Schneier on Security

anonymous script doctor • June 4, 2015 1:11 PM

I think there is a murder of words going on here, just a bit, and I would like to subject my theories to your esteemed considerations. To shed some light on a very mysterious matter.

http://karpathy.github.io/2015/05/21/rnn-effectiveness/

Before this Russian troll debacle, which clues were accidentally hacked out by Anonymous, there was the American troll debacle. You may recall that Anonymous, there, as well, supplied that leak, as led by the Master Troll of Weev and Sabu. They hacked HBGary Federal, and discovered a treasure trove of highly senstive data, including their plot to provide a system of multiple identities to the US Government. Here, we might ask ourselves, “Who, then, is Anonymous”.

But, that is not an important question. What is a much more important question is to look again at the myths of strange online phenomena such as the behavior of certain online crowds and posters. You might notice that, years ago, a certain nation state well perfected the art of taking in input files such as a large collection of postings and outputting seemingly real posters on a frequent or infrequent basis. These systems operate off of hacked systems and the only material they steal is the owner’s name and other name’s found in the owner’s system. It is a manner of distributed network. A sort of round robin sequence is used, and the system is designed to be undetectable. It does not spam from any particular address, but just posts very, very, very infrequently.

You have seen this sort of mass distributed system at work on places where Anonymous has frequented. A key element to that manner of operation does involve a level of persistent identities. This is why it has been very difficult for authorities to actually investigate these manner of groups.

Another element of this system is its’ capacity to provide meaningful garbage to other automated NLP analysis systems.

There is, however, a significant flaw in that mechanism, I have discovered: namely, you can perform NLP analysis on that murder of posters identities and pinpoint likely real suspects for whom the distributed network is actually working for.

I was alerted to this scenario by a colleague of mine, who alarmed me by pointing out the supposed “GCHQ Twitter Dreadbot” was actually not GCHQ but a sophisticated FSB neural network system designed to attack likely GCHQ targets and spew out GCHQ seeming garbage. That very same colleague pointed me to a post at computer security forum detailing doubts about the analysis performed by Kaspersky Anti-Virus. It was pointed out that Kaspersky himself went straight from the FSB to founding that company.

A case of where the spider catches the fly, so that the spider can intentionally miss catching some flies, and the low level necessary access of the AV system, can, its’ self be subverted easily by a seemingly normal AV signature file update, and then be quickly reverted back by another seemingly normal AV signature file update. This, of course, on an individual level, and not a matter of mass injection programming and change back. Which would be highly noisy and easily detectable.

My colleague pointed out the sudden reaction of a very real Russian FSB officer posting this exact manner of drivel. He further went on and painted the Kaspersky “Equation Group” study as “complete fiction”. In order to enhance and maintain his cover among the unsuspecting students.

At times, this poster cleverly assumes the identities of previous posters, even mimicking their capacity for speech. He may appear as a female. He may appear as an American. But he is no more American then his grandfather was not riding a tank into Berlin after the war.

(My own fascination with these clever Russian spies operating in foreign nations started when I “accidentally” obtained a job working on the movie project “Salt”. That same person who got me that job gave unusual information to me about real Russian spies and indicated that there might be more to the “Salt” job [a meager ‘script doctor’ job] then he was letting on. He said something about “timing of the release” and “evidence. So, when Salt was released at nearly the same time as the big hooplah over the discovery and ejection of a bunch of deep cover Russian spies, I was shocked. He knew about it, yet, I could not pin him on it. He made it clear, yet, I could not prove it to anyone else. But, my own self.)

As for my own self, I made it clear that I was told there was a Russian agent in their midst. But, clearly, no one listened to me.

anonymous script doctor • June 5, 2015 12:32 PM

@”Another Guy”

Sorry for feeding the troll.

burp and, on reflection, sigh.

I will go ahead and explain “what was said there and why”, as opposed to leaving matters up to speculation by non-targets. The majority crowd here is a non-target. They are unlikely to respond to such posts, and unlikely to be bothered by them. Because the posts are not designed to hit at them.

A real troll is quite the opposite. They hit at a group with a very inflammatory message designed to cause chaos. They will forego reasoning and be unable to argue anything reasonably. Either reason entirely evades them, they do not really believe what they are saying and are merely trolling, they have some more sophisticated agenda (which is obvious, like trying to get people’s “real” opinions though that is a horrible tactic to use for that because it encourages false opinions back merely mirroring their behavior), or, of course, they really just do not have any solid reasoning behind their beliefs. They have never really thought about their beliefs, independently, and are lacking in their capacity for reasoning, in general.

“Do not feed the troll” is a very basic slogan used all across the internet, on forums very far less intelligent then this one. It has value. And it has value here. I have seen it engage, and it has some effect. But, it does not rid the trolls. More then one tactic needs to be employed, and should be expected from a more intelligent crowd focused on highly esoteric security matters. For instance, one poster trails trolls with a certain tone of voice and approach. I do not disagree with their tactic. It has value, especially coupled with the shunning approach also usually employed.

There is another reason why that tactic is not entirely successful here. That is the shunning tactic. That is because while these comments do not have a very wide range audience (the diversity belies this fact or lack thereof), there is some chance it may attract some trolls of an alternate agenda. In some cases, that alternate agenda can be dangerous, so alternative tactics are required for some posters.

Sloganeering security has its’ use. It helps validate social values and tactics. However, it typically is not always the best course of action when it comes to communications security. This is because people are diverse in their perspectives. Therefore, repeating the same tactic often brings no change in result, one should change their tactic. This is the major reason people do not do things asked of them. It is also, by Einstein’s good definition, the definition of “insanity”.

1. the airplane observation – just my basic conclusion, it is useless, and a bad, money wasting tactic to use. I also dislike it from the angle that it is representational of a lean towards domestic totalitarianism. I am not opposed to good policing. Bad policing is when a government’s basis of authority is starting to decay.
2. The 24/7 surveillance of the knife wielding Islamist which had gone on for years without detection. Frankly, I am not for always providing only examples of bad policing, if there is good policing, that is worth comment on. Contrasting that: right subject, difficult to disagree with that, right tactics, not employing significant hassling or old “cointelpro” “techniques”, and it was appropriately stealthed. People who only throw out the negative can get into “crying wolf”. Decay does not happen like that. This applause is a bit controversial to the crowd, but I do not really think so. It is also desensitizing: are the regular posters extreme Islamists? No. Very far from it. Contrary to the espoused or obviously secret view of some of the real trolls. And, by contrast, this also condemns such highly bad moves in regards to domestic surveillance, especially of the abhorrent dragnet ‘target innocent civilians’ variety. This hits at the core of their belief: that their system has any validity even for sheer effectiveness, at all. It surely does not.

The “SSG” comment accompanying that further highlighted that fact, for anyone who might know what SSG is. Partly sarcastic, SSG was likely involved. But that would tell that manner of audience to “pay attention”.

1. A blow off response given to a suspected troll poster was given. They are not as they are presenting themselves. So, multiple tactics have been used with them. That could be a good “not as they present themselves”, or a “bad”. I suspect a “bad”. That is, instead of putting the cards on the table, inching them just a little closer to the chest.

2. The “creepy” poster post was made with the ambiguous name “Sam Waters”. The name of the female FBI profiler in “The Profiler”. That was intended to cue peripheral observation. The depiction was entirely absurd and made partly in jest. The list of criteria of the “profile” was taken from a recent study performed on the “components of creepiness”. It had multiple purposes: to put in an image difficult to “unsee” thereby clouding other gestalt imagery people often rely on; to make the objective of attribution a mockery, a joke so it can be seen as what it is and downplay the absurd, slanderous opinions of some trolls; to be amusing to some audience members; and, if anything escalates, to send out someone matching this description in person to the necessary individual. Such an effect would unsettle them, confuse them, and alarm them (they would be unlikely to process it until the meeting expired), but the ultimate objective would be to introduce to their skeptical minds both the reality and unreality of their situation.

3. If there were a Russian troll, they would wish to engage on multiple matters of the next post. If they were unsophisticated, they would wish to respond directly to some of the challenges. If they were sophisticated, they would want to engage more directly after deep consultation. And that more direct engagement would be towards myself. Not the forum. Because the forum would not have answers there.

Conclusion: there is no unsophisticated Russian troll.

So as to not entirely waste the wider audience’s time, nor raise their cost, I also made sure there was dual purpose across these posts. Some potentially thoughtworthy ideas and observations were raised through out. While maybe the format prevented direction realization, post realization is as valuable too.

1. If you may have paid attention, some nation state rivals and adversaries really do take seriously such technology as “HAARP”, and the possibility that “Hollywood” is tied at least somehow, and significantly, to the USG. To some degree, it is: many Americans are supportive of USG efforts in various even controversial areas. And “Hollywood” likes to feed what people ‘buy into’. For crime and intelligence matter, often consultants are hired on who are fmr/ex/current. At times, like with “Burn Notice” or “The Americans”, fmr/ex/current might actually be primaries in script creation.

Overall, though, one can point out “Hollywood” usually is critical, rather then supportive of just everything and anything. Very often profoundly so. This partly reflects general Hollywood viewpoints which are decidedly liberal leaning. Some come off as bad propaganda, forced injection… but others raise and deeply impress on people, key “unthought of” or “poorly accepted” alternate considerations. Of a critical nature.

Does not matter in this: Russia was sure to have noticed the seeming coincidence of the timing of the expulsion of the spies, and the release of “Salt”, a movie specifically about exactly that nature of spies. Pre-“The Americans”, the existence of Directorate S and reality of deep cover Russian agents was obscure knowledge.

Russia is also a very heavy literary focused nation. They have some of the greats. And they continue to have a flourishing literary production. This also means they are less likely to be confused (as, for instance, Iran would be) on the nature of relationships.

Good example, of late, the “Daywatch”/”Nightwatch” books and resulting films.

However, they also know there were consultants on that film, and the timing was very suspicious. Further, they are extremely interested on any further knowledge the americans might have on their other deep cover spies. Illegals. So, this manner of observation would be kicked up without immediate response.

I do not attract that sort, but deal with them when they are already a problem.

This ‘in tandem’ sort of situation is also a matter worthy of those who wish to understand “how things work”. “They” do it with news stories. And for some movies they will also do it for. For instance, when there are real consultants at work there and so real information inside an otherwise absurd plot. (“Script doctors” can be many, and are rarely credited.)

1. As far as I know, the following scenario is poorly understood, and has a number of severe “alert” points for the general audience: an application which operates on a low level of the operating system, such as av generally does and kav most certainly does, could have functionality not present in ordinary reverse engineering security procedures. That functionality could be added via an otherwise ordinary update. Security systems with frequent and sometimes complex operations where rules are frequently updated and information is frequently sent back and forth, for that, especially makes this a stealthy attack.

The system receives not just instructions for the attack part of the code, but like missing pieces of a deep jigsaw puzzle where the jigsaw puzzle already paints a coherent, if difficult to understand, function… the new jigsaw pieces fit in nicely and add temporary functionality. That temporary functionality is easily later removed. And all of this can be performed in a very stealthy manner.

Not a new tactic, this manner of tactic is one of the more obscure, but relied upon tactics over the centuries by spy organizations (and other stealth organizations, such as resistance in WWII behind enemy lines). By observation, even very close one, the object is harmless and meaningless. But with the addition of another observably harmless and meaningless object, the two (or more) are combined to create ‘something else entirely’.

Stating that would have likely have compelled an unsophisticated russian troll to immediately react defensively, as they would have missed the underlining meaning of the other statements. Including this one. But they would have responded, and likely also ‘sent something up’ (if they have a ‘up’, which is doubtful), but with great dubiousness allowing them to open fire immediately already at the same time.

1. There is an entirely differ angle to that argument, especially in combined with the following. I will explain that angle, momentarily.

2. Kaspersky does have a very direct tie to Russian intelligence, having been one. I would never run Kaspersky for that very reason, nor would anyone else who considers Russians maybe being even accidentally interested in them.

That is a severe tie, far more of the sort then what persuades even very intelligent and observant people skilled in security about companies and their government relations. It is a powerful, but base accusation to leverage. It would especially provoke a bad troll working for Russia to respond. Multiple points of such arguments were made, because in that scenario, multiple points increase the chance they will lose control. Such individuals do not have much control in the first place, being very low level.

1. Similar approach with the skepticism approach on the Equation Group findings.

2. All three points have an implication. Not such an obvious one. If KAV was doing this manner of work, and the systems were discovered by KAV being present on thos systems, then that raises another possibility for the reason of the ‘Equation Group’ work. Misdirection for attribution to the American state. I do not believe that is the case, but I do believe such theories are useful to consider, if only as an intellectual practice of considering all possible angles of a mysterious problem. Nevertheless, this implication would be made on a deeper level even by lower rung trolls. That would raise a possible alert, even if they were not consciously aware of that.

3. There are systems and processes designed to throw off NLP analysis. That is my general surmising of the flood of strange, cryptic posts this forum has experienced. I realize this may be contrary to popular views. There can be some manual intervention in some systems to help them appear more realistic. However, if one examines the posted link and looks at the equation paper which was real, versus the equation people the system devised, it is, frankly, stunning in potential authenticity for a reader who was unfamiliar with the very technical subject matter. And see what I did there.

There is also these sorts of systems apparent in many places, including 4chan, Anonymous’ breeding grounds. ‘War is deception; make few appear as many’. That exhausts resources. It is also a vaguely interesting system for security enthusiasts.

1. The GCHQ twitter troll monster probably is simply GCHQ. No attempts at persuasion were made there otherwise, in fact, the matter was presented as what would be taken as ludicrous by most readers. Not so ludicrous to possible others.

2. The “American system” really was discovered by Anonymous, just as Anonymous really did hack Russia and provide necessary links for discovery and attribution of the Russian systems and companies. That is a worthwhile point to make, maybe dismissed by some, but depends on their interest level.

3. Attribution analysis was further mocked, just a bit, but also challenged. I do this for my own self, and also for others (as all of this is multi-use, and far beyond just “dual use”. The challenge is to attempt to people to think more rigorously. There are highly interesting events going on which people do not properly ‘make a constellation out of random stars’… whereas they so often do make a constellation out of random stars.

But enhanced thinking in this area expands the individual’s over all capacities as a person. Because people do have a strong tendency to themselves getting locked into self-destructive and socially destructive roles and identities and states and moods and emotions which ‘is not them’. They become inflexible as adults, when they were far more healthy and dynamic as children. It is a form of rot.

The general can not think as the liberal critic, indeed, the liberal critic can not think as the conservative critic. The national can not think as the international. Or even as ‘that national’ or ‘this national’. And so on and so on, ad infinitum.

1. The very last part of that described a very real method of communication really used in the deepest, darkest corners of the jungle. That was also not a lonely island all by its’ lonesome, but was included with at least two other side comments that appeared to be simply flavor. One was the getting of a job where that job’s purpose was designed to spell a message to the person who got the job. The other was where a colleague (or peer or stranger) might alert someone else to a matter somewhere, and where that matter might have multiple purposes of a message, as well as an interesting direction for that person.

Life its’ self often does this, and often without notice. Notice it now. And if thinking “local government” might alarm the senses in Danger, Danger Will Robinson, then all the better. Because kicking in those analytical processes is necessary for many levels of good human progress.

I won’t lie a few matters, either important or not, are skipped over here. You either notice that or know it or suspect it or not. I am not saying it is beyond your understanding to notice, I am just saying, not everything needs to be disclosed.

I will, however, dispel potential itching considerations of ‘this is USG’, USG would never reveal methodology. Quite simply. I only do this here, in this rare case, in order to explain what usually goes without comment and affording possible confusion or skepticism or even fear. This also dispels similar paranoid considerations. Fear usually is a horrible method of communication, and while some adrenaline shot can be useful for thinking… ultimately it should be directly noted: it is not real.

Further, as for verbiage such as “target” and “non-target”, that also does not mean anything. Beyond basic concepts such as “Accuracy” versus “Missing the Shot” or “Missing the Bullseye”, which can and should be applied to just about anything we do.

Curious minds do very curious things. And cats have nine lives. If not just a little bit more…