I Didn’t Bring Down the Internet — or Did I?

Friday’s attack against US computer infrastructure using a botnet crafted from the Internet of Things (IoT) appears to be a shot across the bow, demonstrating the power of the hacking team — and those behind that team. Unfortunately I, and many of us, may have unwittingly played a role in the attack. Our computer devices may have been used to send the signals that overwhelmed the computer servers on Friday.

The IoT attack was not unanticipated by many of us. In June  2015 some of us began unclassified discussions with personnel from a major university about the IoT problem. Everything from cars and refrigerators to medical devices are being “computerized” with IoT software and firmware. We foresaw serious security problems in this.

For the most part there is no security screen on IoT devices, allowing hackers easy entry to them. We recognized that any of us could inadvertently be part of the problem because we had no way to prevent IoT devices we already have, and those we will acquire in the future, from being infected with malware. Earlier this year there was some public recognition of one part of the IoT problem when it became known that a medical device had virtually no protection and, in certain circumstances, had the potential of being manipulated to kill the patient using it. There have been reports and claims of IoT threats to cars (potential to affect braking, speed, steering, etc.) There have been claims about the ability to affect control of commercial airliners through attacks against on-board entertainment systems.

IoT security is virtually non-existent at present and is unlikely to be effective even in the future because A) there is no totally effective anti-virus/anti-malware system available for or designed for IoT devices, B) security is not legally required and manufacturers won’t spend money they are do not have to, C) IoT security would not only be more expensive, in some cases it would interfere with the working of the IoT device, D) retrofitting devices and systems already in use would be improbable if not impossible, and E) IoT security would generally have to be configured when the device was brought on-line, and most people wouldn’t take the time or expend the effort — even if they were capable of doing so.

There are some indications, from the size, severity, and markers of the attack, that this could have been a state-sponsored effort. However it appears that only a small part, perhaps as low as 10 percent, of the available capability was used. There is a possibility this may have been a shot across the bow rather than an all-out attack

From the discussions that started in June of 2014 I am not confident that we have a way of thwarting distributed denial of service attacks such as we saw Friday, or dealing with other attacks carried out through the IoT. These attacks use the very design of the Internet — and us, our cameras, our cars, our refrigerators — for their success.


Mark Monday
mark@theresearchschool.com

Oppo Research Popular “New” Job Area?

Following the Watergate scandal that destroyed Richard Nixon’s presidency, a flood of people wanted into the journalism profession. With the leaks and reports coming out during today’s election season Opposition Research (OPPO) may prove to be a very attractive – if unexplored– field for many, as journalism was after Watergate.

OPPO is one of five major, distinct but similar, areas within major job fields.

  • Open Source Intelligence (OSINT) of Intelligence and Law Enforcement
  • Computer-assisted Reporting (CaR) of Journalism
  • Information Literacy (IL) of Library Science
  • Competitive or Competitor Intelligence (CI) of Business
  • Opposition Research (OPPO) of politics and political science

 

Other fields, such as law and lawyers also use versions of it.

The various fields try to institutionalize the knowledge – create unique knowledge sets that apply to their own field – and that is part of the problem. They lack the overall view, and the tools and techniques that come with all of the other fields. All the fields have strengths and each has its weaknesses. By looking at all the fields and filling the weaknesses of one by using the strengths of the others theresearchschool.com is creating a much more robust capability in all the fields – including OPPO.

For those who want to independently explore only OPPO we can recommend: We’re with Nobody by Alan Huffman and Michael Rejebian. This is a book of case studies. While it is not a how-to book, it does offer a good look at the field and shows some of the techniques that are useful. The Opposition Research Handbook by Larry Zilliox is more of a manual on how to conduct OPPO research using a computer. How Do Private Eyes Do That? by Colleen Collins is not strictly OPPO, but has some useful material that would-be political opposition researchers may find useful.

Mark Monday at theresearchschool.com

Ease Your Social Media Searching

For many things and at many times, social media may provide quick and useful answers. But getting answers from many social media sites can be time-consuming.. Researchers may want to try https://www.social-searcher.com/
If you have additional sites you have found that make social media searches easier and quicker, please e-mail them to mark@theresearchschool.com and I will post them

Flagging where the information comes from….

When doing online research, knowing the location of the server is one of several bits of information that can and should be used in assessing the reliability of  information on a site. It is not the only criterion, but it is an important one. When you are using Firefox as your browser you might find this little add-on useful. It displays a tiny flag, showing where you are attached. The claims for this Firefox add-on:

Flagfox  Displays a country flag depicting the location of the current website’s server and provides a multitude of tools such as site safety checks, whois, translation, similar sites, validation, URL shortening, and more. https://addons.mozilla.org/en-US/firefox/addon/flagfox/?src=search