well. The KKK had a policy of assassination and incarceration of Blacks hidden inside an anti-alcohol platform.

The KKK’s war on alcohol as much as the “war” on drugs has failed, in other words they succeeded in both cases seriously destroying political power and American prosperity of other Americans (non-whites). America did not completely stop alcohol production or consumption (mostly shutting down non-white distilleries, breweries and taverns while giving exception licenses to whites), and instead used its government for excessive violence against Blacks. Today we know whites and conservatives sell and make heavy use of drugs yet the Nixon (and later Reagan) concept of this “war” never intended to target them.

Cyber and drugs are just two examples of how “war” has become the unfortunate metaphor that Americans still live by. Maybe the book should have been titled Metaphors We Live For?

Or, to put it like a recent book about Pentagon growth, “Everything became war and the military became everything”.

Albania Breaks Ties With Iran After 2022 Microsoft Investigation of CVE-2019-0604

The U.S. is very confidently accusing Iran of attacking Albania, based on yesterday’s report by Microsoft about Microsoft’s usual software vulnerabilities and mis-configurations.

Microsoft assessed with high confidence that on July 15, 2022, actors sponsored by the Iranian government conducted a destructive cyberattack against the Albanian government, disrupting government websites and public services. At the same time, and in addition to the destructive cyberattack, MSTIC assesses that a separate Iranian state-sponsored actor leaked sensitive information that had been exfiltrated months earlier. Various websites and social media outlets were used to leak this information. […] A group that we assess is affiliated with the Iranian government, DEV-0861, likely gained access to the network of an Albanian government victim in May 2021 by exploiting the CVE-2019-0604 vulnerability on an unpatched SharePoint Server, administrata.al (Collab-Web2.*.*), and fortified access by July 2021 using a misconfigured service account that was a member of the local administrative group. Analysis of Exchange logs suggests that DEV-0861 later exfiltrated mail from the victim’s network between October 2021 and January 2022.

The report unfortunately is not titled “What are you even doing running Sharepoint in 2021” and instead uses this far more provocative line:

Microsoft investigates Iranian attacks against the Albanian government

Just a decade ago many experts in the security industry warned against investigations being so overtly bold or confident with their attribution statements. The fear was rooted in dubious logic that someone could make a mistake and therefore shouldn’t even try.

I mean if that was sound logic Sharepoint would have never been released to the public. Ok, maybe there’s some truth to that logic.

But seriously, anyone in any history 101 class knows you can’t let perfect be the enemy of good when writing reports about what happened in the past. Of course you can get attribution wrong, which is in fact why you should try hard and make sure you do it well.

It feels like a very long ago time ago (but really only 2014) that I gave a counter-argument to fears about uncertainty, in a presentation to incident response teams in Vienna, Austria basically saying it’s time for attribution.

Looking back at my slides, honestly I think I tried too hard to make data integrity funny. Attribution is less complicated by some unique thing about computers than it is by things about people like this: Americans are more likely to want to intervene in places they can’t find on a map (click to enlarge and have a sad laugh).

Here’s another one, where I poked fun at FireEye for making very crude and rube attribution mistakes and surviving (they’re still in business, right?).

Now look how far the world has come!

Microsoft shakes heavy doses of political science into its computer forensics reports like it’s powdered sugar on a Turkish delight.

  • The attackers were observed operating out of Iran
  • The attackers responsible for the intrusion and exfiltration of data used tools previously used by other known Iranian attackers
  • The attackers responsible for the intrusion and exfiltration of data targeted other sectors and countries that are consistent with Iranian interests
  • The wiper code was previously used by a known Iranian actor
  • The ransomware was signed by the same digital certificate used to sign other tools used by Iranian actors

[…] A group that we assess is affiliated with the Iranian government, DEV-0861…
[…] The geographic profile of these victims—Israel, Jordan, Kuwait, Saudi Arabia, Turkey, and the UAE—aligns with Iranian interests and have historically been targeted by Iranian state actors, particularly MOIS-linked actors.
[…] The cyberattack on the Albanian government used a common tactic of Iranian state sponsored actors…
[…] The wiper and ransomware both had forensic links to Iranian state and Iran-affiliated groups. The wiper that DEV-0842 deployed in this attack used the same license key and EldoS RawDisk driver as ZeroCleare, a wiper that Iranian state actors used in an attack on a Middle East energy company in mid-2019.
[…] Multiple other binaries with this same digital certificate were previously seen on files with links to Iran, including a known DEV-0861 victim in Saudi Arabia in June 2021
[…] The messaging, timing, and target selection of the cyberattacks bolstered our confidence that the attackers were acting on behalf of the Iranian government. The messaging and target selection indicate Tehran likely used the attacks as retaliation for cyberattacks Iran perceives were carried out by Israel and the Mujahedin-e Khalq (MEK), an Iranian dissident group largely based in Albania that seeks to overthrow the Islamic Republic of Iran.
[…] The messaging linked to the attack closely mirrored the messaging used in cyberattacks against Iran, a common tactic of Iranian foreign policy suggesting an intent to signal the attack as a form of retaliation. The level of detail mirrored in the messaging also reduces the likelihood that the attack was a false flag operation by a country other than Iran.

Done and dusted. Need I continue?

It is nice to see such definitive and detailed work about attribution as if it’s a normal investigation with regular analysis methods… but it’s even nicer to read Albania has announced they’re cutting ties with Iran. And then… to see the U.S. follow-up with announcements about sanctions, it’s like why didn’t Microsoft start doing this way back in 1986 instead of for decades completely ignoring security as a get-rich scheme?

The Moonbeam Song

by Harry Nilsson from the “Nilsson Schmilsson” album (1971)

Have you ever watched a moonbeam
As it slid across your windowpane
Or struggled with a bit of rain
Or danced about the weathervane
Or sat along a moving train
And wondered where the train has been

Or on a fence with bits of crap
Around its bottom
Blown there by a windbeam
Who searches for the moonbeam
Who was last seen
Looking at the tracks
Of the careless windbeam
Or moving to the tracks
Of the tireless freight train
And lighting up the sides
Of the weathervane
And the bits of rain
And the windowpane
And the eyes of those
Who think they saw what happened

Have you ever watched a moonbeam
As it slid across your windowpane
Or struggled with a bit of rain
Or danced about the weather vane
Or sat along a moving train
And wonder where the train has been?

Looking at the tracks
Of the careless windbeam
Or moving to the tracks
Of the tireless freight train
And lighting up the sides
Of the weathervane
And the bits of rain
And the windowpane
And the eyes of those
Who think they saw what happened

Paul’s Security Weekly #753. “Data Integrity Lights the Way: Security With the Decentralized Web”

The PSW crew were kind enough to invite me on for a discussion with them about data integrity and decentralized web.

There’s a lot of worry about “fakes” especially in a world rapidly adopting AI/ML, so it’s time for solutions. “Solid” is the W3C open standard, extending HTTPS, to upgrade the Web with security paradigms that solve for data integrity. Distributed systems naturally break through digital moats, free control through proper ownership, thus helping expand and achieve the best of the Internet.