Category Archives: Security

Teen Blocks Sim-Hack: Wins Award

The idea of a contest to see who can best defend against attacks sounds like a great one. Yet a recent competition, instead of ending just with the celebration of new-found talent, seems also to come with a subtle marketing spin.

Exercises included advising a start-up on cyber security during a role-playing exercise and fending off a 50-minute-long simulated cyber attack. The simulated attack involved port scans, followed by attacks on a vulnerable webserver, defacement, mail spam, a DDoS and an attempt to extract data. The teams were challenged to try to stop these attacks in real time by changing IDS, firewall and router configurations.

Oh really? They changed IDS, firewall and router configs? Was this a random/unpredictable attack and could defenders choose their own tools? It sounds like it was scripted. Let me guess, this was sponsored by a company that just also happens to sell IDS, firewalls and routers…

…the Hack Idol exercise pitted six five-strong teams against each other in a series of challenges hosted by HP Labs in Bristol on Saturday

Hosted by HP? Shock and surprise. Let me guess next they are going to say how easy it is for anyone to do the same…

[A 19-year-old computer science student], whose only practical experience involved setting up and playing around with a home network, demonstrated innate ability by tackling realistic challenges that simulated the business and practical side of managing enterprise security.

Congrats go to the winner. And then…Bada-bing! It sounds like you just need to send some money to the sponsor for their amazing tools, then do some playing around in the home, and you too will see your attackers start falling down like dominoes.

Hmm, where have I heard this before…

Ocean Punishes Crews in Clipper Round the World Race

Last month the boat Gold Coast Australia sustained crew member injuries and was forced to land in Taiwan after helicopter airlift attempts and ship-to-ship transfer had to be aborted during rough sea state.

Gold Coast Australia in Port
Gold Coast Australia in Port

The skipper of Singapore, Ben Bowley, wrote a graphic account of the extreme conditions sailors faced.

At times the yacht has been less of a big red bus and more of a big red submarine. In the early hours of this morning the boat punched through an enormous solid wall of water, stopped dead and then we had the next wave break directly over the boat. The yacht ended up hove-to with the cockpit and snake-pit full to the brim with water. All the on watch (harnessed on at all times in these conditions) ended up fully immersed and floating.

To give some example of how much water came thundering over the deck, our wooden helming board that normally sits wedged in the aft corner of the cockpit well ended up wedged between the radar post and the pushpit about a foot clear of the deck. So much water came pouring down the companionway that a spare life-jacket in a pocket outside of my cabin inflated. It has taken the best part of four hours to finish getting the water out of the bilges this morning. Luckily no one was hurt and nothing got broken.

I’ve experienced these conditions and they definitely put the power of nature in perspective. Below is a self-portrait after two-weeks on the Pacific Ocean of what I came to appreciate as normal in any kind of breeze and wave state — goggles, full foul-weather gear, life-vest, harness, tethers, jacklines…. The photo may at first give the impression of calm but note how shiny the deck is and how the lines have been pushed together from waves crashing over the windward side.

The real challenge with ocean sailing is that you not only are in the grip of dangerously unpredictable forces, but you are a very long way from assistance or a controlled/stable environment.

A competitor in the Volvo Round the World Race once described to me what being a professional ocean sailor is like: “imagine playing rugby at maximum physical output, but without rest, and if you break a rib you have to keep going in the wet and cold for days or even weeks”.

I used to think of it like climbing Everest because of all the gear and fitness involved, but it really is more like space travel because you depend so much upon a self-sufficient vessel for survival. The Everest of Amateur Sailing blog gives more details.

Tim Burgess, 31, broke his left leg above the knee while working on a headsail change on the foredeck of [Gold Coast Australia], which is competing in the Clipper 11-12 Round the World Yacht Race and is racing from Singapore to Qingdao, China.

Waves up to four metres high and winds of around 30 knots have been providing a gruelling test for the amateur crews of all ten 68-foot yachts and the conditions.

[…]

“The force with which Nick [Woodward] hit his head on the lockers beside the bunk was enough to crack the plywood. There are no obvious signs of further injury however he still has a headache so we are evacuating him as a precautionary measure,” explains [Gold Coast Australia Skipper Richard Hewson].

I suspect he’s lucky it was plywood instead of carbon. Once in port both were successfully transferred to hospital and given medical care.

Updated to add a first-person account of the conditions and accident:

Sleep became the unknown, the unfamiliar as we all struggled to get any rest in the pounding swell and challenging conditions where a hour of sleep was considered a good nights rest.

[…]

With these cold rough conditions our physical state was taking a pounding. My hands were so sore to touch from trying to drag sails down again the gale force winds, my eyes were red and raw from trying to see through the continues spray when I was helming and I had even managed to get wind burn not only on my lips but my eyelids as well. My fatigue was extreme where my muscles would be burning from just getting on to the deck.

[…]

Just when Tim was tying down one of the last sail ties I noticed a large wave coming. I shouted ‘Wave’ which gave Tim enough warning to hold on. He was sitting with his legs either side of the inner-forestay and as the wave cascaded down the deck it washed his leg underneath the Stay Sail and pushed his body around the inner-forestay snapping his leg in two place above his knee.

Although the boat was just 60 nautical miles from land at 8 am when the accident happened, the crew could not transfer the injured men to medical care until 9 hours later.

Zombie Killer Bike

Peacock Groove has done it again. Erik Noren’s pedestrian, er, I mean zombie killing entry (Evil Dead II track bike) has stolen the show at the NAHBS 2012. No need to slow down at those cross-walks when you have a front fork that also can slice.

Check out the amazing artwork and attention to detail, including a chain-saw chain.

Update: I interviewed Erik briefly and he said it was a major challenge to get a real chain-saw chain to work with a large front ring for power instead of an engine in the rear. In typical modest fashion he said credit goes to a chain-saw manufacturer for helping him make it work. He also said he would never actually ride with a chain-saw chain…not sure I believe that. :)

Chain-saw chain

Who is laughing now

Watson: What IBM Won’t Tell You

Many years ago I was on a team tasked with the installation and set-up of IBM cutting-edge speech recognition technology for a research hospital. After we finished we decided to run some tests.

My colleague grabbed the microphone and said “penis degeneration acyclovir sildenafil citrate”. The system dutifully printed the words on the screen, exactly as he said them.

“What was that?” I asked him.

“I dunno, but I hear doctors say it all the time” he replied with a big grin, as if he was imagining himself putting on a white coat and demanding ten times the salary he was currently earning.

“We need to really test it” I said, not willing to believe the system was as clever as the IBM sales reps were trying to make everyone believe. They said the usual stuff about the biggest dictionary ever and the fastest processor on earth…able to decipher any accent in a single bound, yada, yada.

I pulled the microphone away and said “What’s for lunch?”

The screen was blank, the disk access lights were blinking, and then the screen typed “lorazepam soma heartburn”.

“Not what I was expecting but this thing might actually be genius” I said as my colleagues rolled on the floor laughing at it.

I tried again by saying “Make me a peanut butter and jelly sandwich!” It delayed, delayed some more and then printed “vitrectomy paroxetine aloe vera detoxification ciprofloxacin.”

“Yup, perfect. Looks ready for production” I said as we all giggled our way to the project manager’s office.

That’s the story that comes to mind when I read the exciting news of IBM’s latest artificial intelligence project, Watson. But before I get ahead of myself, take a look at the obvious and ironic flaws in IBM’s marketing strategy.

Financial services is the “next big one for us,” said Manoj Saxena, the man responsible for finding Watson work. IBM is confident that with a little training, the quiz-show star that can read and understand 200 million pages in three seconds can make money for IBM by helping financial firms identify risks, rewards and customer wants mere human experts may overlook.

Maybe it’s just me but why is some guy hired by IBM to tell Watson where to work? It’s the smart one, right? Ask Watson whether financial services is the “next big one” and see what this Jeopardy-winning machine says. My guess is it will pop out something like “Defence Industry for $1 trillion, Alex”.

The humans of IBM seem to say they choose target markets for Watson based on how much was spent on technology in the past. Isn’t that exactly the kind of analysis Watson was made for?

Banks spent about $400 billion on information technology last year, said Michael Versace, head of risk research at International Data Corp’s Financial Insights, which has done research for IBM.

I find it also ironic that the name of the guy tracking where the money goes is Versace. What if Watson was focused on risk in the retail industry? A lot of money can be made from predicting who will continue to buy Versace.

But seriously, banks took a massive hit in the 2008 crisis and have been cutting back budgets. Spending $400 billion on IT is a single data point not a trend and it certainly is not a prediction. Yet IBM doesn’t seem worried.

Watson “can give an edge” in finance, said Stephen Baker, author of books The Numerati and Final Jeopardy, a Watson biography. “It can go through newspaper articles, documents, SEC filings, and try to make some sense out of them, put them into a context banks are interested in, like risk.”

Perhaps the real question they should be asking Watson is whether it can predict or find the junk, toxic loans and Bernie Madoff schemes. But that is the part of the story IBM is probably not happy to discuss. While they will always tell you it can outrun human processing they tend not to talk about the dark side of that equation — it can make mistakes faster than ever before and might not be able to recognise when it has based itself on humans’ faulty logic.

I tried to highlight this quandary in my BSidesLV presentation last year “2011: A Cloud Odyssey“. Aside from simple error in automation, automation of human thought can also mean accelerating the wrong decision or having too much confidence in a decision. HAL killed the crew of his ship when he (mistakenly) thought they would jeopardise the mission.

Watson isn’t as powerful as HAL, of course, and probably will be managed better. If you think of it as a CPU, a fast tool, the level of risk seems far more reasonable. Unfortunately we humans always are tempted to personalise computers and see them as thinking, sensing machines…only to realise too late our deepest questions will be answered with nonsense (e.g. “42“).

A first person account of Watson that was sent to me seems far more reasonable in perspective and explanation of limitations than the predictably glowing marketing statements from IBM.

It fails mostly when leaps of creative thinking are required. The kind of thing humans can do quickly and computers can’t. Otherwise it searches (and seems to add to) its knowledge base much as humans do, only way way faster. Perfect (almost) for Jeopardy. Or for assisting with diagnosing medical conditions.

That sounds like something Watson might agree with.

Watson

Update: a decade later in 2022, Watson has been scrapped for trying to kill patients.