Tag Archives: wtf

2024: The Year of Infinite Infosec Fail

Posted on by
1

First up in today’s game of “who fed it and who ate it:” Artificial Intelligence.

AI is everywhere. AI chatbots! AI image generators! And now, AI code assistants, that help developers write computer programs!

Only here’s the thing: AI doesn’t know anything. A lot of folks think these AI systems are, like, some sort of huge database of facts or something. They aren’t. They’re closer to supercharged versions of the autocomplete on your phone.

Which means if you ask an AI chatbot or code generator a question, it does the same thing autocomplete does: fills in syntactically correct words that are likely to come after the words you typed. There is no intelligence. There is no storehouse of facts it looks up.

That’s why AI is prone to “hallucinations”—completely imaginary false statements that the AI systems invent because the words it uses are somehow associated with the words you typed.

AI Fembot says: The Golden Gate Bridge was transported for the second time across Egypt in October of 2016. (Image: Xu Haiwei)

So, code generation.

AI code generation is uniformly terrible. If you’re asking for anything more than a simple shell script, what you get likely won’t even compile. But oh, it gets worse. So, so much worse.

AI code generators do not understand code. They merely produce output that resembles the text they were trained on. And sometimes, they hallucinate entire libraries or software packages that do not exist.

Which is perfectly understandable once you get how AI LLMs work.

What’s particularly interesting, though, is that malware writers can write malware, give it the same name as the packages AI code generators make up out of thin air, and devs will download and install them just because an AI chatbot told them to.

Bet you didn’t have that on your “Reasons 2024 Will Suck” bingo card.

And speaking of things that suck:

I woke this morning to a message from Eunice that a popular, trusted developer had inserted malicious code in an obscure Linux library he maintains, code that would allow him to log in and access any Linux system that his library is installed on.

In February, then again in March, the developer released updates to a library called “XZ Utils.” The update contained weird, obfuscated code—instructions that were deliberately written in a manner to conceal what they did—but because he was a trusted dev, people were just like 🤷‍♂️. “We don’t know what this code he added does, but he seems an okay guy. Let’s roll this into Linux.”

He seems a decent fellow. We don’t know what this code does, but what’s the harm? (Image: Zanyar Ibrahim)

Fortunately it was spotted quickly, befure it ended up widely used, so only a handful of bleeding-edge Linux distros were affected, but still:

What the actual, literal fuck, people??!

“This library contains obfuscated code whose purpose has been deliberately concealed. What’s the worst that can happen?”

Jesus. And it’s only March.

Developers should never be allowed near anything important ever.

The Lads from Cyprus: Now on Quora!

Posted on by
2

Back in March 2016, eight years and one day ago, I published an analysis of a spam ring advertising phony pay-for-play scam “dating sites.” This particular group was responsible for about 90% of the “Hot Lady Wants to F*ck You” spam in circulation. The spam contained links to hacked sites that the spammers placed malicious redirectors on, that would redirect to other sites that redirected to other sites that redirected to a site that would promise sex and ask you a bunch of questions about what you were looking for, then take you to the actual scam site.

I called these guys “the Lads from Cyprus” because invariably the scam dating sites were registered to a shell company organized in Cyprus.

Times have changed, and the Lads from Cyprus have changed with them. While they still do send spam emails, I rarely see them any more—perhaps six or eight times a year, where I used to see them multiple times per day.

Instead, they’ve moved on…to Quora.

The Quora Connection

I spend most of my time on Quora these days. A few years back, I started noticing a certain type of profile: large number of profiles with consistent behavior: a profile pic of a hot woman in a kind of blandly generic Instagram pose, answering questions at an enormous rate (sometimes once a minute or more), with the answers all being a sentence or so that might or might not be related to the question, but that always included a photo of a scantily-dressed woman.

The profiles look like this:

The links (“Latest Nude Videos and Pics,” “Hookup [sic] with me now”) all lead to domains that are registered on Namesilo, usually with ultra-cheap TLDs like “.life,” that—rather amazingly—are still using the exact same templates I saw in 2016.

Go with what works, eh?

Anyway, these sites ask you a bunch of questions, tell you you’re about to see nude photos, then redirect you to a scam dating site—in this case, one called onlylocalmeets.com”—where you will immediately see a direct message request the moment you connect, though of course you’ll need to pay if you want to receive it.

It’s actually kind of amazing to me that they’re still running the same scams essentially unchanged, using the same templates they used eight years ago. They’ve clearly got this down to an art—the redirection sites even do some spiffy geolocation and collect as much information from your browser fingerprint as they can before sending oyu off to the scam site.

There are at least hundreds, possibly thousands, of these fake profiles on Quora, all of which use stolen photos of Instagram models, and all of which link back, through various intermediaries, to the same scam dating site.

I started recording the scam profiles in a Notes file. I deliberately didn’t go out searching for them; instead, I just browsed Quora as I normally do, and made a note whenever I encountered one of these scam profiles (and if I was in the mood, did a reverse image search to see whose photos were stolen for that profile).

There are…a lot of them.

Based on what I’ve seen, I’d say probably 800 on the low end and 1,500 on the high end.

One of them even used stolen Instagram photos of pro golfer and model Paige Spiranac. When I reverse image searched the photos, I looked up the email address of her agent (who was easy to find) and sent an email saying “hey, just so you know, your client’s photos are being used in a catfishing scam, here’s the link.” The profile was banned a few days later, so maybe she or her agent filed a DMCA takedown request.

I find it interesting that this organized spam gang is still at it, still running the same scam they’ve been running for at least ten years, but always looking for new ways to find fresh crops of victims.

I also find it interesting that it works. These scam profiles quickly end up with thousands, sometimes tens of thousands, of followers.

And finally, if you’ve ever wondered what it’s like to be a woman online, just look at the comments to the spam posts, which range from the drearily predictable:

To the completely unhinged:

(And what is it with these people not knowing the difference between “your” and “you’re”? You can be a completely deranged psycho who abuses women online or you can spell, but not, it seems, both.)

To the…well, I don’t know what the fuck this is. I’ve deliberately cropped off this fellow’s username.

Jesus, I do not understand why any woman would ever voluntarily go online.

On the one hand, it’s kinda hard to feel sorry for some of these blokes, who will no doubt be fleeced of all their money. That particular combination of toxic entitlement toward access to women’s bodies and aggressive stupidity makes it really hard to sympathize with the folks being ripped off here.

On the other, any scam is wrong, regardless of the victims it targets.

Stalker Update

Posted on by
4

So, some of you likely know I’ve been stalked over the past few years by an online stalker who has, among other things, created fake social media profiles in my name and used them to send rape and death threats to folks who follow me on social media. (Please, no speculation about who the stalker is.)

A week ago yesterday, the stalking escalated. I’ve been documenting the stalking, both publicly and privately, so I want to record the latest escalation here where everyone can see it.

I had an unexpected conversation with Portland PD a week ago last Tuesday, as I prepared to fly down to Ft. Myers to help care for my mom, who is in end-stage terminal cancer. It seems my stalker created a fake email account in my name, which he or she used to send an email to Portland police saying I was hearing voices commanding me to kill my wife. (They contacted her as well.)

I explained the stalking situation to them, and told them I’d filed a police report about it some time ago. They found my report and man, I’m really glad I filed it, because it instantly changed the tenor of the conversation.

Portland PD has referred the matter to their cybercrimes unit (I didn’t realize Portland has a cybercrimes unit, but apparently they do).

It’s been a weird ride. So far, the stalker has limited himself or herself to creating accounts that look like mine, using my name and avatar, and then using them to send threatening PMs to folks who follow me, or post public social messages trying to smear me:

(Note that this profile has no followers and nobody following it.)

People’s reactions are…weird. Some Facebook user flat-out said it isn’t happening and I’m lying about it because, direct quote, “men don’t get stalked, women do” (yes, seriously).

This new thing is an escalation. Fortunately, there’s now a pattern of law enforcement contact over this, and I think going forward I’m probably going to file a new police report with every single new incident.

Meanwhile, if you should happen to receive a rape or death threat, or some other harassing message from “me,” please check the profile carefully.

On Quora I’m Franklin-Veaux, no numbers, spaces, or other characters. On Twitter, Facebook, Instagram, and Threads, I’m franklinveaux, all one word, all lower case, no numbers or other characters.

Should you receive, or see, any of this harassment, I’d greatly appreciate if you let me know. I’m collecting as many examples as I can and turning them all over to Portland PD.

A Xenomorph Hiphugger Strapon of your very own!

Posted on by
Reply

Whilst the extended polyamorous netowork and I were in Barcelona, we took time out from seeing the Sagrada Familia and doing…um, other stuff to take a ton of photos of the xenomorph sex toy prototypes.

I’m still working through the mass of photos, bit by bit, but in the meantime I’ve actually put the hiphugger strapon up for sale!

That’s right, now you can order your very own hiphugger, for all your xenomorph ovipositor violation needs.

These things each take about three days of fussy, fiddly work to make, so for the foreseeable future I will only make one of them a month. First come, first served, and yes, they’re expensive.

If you order one, I’ll make it specifically for you, in whatever color you like.

We had a ton of fun doing the photo shoot, and got pics of some other xenomorphic goodness as well, including the xenomorph pacifiers and nipple pasties. (Yes, I made xenomorph pacifiers and nipple pasties. What can I say? My parents brought me to see Alien when I was, like, 12 or so, and it scared the holy hell out of me for the next thirty years.)

Now my nightmares are yours too. You’re welcome.

Adventures in TSA

Posted on by
Reply

In which our hero has alien sex toys scanned for bombs, and urethral sounds confiscated…

Okay, so. I travel a bit, sometimes internationally, and so it was I found myself jetting off to Barcelona for a vacation with the extended polyamorous family a few months back.

I have, as those who follow this blog know, been working for several years on a Xenomorph Hiphugger Strapon, inspired by (a) my lifelong fear of the alien from Alien (a movie my parents took me to when I was, like, 11 or 12 or something, thinking it was like a new Star Wars…no exaggeration, I had nightmares aout that alien for more than 30 years after), and (b) a suggestion by my wife that I should make a sex toy inspired by the alien, because she loves to push my buttons.

In fact, a photo of one of the early prototypes ended up going mad viral on the Internet, and I’m told has even been uploaded to the official Sigorney Weaver fan page, which means Ms. Weaver has likely seen it. 0.o

Anyway.

I cast four prototype xenomorph hiphugger strapons and one xenomorph facehugger gag in the runup to Barcelona, with the idea that having multiple lovers in the same space would be a fine opportunity for a xenomorph gangbang, truly a test of the design.

So it was I packed all these xenomorph hiphuggers in my luggage and jetted off to Springfield, MO, to meet my Talespinner, who would be accompanying me to Spain.

You would not believe what this looked like on the X-ray. Sadly, they refused to allow me to take a pic.

The problem started quite early. Whilst carrying my luggage aboard the plane, the X-ray showed a suitcase absolutely packed with aggressive alien endoparasites, which, as you might imagine, elicited some…excitement at screening. (I didn’t put them in my checked bag because it was mainly filled with photographic gear and clothes.)

The bag got bounced, the TSA checker opened the lid, and gentle reader, if I could have photographed his expression and shown it to you, you would know that it is possible for surprise to take on human form.

Within minutes, there was a crowd around the table: the TSA inspector, the woman running the X-ray, and two other people, all of them staring in slack-jawed astonishment. The TSA checker called for his superior, who was like “What the…?” One of the other TSA screeners said “Holy shit, that looks like the alien from the Alien movies!”

TSA screener: “Should I—”

Supervisor: “Yes.”

And then they, hand to God, scanned the hiphuggers for explosives.

Eventually convinced the hiphuggers weren’t actually bombs, they allowed me to board, where I sat in a chair that through the miracle of Science flew through the air.

But that’s not the end of the story, oh my no.

When the time came for us to head from Springfield to Barcelona, I re-packed everything, in no small part because of the way TSA freaked out about the xenomorphs, but also prompted by the need to rearrange in order to fit two rather large studio lights for the xenomorph photo shoot we had planned. (That was an adventure in itself; the tripods for the studio lights were an inch and a half too long to fit the suitcase, but fifteen minutes with a hacksaw soon fixed that.)

We set off for the airport, confident that this TSA experience would be far smoother. Alas, it was not to be.

During the rearranging, I’d put the more conventional sex toy kit in my carryon whilst the hiphuggers ent in checked baggage with the studio lights, UV-reactive body paints, UV blacklight, and other miscellaneous orgy supplies.

I did not know, Gentle Reader, I did not suspect, that I had planted the seeds of my own undoing.

For you see, in my conventional sex toy kit I’d placed my collection of sounds. If oyu don’t know what those are, I won’t disturb you with the details, except to say that I had about ten or fifteen and they looked like this:

The TSA guy…

…confiscated and threw away the sounds.

When I asked him why, he looked me straight in the eye and told me, you could stab someone with them.”

You. Could. Stab. Someone. With. Them.

Words…words fail. Whatever danger these may pose as a weapon, Gentle Reader, let me assure you that the 100% sustainably made, biodegradable wood cutlery they gave us aboard the plane would be a far better stabby weapon in every single axis.At this point, it’s hard to escape the perhaps paranoid conclusion that my name exists on some TSA list somewhere. I had a slab of Barcelonan chocolate in my computer bag on the way home and it got scanned for explosives every single time I went through security.

They do it with malice.

Quick xenomorph hiphugger teaser

Posted on by
Reply

I’ve now been back from Barcelona for a week, but I still don’t have my luggage (thanks, WestJet!). I’m way, waaaaay behind on processing and posting photos from the trip, including from the two days I spent at the Sagrada Familia (which was magnificent beyond what I ever imagined), so here’s a quick teaser from a Barcelona photo shoot of the alien xenomorph hiphugger Borg Queen parasite.

Want a hiphugger of your very own? You can find the FAQ for the xenomorph hiphugger here!

In which I send porn to Congress

Posted on by
Reply

Today, I had to run a rather annoying errand—namely, I had to hike down to the Post Office (a 20-minute trek each way), which thankfully is open half the day on Saturday, to mail some of my personal porn stash to Congress.

Yes, I’m serious.

To understand this story, you must first understand cataloguing-in-publication. Most books published in or for sale in the United States have a CIP data block on the copyright page. It’s a set of bizarre numbers and dashes, and it indicates exactly how the book should be catalogued using the Library of Congress cataloging system.

This system is way more complex than the Dewey Decimal System, and has category identifiers for every category of fiction and nonfiction you can imagine, up to and including subjects as specific as “hacking,” “betrayal,” and “voluntary human sacrifice.”

This CIP data block looks like this:

These numbers all instruct libraries exactly how to file the book. The CIP block is put together by library science researchers who are intimately familiar with the filing system, and study the book to see how to categorize it.

You can get this information free from the Library of Congress, or pay researchers at specialized companies to put this block together. Without it, libraries will refuse to stock the book.

If you have the Library of Congress do it, you can get a Library of Congress Control Number, an ID that links the book to its CIP data block online. This LCCN also appears on the copyright page. So far, so boring.

Now, when you register a copyright on a book, you must send two copies of the book to the Library of Congress. However, if you get an LCCN, you must also send a third copy to a different office at the Library of Congress.

When Eunice and I published our pornographic collection of short stories, Ecstatic Communion, we got an LCCN. I didn’t realize until today that the Library of Congress needed that third copy. I didn’t have any extra copies, so I just had to send them my own personal copy.

Which means I can now check off “send porn from my personal stash to Congress.”

T’was the night before Christmas…

Posted on by
Reply

…and all through the house, the hiphuggers were scurrying, searching for a victim to parasitize, a host they could control, forcing the host to violate all around, spreading their eggs in a gush of slime…

My wife decided that, given the alien from the Aliens movie has been the shape of my nightmares for years, I should make an alien xenomorph hiphugger strapon sex toy. And given that she loves cosplay, she’s also decided to do a Borg Queen costume, to go with it.

Because what’s worse than being parasitized by an alien hiphugger? The Borg Queen parasitized by an alien hiphugger, of course!

I’m helping her design those bits of the costume that require a 3D printer, so she’s made a life-sized dressmaker’s dummy casting of herself to better help me make sure the various bits and bobs I print are the right size.

I have the dummy sitting on my couch right now, and, well…

It’s a bit disconcerting when I wake up in the middle of the night to pee.

Come closer, and fertilize me with your reproductive stalk…

Posted on by
Reply

Orchids are cool, in a “nature is horrifying” way. There are species of orchid that have evolved structures that look like insects, which they use to lure in insects searching for mates.

Some orchids use these insect visitors to pollinate themselves. The insect does its thing and then flies off, horny and frustrated and covered with sticky pollen, but otherwise none the worse for wear.

But some orchids are carnivorous. They lure insects to their doom, slowly digesting their prey alive as the ill-fated insect struggles helplessly.

And some orchids mimic insect pheromones, sweeting the honeytrap with the same signals that female insects use.

I’ve been thinking quite a lot about sexual parasitism of humans lately, in no small measure because I’ve finished the first version of the Xenomorph Hiphugger Strapon, a Giger-esque nightmare sex toy first conceived by my wife Joreth. Imagine an alien facehugger that wraps around the subject’s hips, then incites the subject to seek out victims, violating them in a parasitic frenzy. As creepy as this image is, it’s table stakes in the game of real-world sexual parasitism, which is horrifying.

Anyway, that’s got me thinking: what if an alien species created mimics of human females to lure in the male of the species? (An idea for a horror novel with this theme is bubbling in my brain; stay tuned!)

I’ve been playing with a version of the Stable Diffusion 2.0 AI image generator tuned to human faces, looking to take the images out of my head and drag them into the light.

What I’ve come up with so far is…well, pretty horrifying.

I’ve started work on a small, AI-illustrated graphic novella (is a graphic novella a thing?), though with all the projects in the pipe right now—including a version of the hiphugger strapon optimized for oral violation—it may be a while before it’s finished.

I did a thing

Posted on by
Reply

I tried to do a different thing, but I couldn’t do the thing I wanted to do that was different from the thing I did, so I did the thing instead. Then I did the other thing, too, so…things got done.

It started yesterday morning, when I woke intending to post a new episode of the Skeptical Pervert podcast, this one looking at sex work in different cultures. But what to my wondering eye should show up, but a database server error at my webhosting provider. As I waited for them to fix the problem, I…amused. Yes, that’s the word we’ll use. I amused myself by writing a quick and crude web page that generates random horror poetry and pairs it with a random tentacle image generated by a Stable Diffusion AI generator.

It’s still quite primitive, but it looks like this:

You can, if this strikes your fancy, check it out here:

Random Tentacle Horror Poetry Generator