Category Archives: Security

Is it Whack to Hack Back a Persistent Attack?

The title of this blog post is from our 2013 RSA Conference panel presentation on the ethics and business of “hack back”, a stage we shared with CrowdStrike and Trend Micro.

It was based on 2012 presentations we had been giving to explain an ethical business model for hack back, based on setting international precedent and trial: a working legal framework for self-defense using information technology.

We had a fairly large turn out those years, and I’ll never forget CrowdStrike’s founder demanding that no recordings be allowed for our panel.

He wanted no press coverage.

I found that highly annoying because the WHOLE point of our efforts at the time was to raise awareness to bring MORE scrutiny, transparency and therefore ethics into the market.

And then CrowdStrike basically took a $50m self-loan and went on to becoming yet another American Anti-Virus company with ties to the FBI, moving the dial not an inch.

Fast forward and I’m here today to say the sad news from the NSA didn’t have to turn out this way.

David Evenden was hired in 2014 to work in Abu Dhabi on a defensive cybersecurity project, only to discover it was actually an offensive spy operation for a United Arab Emirates intelligence service.

Obviously things really took off around this time Evenden mentions.

I gave several talks after 2013 where I implored people to understand that “hack back” was very active even if people continued trying to keep it secretive.

Why so secretive? One reason obviously is entrapment of those recruited to do the technical work.

Once in Abu Dhabi, Evenden realized he had been deceived and that he and colleagues had actually been recruited to perform offensive hacking operations and surveillance on behalf of the UAE’s National Electronic Security Authority, or NESA (the UAE’s equivalent of the NSA).

The deception didn’t initially concern Evenden, however, because the work was primarily focused on conducting surveillance against would-be terrorist targets.

Ugh. Deception is a very loaded word here.

This is a text-book example of exactly what in 2013 we were working so hard on to avoid. Even if Evenden is lying, he can do so on the basis that deception is very easy when there’s zero transparency built in the system.

Evenden goes on to say literally the exact thing we discussed in our panel of 2013, which as I said was censored by CrowdStrike.

I’m an American and I want to target something overseas. What’s going to happen to me? Nothing. Almost nothing. We just proved that…

Even in 2017 I was on a panel at BSidesLV called “Baby got hack back” where I implored people again to consider how much of it was going on already without transparency or accountability.

It wasn’t a hypothetical for me in 2012. It certainly wasn’t in the news enough in 2017 (there was an audible gasp from my audiences) yet should have been.

Even if these stories would have been published sooner, more importantly an opportunity was missed to run and test far better guidelines for the market to reduce deception and confusion about legal hack back.

So I guess the point here is that this “proof” story is a decade after we very clearly said it’s a viable business plan, with activities mostly obscured and hidden from view, such that it needed open discussion already to avoid errors (e.g. criminal charges).

How to braid hair (“corn rows”) for secret messaging

What does your hair communicate? I don’t mean about you, I mean communicate on its own. Can you think of it as a canvas to write a story, or send an ephemeral signal?

Source: Etsy Shop “Claire” Black History Month SVG

During the Cold War the CIA allegedly trained agents to message using variations of shoe lacing, among other clothing alteration strategies.

A “Recognition Signals” instructional manual was distributed in 1953 by a magician named John Mulholland (MKUltra Subproject Number 4, as reproduced by The Official CIA Manual of Trickery and Deception by
H. Keith Melton and Robert Wallace):

The first suggestion is to have the shoelace run as a double strand through the
eyelets nearest the instep, i.e., toward the toes. First, the shoestring is cut in half. Then
the tip of one lace is pushed from the inside of the shoe up through one hole, across the
instep, and down through the opposite hole. The tip of the other half is treated in the
same way but is started from the opposite side. While the cut ends still are outside the
shoe, each is tied, with a slipknot, around the other lace. The tips of the laces then are
drawn so as to have the two knots inside the shoe and each by one of the eyelets. (See
illustration.) The shoe then is laced in the normal way. For one who is looking for such a
possibility, the double lace is easy to distinguish. It will never be seen by one not
particularly looking for it. Though it will not be noticed, it is without reason except to
mend a broken lace were the shoes to be examined.

Because shoelaces are inserted in shoes in three standard ways, any deviation in
these ways becomes useful for signaling. On other pages are illustrations of the standard
ways of lacing shoes and several ways in which shoes could be laced but never are. None
of these alternate ways will attract attention, yet each is very obvious to one looking for
such a signal.

The manual goes on to say things like a neck tie should expose two buttons on a shirt so that the sizes can be alternated to transmit a message. Clothing indeed can easily be altered and be subtle enough to communicate without detection.

So what about hair?

What this “old” manual seems to never mention, which I find a bit strange, is how hair designs can factor into secret messaging.

Even though it has been used like clothing as a signaling device for hundreds if not thousands of years, somehow hair doesn’t show up in 1950s American spy tactics.

Afro-Columbian women, as reported in 2011 by the Washington Post for example, encoded “messages of freedom” into their hair style.

In the time of slavery in Colombia, hair braiding was used to relay messages. For example, to signal that they wanted to escape, women would braid a hairstyle called departes. “It had thick, tight braids, braided closely to the scalp and was tied into buns on the top.

And another style had curved braids, tightly braided on their heads. The curved braids would represent the roads they would [take for] escape. In the braids, they also kept gold and hid seeds which, in the long run, helped them survive after they escaped.

A contest in 2015 called ‘Tejiendo Esperanzas‘ (Knitting Hope), celebrating emancipation from slavery, was even reported by the DailyMail with laces woven into braids.

Source: DailyMail

This kind of multi-braid hair style was developed and worn over thousands of years, including by world famous royalty like Cleopatra or Nefertiti.

Source: DeAgostini/Getty Images

One might think that it thus would figure as a classic or common style and remain unnoticed.

Aside from feeding into racial ideologies and discrimination based on appearance, some research indicates that details of “messaging” hair styles may have been ignored until much later in history if noticed at all.

My analysis contradicts the finding that eighteenth-century advertisements “very frequently” described runaway slaves’ hair. It may be that longer post-Revolutionary and nineteenth-century advertisements were more likely to focus on details like hair. It may also be that the often-cited compelling descriptions of African American hairstyles were exceptions rather than the rule.

Perhaps some of the secrecy embedded into hair styles could be attributed also to “head rags” or “kerchief” used to hide hair, often from requirements to keep the head under cover.

Concealment was driven not least from late 1700s racism in America that shamed “kinky” and curled hair, leading to ideas like “tignon” of the Louisiana territory being required by 1785 law, or even structured signaling using head coverings.

A South Carolinian who trafficked humans indeed regulated things like a white turban be worn by a chief house servant, obliterating any appearance of natural black hair, while house servants had to cover with a bandana.

…the headwrap was to maintain Southern white power in a society based economically and socially on racial slavery. Noteworthy in this respect are the ordinances which regulated African American dress throughout the South during the eighteenth century. In effect, whites used these dress codes to outwardly distinguish those without power from those who held it.

Underneath, however, remained a “wrapping” often using thread or string with hair parted into sections and rows. Perfect for concealing a message, like a letter inside an envelope.

With all that in mind, I’ll now give you three guesses why thousands of years of design and messaging with black hair is never mentioned in the CIA guide to secrets.

And also you should guess why in America it’s “illegal to braid hair without a license“.

To get a license, Jestina would have to spend more than a year in cosmetology school. Tuition would cost $16,000 dollars or more.

Hint: it’s not consumer safety or harm, as argued in the report, although it is related to fear of what is broadly messaged by corn rows (e.g. black liberty and freedom of expression).

VR Guide: How to Tell if You Prefer Reality to Illusion

If there’s one thing i learned in my early philosophy classes, it’s the difference between illusion and reality is a desire to achieve meaningful change in others’ lives.

Illusion is for those who can’t stand a notion of doing service that benefits society, which is why it’s odd to see people pitch it as a service training tool.

It could also help clinicians to collaborate on treatments for patients, and make patients feel more involved and informed in the process. Doctors could view, feel and discuss the features of tumour cells, and show patients plans for a medical procedure.

I have to admit I make the same mistake. I keep imagining a VR tool based in history that presents the real world with an overlay to explain disinformation (e.g. when you see streets in Louisiana, it exposes the systemic racism and terrorism).

This is a real development with real street names:

Can you see better the plans for a… harm reduction procedure?

Then I look at history degree enrollment decline and figure very few people (certainly not a mass market) probably want to use the power of story-telling (illusion) to benefit others. Where’s the fun, money, social entry, etc in that?

Tesla Defines “Good Driver” Based on 7 Days Out of 730

There is so much proof now that Tesla is not intelligent, doesn’t learn, and is a scam based on short-cuts… it should come as no surprise they’re defining “good driver” with almost no data.

“If driving behavior is good for 7 days, beta access will be granted.” (The company began selling insurance in its home state of California in August 2019.)

After two years of selling insurance, Tesla will use its own insurance data from 7 days prior to a button being pushed by the driver to define whether that driver is “good”.

This obviously fails to use independent evaluation and gives the driver an obvious way to avoid being judged accurately. It’s just more proof Tesla has no intention of keeping roads safe.

It should be called “autocratic” driving.

More to the point here, look at these quotes from Elon Musk (in my latest presentation).

Then look at this quote, which is obviously full of lies.

Tesla CEO Elon Musk, who called a previous version of FSD Beta software “not great,” cautioned Friday evening that FSD Beta now seems so good it can give drivers a false sense of security that they don’t need to pay attention to driving while FSD Beta is engaged, even though they do have to remain attentive and at the wheel.

With a small group of FSD drivers, there has been a lot of evidence the car is getting worse and it’s manifestly unsafe.

Multiple near-misses are being documented where the Tesla is pushing the driver into crashing.

And this is being turned into a message from the CEO that “seems so good it can give drivers a false sense of security”? It’s the CEO who is giving them this sense, and those who repeat his lies.

It’s completely disingenuous and obviously negligent of the company to even hint that the car is to blame for driver overconfidence, but it also goes back to the CEO arguing people will be killed if they are warned they might be killed.