Oh my, oh my: 24 days in Altai!

I think I’ve mentioned in passing recently – perhaps more than once – that I took my annual summer vacation this year in Altai. But it’s mid-September already – and still no Altai series of pics and tales? Eh? But don’t worry, it’s on its way – coming up soon. The thing is, there are soooo many photos this year, and so much video too that needs professional digital editing. Still, I am today able to at least give you my traditional taster, aka, starter course, aka aperitif, as a warm-up…

First, I can tell you – no, repeat to you, since I’ve been to Altai before, and even wrote a travelogue-book about the experience – that Altai is one of the most magically enrapturing places in the planet, IMHO. It’s crammed with: marvelous mountainous beauty, rivers with water of various bright colors, glacial lakes, and assorted other extraordinarily beautiful natural landscapes. But what’s perhaps most extraordinary of all is the fact that the place has a mysterious, powerful… energy, which you almost start to feel physically after several days there. I don’t know what it is; it must be some kind of magic force that’s emitted out of the Altai earth. What I do know is that it affects how you feel: better overall; experiences and sensations are brighter, richer, more intense; and your mood is always fairly cloud-nine! And the wildlife there is similarly other-worldly: ants are huge – the size of cockroaches; mushrooms grow to the size of watermelons; while the region’s mosquitos… – you might expect them to be similarly crazy and mutant-ninja, but no – they’re not interested in humans, leaving them practically completely alone! EH?!

So yeah: Altai: oh my, oh my. Natural, wild beauty redefined!

Read on…

First post-quarantine industrial.

A few days ago, a momentous, landmark event took place. It was in a seaside city – a ‘regular’ one, where it gets dark of a night (unlike others I can think of:) ->

The momentous event was – drum roll, cymbal…….. our first post-quarantine conference! In sunny ~Sochi!

And here’s my first post-quarantine event badge! ->

Read on…

Flickr photostream

  • Sochi / Sep 2020
  • Sochi / Sep 2020
  • Sochi / Sep 2020
  • Sochi / Sep 2020

Instagram photostream

Murmansk: the sunny, windless resort!

The other day – finally! – I was back on the road after a six-month hiatus. It wasn’t my usual globetrotting routine, but it was a trip away – on a plane. Up to Murmansk!

It was just a short trip (over a long weekend), whose main purpose was a spot of fishing in the Barents Sea. Actually (and just as I like it), there was another reason for the trip – a spot of business (discussing certain industrial cybersecurity projects). But enough about work already (more on the work topic in an upcoming post from Sochi); today – it’s all about the fishing!…

Read on…

Enter your email address to subscribe to this blog

The film ‘From Kurils with Love’ – much of it shot from above.

Precisely a year ago, a group of like-minded adventurers and I took few weeks to leisurely tour Russia’s far-eastern Kuril Islands on a ship. Click on the link for plenty of pics and words about the expedition, but today I’m not writing about that, I’m writing about something else.

See, the group of like-minded adventurers I was with included a group of curious American documentary makers. Among them: the famous landscape photographer Chris Burkard, the legendary traveler-photographer-climber Renan Ozturk, the documentary filmmaker and conservationist Taylor Rees, their super-professional photography-and-film crew, plus ecologist-researchers.

And they all boarded our small ship for a lengthy investigation of the unique ecosystem of the Kuril archipelago, at the same time bringing attention to the remote region’s ecological problems.

And now, as a result of the eco-expedition a documentary has been released – From Kurils with Love. The ‘star’ of the short film is Vladimir Burkanov, Kurils conservationist and leading expert-biologist of the Kamchatka branch of the Pacific Institute of Geography of the Russian Academy of Sciences, who for more than 30 years has been studying the region’s sea mammals.

Read on…

Cybersecurity – the new dimension of automotive quality.

Quite a lot of folks seem to think that the automobile of the 21st century is a mechanical device. Sure, it has added electronics for this and that, some more than others, but still, at the end of the day – it’s a work of mechanical engineering: chassis, engine, wheels, steering wheel, pedals… The electronics – ‘computers’ even – merely help all the mechanical stuff out. They must do – after all, dashboards these days are a sea of digital displays, with hardly any analog dials to be seen at all.

Well, let me tell you straight: it ain’t so!

A car today is basically a specialized computer – a ‘cyber-brain’, controlling the mechanics-and-electrics we traditionally associate with the word ‘car’ – the engine, the brakes, the turn indicators, the windscreen wipers, the air conditioner, and in fact everything else.

In the past, for example, the handbrake was 100% mechanical. You’d wrench it up – with your ‘hand’ (imagine?!), and it would make a kind of grating noise as you did. Today you press a button. 0% mechanics. 100% computer controlled. And it’s like that with almost everything.

Now, most folks think that a driver-less car is a computer that drives the car. But if there’s a human behind the wheel of a new car today, then it’s the human doing the driving (not a computer), ‘of course, silly!’

Here I go again…: that ain’t so either!

With most modern cars today, the only difference between those that drive themselves and those that are driven by a human is that in the latter case the human controls the onboard computers. While in the former – the computers all over the car are controlled by another, main, central, very smart computer, developed by companies like Google, Yandex, Baidu and Cognitive Technologies. This computer is given the destination, it observes all that’s going on around it, and then decides how to navigate its way to the destination, at what speed, by which route, and so on based on mega-smart algorithms, updated by the nano-second.

A short history of the digitalization of motor vehicles

So when did this move from mechanics to digital start?

Some experts in the field reckon the computerization of the auto industry began in 1955 – when Chrysler started offering a transistor radio as an optional extra on one of its models. Others, perhaps thinking that a radio isn’t really an automotive feature, reckon it was the introduction of electronic ignition, ABS, or electronic engine-control systems that ushered in automobile-computerization (by Pontiac, Chrysler and GM in 1963, 1971 and 1979, respectively).

No matter when it started, what followed was for sure more of the same: more electronics; then things started becoming more digital – and the line between the two is blurry. But I consider the start of the digital revolution in automotive technologies as February 1986, when, at the Society of Automotive Engineers convention, the company Robert Bosch GmbH presented to the world its digital network protocol for communication among the electronic components of a car – CAN (controller area network). And you have to give those Bosch guys their due: still today this protocol is fully relevant – used in practically every vehicle the world over!

// Quick nerdy post-CAN-introduction digi-automoto backgrounder: 

The Bosch boys gave us various types of CAN buses (low-speed, high-speed, FD-CAN), while today there’s FlexRay (transmission), LIN (low-speed bus), optical MOST (multimedia), and finally, on-board Ethernet (today – 100mbps; in the future – up to 1gbps). When cars are designed these days various communications protocols are applied. There’s drive by wire (electrical systems instead of mechanical linkages), which has brought us: electronic gas pedals, electronic brake pedals (used by Toyota, Ford and GM in their hybrid and electro-mobiles since 1998), electronic handbrakes, electronic gearboxes, and electronic steering (first used by Infinity in its Q50 in 2014).

BMW buses and interfaces

Read on…

The Catcher in the YARA – predicting black swans.

It’s been a long, long time since humanity has had a year like this one. I don’t think I’ve known a year with such a high concentration of black swans of various types and forms in it. And I don’t mean the kind with feathers. I’m talking about unexpected events with far-reaching consequences, as per the theory of Nassim Nicholas Taleb, published in his book The Black Swan: The Impact of the Highly Improbable in 2007. One of the main tenets of the theory is that, with hindsight, surprising events that have occurred seem so ‘obvious’ and predictable; however, before they occur – no one does indeed predict them.

Cybersecurity experts have ways of dealing with ambiguity and predicting black swans with YARA

Example: this ghastly virus that’s had the world in lockdown since March. It turns out there’s a whole extended family of such viruses – several dozen coronaviridae, and new ones are found regularly. Cats, dogs, birds, bats all get them. Humans get them; some cause common colds; others… So surely vaccines need to be developed against them as they have been for other deadly viruses like smallpox, polio, whatever. Sure, but that doesn’t always help a great deal. Look at flu – still no vaccine that inoculates folks after how many centuries? And anyway, to even start to develop a vaccine you need to know what you’re looking for, and that is more art than science, apparently.

So, why am I telling you this? What’s the connection to… it’s inevitably gonna be either cybersecurity or exotic travel, right?! Today – the former ).

Now, one of the most dangerous cyberthreats in existence are zero-days – rare, unknown (to cybersecurity folks et al.) vulnerabilities in software, which can do oh-my-grotesque large-scale awfulness and damage – but they often remain undiscovered up until the moment when (sometimes after) they’re exploited to inflict the awfulness.

However, cybersecurity experts have ways of dealing with unknown-cyber-quantities and predicting black swans. And in this post I want to talk about one such way: YARA.

GReAT’s Costin Raiu examined Hacking Team’s emails and put together out of practically nothing a YARA rule, which detected a zero-day exploit

Briefly, YARA helps malware research and detection by identifying files that meet certain conditions and providing a rule-based approach to creating descriptions of malware families based on textual or binary patterns. (Ooh, that sounds complicated. See the rest of this post for clarification.:) Thus, it’s used to search for similar malware by identifying patterns. The aim: to be able to say: ‘it looks like these malicious programs have been made by the same folks, with similar objectives’.

Ok, let’s take another metaphor: like a black swan, another water-based one; this time – the sea…

Let’s say a network you (as a cyber-sleuth) are studying (= examining for the presence of suspicious files/directories) is the ocean, which is full of thousands of different kinds of fish, and you’re an industrial fisherman out on the ocean in your ship casting off huge drift nets to catch the fish – but only certain breeds of fish (= malware created by particular hacker groups) are interesting to you. Now, the drift net is special: it has special ‘compartments’ into which fish only get into as per their particular breed (= malware characteristics). Then, at the end of the shift, what you have is a lot of caught fish all compartmentalized, and some of those fish will be relatively new, unseen before fish (new malware samples) about which you know practically nothing, but they’re in certain compartments labeled, say, ‘Looks like Breed X’ (hacker group X) and ‘Looks like Breed Y’ (hacker group Y).

We have a case that fits the fish/fishing metaphor perfectly. In 2015, our YARA guru and head of GReAT, Costin Raiu, went full-on cyber-Sherlock mode to find an exploit for Microsoft’s Silverlight software. You really need to read that article on the end of the ‘case’ link there but, if very briefly, what Costin did was carefully examine certain hacker-leaked email correspondence (of ‘Hacking Team’: hackers hacking hackers; go figure!) published in a detailed news article to put together out of practically nothing a YARA rule, which went on to help find the exploit and thus protect the world from all sorts of mega-trouble.

So, about these YARA rules…

Graduates receive a certificate confirming their new status as a YARA ninja. Previous graduates say it really does help in their professional career

We’ve been teaching the art of creating YARA rules for years. And since the cyberthreats YARA helps uncover are rather complex, we always ran the courses in person – offline – and only for a narrow group of top cyber-researchers. Of course, since March, offline training have been tricky due to lockdown; however, the need for education has hardly gone away, and indeed we’ve seen no dip in interest in our courses. This is only natural: the cyber-baddies continue to think up ever more sophisticated attacks – even more so under lockdown. Accordingly, keeping our special know-how about YARA to ourselves during lockdown looked just plain wrong. Therefore, we’ve (i) transferred the training format from offline to online, and (ii) made it accessible to anyone who wants to do it. For sure it’s paid, but the price for such a course at such a level (the very highest:) is very competitive and market-level.

Introducing! ->

Read on…

Antimonopoly justice: wheels finally turning, or another flash in the pan?

Business done successfully will always tend toward becoming bigger. C’est la vie.

It often goes like this: In a given field, the big and strong gobble up the small and… smart (exceptions prove the rule). But what also sometimes happens is the big and strong with breakthrough technologies in one field gobble up everyone in different field. Example: once upon a time there was the giant, all-powerful Kodak, but then the era of digital photography came along, and the film-based photography field was wiped out. And this is how scientific-technical revolutions come about, and they’re useful: they help humanity progress.

But there’s another scenario: the big and strong become… so incredibly big and strong that they start dictating rules to all the other players in their industry, they strangle the natural selection of innovative and successful companies, and even try to hamper the development of any allied companies or markets that represent potential danger for their business. And in this case, antimonopoly bodies have to intervene to put a stop to such abuse of power so as to protect progress.

Domination in a market isn’t unlawful under antimonopoly rules. However, companies that dominate have a special responsibility not to abuse their power by limiting competition.

This latter scenario is being played out right now on a (socially-distanced) stage in a suspenseful IT-show whose main characters are Amazon, Apple, Facebook and Google – operators of the world’s largest online platforms – three of which (all bar Facebook) also act as the world’s largest online marketplaces. The other main characters in the show are the U.S. authorities, which are trying to rein in these online platforms – meaning checking they’re not unfairly taking advantage of their powerful positions – including hindering their ability to be judge, jury and executioner in their marketplaces. They are trying to prevent unfair competition – including exertion of pressure on competitors to ease promotion of the marketplaces’ own products. I’ve already written about one such high profile show case like this: the one where Apple has been driving out independent developers of parental control applications from its App Store.

Let me give an analogy here:

A landlord starts to lease out his land to farmers on equal terms and conditions, which suit everyone just fine. But at the same time, the landlord keeps a close watch on the farmers to see which are doing best. The following year, he starts doing what those successful farmers do himself. He also changes the terms and conditions of the leases ‘to protect worms’: now all farmers under those leases aren’t allowed to use spades – they must use trowels, and they should stop using fertilizer. But this rule doesn’t apply to the landlord. It’s like, he’s not actually preventing the farmers from going about their farming business – and he’s declaring worthy intentions – but how on earth can the farmers with trowels compete with the landlord with his spades and the very latest fertilizer?

Sounds all very Middle Ages, right? But a similar thing is happening in 2020 – only not in farming but in the modern digital economy; however, finally, the powers-that-be appear to be waking up to the fact. Or so it seems…

In early 2019, U.S. Senator Elizabeth Warren gave a watershed interview to The Verge, in which she stated that she “would classify any company that runs a marketplace and makes more than $25 billion a year in revenue as a ‘platform utility’, and prohibit those companies from using those platforms from [sic] selling their own products.” Put simpler – incidentally when referring to Apple in particular – she stated: “Either they run the platform or they play in the store”.

And that was that: despite the fact these were Very Big Boys she was talking about, the starting gun was duly fired…

Read on…

Into resource-heavy gaming? Check out our gaming mode.

Nearly 30 years ago, in 1993, the first incarnation of the cult computer game Doom appeared. And it was thanks to it that the few (imagine!) home computer owners back then found out that the best way of protecting yourself from monsters is to use a shotgun and a chainsaw ).

Now, I was never big into gaming (there simply wasn’t enough time – far too busy:); however, occasionally, after a long day’s slog, colleagues and I would spend an hour or so as first-person shooters, hooked up together on our local network. I even recall Duke Nukem corporate championships – results tables in which would be discussed at lunch in the canteen, and even bets being made/taken as to who would win! Thus, gaming – it was never far away.

Meanwhile, our antivirus appeared – complete with pig squeal (turn on English subs – bottom-right of video) to give fright to even the most fearsome of cyber-monsters. The first three releases went just fine. Then came the fourth. It came with a great many new technologies against complex cyberthreats, but we hadn’t thought through the architecture well enough – and we didn’t test it sufficiently either. The main issue was the way it hogged resources, slowing down computers. And software generally back then – and gaming in particular – was becoming more and more resource-intensive by the day; the last thing anyone needed was antivirus bogarting processor and RAM too.

So we had to act fast. Which we did. And then just two years later we launched our legendary sixth version, which surpassed everyone on speed (also reliability and flexibility). And for the last 15 years our solutions have been among the very best on performance.

Alas, leopards are thought to never lose their spots. A short-term issue affecting computer performance turned into a myth – and it’s still believed by some today. Competitors were of course happy to see this myth grow… to mythical proportions; we weren’t.

But, what has any of this K memory-laning got to do with Doom? Well…

Read on…

Top-5 K-technologies that got us into the Global Top-100 Innovators.

We’ve done it again! For the second time we’re in the Derwent Top 100 Global Innovators – a prestigious list of global companies that’s drawn up based on their patent portfolios. I say prestigious, as on the list we’re rubbing shoulders with companies such as Amazon, Facebook, Google, Microsoft, Oracle, Symantec and Tencent; also – the list isn’t just a selection of seemingly strong companies patents-wise: it’s formed upon the titanic analytical work of Clarivate Analytics, which sees it evaluate more than 14,000 (!) candidate companies on all sorts of criteria, of which the main one is citation rate, aka ‘influence’. And as if that wasn’t tough enough, in five years the threshold requirement for inclusion in the Top-100 on this criterion has risen some 55%:

In a bit more detail, the citation rate is the level of influence of inventions on the innovations of other companies. For us, it’s how often we’re mentioned by other inventors in their patents. And to be formally mentioned in another company’s patent means you’ve come up with something new and genuinely innovative and helpful, which aids their ‘something new and genuinely innovative and helpful’. Of course, such an established system of acknowledging other innovators – it’s no place for those who come up with mere BS patents. And that’s why none of those come anywhere near this Top-100. Meanwhile, we’re straight in there – in among the top 100 global innovator companies that genuinely move technological progress forward.

Wow, that feels good. It’s like a pat on the back for all our hard work: true recognition of the contributions we’ve been making. Hurray!

Still reeling – glowing! – from all this, ever the curious one, I wondered which, say, five, of our patented technologies are the most cited – the most influential. So I had a look. And here’s what I found…

5th place – 160 citations: US8042184B1 – ‘Rapid analysis of data stream for malware presence’.

Read on…

An early-warning system for cyber-rangers (aka – Adaptive Anomaly Control).

Most probably, if you’re normally office-based, your office right now is still rather – or completely – empty, just like ours. At our HQ the only folks you’ll see are the occasional security guards, and the only noise you’ll hear is the hum of the cooling systems of our heavily-loaded servers given that everyone’s hooked up and working from home.

You’d never imagine that, unseen, our technologies, experts and products are working 24/7 protecting the cyberworld. But they are. But the bad guys are up to new nasty tricks at the same time. Just as well, then, that we have an early-warning system in our cyber-protection collection of tools. But I’ll get to that in a bit…

The role of an IT security guy or girl in some ways resembles that of a forest ranger: to catch the poachers (malware) and neutralize the threat they pose for the forest’s dwellers, first of all you need to find them. Of course, you could simply wait until a poacher’s rifle goes off and run toward where the sound came from, but that doesn’t exclude the possibility that you’ll be too late and that the only thing you’d be able to do is clear up the mess.

You could go full-paranoiac: placing sensors and video cameras all over the forest, but then you might find yourself reacting to any and every rustle that’s picked up (and soon losing sleep, then your mind). But when you realize that poachers have learned to hide really well – in fact, to not leave any trace at all of their presence – it then becomes clear that the most important aspect of security is the ability to separate suspicious events from regular, harmless ones.

Increasingly, today’s cyber-poachers are camouflaging themselves with the help of perfectly legitimate tools and operations.

A few examples: opening a document in Microsoft Office, a system administrator being granted remote access, the launch of a script in PowerShell, and the activation of a data encryption mechanism. Then there’s the new wave of so-called fileless malware, leaving literally zero traces on a hard drive, which seriously limits the effectiveness of traditional approaches to protection.

Examples: (i) the Platinum threat actor used fileless technologies to penetrate computers of diplomatic organizations; and (ii) office documents with malicious payload were used for infections via phishing in the operations of the DarkUniverse APT; and there are plenty more. One more example: the fileless ransomware-encryptor ‘Mailto’ (aka Netwalker), which uses a PowerShell script for loading malicious code directly into the memory of trusted system processes.

Now, if traditional protection isn’t up to the task, it’s possible to try and forbid to users a whole range of operations, and to introduce tough policies on access and usage of software. However, given this, both the users and the bad guys will eventually probably find ways round the prohibitions (just like the prohibition of alcohol was always gotten around too:).

Much better would be to find a solution that can detect anomalies in standard processes and for the system administrator to be informed about them. But what is crucial is for such a solution to be able to learn how to automatically determine accurately the degree of ‘suspiciousness’ of processes in all their great variety, so as not to torment the system administrator with constant cries of ‘wolf!’

Well – you’ve guessed it! – we have such a solution: Adaptive Anomaly Control, a service built upon three main components – rules, statistics and exceptions.

Read on…