Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

July 18, 2018

Is the GRU Running Windows 10?

Filed under: Cybersecurity,Microsoft,Security — Patrick Durusau @ 7:44 pm

I ask if the GRU is running Windows 10 in part because of the fanciful indictment of twelve Russians that presumes key logging on GRU computers.

That and I saw: Exploiting a Windows 10 PagedPool off-by-one overflow (WCTF 2018), today.

From the post:

My contribution to the above result was a flag for the “Searchme” task authored by Eat, Sleep, Pwn, Repeat. It involved the exploitation of an off-by-one buffer overflow of a PagedPool allocation made by a vulnerable kernel driver loaded in Windows 10 64-bit. Shortly after the CTF, the original author (@_niklasb) published the source code of the driver and the corresponding exploit (see niklasb/elgoog on GitHub and discussion on Twitter), which revealed that my solution was partially unintended. Niklas used the off-by-one to corrupt allocation metadata and performed some pool feng-shui to get overlapping pool chunks. On the other hand, I achieved a similar outcome through a data-only attack without touching any pool metadata, which made the overall exploitation process somewhat simpler. I encourage you to closely analyze Niklas’ exploit, and if you’re interested in my approach, follow along.

If you want to jump straight to the exploit code, find it on GitHub.

Beyond my current skill level but a good example to follow for improving the same.

Aside to the GRU: Software compiled by others is untrustworthy. All cases, no exceptions. Consider Linux.

Apologies for the Silence!

Filed under: Social Media — Patrick Durusau @ 12:18 pm

After years of posting on a daily basis, I fell into a slump since 30 June 2018 with no posts.

Sorry!

Part of the blame goes to social media, Facebook/Twitter, where I wasted time every day correcting people who were wrong. 😉

Both are tiresome and bottomless pits of error.

The sight of people wrapping themselves in flag and country over remarks concerning the US intelligence community, shocked me back into some semblance of sanity.

There are no words, no facts, no persuasive techniques that will sway anyone in the grip of such delusions.

That being the case, I was wasting my time trying to do so.

I’ve still been collecting links so have a large backlog of potential posts.

Spread the word! I’m back!

June 30, 2018

What’s Your Viral Spread Score?

Filed under: Fake News,News,Social Media,Social Networks — Patrick Durusau @ 4:13 pm

The Hoaxy homepage reports:

Visualize the spread of claims and fact checking.

Of course, when you get into the details, out of the box, Hoaxy isn’t setup to measure your ability to spread virally.

From the FAQ:


How does Hoaxy search work?

The Hoaxy corpus tracks the social sharing of links to stories published by two types of websites: (1) Low-credibility sources that often publish inaccurate, unverified, or satirical claims according to lists compiled and published by reputable news and fact-checking organizations. (2) Independent fact-checking organizations, such as snopes.com, politifact.com, and factcheck.org, that routinely fact check unverified claims.

What does the visualization show?

Hoaxy visualizes two aspects of the spread of claims and fact checking: temporal trends and diffusion networks. Temporal trends plot the cumulative number of Twitter shares over time. The user can zoom in on any time interval. Diffusion networks display how claims spread from person to person. Each node is a Twitter account and two nodes are connected if a link to a story is passed between those two accounts via retweets, replies, quotes, or mentions. The color of a connection indicates the type of information: claims and fact checks. Clicking on an edge reveals the tweet(s) and the link to the shared story; clicking on a node reveals claims shared by the corresponding user. The network may be pruned for performance.

(emphasis in original)

Bottom line is you won’t be able to ask someone for their Hoaxy score. Sorry.

On the bright side, the Hoaxy frontend and backend source code is available, so you can create a customized version (not using the Hoaxy name) with different capabilities.

The other good news is that you can study the techniques of messages that do spread virally, so you can get better at creating messages that go viral.

June 28, 2018

The Arcane Algorithm Archive

Filed under: Algorithms,Computer Science,Volunteer — Patrick Durusau @ 1:46 pm

The Arcane Algorithm Archive

From the webpage:

The Arcane Algorithm Archive is a collaborative effort to create a guide for all important algorithms in all languages.

This goal is obviously too ambitious for a book of any size, but it is a great project to learn from and work on and will hopefully become an incredible resource for programmers in the future.

The book can be found here: https://www.algorithm-archive.org/.

The github repository can be found here: https://github.com/algorithm-archivists/algorithm-archive.

Most algorithms have been covered on the youtube channel LeiosOS: https://www.youtube.com/user/LeiosOS and livecoded on Twitch: https://www.twitch.tv/simuleios.

If you would like to communicate more directly, please feel free to go to our discord: https://discord.gg/Pr2E9S6.

Note that the this project is is essentially a book about algorithms collaboratively written by an online community.

Fortunately, there are a lot of algorithms out there, which means that there is a lot of content material available.

Unfortunately, this means that we will probably never cover every algorithm ever created and instead need to focus on what the community sees as useful and necessary.

That said, we'll still cover a few algorithms for fun that have very little, if any practical purpose.

If you would like to contribute, feel free to go to any chapter with code associated with it and implement that algorithm in your favorite language, and then submit the code via pull request, following the submission guidelines found in chapters/how_to_contribute.md (or here if you are reading this on gitbook).

Hopefully, this project will grow and allow individuals to learn about and try their hand at implementing different algorithms for fun and (potentially) useful projects. If nothing else, it will be an enjoyable adventure for our community.

Thanks for reading and let me know if there's anything wrong or if you want to see something implemented in the future!

If you are looking for a volunteer opportunity where your contribution will be noticeable (not a large bulk of existing contributions), you have landed at the right place!

I don’t know a workable definition for “all algorithms” or “all languages” so feel free to contribute what interests you.

This being a mid-term election year in the U.S., I’m sure we are all going to need extra distractions in the coming months. Enjoy!

June 26, 2018

Reading While White

Filed under: Bias,News,Politics,Texts — Patrick Durusau @ 12:54 pm

40 Ways White People Say ‘White People’ Without Actually Saying ‘White People’ came up on my Facebook feed. I don’t think people of color need any guidance on when “white people” is being said without saying “white people.” They have a lifetime of experience detecting it.

On the other hand, “white people” have a lifetime of eliding over when someone says “white people” without using those precise terms.

What follows is a suggestion of a tool that may assist white readers in detecting when “white people” is being said, but not in explicit terms.

Download the sed script, reading-while-white.txt and Remarks by President Trump at Protecting American Workers Roundtable (save as HTML page) to test the script.

Remember to chmod on the sed script, then:

reading-while-white.sed remarks-president-trump-protecting-american-workers-roundtable > reading.while.white.roundtable.html

The top of the document should read:

The replacement text will appear as:

and,

I use “white people” to replace all implied uses of white people and preserve the text as written in the following parentheses.

Hard coded for HTML format of White House pages but just reform the <h1> line to apply to other sites.

Places to apply Reading While White:

  1. CNN
  2. Fox News
  3. The Guardian
  4. National Public Radio
  5. New York Times
  6. Wall Street Journal
  7. Washington Post

Save your results! Share them with your friends!

Educate white readers about implied “white people!”

I’m looking for an easier way to share such transformations in a browser.

Do you know of a browser project that does NOT enforce a stylesheet and file having to originate from the same source? That would make a great viewer for such transformations. (Prohibited in most browsers as a “security” issue. Read “content provider in control” for “security” and you come closer to the mark.)

June 23, 2018

Got Bots? Canadians to Monitor Online Chatter for Threats

Filed under: Bots,Cybersecurity,Government — Patrick Durusau @ 7:58 pm

NEB seeks contractor to monitor ‘vast amounts’ of online chatter for potential security threats.

From the post:

The federal regulator responsible for pipelines is seeking an outside company to monitor online chatter en masse and aggregate the data in an effort to detect security risks ahead of time.

The National Energy Board has issued a request for information (RFI) from companies qualified to provide “real-time capability to algorithmically process vast amounts of traditional media, open source and public social media data.”

It is asking applicants to provide a “short demo session” of their security threat monitoring services in early July.

“This RFI is part of our processes to ensure we are getting the services we require to proactively manage security threats, risks and incidents to help protect its personnel, critical assets, information and services,” NEB communications officer Karen Ryhorchuk said in an email.

“It is not specific to any project, application or issue.”

The National Energy Board website is loaded with details on human mistakes (read pipelines) in varying degrees of detail. First stop if you are looking to oppose, interfere with, or degrade a pipeline located in Canada.

It’s interesting to note that despite the RFI being reported, you won’t find it on the News Releases page for the National Energy Board. It’s not on their Twitter feed, NEBCanada as well.

Someone in Canada should know the Yogi Berra line:

“It’s tough to make predictions, especially about the future.”

Well, perhaps not.

Still, if the Canadians are going to spend money on it, whoever they hire needs to earn their pay.

It’s would be trivial to create bots that randomly compose “alert” level posts, but the challenge would be to create an interlocking network of bots that “appear” to be interacting and responding to each others posts.

Thoughts on models of observed network communities that would be useful in training such a system?

There’s nothing guaranteed to stop governments from monitoring social media (if you believe government avowals of non-collection, well, that’s your bad), so the smart money is on generating too many credible signals for them to separate wheat from the chaff.

June 20, 2018

Intentional Ignorance For Data Science: Ignore All Females

Filed under: Bias,Bioinformatics,Biology,Biomedical,Data Science — Patrick Durusau @ 4:10 pm

When Research Excludes Female Rodents, Human Women Lose by Naseem Jamnia.

From the post:


Even when I was at the University of Pennsylvania, one of the best research institutes in the world, I talked to researchers who were reluctant to use female rodents in their studies, especially if they weren’t examining sex differences. For example, one of the labs I was interested in working in looked at social behavior in a mouse model of autism—but only in male mice, even though we need more studies of autism in girls/female models. PhD-level scientists told me that the estrous cycle (the rodent menstrual cycle) introduced too many complications. But consider that the ultimate goal of biomedical research is to understand the mechanisms of disease so that we can ultimately treat them in humans. By excluding female animals—not to mention intersex animals, which I’ll get to in a bit—modern scientists perpetuate the historical bias of a medical community that frequently dismisses, pathologizes, and actively harms non-male patients.

The scientific implications of not using female animals in scientific and biomedical research are astounding. How can we generalize a drug’s effect if we only look at part of the population? Given that sex hormones have a ton of roles outside of reproduction—for example, in brain development, cell growth and division, and gene regulation—are there interactions we don’t know about? We already know that certain diseases often present differently in men and women—for example, stroke and heart disease—so a lack of female animal studies means we can’t fully understand these differing mechanisms. On top of it all, a 2014 Nature paper showed that rodents behave differently depending on the researcher’s gender (it appears they react to the scent of secreted androgens) which puts decades of research into question.

Jamnia’s not describing medical research in the 19th century, nor at Tuskegee, Alabama or Nazi medical experiments.

Jamnia is describing the current practice of medical research, today, now.

This is beyond bias in data sampling, this is intentional ignorance of more than half of all the people on earth.

I hasten to add, this isn’t new, it has been known and maintained throughout the 20th century and thus far in the 21st.

The lack of newness should not diminish your rage against intentional ignorance of how drugs and treatments impact, ultimately, women.

If you won’t tolerate intentional ignorance of females in data science (you should not), then don’t tolerant of intentional ignorance in medical research.

Ban funding of projects that exclude female test subjects.

So-called “researchers” can continue to exclude female test subjects, just not on your dime.

June 16, 2018

Thumbprint Loans @ Post Offices?

Filed under: Government,Politics,Privacy — Patrick Durusau @ 12:32 pm

In case you haven’t heard, payday loans are the ban of the poor. Aboutpayday.com

I created a graphic that captures the essential facts of a thumbprint loan proposal, which I suggest locating at US Post offices.

The essence of the proposal is to eliminate all the paperwork for government sponsored payday loans at prime plus 1% simple interest.

To do that, all that is required for a loan is a thumbprint. That’s it. No name, location, where your job is located, etc.

When paid, users can choose to create a credit history for their thumbprint, or, have it deleted from the system. Users who create a credit history can build up a record in order to borrow larger than base amounts, or to create a credit history for export to more conventional lenders.

When I first starting thinking about this proposal, I envisioned interactions with Post Office personnel but even that is unnecessary. Thumbprint loans could be wholly automated, up to and including dispersal of cash. That has the added feature of not being limited to post office hours of operation.

A rough sketch to be sure but reducing the APR of payday loans by 791% to 532% for 24 million Americans is worth being on the national agenda.

June 13, 2018

A White Male Reads: “Why can’t we hate men?”

Filed under: Feminism — Patrick Durusau @ 4:18 pm

Why can’t we hate men? by Suzanna Danuta Walters (Washington Post, June 8, 2018), has gotten a surprising number of comments that have little, if any, relationship to what she wrote.

What follows is a reading that other white males may or may not find persuasive.

Open up the Walters’ text and align it with this post in your browser. All set?

Paragraph 1: “It’s not that Eric Schneiderman …” Using “edge” imagery, the author establishes the position in this post, isn’t a new one. It’s one of long and mature consideration.

Paragraph 2: “Seen in this indisputably true context,…” Walters confesses hating all men is a tempting proposition. One she herself has struggled with.

Paragraph 3: “But, of course, the criticisms of this blanket condemnation of men…” Despite the temptation to hate all men, Walters recognizes the proper target is: “…male power as institutional, not narrowly personal or individual or biologically based in male bodies.”

Anyone who claims Walters says “hate all men,” hasn’t read up to and including the third paragraph of her essay.

Paragraph 4: “But this recognition of the complexity of male domination…” A transition to reciting universal facts about women. Facts which are true, despite “…the complexity of male domination.”

Paragraph 5 and 6: “Pretty much everywhere in the world, this is true: Women experience sexual violence, and the threat of that violence permeates our choices big and small.” Does anyone dispute these facts about the lives of women? (If you do, you can stop reading here. What follows will make little sense to you.)

Paragraph 7: “So, in this moment, here in the land of legislatively legitimated toxic masculinity, is it really so illogical to hate men?” Returning to “hating all men,” Walters says despite widespread reporting of male abuse of women, she isn’t seeing significant change. (I don’t see it either. Do you?) Women being abused by men and men taking few steps to stop that abuse, adds up to a pretty logical reason to hate all men. (Walters does not make that call here or elsewhere.)

Paragraph 8: “The world has little place for feminist anger…” You don’t grab female co-workers by the genitals, don’t extort sexual favors, aren’t an incel troll. Feminists are angry over your lack of effort to create a better environment for women.

To put that in another context, not being a slaver isn’t the same thing as opposing slavery. A majority of the families where slavery was legal, were passive beneficiaries of slavery:

(edited to remove date of secession but otherwise the same as found at: The Extent of Slave Ownership in the United States in 1860.)

The state with the lowest number of passive beneficiaries of slavery was Mississippi, with passive beneficiaries representing 51% of the population.

Compare that with the number of passive beneficiaries of patriarchy:

There is no state with less than 48% of its population as passive beneficiaries of patriarchy.

There are men in those populations who are actively campaigning on behalf of women. But if you’re not one of them, then feminists have a right to be angry in general and angry with you in particular.

Paragraph 9: “So men, if you really are #WithUs and would like us to not hate you for all the millennia of woe you have produced and benefited from, start with this:” Walters never says “hate all men.”

There are factual and logical reasons why women could hate all men, but Walters turns aside from the sterility of hate to suggest ways men can make the lives of women different. Different in a positive way.

I read Walters as saying action-less sympathy for women, while enjoying the benefits of patriarchy, is adding insult on top of injury.

Helping to create a different life experience for women requires more than doing no harm. Are you ready to spend your time, resources and energy doing good for women? Ask, respectfully, women in your life what they see as important, read feminist literature and forums, listen before speaking. Spread the word about feminism even when women and/or feminists aren’t present. A better world for women is a better world for us all.

June 11, 2018

Weaponize Information

Filed under: Data Science,Government,Military — Patrick Durusau @ 4:39 pm

Military Seeks New Tech to Weaponize Information by Aaron Boyd.

Knowledge is power, and the Defense Department wants to ensure it can outpower any enemy in any domain. But first, it needs to know what is technically possible and how industry can support those efforts.

Information warfare—controlling the flow of information in and out of a battlespace to gain a tactical edge—is one of the oldest military tactics in existence. But with the rise of the internet and other advanced communications technologies, it is fast becoming a core tool in every military’s playbook.

In February 2017, Russian military leaders announced the existence of an information warfare branch, replete with troops trained in propaganda and other information operations. In the U.S., these duties are performed by troops in the Joint Information Operations Warfare Center.

The U.S. Army and JIOWC are hosting an industry event on June 26-28 in McLean, Virginia, to identify potential industry and academic partners, find out what new technologies are available to support information operations and determine what kind of products and services the military might want to contract for in the future. While the Army is hosting the event, representatives from the entire Defense Department have been invited to attend.

The information gathered during the event will help JIOWC develop requirements for future procurements to “support the emerging domain of operations in the information environment,” according to a notice on FedBizOpps. Those requirements will likely fall under one of four capability areas:

Only nine (9) days left to file a request to attend and presentation abstracts (June 20th at 3:00pm EST), http://www.cvent.com/d/mgqsvs.

Further information: Elizabeth Bowman, (410) 278-5924, E-Mail: Elizabeth.k.bowman.civ@mail.mil.

Lacking a pet retired colonel and/or any interest in acquiring one, this event is of little interest to me.

If after reviewing the vaguely worded descriptions, you would like to discuss breaching present and future information silos, please feel free to contact me with your semantic integration requirements. patrick@durusau.net.

Speaking of Being Vulnerable: Tor Browser 7.5.5 and 8.0a8 released!

Filed under: Cybersecurity,Security,Tor — Patrick Durusau @ 10:03 am

Tor Browser 7.5.5 is released (stable)

Tor Browser 8.0a8 is released (experimental)

BTW, if you want to use Tor in more than name only, follow these instructions (no exceptions):

Want Tor to really work?

You need to change some of your habits, as some things won’t work exactly as you are used to.

  1. Use Tor Browser

    Tor does not protect all of your computer’s Internet traffic when you run it. Tor only protects your applications that are properly configured to send their Internet traffic through Tor. To avoid problems with Tor configuration, we strongly recommend you use the Tor Browser. It is pre-configured to protect your privacy and anonymity on the web as long as you’re browsing with Tor Browser itself. Almost any other web browser configuration is likely to be unsafe to use with Tor.

  2. Don’t torrent over Tor

    Torrent file-sharing applications have been observed to ignore proxy settings and make direct connections even when they are told to use Tor. Even if your torrent application connects only through Tor, you will often send out your real IP address in the tracker GET request, because that’s how torrents work. Not only do you deanonymize your torrent traffic and your other simultaneous Tor web traffic this way, you also slow down the entire Tor network for everyone else.

  3. Don’t enable or install browser plugins

    Tor Browser will block browser plugins such as Flash, RealPlayer, Quicktime, and others: they can be manipulated into revealing your IP address. Similarly, we do not recommend installing additional addons or plugins into Tor Browser, as these may bypass Tor or otherwise harm your anonymity andprivacy.

  4. Use HTTPS versions of websites

    Tor will encrypt your traffic to and within the Tor network, but the encryption of your traffic to the final destination website depends upon on that website. To help ensure private
    encryption to websites, Tor Browser includes HTTPS Everywhere to force the use of HTTPS encryption with major websites that support it. However, you should still watch the browser URL bar to ensure that websites you provide sensitive information to display a blue or green URL bar button, include https:// in the URL, and display the proper expected name for the website. Also see EFF’s interactive page explaining how Tor and HTTPS relate.

  5. Don’t open documents downloaded through Tor while online

    Tor Browser will warn you before automatically opening documents that are handled by external applications. DO NOT IGNORE THIS WARNING. You should be very careful when downloading documents via Tor (especially DOC and PDF files, unless you use the PDF viewer that’s built into Tor Browser) as these documents can contain Internet resources that will be downloaded outside of Tor by the application that opens them. This will reveal your non-Tor IP address. If you must work with DOC and/or PDF files, we strongly recommend either using a disconnected computer, downloading the free VirtualBox and using it with a virtual machine image with networking disabled, or using Tails. Under no circumstances is it safe to use BitTorrent and Tor together, however.

  6. Use bridges and/or find company

    Tor tries to prevent attackers from learning what destination websites you connect to. However, by default, it does not prevent somebody watching your Internet traffic from learning that you’re using Tor. If this matters to you, you can reduce this risk by configuring Tor to use a Tor bridge relay rather than connecting directly to the public Tor network. Ultimately the best protection is a social approach: the more Tor users there are near you and the more diverse their interests, the less
    dangerous it will be that you are one of them. Convince other people to use Tor, too!

Be smart and learn more. Understand what Tor does and does not offer. This list of pitfalls isn’t complete, and we need your help identifying and documenting all the issues.

Volunteer, donate, spread the word about the Tor project! The privacy you protect, could well be your own!

Zip Slip – Universal Government Vulnerability?

Filed under: Cybersecurity,Security — Patrick Durusau @ 9:25 am

Zip Slip vulnerability affects thousands of projects by Zeljka Zorz.

From the post:


The vulnerability, dubbed Zip Slip by the researchers, has been seen in the past before, but was never this widely spread, Snyk CEO Guy Podjarny told Help Net Security.

“Zip Slip is a form of directory traversal that can be exploited by extracting files from an archive. The premise of the directory traversal vulnerability is that an attacker can gain access to parts of the file system outside of the target folder in which they should reside,” the company explained.

“The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.sh). The two parts required to exploit this vulnerability is a malicious archive and extraction code that does not perform validation checking.”

There is a list of vulnerable libraries/apps, good for checking versions to discover failures to update. For the technical details, see: Zip Slip Vulnerability.

A large number of libraries have been updated but effectiveness of those updates depends upon projects in the wild updating the libraries they use.

Considering the sluggishness of government IT operations, Zip Slip may be a universal government vulnerability even in the face of updated libraries.

Nothing ventured, nothing gained. The worse case scenario for attackers is the attack fails.

June 7, 2018

Are AI Psychopaths Cost Effective?

Filed under: Artificial Intelligence,Machine Learning,Reddit — Patrick Durusau @ 3:34 pm

Norman, World’s first psychopath AI

From the webpage:


We present you Norman, world’s first psychopath AI. Norman is born from the fact that the data that is used to teach a machine learning algorithm can significantly influence its behavior. So when people talk about AI algorithms being biased and unfair, the culprit is often not the algorithm itself, but the biased data that was fed to it. The same method can see very different things in an image, even sick things, if trained on the wrong (or, the right!) data set. Norman suffered from extended exposure to the darkest corners of Reddit, and represents a case study on the dangers of Artificial Intelligence gone wrong when biased data is used in machine learning algorithms.

Norman is an AI that is trained to perform image captioning; a popular deep learning method of generating a textual description of an image. We trained Norman on image captions from an infamous subreddit (the name is redacted due to its graphic content) that is dedicated to document and observe the disturbing reality of death. Then, we compared Norman’s responses with a standard image captioning neural network (trained on MSCOCO dataset) on Rorschach inkblots; a test that is used to detect underlying thought disorders.

Note: Due to the ethical concerns, we only introduced bias in terms of image captions from the subreddit which are later matched with randomly generated inkblots (therefore, no image of a real person dying was utilized in this experiment).

I have written to the authors to ask for more details about their training process, the “…which are later matched with randomly generated inkblots…” seeming especially opaque to me.

While waiting for that answer, we should ask whether training psychopath AIs is cost effective?

Compare the limited MIT-Norman with the PeopleFuckingDying Reddit with 690,761 readers.

That’s a single Reddit. Many Reddits count psychopaths among their members. To say nothing of Twitter trolls and other social media where psychopaths gather.

New psychopaths appear on social media every day, without the ethics-limited training provided to MIT-Norman. Is this really a cost effective approach to developing psychopaths?

The MIT-Norman project has great graphics but Hitchcock demonstrated over and over again, simple scenes can be packed with heart pounding terror.

Not Quite Being A Pirate, But Close (Hacking Ships)

Filed under: Cybersecurity — Patrick Durusau @ 12:40 pm

Ship hack ‘risks chaos in English Channel’ by Leo Kelion.

From the post:


A French researcher, who goes by the nickname x0rz, had earlier demonstrated that many ships never changed their satellite communications equipment’s default username and password, and that it was relatively easy to find cases via an app to gain remote access.

Mr Munro has shown that it is possible to take advantage of this to reconfigure a ship’s Ecdis software in order to mis-identify the location of its GPS (global positioning system) receiver.

The receiver’s location can be moved by only about 300m (984ft), but he said that was enough to force an accident.

“That doesn’t sound like much, but in poor visibility it’s the difference between crashing and not crashing,” he said.

He added that it was also possible to make the software identify the boat as being much bigger than its true size – up to 1km sq.
… (emphasis in original)

Kelion’s non-specifics on hacking ships were posted within the last hour. One report, with actionable details, on hackable ships, appeared on July 17, 2017, Welp, even ships are hackable now by Matthew Hughes.

If you are interested in timely news on cyber-security weaknesses, follow @x0rz.

Great pirate pic from x0rz’s post in July of 2017:

The unimaginative use of the hack to “block the English channel” was suggested by the Pen Test Partners report, Hacking, tracking, stealing and sinking ships by Ken Munro.

The report imagines numerous ships in the English Channel being frightened into immobility due to false collision alarms.

American warships appear to lack collision alarms (or they don’t turn them on) so false ship locations may lead to more than simple confusion.

I haven’t seen this reported but one assumes that military gear comes with default user names and passwords as well. Not unlike the rumored nuclear missile launch codes being 00000000 for 20 years. User name and password defaults for military systems have definite potential.

June 5, 2018

Installing Google Earth – Ubuntu 16.04 (Tooling to help “Preserve The New River Valley”)

Filed under: Environment,Google Earth,Google Maps,Government — Patrick Durusau @ 7:20 pm

I encountered a remarkable resource, Proposed Route Using Google Earth and Geographic Information Systems (GIS) that details the route to be taken by the Mountain Valley Pipeline. (It’s hard to get in the way if you don’t know the route.)

But it requires use of Google Earth, an application I have only used on Windows. Time to change that!

Download Google Earth Pro for PC, Mac, or Linux then run:

sudo dpkg -i google-earth-stable_current_amd64.deb

in the same directory as the downloaded file.

It’s working!

Now back to the nifty resource I was talking about:

Dr. Stockton Maxwell, Assistant Professor of Geospatial Science at Radford University contacted EQT to request a Geographic Information Systems (GIS) request for the proposed pipeline route. A GIS is, in layman’s terms, a computer system that allows geographical data to be captured, stored, analyzed, and presented. Many counties and municipalities now use GIS to map all parcels and provide pertinent information on each parcel. Not surprising to those of us familiar with the EQT/NextEra Alliance, Mountain Valley Pipeline. LLC, they did not respond to Dr. Maxwell’s request. However, the company did have to share this information with the Virginia Department of Conservation and Recreation (DCR) as they are one of the stakeholders that must be notified during the pre-filing process. Dr. Maxwell contacted DCR and they shared the GIS information with him.

To make it easier for us to interpret the GIS information, Dr. Maxwell was kind enough to create a Google Earth file of the entire route (from Wetzel County, WV to Pittsylvania County, VA. He then created a buffer of 150 feet on each side of the route as this is the planned right-of-way during the construction phase of the project. To view this file, you will first need to download and install Google Earth — you can download it for free at: http://www.google.com/earth/download/ge/agree.html. Once you have downloaded Google Earth and installed it (or if you already have Google Earth installed), you will need to download the following file: http://preservethenrv.com/docs/MVP_Route.kmz. The file will download onto your computer. You can then Open the file (you will see the file name show at the bottom of your screen; click on the arrow to the right and select open) and it should open in Google Earth.

We are so lucky to have someone with Dr. Maxwell’s talents on our side — this resource will help landowners and citizens investigate the route better than the company’s maps.

A portion of the default view:

I’m going to be looking for places where accidental traffic congestion will delay construction. Critical sites that need re-routing will require boots on the ground to find and document those places. Got boots?

May 29, 2018

Balisage Late-Breaking News Deadline – 6 July 2018 – Attract/Spot a Fed!

Filed under: Conferences,XML,XML Schema,XPath,XQuery,XSLT — Patrick Durusau @ 7:10 pm

Balisage 2018 Call for Late-breaking News

From the post:


Proposals for late-breaking slots must be received at info@balisage.net by July 6, 2018. Selection of late-breaking proposals will be made by the Balisage conference committee, instead of being made in the course of the regular peer-review process. (emphasis in original)

The Def Con conference attendees play spot the fed.

But spot the fed requires some feds in order to play.

Feds show up at hacker conferences. For content or the company of people with poor personal hygiene.

Let’s assume it’s the content.

What content for a markup paper will attract undercover federal agents?

Success means playing spot the fed at Balisage 2018.

Topics anyone?

May 23, 2018

Balisage 2018 Program!

Filed under: Conferences,XML,XPath,XQuery,XSLT — Patrick Durusau @ 12:40 pm

The Balisage 2018 program has hit the Web!

Among the goodies on the agenda:

  • Implementing and using concurrent document structures
  • White-hat web crawling: Industrial strength web crawling for serious content acquisition
  • Easing the road to declarative programming in XSLT for imperative programmers
  • Fractal information is
  • Scaling XML using a Beowulf cluster

That’s a random sampling from the talk already scheduled!

Even more intriguing are the open spots left for “late-breaking” news.

Perhaps you have some “late-breaking” XML related news to share?

I haven’t seen the 2018 Call for Late-Breaking papers but if the 2017 Call for Late-Breaking papers is any guide, time is running out!

Enjoy!

May 22, 2018

PubMed retractions report (New Home!)

Filed under: Bioinformatics,Biomedical,PubMed — Patrick Durusau @ 8:45 pm

PubMed retractions report by Neil Saunders

If you need encouragement to read publications that appear in PubMed carefully, the PubMed retractions report will provide it.

You should read your own drafts carefully, if for no other reason than to avoid appearing in this report.

This is a great service and kudos to Neil Saunders for providing it.

ACLU Flyer for Amazon’s Rekognition

Filed under: Government,Privacy — Patrick Durusau @ 7:22 pm

Did you see the ACLU flyer for Amazon’s Rekognition program?

If there was a police department in the United States that was unaware of Rekognition, that is no longer the case. Way to go ACLU!

Part of the ACLU flyer reads as follows:

Marketing materials and documents obtained by ACLU affiliates in three states reveal a product that can be readily used to violate civil liberties and civil rights. Powered by artificial intelligence, Rekognition can identify, track, and analyze people in real time and recognize up to 100 people in a single image. It can quickly scan information it collects against databases featuring tens of millions of faces, according to Amazon.

Amazon is marketing Rekognition for government surveillance. According to its marketing materials, it views deployment by law enforcement agencies as a “common use case” for this technology. Among other features, the company’s materials describe “person tracking” as an “easy and accurate” way to investigate and monitor people. Amazon says Rekognition can be used to identify “people of interest” raising the possibility that those labeled suspicious by governments — such as undocumented immigrants or Black activists — will be seen as fair game for Rekognition surveillance. It also says Rekognition can monitor “all faces in group photos, crowded events, and public places such as airports” — at a time when Americans are joining public protests at unprecedented levels.

Amazon’s Rekognition raises profound civil liberties and civil rights concerns. Today, the ACLU and a coalition of civil rights organizations demanded that Amazon stop allowing governments to use Rekognition.

My first impression was this is yet another fund raising effort by the ACLU. That impression grew stronger when I saw:

right under the “…demanded that Amazon stop allowing governments to use Rekognition.”

That takes you to:

ACLU address and permission harvesting!

The ACLU’s faux concern about Rekognition obtains your contact data and permission to contact.

Why do I say “faux concern?” Petitioning a vendor to withdraw a product offered by others. Name five similar campaigns that were successful. Name three. Still nothing? How about one?

I’ve got nothing, how about you?

On the other hand, despite surveillance of US citizens being illegal, the NSA engaged in, concealed and continued that surveillance. Explosive Revelation of Obama Administration Illegal Surveillance of Americans (National Review), NSA surveillance exposed (CBS News), NSA Surveillance (ACLU).

Based on experience with the NSA and others, would you guess that ACLU address and permission harvesting is going to be less than effective at stopping Rekognition? The only possible success of this ACLU effort will be a larger solicitation list for the ACLU. Not what I’m interested in signing up for. You?

Options from defeating facial recognition software range from the purely physical to tricking the underlying software. A bit old (2016) but 6 Ways to Defeat Facial Recognition Cameras has some amusing ways to defeat facial recognition software, but most of them tag you as avoiding facial recognition. Unless and until avoiding facial recognition becomes commonplace, obvious avoidance isn’t the best plan.

More recent and promising efforts include Google researchers create universal adversarial image patches to defeat AI object recognition (2018), an effort to hijack an AI system’s attention. That’s only one of many efforts to defeat facial/image recognition software.

Bottom line: Amazon is going to successfully market its Rekognition software, especially with name recognition assistance from the ACLU.

Forfeiting your contact data and permission to the ACLU accomplishes exactly that, gives the ACLU your contact data and permission to contact.

Using, developing, and promoting technology to defeat facial recognition software without permission or agreement is our only hope.

May 21, 2018

Cyber Bullies and Script Kiddie Hacking

Filed under: Cybersecurity,Hacking — Patrick Durusau @ 4:55 pm

I saw a tweet about: AutoSQLi, the new way script-kiddies hack websites saying:

Oh joy, a new tool for script kiddies

With all the initiatives to address cyber-bullying do you find it strange that no one speaks up for “script kiddies?” (It’s not a term of endearment.)

Learning a new skill, whether SQL injection, phishing, making biscuits or hand loading ammunition, you follow detailed instructions of others. A “script,” “recipe,” etc.

We have been at the “script kiddie” level for one or more skills in our lives.

What do we gain by trashing tools that introduce new skills and hopefully capture the interest of new users?

Nothing. Shaming tools or users is an attempt to gain status by downgrading others.

It doesn’t work for me.

Does it work for you?

Contrived Russian Facebook Ad Data

Filed under: Data Preservation,Data Quality,Data Science,Facebook,Politics — Patrick Durusau @ 2:16 pm

When I first read about: Facebook Ads: Exposing Russia’s Effort to Sow Discord Online: The Internet Research Agency and Advertisements, a release of alleged Facebook ads, by Democrats of the House Permanent Select Committee on Intelligence, I should have just ignored it.

But any number of people whose opinions I respect, seem deadly certain that Facebook ads, purchased by Russians, had a tipping impact on the 2016 presidential election. At least I should look at the purported evidence offered by House Democrats. The reporting I have seen on the release indicates at best skimming of the data, if it is read at all.

It wasn’t until I started noticing oddities in a sample of the data that I cleaned that the full import of:

Redactions Completed at the Direction of Ranking Member of the US House Permanent Select Committee on Intelligence

That statement appears in every PDF file. Moreover, if you check the properties of any of the PDF files, you will find a creation date in May of 2018.

I had been wondering why Facebook would deliver ad data to Congress as PDF files. Just seemed odd, something nagging in the back of my mind. Terribly inefficient way to deliver ad data.

The “redaction” notice and creation dates make it clear that the so-called Facebook ad PDFs, are wholly creations of the House Permanent Select Committee on Intelligence, and not Facebook.

I bring that break in the data chain because without knowing the content of the original data from Facebook, there is no basis for evaluating the accuracy of the data being delivered by Congressional Democrats. It may or may not bear any resemblance to the data from Facebook.

Rather than a blow against whoever the Democrats think is responsible, this is a teaching moment about the provenance of data. If there is a gap, such as the one here, the only criteria for judging the data is do you like the results? If so, it’s good data, if not, then it’s bad data.

Why so-called media watch-dogs on “fake news” and mis-information missed such an elementary point isn’t clear. Perhaps you should ask them.

While cleaning the data for October of 2016, my suspicions were re-enforced by the following:

Doesn’t it strike you as odd that both the exclusion targets and ad targets are the same? Granting it’s only seven instances in this one data sample of 135 ads, but that’s enough for me to worry about the process of producing the files in question.

If you decide to invest any time in this artifice of congressional Democrats, study the distribution of the so-called ads. I find it less than credible that August of 2017 had one ad placed by (drum roll), the Russians! FYI, July 2017 had only seven.

Being convinced the Facebook ad files from Congress are contrived representations with some unknown relationship to Facebook data, I abandoned the idea of producing a clean data set.

Resources:

PDFs produced by Congress, relationship to Facebook data unknown.

Cleaned July, 2015 data set by Patrick Durusau.

Text of all the Facebook ads (uncleaned), September 2015 – August 2017 (missing June – 2017) by Patrick Durusau. (1.2 MB vs. their 8 GB.)

Seriously pursuit of any theory of ads influencing the 2016 presidential election, has the following minimal data requirements:

  1. All the Facebook content posted for the relevant time period.
  2. Identification of paid ads and by what group, organization, government they were placed.

Assuming that data is available, similarity measures of paid versus user content and measures of exposure should be undertaken.

Notice that none of the foregoing “prove” influence on an election. Those are all preparatory steps towards testing theories of influence and on who, to what extent?

May 17, 2018

Xidel – HTML/XML/JSON data extraction tool

Filed under: Web Scraping,XQuery — Patrick Durusau @ 7:12 pm

Xidel – HTML/XML/JSON data extraction tool

From the webpage:


Features

It supports:

  • Extract expressions:
    • CSS 3 Selectors: to extract simple elements
    • XPath 3.0: to extract values and calculate things with them
    • XQuery 3.0: to create new documents from the extracted values
    • JSONiq: to work with JSON apis
    • Templates: to extract several expressions in an easy way using a annotated version of the page for pattern-matching
    • XPath 2.0/XQuery 1.0: compatibility mode for the old XPath/XQuery version
  • Following:
    • HTTP Codes: Redirections like 30x are automatically followed, while keeping things like cookies
    • Links: It can follow all links on a page as well as some extracted values
    • Forms: It can fill in arbitrary data and submit the form
  • Output formats:
    • Adhoc: just prints the data in a human readable format
    • XML: encodes the data as XML
    • HTML: encodes the data as HTML
    • JSON: encodes the data as JSON
    • bash/cmd: exports the data as shell variables
  • Connections: HTTP / HTTPS as well as local files or stdin
  • Systems: Windows (using wininet), Linux (using synapse+openssl), Mac (synapse)

Xidel is a very good excuse to practice your XML (XPath/XQuery) on a daily basis!

Not to mention being an interchangeable way to share web scraping scripts for websites.

Enjoy!

May 13, 2018

When Sed Appears To Lie (It’s Not Lying)

Filed under: Data Mining — Patrick Durusau @ 7:34 pm

I prefer Unix tools, bash scripts and sed in particular, for mining text files.

But most of my sed scripts are ad hoc and ran at the command line. But I needed to convert text extracted from PDF (gs) for import into a spreadsheet.

I had 21 invocations of sed that started with:

sed -i 's/Ad\ ID\ //' $f

All the other scripts up to that point had run flawlessly so I was unprepared for:

sed: -e expression #1, char 73: unterminated `s' command

I love command line tools but error messages are not their strong point.

Disclosure: Yes, yes I did have an error in one of the sed regexes, but it was on line #15, not #1.

Ok, ok, laugh it up. The error message was correct because each line counts as a separate “expression #1.”

I did find the error but only by testing each regex.

Sed scripting tip: In a series of sed invocations, each invocation is “expression #1.”

Hope that saves you from looking for exotic problems with your sed distribution, interaction with your shell escapes, etc. (Yeah, all that and more.)

May 10, 2018

Spot the Fed (Home Edition)

Filed under: Face Detection,Image Recognition — Patrick Durusau @ 4:18 pm

I won’t ever play Spot the Fed at a Def Con conference, but OpenFace enables you to play “Spot the Fed” at home!

From the post:

OpenFace is a Python and Torch implementation of face recognition with deep neural networks and is based on the CVPR 2015 paper FaceNet: A Unified Embedding for Face Recognition and Clustering by Florian Schroff, Dmitry Kalenichenko, and James Philbin at Google. Torch allows the network to be executed on a CPU or with CUDA. OpenFace is the improved neural network training techniques that causes an accuracy improvement from 76.1% to 92.9%.

This research was supported by the National Science Foundation (NSF) under grant number CNS-1518865. Additional support was provided by the Intel Corporation, Google, Vodafone, NVIDIA, and the Conklin Kistler family fund. Any opinions, findings, conclusions or recommendations expressed in this material are those of the authors and should not be attributed to their employers or funding sources.

Wireless surveillance cameras are as little as $40.00 plus shipping. Oddly the default color appears to be white but black spray paint can fix that design defect.

Get legal advice on the potential legal risks of pointing your surveillance camera outside of your property boundaries.

If you spot a suspected Fed lurking, Sound the Alarm!

May 9, 2018

Increasing Your Security (As Opposed to Thinking You Are Secure)

Filed under: Cybersecurity,Security,Tails,Tor — Patrick Durusau @ 8:36 pm

You can increase your security, against known hazards/bugs, by installing and using:

along with other appropriate practices and cautions.

Bear in mind that no software or encryption scheme is a defense against a $5 wrench.

May 8, 2018

2,000+ New Egyptian Hieroglyphs Coming Soon! [Code Talker Security?]

Filed under: Hieroglyphics,Security — Patrick Durusau @ 7:37 pm

Soon You May Be Able to Text with 2,000 Egyptian Hieroglyphs by Sarah E. Bond.

From the post:

Collaborations among Egyptologists and digital linguistics promise global visualizations of what was written on inscriptions, papyri, wall paintings, and other sources of Hieroglyphs. It may also allow for more popular knowledge of Egyptian Hieroglyphs and encourage its assimilation into popular language-learning apps like Duolingo.

Over 2,000 new Hieroglyphs may soon be available for use on cell phones, computers, and other digital devices. The Unicode Consortium recently released a revised draft of standards for encoding Egyptian Hieroglyphs. If approved, the available Hieroglyphs will provide greater access and global uniformity for Egyptologists, covering a much longer period of Hieroglyphic usage than ever before. The proposal is part of a larger effort between the Unicode Consortium, ancient linguists, font designers, and the federal government to attempt to study, preserve, and then digitally represent ancient and endangered languages through the use of computer code.

Certainly a boon for Egyptologists but don’t miss the opportunity to use Egyptian from different historical periods as a secure language.

Before you say: “Security through obscurity is a bad idea,” remember that Navajo code talkers worked quite well during World War II.

Moreover, in adapting an ancient language to a modern context, you can shift the meaning of words such that standard dictionaries and tools aren’t useful.

Being always mindful of the question: How long does this message need to remain secure? Messages about an action are of little value once an action is public. Events replace hopes and aspirations.

Enjoy!

Extracting Data From FBI Reports – No Waterboarding Required!

Filed under: FBI,Government,Government Data,R — Patrick Durusau @ 1:01 pm

Wrangling Data Table Out Of the FBI 2017 IC3 Crime Report

From the post:

The U.S. FBI Internet Crime Complaint Center was established in 2000 to receive complaints of Internet crime. They produce an annual report, just released 2017’s edition, and I need the data from it. Since I have to wrangle it out, I thought some folks might like to play long at home, especially since it turns out I had to use both tabulizer and pdftools to accomplish my goal.

Concepts presented:

  • PDF scraping (with both tabulizer and pdftools)
  • asciiruler
  • general string manipulation
  • case_when() vs ifelse() for text cleanup
  • reformatting data for ggraph treemaps

Let’s get started! (NOTE: you can click/tap on any image for a larger version)

Freeing FBI data from a PDF prison, is a public spirited act.

Demonstrating how to free FBI data from PDF prisons, is a virtuous act!

Enjoy!

May 6, 2018

Natural Language Toolkit (NLTK) 3.3 Drops!

Filed under: Linguistics,Natural Language Processing,NLTK,Python — Patrick Durusau @ 7:52 pm

Natural Language Toolkit (NLTK) 3.3 has arrived!

From NLTK News:

NLTK 3.3 release: May 2018

Support Python 3.6, New interface to CoreNLP, Support synset retrieval by sense key, Minor fixes to CoNLL Corpus Reader, AlignedSent, Fixed minor inconsistencies in APIs and API documentation, Better conformance to PEP8, Drop Moses Tokenizer (incompatible license)

Whether you have fantasies about propaganda turning voters into robots, believe “persuasion” is a matter of “facts,” or other pre-Derrida illusions, or not, the NLTK is a must have weapon in such debates.

Enjoy!

May 5, 2018

Sci-Hub Needs Your Help

Filed under: Open Access,Open Science,Science — Patrick Durusau @ 4:40 pm

Sci-Hub ‘Pirate Bay For Science’ Security Certs Revoked by Comodo by Andy.

From the post:

Sci-Hub, often known as ‘The Pirate Bay for Science’, has lost control of several security certificates after they were revoked by Comodo CA, the world’s largest certification authority. Comodo CA informs TorrentFreak that the company responded to a court order which compelled it to revoke four certificates previously issued to the site.

Sci-Hub is often referred to as the “Pirate Bay of Science”. Like its namesake, it offers masses of unlicensed content for free, mostly against the wishes of copyright holders.

While The Pirate Bay will index almost anything, Sci-Hub is dedicated to distributing tens of millions of academic papers and articles, something which has turned itself into a target for publishing giants like Elsevier.

Sci-Hub and its Kazakhstan-born founder Alexandra Elbakyan have been under sustained attack for several years but more recently have been fending off an unprecedented barrage of legal action initiated by the American Chemical Society (ACS), a leading source of academic publications in the field of chemistry.

While ACS has certainly caused problems for Sci-Hub, the platform is extremely resilient and remains online.

The domains https://sci-hub.is and https://sci-hub.nu are fully operational with certificates issued by Let’s Encrypt, a free and open certificate authority supported by the likes of Mozilla, EFF, Chrome, Private Internet Access, and other prominent tech companies.

It’s unclear whether these certificates will be targeted in the future but Sci-Hub doesn’t appear to be in the mood to back down.

There are any number of obvious ways you can assist Sci-Hub. Others you will discover in conversations with your friends and other Sci-Hub supporters.

Go carefully.

Weekend Readings: Qubes (‘Reasonably Secure OS’)

Filed under: Cybersecurity,Linux OS,Security — Patrick Durusau @ 3:00 pm

Weekend Readings: Qubes by Carlie Fairchild.

From the post:

Qubes OS is a security-focused operating system that, as tech editor Kyle Rankin puts it, “is fundamentally different from any other Linux desktop I’ve used”. Join us this weekend in reading Kyle’s multi-part series on all things Qubes.

In order:

  1. Secure Desktops with Qubes: Introduction
  2. Secure Desktops with Qubes: Installation
  3. Secure Desktops with Qubes: Compartmentalization
  4. Secure Desktops with Qubes: Extra Protection
  5. Qubes Desktop Tips
  6. What’s New in Qubes 4

From the Qubes homepage: Motherboard: “Finally, a ‘Reasonably-Secure’ Operating System: Qubes R3” by J.M. Porup.

After reading Rankin’s posts, Qubes is high on my list of things to try.

« Newer PostsOlder Posts »

Powered by WordPress