SXSW Day 2, session 3: Catch me if you can: Overview of moving target defence techniques for preventative cybersecurity

By Chris Christou of Booz Allan Hamilton

This session sounded very interesting, but unfortunately was presented by someone who didn't seem to be very versed in the details.  Every question I asked he went to his tablet to search for the answer, and eventually I gave up trying to understand, figuring out that I may as well go to wikipedia myself instead of having him intermediate it for me.  I haven't had a chance to do that quite yet, so this is a rather brief summary of the little I understood:

Most cyber defenses today are reactive.  But are there proactive measures we can take to improve our defenses against cyber threats?
The traditional cyber defense relies on these four pillars: Prevention, Detection, Reaction, Recovery; but it primarily consists of building a moat around my assets.  The problem is that all the elements that are used to build the moat are based on the same underlying platform components: Linux, firewall, etc.  Hackers know these components well, including all their weaknesses and vulnerabilities.  Furthermore, while the defenses are stationary, the attackers are a moving target - it's hard to anticipate where they might strike from.  The way we map our network elements is static - IPs and DNS lookup tables - these present stationary targets.  How can you get around this structured defense problem?

A new field of cyber defense is called moving target defense.  The idea is to constantly change the environment in some way, to deprive the attacker of the advantage of consistency.  Conceptually, this is like frequency hopping in communication: it forces the attackers to spend a lot more time and resources to find a pattern they can attack.

Four areas of research were discussed:

1. Anti Return Oriented Programming (Anti-ROP), researched by IBM (Haifa, so an Israeli Idea.  also, a similar solution is provided commercially by an Israeli company called Morphisec): One common attack form hackers use exploits the fact that code libraries used in attacked computers are frequently publicly available and can be studied.  Attackers can use this knowledge to use the code out of order, by jumping around in the memory to areas they know in advance will contain certain commands they want to be able to use.  What Anti-ROP does is to mix up and randomize the order of the code in memory, so an attacker won't know where to find what they are looking for.  A nice little video explaining how this works can be found here.
2. Network attribute randomization, researched by Sandia labs: As mentioned above, one of the weaknesses of a static network is that if attackers are able to gain even limited access to it, they can observe it over time and map its structure, looking for weak points.  Network attribute randomization constantly changes the network attributes, such that it's very hard to map it, and even if mapped the map very quickly becomes obsolete.  This makes attacks much harder, as you can't pinpoint the weak elements.  The paper Sandia labs published can be found here.
3. Self adaptive system: this was presented more as a concept than a concrete solution.  A self adaptive system is a system that uses some form of AI to constantly evaluate its own behavior to see if it is accomplishing its goals, and if not, change itself to adapt.  This general concept can be applied to cyber security, but no details were given as to how.
4. Host Identity Protocol: This one I understood the least, but generally speaking, today a client accessing a server looks up the server name in a DNS server and gets the server IP.  Once it has the IP, it can easily find the server again.  Host identity protocol is an enhancement to internet protocol that adds host identity as an additional layer, which intermediates between namespace and IP.  That is to say, the DNS returns the host ID, which is encrypted, and the client makes the call to the host ID instead of to the IP.  This separates the transport layer from the internet layer.  To be honest I'm not sure I understand how this helps, but you can read more about it here and here.  If you figure it out, let me know.  By the way, this is a proposal only, it's not implemented anywhere.

So that's that.  Certainly an interesting topic, but unfortunately not well delivered.

SXSW Day 2, session 2: The Future of You: Identity Tomorrow

Panel discussion by Steve Larson from SureID, Lindsey Edwards from Linkedin and Tom Gosner, founder of Docusign, moderated by James Varga.

SureID provides a service whereby people can enroll to get a verified digital identity.  It's a commercial service, so you can go to a UPS store, provide proper documentation proving who you are, and get a digital identity (which includes biometrics) that you could use online in a few places to validate you are who you say you are.
Linked-in, which focused on professional identity, is now looking to help people establish their Enterprise identity, that is all the things you would like to identify about yourself in the context of your Enterprise, but not externally (teams you worked with, projects you worked on, etc).
Docusign is a system allowing for secure online digital signing of documents, replacing traditional pen signature with certificate based signing.

The main discussion of the panel is how you can achieve online trust in identity: proving you are who you say you are.  This requires a source of trust which can verify you, and provide you with a digital identity that cannot be forged.

Currently, business are struggling to know who is coming to use their digital services.  An example sited was dating sites, where many identities are fake, or embellished, and there's no real way to get trusted information about the person you're connecting with.

Another interesting point raised is that there are multiple levels of verifications to consider.  First, there is the basic verification that you are who you claim to be.  However, then comes the question of the information you attribute to yourself - is it also verified?  The system can identify you are John Doe, but how does it know you are 21 as you claim to be?  That you are 6' tall?  That you have an engineering degree?  Conversely, if the digital identity has all this information, you don't always want to expose all of it, or sometimes you only want to expose categories of it.  For example, if a site needs to know you are at least 21 years old, you don't want it to be able to access your age from the digital identity - only to confirm that it's 21 or more.  This is a level of sophistication not currently available, but which will need to be considered.

Currently, we have dozens or more digital identities – most web sites we register to manage their own ID, which forces the user to remember multiple passwords to each identity.  The risk with this is that forgetting a password to one of your identities is frustrating and may cause a user to drop out of a service.
What can be used as the single digital identity?  On the one hand you have social network identities, which are well established: Facebook connect, for example, is the biggest identity network in the world.  Unfortunately, though, it is not at all reliable - cats and dogs have Facebook accounts.
Alternatively, more secure identification methods are not as available, require more effort to sign up for, and may be costly as well.  Business do not want to force them because they have not reach mass adoption, and people won’t go to the effort of adopting them until they are usable in a lot of places.  The process of adoption will have to be enforced by strong entities like governments or banks.  Right now they lose most, and can force the issue to reduce their liability.  An example given was fake tax returns, submitted by people impersonating others, and which costs the US government billions of dollars annually.
In Europe the governments are more active in trying to formalize digital identification.  Estonia, for example, has a digital identity platform which they are opening up to other countries.  But it still requires you going to an Estonian embassy to get it.
In the Nordic countries, banks and government have collaborated to create a Bank ID which has reduced bank fraud substantially.  However there is no universal solution – each country does its own thing (e.g. Israel, with the biometric database).

A driver’s license is a good example of a locally verified document, but very few people know how to identify a fake one, so the enforcement mechanism is limited.  Also, it’s only as up to date as the date it was issued.
A passport is an example of a globally accepted identification document, which is accepted for a wide variety of applications.  However it suffers the same limitations as a driver’s license in terms of authentication and being up to date.

Notaries are a traditional form of identity verification, which has lost its usefulness; a notary will usually validate you presented a document to them that identifies you, but the document itself may suffer the same weaknesses described above.

What is the future of digital identity?

• Social networks like Facebook and Linked-in have hundreds of millions of identities, and may have an interest in making them more reliable as a digital identity
• Individuals need to be more motivated to use strong digital identity, which would require digital identities to be more convenient.  Also, the unification of digital identity is a must, one digital identity that can be used multiple times.

What is the future of digital identity theft?

• More than half of US fraud is online fraud
• Personal information is already out in the open now, so if we keep relying on personal information we will never get ahead of identity theft
• We overshare to compensate for our inability to trust digital identity – identification processes force us to give more and more information about ourselves, which feeds into the fraud problem. 

SXSW Day 2, session 1: AI on the Horizon: Challenges, Directions, Future

The speaker in this session was Eric Horvitz, Director of the Microsoft Research Lab on MS's main campus.

The lecture started with a basic primer on AI, defining the four pillars of AI, as the speaker identified them - perception, learning, reasoning and natural language.  He went through a few areas where AI is being applied, such as image recognition and meaning (recognizing expressions), though drone piloting (preventing collisions by teaching in simulated environments) through assisted surgery - a human doctor and a robot collaborating to perform a particularly complex surgery.  He also talked about autonomous cars and the benefits expected from them.  All very standard for an AI conversation.

He then moved on to some of the challenges.  First, dealing with unknowns.  AI is trained to identify patterns, but how should it deal with surprises?  This is especially clear in autonomous driving, where surprises can happen all the time - a kid popping out into the road, a tree branch falling and so on.  He also touched on Ethical challenges; again, the example of autonomous cars, where a car might have to decide whether to swerve away from a person on the road but risk the passenger, or avoid risk to the passenger at the cost of hitting the person on the road?  These kinds of questions will have to be programmed into the cars, and also dealing with unexpected scenarios that cannot be predetermined.

Another risk is using AI to generate new "attack surfaces" that were previously unavailable.  For example, adversarial machine learning.  An image recognition AI will map a set of properties and parameters it finds on an image to a definition of the image.  One group of researches took the AI and used it to look for the smallest possible changes in the image that would make the software recognition AI misidentify the image.  See the below example:

The image of the stop sign on the right was tweaked by only a few pixles - to the eye it looks exactly the same; however to the image recognition software these small changes were enough to change the definition it matched to from "stop" to "yield", even though the image looks nothing like a yield sign.  I wondered whether this sort of things could be done with humans as well, and asked him, but he said that machines work differently than the human brain, about which we don't know nearly enough about to be able to engineer this type of attach.

Another concern is AI attacks on human minds.  Research here studied the information from twitter to craft a twitter message personalized to one specific user, that would make them most likely to click a link in the tweet.  This required understanding from the twitter feed what types of messages cause that person to click on an attached link, and then construct a message to match those parameters. The message looks like it was written by a human, not by a machine.

An additional advancement in AI that can be misused is the ability to add the expressions from one person on to a video of another in real time.  This allows to take a video of someone and make their face match expressions they did not make.

Another area to be careful of is machine bias.  Artificial intelligence algorithms are extremely complex and it's hard to fully grasp how they will behave precisely.  This can lead to unexpected biases forming in the system.  For example, a system used in advising judges about early releases of prisoners was found to have bias in determining who is likely to recommit a crime.

The speaker then considered the concern addressed by a few that once AI is able to design its own code, it will grow at an incredible accelerated pace, leaving humans far behind.  This view is shared by a number of members of the computer scientist community, although there is some debate as to when this type of condition may arrive.

Looking forward, the speaker compared where we are with AI now to the Kittyhawk moment - we've done the initial breakthrough equivalent of the first airplane getting into the air.  He noted that it only took 50 years from that moment to the first Jumbo 707 plane, and with software improvements can be done in a much faster pace.

The speaker closed by looking at some of the work he's involved in now in thinking about the impact of AI.  One example is a 2016 report on AI and life in 2030, and another is a session he coordinated that pitted two AIs against each other, one coming up with nightmare scenarios of AI running out of control, and the other building countermeasures and defensive strategies.

He briefly addressed the possible combination of Quantum computing and whether it would be an accellerator for AI, and said that in his opinion, it was not clear this was the sort of thing quantum computing would be good at.

Another future of AI question is what happens when we all become completely dependent on getting our recommendations from AI?  what impacts does that have on the life of people?

An excellent lecture overall.

SXSW 2017 Day 1: Friday, March 10

A short day, consisting primarily of registration and one and a half sessions.  The fault is in travel - by the time a room was available for me at the Hotel half the day was gone.  At any rate, I caught the tail end of an interview with some CNN guy, and then went to a session called "The Best Innovation is in Africa", by Toby Shapshak.

It was ok, nothing groundbreaking.  I took a few things from the session, which to be honest focused almost exclusively on the revolution the mobile phone is bringing to Africa.  Toby put it well by saying that Africa skipped the desktop computer right into the mobile phone (reminiscent of how India largely skipped industrialization right into IT).  At any rate, almost all the innovation he talked about was telco related, which, while truly impressive, is not telling the whole story.  But more on that later.
Another important talking point is that innovation is happening in Africa because there they have real life-and-death problems they need to solve.  In the west we are working on problems of convenience, so it's less impressive innovation.

Most of the focus was mobile money - the prevalence of using mobile phones to pay for pretty much anything.  The main payment system over mobile is MPesa, which accounts for 80% of the mobile transactions in East Africa.  The amount of transactions they do a year adds up to 40% of Kenya's GDP.  He said he had encounters with beggars, who asked for money in MPesa, and an official attempting to get a bribe using it.  It's simple, fast and available, so it's ubiquitous.
By the way, the feature phone is still huge in Africa, although smartphones are growing.  Still, feature phones are super cheap, have a battery that can last a month, and come with useful features like radio and flashlight.  The battery life is important because charging the phone is expensive, and you can't do it everywhere.  Here too innovation springs up - he talked of a $200 solar panel sold on payment plan, which allows people to charge their battery on it, light up the house and even sell electricity to their neighbors.

Another clever use of the mobile is MFarm, which allows farmers to group together to get better leverage in buying material and selling product.  Again, since this is all done in SMS, it's super easy to use.

One more interesting example he presented was an incubator for premature babies.  He said that NGOs would ship out modern western incubators to clinics and hospitals, but those would not be able to afford the parts if anything went wrong with them.  So someone designed a more suitable incubator, where all the mechanical parts are made of Toyota car parts (most popular brand), so it's easy to get.  The heat is generated by a pair of headlamps, they put the car fan there, and so on.  Very innovative.

What he did not talk about (and what I was hoping to hear more about was infrastructure architecture: Given Africa's _massive_ infrastructure deficits, what innovation is going to disrupt this field?  For example, drones are going to circumvent the lack of roads.  I would have loved to hear more things like that.

Over all, not bad.

SXSW 2017!

Here I find myself in Austin Texas for SXSW conference, where I am expecting a whirlwind of futurology, innovation and general coolness.  I'll report each day's learning in a separate blogpost.  Stay tuned!  First one coming right away.

Over a year

So it's been almost two years since I last posted here, and I don't even know what prompted me to go back and post.  No one reads this post, anyway.
Perhaps it was John Scalzi's "Whatever" blog, which I got to after reading a number of his books.  His Old Man's War series was pretty good, with lots of spinoffs, and I'm going through them as he's putting them out.  But then the search results showed a collection of posts he published, plus another book called "You're not fooling anyone bringing that laptop into the coffeeshop", which is a book on how to be a professional writer.
Reading that you understand the guy better, in that he writes all the time, constantly, and for anyone and anything.  I'm not sure how he can avoid drying up inside, as much as he writes.  Plus he does lots of other stuff as well, so I guess the writing comes pretty easily for him.  Nevertheless, it got me thinking that perhaps I need to try and do more with my life than just, well, work.
Anyway, some of his posts were hilarious.  One that's in the book is called "Your hate mail will be graded", and it was so funny I fell off the couch, laughing, reading it.  He's got another funny one in his blog about politics, telling how he hates the various different groups of politicians in the US.  Some choice quotes:

"Liberals champion the poor and the weak but do it in such condescendingly bureaucratic ways that the po’ illedumacated Cleti would rather eat their own shotguns than associate with the likes of them"

On Conservatives: "Let their sons get caught with a dime bag and see how many are really for “zero-tolerance.” Let a swarthy day laborer impregnate their daughters and find out how many of them are really pro-life."

"Libertarians secretly worried that ultimately someone will figure out the whole of their political philosophy boils down to “Get Off My Property.” News flash: This is not really a big secret to the rest of us."

Hilarious stuff, that.

Visionary, Revolutionary, Philosopher, Artist

It is rare to find a person with the qualities of Steve Jobs - a visionary who could see well beyond his time; a revolutionary who had the daring and drive to bring his visions to life; a philosopher who believed in bringing simplicity and emotional experience into a world of technology that had neither; and an artist who could not and would not compromise on the perfection and beauty in everything he did. A man of unparalled standards and patience in a world full of compromise and quick wins - how dull and frustrating would technology be without him! How restrictive and oppressive it would be, accessible to only to the tech savey nerds, while the rest of the world is locked out (as it was until the 80s).
Apple is an amazing company. Its products are not only popular, they set the standard for popular. They are not only innovative, they set the standard for innovative. Apple sets the yardstick for the entire industry: tech pundits compare every smart phone to the iPhone; every tablet to the iPad. If imitation is the greatest form of flattery, then Apple must be the most flattered company on earth. And this spirit of innovation, the drive for excellence, this uncompromising strive for artistic perfection all came from Steve Jobs. We know this because in the years he was not there, Apple plummeted to near bankruptcy and technological irrelevance. Since he came back, it's become the biggest company in the world (bigger than Exxon Mobile), all by making cool stuff. Not by drilling for natural resources, or making weapons, or doing financial speculation, or monopolizing the industry with drab, boring and inferior products; just by making really cool stuff that people enjoy using. Isn't that a great legacy to leave behind?

Rest in peace, Steve, and thanks.