Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[martinuzz]

Well yea, this could be the end of NSA, once the lawsuits for more money than the entire US national budget start hitting them.

Evenmoreso, since they managed to disable the attack when they discovered that the malware had a built in kill switch.

Raises the question, why did the NSA not come forward with killswitch info the minute hospitals started getting hit? That's technically not even negligence, but makes it seem they're accomplice to the crime.

Which is quite possible tbh. Good chances this was no ransomware attack, but just the NSA testing how well their virus works.

I mean, I can see it easily.
"hey boss we made this awesome virus that can do major infrastructural damage to whomever we want, we think. We just need to test it, but, constitutional rights, international treaties yadda yadda"

"Oh hey, why don't we pretend it was stolen from us and then test it after a while pretending we're ransomware hackers? No one will ever know!"

[Reelya]

THe killswitch was put in by the attacker.

The leaked code was dumped online last year, so security experts already knew what was in that, i.e. no convenient killswitch known.

[wierd]

The real point, is that a huge collection of military grade exploits leaked all at once--- because a certain 3 letter agency decided that the best way to fullfill its mandate to the american people, was to sit on them, hoard them, and try to use them to screw with other countries, instead of developing effective and reliable countermeasures, and applying government pressure to assure that those protections were implemented expediently.

As a consequence, a huge number of attack vectors leaked all at once, and the people who's job it is to plug those holes were overworked trying to do so, resulting in less than stellar proliferation of the fixes before the storm hit.

It is NOT a good idea to hoard dangerous exploits in a centralized location. It is NOT a good idea to think, just because you are a 3 letter agency that you wont be hacked.

If you have all the nice tasty goodies, the attackers will be beating on your door to get them.  It's about time they figured that out, and stopped hoarding shit like that.

[Max™]

Which is why the pwn2own contests aren't just useful as bragging rights for given vendors/hackers.

[martinuzz]

After winning Elon Musk's hyperloop contest this january, a joint venture of construction company BAM and a startup by the winning team of TU Delft students are going to build the first hyperloop in the world in Delft.
It will only be 3m in diameter and 30 meters long, yet it can be used to test all critical systems in a near vacuum.
They're not wasting any time either, it's scheduled to be finished and ready for use the 1st of june.

The student's startup company, Hardt, hopes to have a test traject of several kilometers ready within 4 years.

[alway]

If you have all the nice tasty goodies, the attackers will be beating on your door to get them.  It's about time they figured that out, and stopped hoarding shit like that.

There's three things I always point out to people that say "But they won't abuse it!"
1) Are you sure?
2) Even if they don't, it's a massive target
3) You cannot stop an attack, you can only make it take so much time and effort that people give up on it.

Addendums:
4. They will never actually give up on it.
5. humint is ez-mode.

Consider: A while back, they caught a guy who apparently had vast quantities of NSA material. Explanation last I heard:
 Dude just liked hoarding classified material

Snowden: acquired vast amounts of material and leaked it to the press. Generally agreed not a spy; just a random person.

Neither of them even worked directly for the government; they were military industrial complex contractors. The NSA in particular doesn't traffic in material goods like the military generally does, nor does it traffic in intelligence and analysis like the CIA does. It traffics in weaponized data; the simplest thing out there to steal by the very nature of what technology is. Unlike elsewhere, an individual can't be constrained easily by task. Compromise or plant a nuclear weapons scientist, at best you'll get the component they worked on and the basics of the things it's plugged into. They don't need to know the rest, nor do they need to know the schematics of the submarines or aircraft carriers on which they might be placed; things can be compartmentalized easily there. But because of what the NSA does, every operator needs access to both specifications for essentially every tool in the arsenal, and also the executable file, which is all the blueprint necessary for an exploit. This is what makes the NSA inherently more dangerous than the others; any breach at all is less "a missing tomahawk missile" and more "half of all the US military was stolen, leaving both sides on an equal playing field if the other side started with absolutely nothing, and due to their existing military makes them more powerful."

[wierd]

I disagree that it cannot be compartmentalized.

Here's a basic flow outline.

SigINT operative needs access to a toolset, to monitor SuperSuspiciousPerson's network. Through some basic sniffing with common tools, they have determined that SuperSuspiciousPerson has some open ports commonly used by say-- SMB protocol.

They send a requisition to the digital munitions group, for access to an SMB exploit toolkit.

Digital munitions group requests more information about the target to better supply a good exploit. The sniffing logs collected in phase 1 (SigInt operative already collected, when they determined that SMB is a good attack vector, after all) will probably suffice, as headers and other identifying digital features of the SMB traffic collected would identify the patch level and protocol version used. Digital munitions accepts the sniff logs, grants access to a single toolkit, based on best use criteria.

SigInt operative then proceeds to set up the necessary phishing and or social engineering (or even technical delivery) vector to deliver the payload, then begins SigInt monitoring of SuperSuspiciousPerson.

At no time does SigInt operative have unrestricted access. Only as-needed, and on case-by-case basis.  This greatly reduces the risk of improper use of the toolkit, reduces attack surface of the toolchest, and adds paper trail accountability for use.

Of course, NONE OF THOSE THINGS are at all desirable to the NSA.

Why?

[Reelya]

https://developers.slashdot.org/story/17/05/29/169233/startup-uses-ai-to-create-programs-from-simple-screenshots

A new neural network being built by a Danish startup called UIzard Technologies IVS has created an application that can transform raw designs of graphical user interfaces into actual source code that can be used to build them. Company founder Tony Beltramelli has just published a research paper that reveals how it has achieved that. It uses cutting-edge machine learning technologies to create a neural network that can generate code automatically when it's fed with screenshots of a GUI. The Pix2Code model actually outperforms many human coders because it can create code for three separate platforms, including Android, iOS and "web-based technologies," whereas many programmers are only able to do so for one platform. Pix2Code can create GUIs from screenshots with an accuracy of 77 percent, but that will improve as the algorithm learns more, the founder said.

[Reelya]

Hey man, first time i decided to post in months since that shitstorm, now you're being argumentative again, like instantly?

if you think there's a better link, post it yourself rather than criticize other people for posting links.

I made this thread as a place to drop interesting articles that I get in my feeds, because other people might be interested to discuss them, having some angry person instally jump to attack the links doesn't foster any sort of discussion.

[Reelya]

Apparently commenting on the thing is being argumentative. Didn't know that I can't even post my thoughts on a thing. I'll keep that in mind. You say "discuss" but apparently the moment I try to discuss things it's being argumentative.

As for the link, it'd be this.

You didn't comment on the thing you started with :

I don't see why you don't ... XYZ

Which is attacking the messenger not the message. Ad hominen plus in passive tone (passive aggressive). I linked a site you don't like, you made the main point of your post about admonishing me for not linking a source to your liking, not about the actual technology. I responded harshly because you made it a personal directed thing.

Then

"that headline is dubious - it it recreates GUIs, not entire programs"

If you're being pedantic, no-one said "entire programs" and we'd have to determine exactly what the specific meaning of computer program even is.

http://www.businessdictionary.com/definition/computer-program.html
"instructions to a computer telling it to do a particular piece of work"

http://dictionary.cambridge.org/dictionary/english/computer-program
a set of instructions that makes a computer do a particular thing"

Which is exactly what the code for a GUI is doing. If you make a GUI that's functional but has no purpose, it's still a program. Just because you can add more to it to make it more "complete" for some specific purpose, that doesn't make the plain GUI any less of a complete program at doing it's purpose - even if that purpose is just to have buttons clicked on and respond visually. That's just as much a complete program as Hello World. The fact that the GUI can't exist outside of it's OS / graphics framework doesn't make it any less of a real program. All programs rely heavily on the existence of frameworks for their operation.

"Looks rather nifty, but I'm not exactly sure of its use Given that with modern IDEs, developing GUIs is as simple as a drag-and-drop procedure,"

Also completely irrelevant. It's an advance in technique, which could be applied to multiple tasks. The fact that a human can already do that task using a manual process isn't a relevant criticism of an AI advance. Humans could already play chess, or any of many other things AIs can now do, that doesn't invalidate the advances.

Still, I'm not exactly sure what problem this tool is trying to solve. Neat demonstration, though.

Any time you might want to automatically generate code from messy data perhaps, which is what NNs are good at filtering out. Hand-coded solutions to deal with complex data which might have noise in the signal isn't very good. Which is why NNs are a thing.

Anyway the argument that you can already get this sort of result from a manual human-operated process is a weak argument to dismiss the potential of any AI advance. How long does manual click and drag take, are there known errors that can crop up when doing that? etc etc? Automatable. I'm pretty certain they can get to the point at which you just give a written description of what a program is meant to do then AI can in fact create that program for you.

[PTTG??]

Neural networks are certainly interesting... We have categorizing networks, but I'd like to make one that works backwards, where you give it a category and it makes an example of it. Throw in the ability to mix categories and see what the AI thinks a half-car, half-tree looks like.

[alway]

That's the image synthesis problem, which is related. Here's some:
https://twitter.com/quasimondo (most recently, they've been messing with creepy portrait-to-doll face conversion) The style transfer problem is sorta like doing both at once; deconstructing an image into features, then re-mapping the features as a different type of thing.
Photorealistic text-to-image synthesis of several types of objects: https://arxiv.org/pdf/1612.03242.pdf
Though most of the latter generate very small images, for memory and time constraint reasons


And in entirely unrelated news: https://arstechnica.com/science/2017/05/renewable-energy-generation-in-the-us-dramatically-exceeds-2012-predictions/

According to the EIA, renewable energy sources like wind, solar, and geothermal power accounted for 10.68 percent of total electricity generation in the first quarter of 2017. If you include electricity from conventional hydroelectric plants, renewables made up nearly a fifth of total electricity generation—as much as 19.35 percent.

So the US grid is apparently now at nearly 20% renewable generation.

[alway]

More really cool SIGGRAPH stuff going up on youtube: https://www.youtube.com/playlist?list=PL_qsGIAxmRQEWUVwymzLecOZVsMYatx2Y
https://www.youtube.com/playlist?list=PLHFiqDkNCp1gaKu4HQwL9-S3eIDmAHIUw
Favorite thus far, wet hair simulation with really neat results video: https://www.youtube.com/watch?v=9Oo0TlprwAQ
Though sadly the lack of runtime information suggests it's far too expensive for us poor game developers who can't afford the extravagance of several minutes/hours of computing on a renderfarm per frame.

[martinuzz]

The Uber top is decimated, after an investigation by former minister of Justice Eric Holder into sexism and machist culture at Uber.
Fellow founder, and CEO Travis Kalanic is put on non-active for at least 3 months, and will get 'another role' upon his return. His right hand Emil Michael is forced to resign completely. Fellow founder Ryan Graves, and technical director Thuan Pam will likely also be forced to resign.

The investigation was opened on request of Uber itself, after former employees spoke up against the company's sexist culture. After recieving the investigation's result, the company's top management has announced it will follow every recommendation in it.

Uber will inform it's employees today / tomorrow about the findings of the investigation, and Holder's recommendations.

In the past few months, Uber has already fired about 20 employees, amongst whom managers and staff members.
With the loss of Kalanic, Michael, Graves and Pam, Uber will be left without COO, CFO, CEO, CBO and CTO, rendering the company all but headless.

There is a fear that it will be left with too little top managers to be able to cope with the various large lawsuits the company is involved in. Amongst others, Uber is being accused of stealing technology for self-driving cars, and for developing it's Greyball App, which misleads authorities in places where Uber is not allowed to operate.

http://www.volkskrant.nl/binnenland/uber-stuurloos-uber-top-moet-veld-ruimen-na-vernietigend-seksismerapport~a4500360/
https://www.nytimes.com/2017/06/11/technology/uber-holder-report.html
https://www.ft.com/content/a2713dd0-4ebf-11e7-bfb8-997009366969


tl;dr R.I.P. Uber?

[hops]

This smells like a power grab by the remaining managers...