Day: August 29, 2023

The CIA wants to share what it knows about world space programs. Some of what it knows, anyway.

The United States Central Intelligence Agency, better known as the CIA, has released a new entry in its World Factbook that catalogues the programs and milestones of space agencies around the world. Over 90 countries and the European Union are represented in the new Space Programs section of the agency’s factbook, spanning from Algeria to Zimbabwe.

A CIA spokesperson told Space.com that, due to the increased visibility of space programs around the world, there is a need for the agency to provide “sound, reliable background information” for use by students of all ages, journalists, academics or anyone else looking for a “deep dive into a country and its space program.” 

Related: CIA about UFOs of the 1950s and ’60s: ‘It was us’

The Space Programs factbook includes how much each nation spends on its space program, based on available spending estimates and budget information. The resource also includes brief listings on individual countries’ key activities, both historical and current. 

All of the information in the new factbook section is unclassified and publicly available, and has been gathered together from open sources. Still, it might be surprising to some readers to learn which nations do, in fact, have a space program, the CIA spokesperson added. Nicaragua, for example, a country not commonly associated with spaceflight, pledged to spend over $250 million on a communications satellite with Chinese funding in 2013, according to the factbook.

The new Space Programs section is the first new appendix added to the CIA World Factbook since 2021. Its addition coincides with the 80th anniversary of the factbook’s predecessor publication.

The agency’s spokesperson said the CIA’s Space Programs appendix is a “living document” that is expected to be updated weekly, but the agency hopes to be able to include more frequent updates in the future. 

Join our Space Forums to keep talking space on the latest missions, night sky and more! And if you have a news tip, correction or comment, let us know at: community@space.com.

Cybercriminals can be inventive—especially if there’s money on the table. One hacker has penned a 50-page essay on how to invest in cryptocurrency and sell at the right time to make a profit. Another put together a guide for how to create a fake version of blockchain.com that could be used to steal people’s usernames and passwords. And another produced instructions—cryptically titled “Elegantly breed daddies on lavender”—explaining how to scam money from people who pay to watch webcam models perform.

The unusual collection of documents and tutorials were all produced by cybercriminals and hackers trying to win money for their ideas, technical skills, and writing ability. Once they finish their articles, they submit them to be judged in competitions on Russian-language cybercrime forums. These contests, which can pay out thousands of dollars, are one of the forums’ more peculiar aspects.

For more than a decade, Russian-language cybercrime forums—which largely exist for trading stolen data, touting new security vulnerabilities, and connecting criminals—have run contests allowing their members to make some extra cash and gain some kudos in the process. A new analysis by cybersecurity firm Sophos is shedding some light on how these contests run and how they’ve rapidly grown in size in the last few years. For those entering, there’s the potential of a decent payday: $80,000 USD was the total prize pot in one recent contest.

“You can tell some people put a lot of work into these,” says Christopher Budd, director of threat research at Sophos X-Ops. “Sometimes what people present isn’t necessarily the newest or most original stuff. But it’s stuff that is interesting or in some way has appeal to the audience.”

In the analysis, Sophos researcher Matt Wixey examined the most recent contests on the cybercrime forums Exploit and XSS. The forums’ administrators announce the contests and ask people to submit written articles. While the entries are most often in Russian, Budd says, sometimes forum members will translate them into English to be “a good community member.”

The most recent competition on XSS was held between March and July 2022. There was a general prize pot of $40,000—up from $15,000 the previous year. The Sophos analysis says the contest was general, with forum members being asked to submit entries on around half a dozen topics. Malware development, methods for dodging antivirus and security products, ways of hiding malicious code, and social engineering techniques were all included in the list.

Meanwhile, Exploit’s last contest offered more prize money—$80,000 in total—but was more specific, asking for entries on cryptocurrency attacks, thefts, and vulnerabilities in April 2021. One sub-genre of the theme was “security of working with cryptocurrencies, except for banal things.”

“It’s another way that the criminal world is mirroring and adapting and adopting best practices from the legitimate side of the business,” says Budd. He compares some of the processes and entries as akin to those of legitimate cybersecurity research conferences and events, such as Black Hat, Defcon, and Pwn2Own. Unlike cybersecurity researchers who find issues to make products and services more secure before sharing their research for others to learn from, the criminals are producing the work with malicious intent.

In May, Sputnik International, a state-owned Russian media outlet, posted a series of tweets lambasting US foreign policy and attacking the Biden administration. Each prompted a curt but well-crafted rebuttal from an account called CounterCloud, sometimes including a link to a relevant news or opinion article. It generated similar responses to tweets by the Russian embassy and Chinese news outlets criticizing the US.

Russian criticism of the US is far from unusual, but CounterCloud’s material pushing back was: The tweets, the articles, and even the journalists and news sites were crafted entirely by artificial intelligence algorithms, according to the person behind the project, who goes by the name Nea Paw and says it is designed to highlight the danger of mass-produced AI disinformation. Paw did not post the CounterCloud tweets and articles publicly but provided them to WIRED and also produced a video outlining the project.

Paw claims to be a cybersecurity professional who prefers anonymity because some people may believe the project to be irresponsible. The CounterCloud campaign pushing back on Russian messaging was created using OpenAI’s text generation technology, like that behind ChatGPT, and other easily accessible AI tools for generating photographs and illustrations, Paw says, for a total cost of about $400.

Paw says the project shows that widely available generative AI tools make it much easier to create sophisticated information campaigns pushing state-backed propaganda.

“I don’t think there is a silver bullet for this, much in the same way there is no silver bullet for phishing attacks, spam, or social engineering,” Paw says in an email. Mitigations are possible, such as educating users to be watchful for manipulative AI-generated content, making generative AI systems try to block misuse, or equipping browsers with AI-detection tools. “But I think none of these things are really elegant or cheap or particularly effective,” Paw says.

In recent years, disinformation researchers have warned that AI language models could be used to craft highly personalized propaganda campaigns, and to power social media accounts that interact with users in sophisticated ways.

Renee DiResta, technical research manager for the Stanford Internet Observatory, which tracks information campaigns, says the articles and journalist profiles generated as part of the CounterCloud project are fairly convincing.

“In addition to government actors, social media management agencies and mercenaries who offer influence operations services will no doubt pick up these tools and incorporate them into their workflows,” DiResta says. Getting fake content widely distributed and shared is challenging, but this can be done by paying influential users to share it, she adds.

Some evidence of AI-powered online disinformation campaigns has surfaced already. Academic researchers recently uncovered a crude, crypto-pushing botnet apparently powered by ChatGPT. The team said the discovery suggests that the AI behind the chatbot is likely already being used for more sophisticated information campaigns.

Legitimate political campaigns have also turned to using AI ahead of the 2024 US presidential election. In April, the Republican National Committee produced a video attacking Joe Biden that included fake, AI-generated images. And in June, a social media account associated with Ron Desantis included AI-generated images in a video meant to discredit Donald Trump. The Federal Election Commission has said it may limit the use of deepfakes in political ads.