2018 AppSec California: “Unpoisoned Fruit: Seeding Trust into a Growing World of Algorithmic Warfare”

My latest presentation on securing big data was at the 2018 AppSec California conference:

When: Wednesday, January 31, 3:00pm – 3:50pm
Where: Santa Monica
Event Link: Unpoisoned Fruit: Seeding Trust into a Growing World of Algorithmic Warfare

Artificial Intelligence, or even just Machine Learning for those who prefer organic, is influencing nearly all aspects of modern digital life. Whether it be financial, health, education, energy, transit…emphasis on performance gains and cost reduction has driven the delegation of human tasks to non-human agents. Yet who in infosec today can prove agents worthy of trust? Unbridled technology advances, as we have repeatedly learned in history, bring very serious risks of accelerated and expanded humanitarian disasters. The infosec industry has been slow to address social inequalities and conflict that escalates on the technical platforms under their watch; we must stop those who would ply vulnerabilities in big data systems, those who strive for quick political (arguably non-humanitarian) power wins. It is in this context that algorithm security increasingly becomes synonymous with security professionals working to avert, or as necessary helping win, kinetic conflicts instigated by digital exploits. This presentation therefore takes the audience through technical details of defensive concepts in algorithmic warfare based on an illuminating history of international relations. It aims to show how and why to seed security now into big data technology rather than wait to unpoison its fruit.

Copy of presentation slides: UnpoisonedFruit_Export.pdf

Locally Decode Windows Administrator Password for AWS Instance

If you’ve run into that awkward moment in AWS when they ask you to submit your key into some suspicious-looking web interface in order to receive the password for your newly created instance, this quick command is for you.

After an instance is created and running, right-click on the instance and select “Instance Settings” then “Get System Log”:

As you just booted your instance for the first time, the administrator password will be printed to the log:

Copy the text between the password markup to your buffer and then paste it into this command along with the local directory of your pemfile:

echo "copied-password" | base64 -d | openssl rsautl -decrypt -inkey "directory/pemfilename" -out administrator.password

Then open the administrator.password file and you’ll see the password for your administrator account

Did a Spitfire Really Tip the Wing of V1?

Facebook has built a reputation for being notoriously insecure, taking payments from attackers with little to no concern for the safety of its users; but a pattern of neglect for information security is not exactly the issue when a finance guy in Sydney, Australia gives a shout-out to a Facebook user for what he calls an “amazing shot” in history:

As anyone hopefully can see, this is a fake image. Here are some immediate clues:

  1. Clarity. What photographic device in this timeframe would have such an aperture let alone resolution?
  2. Realism. The rocket exhaust, markings, ground detail…all too “clean” to be real. That exhaust in particular is an eyesore
  3. Positioning. Spitfire velocity and turbulence relative to V1 is questionable, so such a deep wing-over-wing overlap in steady formation is very unlikely
  4. Vantage point. Given positioning issue, photographer close position aft of Spitfire even less likely

That’s only a quick list to make a solid point this is a fabrication anyone should be able to discount at first glance. In short, when I see someone say they found an amazing story or image on Facebook there’s a very high chance it’s toxic content meant to deceive and harm, much in the same way tabloid stands in grocery stores used to operate. Entertainment and attacks should be treated as such, not as realism or useful reporting.

Now let’s dig a little deeper.

In 2013 an “IAF Veteran” posted a shot of a Spitfire tipping a V1.

This passes many of the obvious tests above. He also inserts concern about dangers of firing bullets and reliably blowing up a V1 in air, far away from civilians, versus sending it unpredictably to ground. Ignore that misleading analysis (shooting always remained the default) and revel instead in authentic combat photo quality of that time.

After this 2013 tweet several years then pass by, and nobody talks about V1 tipping, until only a few weeks ago a “Military aviation art” account posts a computer rendered image with a brief comment:

Part of a new work depicting the first tipping of a V-1 flying bomb with a wing tip. Who achieved this?

It is a shame this artist’s tweet wasn’t given proper and full credit by the Sydney finance guy, as it would have made far more sense to have a link to the artist talking about their “new work” or even to their art gallery and exact release dates:

Who achieved this? Who indeed? The artist actually answered their own question in their very next tweet, where they wrote…

On the bright side the artist answers their own question with some real history and a real photo, worth researching further. On the dark side the artist’s answer also sadly omits any link to original source or reference material, let alone the (attempted) realism found above in that “IAF veteran” tweet with an actual photograph.

The artist simply says it is based on a real event, and leaves out the actual photograph (perhaps to avoid acknowledging the blurry inspiration to their art) while including a high-resolution portrait photo of the pilot who achieved it.

Kind of misleading to have that high-resolution photograph of Ken Collier sitting on the ground, instead of one like the IAF Veteran tweeted… an actual photograph of a V1 being intercepted (e.g. Imperial War Museum CH16281).

The more complete details of this story not only are worth telling, they put the artist’s high-resolution fantasy reconstruction (of the original grainy blotchy image) into proper context.

Uncropped original has a border caption that clearly states it’s art, not a photo

Fortunately “V1 Flying Bomb Aces by Andrew Thomas” is also online and tells us through first-person accounts of a squadron diary what really happened (notice both original photographs are put together in this book, the plane and the pilot).

And for another example, here’s what a Vickers staged publicity photo of a Spitfire looked like from that period.

A Spitfire delivers beer to thirsty Allied troops

It shows the “Mod XXX Depth Charge” configuration (two 18 gallon barrels of bitter “beer bombs” to deliver into Normandy) and you can be sure an advertising/propaganda agency would have used the clearest resolution possible — the British don’t mess around with their beer technology.

Again notice the difference between air and ground photos, even when both are carefully planned and staged for maximum clarity.

Strong’s Brewery Barrels Locked and Loaded.

Back to the point here, V1 would be shot down in normal operations not “tipped”, as described below in a Popular Mechanics article about hundreds in 1944 being destroyed by the Tempest’s 22mm cannon configuration.

Popular Mechanics Feb 1945

Just to make it absolutely clear — Popular Mechanics’ details about cannons unfortunately doesn’t explain shooting versus tipping — here’s a log from Ace pilots who downed V1.

Excerpted from “V1 Flying Bomb Aces” by Andrew Thomas

So you can see how debris after explosions was a known risk to be avoided, even leading to gun modifications to hit with longer-ranges. It also characterizes tipping as so unusual and low frequency it would come mainly at an end of a run (e.g. with gun jammed).

Just for a quick aside for what followed soon after WWII ended, as I wrote on this blog last year, things inverted — shooting drones down in the 1950s was far more dangerous than tipping them because of increased firepower used (missiles).

Compared to shooting cannons at the V1, shooting missiles at drones was more like launching a bunch of V1s to hit a bigger V1, which ended as badly as it sounds (lots of collateral ground damage).

Again, the book “V1 Flying Bomb Aces” confirms specific ranges in the 1940s were used for shooting bombs so they exploded in air without causing harm, preferred against tipping.

Osprey Pub., Sep 17 2013.
ISBN 9781780962924

…the proper range to engage the V1 with guns was 200-250 yards.

Further out and the attacker would only damage the control surfaces, causing the V1 to crash and possibly cause civilian casualties upon impact.

Any closer and the explosion from hitting the V1’s warhead could damage or destroy the attacking aircraft.

Apparently the reason tipping worked at all was the poorly engineered Nazi technology had a gyro stabilizer for two dimensions only — flight control lacked roll movement.

V1 Flying Bomb Gyro. Source: MechTraveller

Tipping technically and scientifically really was a dangerous option, because physics would send the bomb out of control to explode on something unpredictable.

Back to the curious case of the artist rendering that started this blog post, it was a Spitfire pilot who found himself firing until out of ammo. He became frustrated without ammo so in a moment of urgency decided to tip a wing of the V1.

Only because he ran out of bullets, in a rare moment, did he decide to tip… of course later there would be others who used the desperate move, but the total number of V1 tipped this way reached barely the dozens, versus the thousands destroyed by gunfire.

Shooting the V1 always was preferred, as it would explode in air and kill far fewer than being tipped to explode on ground as also documented in detail by Meteor pilots, hoping to match the low-altitude high-speed of a V1.

Compared with the high performance piston-engined fighters then in service with the RAF (the Tempest V and Spitfire XIV), the Meteor offered little in the way of superior performance. Where it excelled, however, was at low level – exactly where the V1 operated. The Meteor I was faster than any of its contemporaries at such altitudes. This was just as well, for the V1 boasted an average speed of roughly 400mph between 1,000ft and 3,000ft. At those heights the Tempest V and Spitfire XIV could make 405mph and 396mph, respectively, using 150-octane fuel. The Meteor, on the other hand, had a top speed of 410mph at sea level. […] While the first V1 to be brought down by a Meteor was not shot down by cannon fire, the remaining 11 credited to No. 616 Sqn were, using the Meteor I’s quartet of nose-mounted 20mm cannons.

Note the book’s illustration of a V1 being shot at from above and behind. Osprey Publishing, Oct 23 2012. ISBN 9781849087063

Does a finance guy in Sydney feel accountable for claiming a real event instead of admitting to an artist’s fantasy image?

Of course not, because he has been responding to people that he thinks it still is a fine representation of a likely event (it isn’t) and he doesn’t measure any harm from confusion caused; he believes harm he has done still doesn’t justify him making a correction.

Was he wrong to misrepresent and should he delete his “amazing shot” tweet and replace with one that says amazing artwork or new rendering? Yes, it would be the sensible thing if he cares about history and accuracy, but the real question is centered around the economics of why he won’t change.

Despite being repeatedly made aware that he has become a source of misinformation, the cost of losing “likes” probably weighs heavier on him than the cost of having a low integrity profile. And as I said at the start of this post (and have warned since at least 2009 when I deleted my profile), the real lesson here is that Facebook loves low-integrity people.

The Chaos

by Dr. Gerard Nolst Trenité
(Netherlands, 1870-1946)

Dearest creature in creation,
Study English pronunciation.
I will teach you in my verse
Sounds like corpse, corps, horse, and worse.
I will keep you, Suzy, busy,
Make your head with heat grow dizzy.
Tear in eye, your dress will tear.
So shall I! Oh hear my prayer.
Pray, console your loving poet,
Make my coat look new, dear, sew it!

Just compare heart, beard, and heard,
Dies and diet, lord and word,
Sword and sward, retain and Britain.
(Mind the latter, how it’s written.)
Now I surely will not plague you
With such words as plaque and ague.
But be careful how you speak:
Say break and steak, but bleak and streak;
Cloven, oven, how and low,
Script, receipt, show, poem, and toe.

Hear me say, devoid of trickery,
Daughter, laughter, and Terpsichore,
Typhoid, measles, topsails, aisles,
Exiles, similes, and reviles;
Scholar, vicar, and cigar,
Solar, mica, war and far;
One, anemone, Balmoral,
Kitchen, lichen, laundry, laurel;
Gertrude, German, wind and mind,
Scene, Melpomene, mankind.

Billet does not rhyme with ballet,
Bouquet, wallet, mallet, chalet.
Blood and flood are not like food,
Nor is mould like should and would.
Viscous, viscount, load and broad,
Toward, to forward, to reward.
And your pronunciation’s OK
When you correctly say croquet,
Rounded, wounded, grieve and sieve,
Friend and fiend, alive and live.

Ivy, privy, famous; clamour
And enamour rhyme with hammer.
River, rival, tomb, bomb, comb,
Doll and roll and some and home.
Stranger does not rhyme with anger,
Neither does devour with clangour.
Souls but foul, haunt but aunt,
Font, front, wont, want, grand, and grant,
Shoes, goes, does. Now first say finger,
And then singer, ginger, linger,
Real, zeal, mauve, gauze, gouge and gauge,
Marriage, foliage, mirage, and age.

Query does not rhyme with very,
Nor does fury sound like bury.
Dost, lost, post and doth, cloth, loth.
Job, nob, bosom, transom, oath.
Though the differences seem little,
We say actual but victual.
Refer does not rhyme with deafer.
Foeffer does, and zephyr, heifer.
Mint, pint, senate and sedate;
Dull, bull, and George ate late.
Scenic, Arabic, Pacific,
Science, conscience, scientific.

Liberty, library, heave and heaven,
Rachel, ache, moustache, eleven.
We say hallowed, but allowed,
People, leopard, towed, but vowed.
Mark the differences, moreover,
Between mover, cover, clover;
Leeches, breeches, wise, precise,
Chalice, but police and lice;
Camel, constable, unstable,
Principle, disciple, label.

Petal, panel, and canal,
Wait, surprise, plait, promise, pal.
Worm and storm, chaise, chaos, chair,
Senator, spectator, mayor.
Tour, but our and succour, four.
Gas, alas, and Arkansas.
Sea, idea, Korea, area,
Psalm, Maria, but malaria.
Youth, south, southern, cleanse and clean.
Doctrine, turpentine, marine.

Compare alien with Italian,
Dandelion and battalion.
Sally with ally, yea, ye,
Eye, I, ay, aye, whey, and key.
Say aver, but ever, fever,
Neither, leisure, skein, deceiver.
Heron, granary, canary.
Crevice and device and aerie.

Face, but preface, not efface.
Phlegm, phlegmatic, ass, glass, bass.
Large, but target, gin, give, verging,
Ought, out, joust and scour, scourging.
Ear, but earn and wear and tear
Do not rhyme with here but ere.
Seven is right, but so is even,
Hyphen, roughen, nephew Stephen,
Monkey, donkey, Turk and jerk,
Ask, grasp, wasp, and cork and work.

Pronunciation — think of Psyche!
Is a paling stout and spikey?
Won’t it make you lose your wits,
Writing groats and saying grits?
It’s a dark abyss or tunnel:
Strewn with stones, stowed, solace, gunwale,
Islington and Isle of Wight,
Housewife, verdict and indict.

Finally, which rhymes with enough —
Though, through, plough, or dough, or cough?
Hiccough has the sound of cup.
My advice is to give up!!!

Originally transcribed by Pete Zakel .