On cargo cranes and undersea cables

Posted on September 17, 2024 by dstrom

What do cargo cranes, drones and undersea cables have in common? This isn’t a trick question. All three have significant intersections with Chinese businesses, and all three could be considered critical infrastructure elements that has got our Congress worried. And while normally I wouldn’t highlight the fear mongering (we have enough of that, especially lately), this seems to merit some attention.

A joint Congressional report was released this week which focuses on Shanghai Zhenhua Heavy Industries, a Chinese company which accounts for roughly 80% of the ship-to-shore port cranes operational in the US, and 70% of the worldwide port cranes. These are those huge structures that take cargo off and on container ships. What has got Congress worried is that the cranes are fitted with cellular modems which may have remote software installed. Much of the control systems used by these cranes is subcontracted to industrial suppliers such as ABB and Siemens. However, their gear is shipped to Shanghai and installed by the Chinese before the crane is sent to the ultimate port destination. The investigation found that these companies allow for their gear to be sitting in China for long periods of time outside of their operational control. As you might have guessed, there are no US-based crane manufacturers.

The report cites that more than a dozen software vulnerabilities from SZHI have been reported to American but not Chinese security regulators, saying that it could be a potential national cybersecurity issue.

Let’s move on to drones. The U.S. House of Representatives voted on Monday to bar new drones from Chinese drone manufacturer DJI from operating in the United States, one of a series of measures aimed at China that lawmakers are considering this week. The bill, which still needs to be approved by the Senate before it could become law, would prohibit the company’s products from operating on U.S. communications infrastructure. It would not prevent existing DJI drones from operating in the United States. DJI has 80% of the US drone market share and 54% of the global drone market. Again, one motivation for this proposed ban is the potential for data collection from their operation. Another is the recent fears about Tik Tok data ownership.

Finally, Tom’s Hardware reports that the US and EU are working on a draft statement about undersea communications cable ownership. The proposed language would intentionally exclude Chinese ownership and ask member countries to only consider “trusted suppliers from allied countries,” and require cable operators to have supply chain and data security measures in place, along with more transparent ownership documentation. The lofty proposed language doesn’t specify any enforcement mechanisms, however. The cable market is not yet dominated by any Chinese supplier and is quite competitive. The major US supplier is SubCom. You might have guessed that here the US dominates in terms of cable ownership, with Google, Amazon, Microsoft and Facebook/Meta owning or leasing at least half of all undersea bandwidth. I am not sure whether FAANG or China would be more of an issue to our regulators.

It is hard to sort out the technology issues from the political, something we have seen with the various Tik Tok screeds. it is clear that figuring out what is happening, understanding the extent of Chinese market control, and understanding whether insidious remote control software is actually present or could be present is a difficult lift.

CSOonline: AI-SPM buyer’s guide

Posted on September 17, 2024 by dstrom

Widespread adoption of generative AI across businesses has increased the need for contingencies, including AI security software. It is a tall order because AI’s reach into an organization’s infrastructure and data is enormous, meaning that there is a broad spectrum of protective measures required. This is one of the reasons why attackers are drawn to AI abuses.

I examined nine vendors’ tools that handle AI security posture management (AI-SPM). This is an emerging field and unfortunately that means most products are nowhere near as comprehensive or as integrated as they could be. You can read my buyer’s guide in CSOonline here. For your reference, here are a collection of AI SPM screenshots

Book review: Casket Case by Lauren Evans

Posted on September 11, 2024 by dstrom

Normally, I try to write reviews without any spoilers, but the main spoiler has already been revealed in the blurb about this very inventive and realistic novel about a very modern relationship. She has inherited her family business, and falls in love with a handsome gentlemen. What saves this from being another romance is that the business is a casket showroom, and he is actually a representative of Death. His job is to visit someone who is about to die and comfort them in their final moments. It is an interesting conceit, and his business doesn’t get revealed to her until halfway through the novel, at which point their love affair has fully blossomed. The book nicely deals with mutual trust, sharing one’s feelings, and one’s place in the family in a way that is fresh and interesting. This novel could border on the trite or the macabre, but doesn’t. And the topic of death for me personally is a tough one, having lost my adult son a few years ago to cancer. But Evans treats the topic with a great deal of sensitivity and verve, and I won’t give away the ending but this is a book that is interesting and well worth your time as well as well-written. Highly recommended.

Direct admissions: a new way to get into college

Posted on September 5, 2024 by dstrom

For the past couple of years, high school seniors have been part of an interesting experiment called direct admissions. Basically, there are systems that allow them to get conditional pre-acceptance offers, without having to fill out much of an application in advance, or even think about where they want to attend. What makes these offers interesting is that they arrive unsolicited. There are a few caveats, but hundreds of students are now attending college using this method.

Back in the pre-historic era when I was a high school senior when I had to walk uphill both ways to school, we had to fill out applications by hand. There was no CommonApp, a system by which a thousand or so colleges agree to basically open source the application process. They are one of the entities involved direct admissions, I’ll get to them in a moment. Each place had its own essay to write. You also had to take standardized tests from places like the College Board, the dreaded SAT or ACT. And then there were the application fees.

Direct admissions puts all that aside. You have to have good grades, of course, or good enough grades for the particular school that you want to attend. But that’s about it. No more stuffing silly clubs to pad your pre-college resume. No more parental nagging about whether you have written word one on your essays.

Not every college is on board, yet. But it clearly is the coming wave. As costs to attend college continue to rise, the onerous application process has to be simplified. One private venture is leading the charge called Niche. Their website has a portal for students to enter the direct admissions world and while there is some information to fill out, it doesn’t seem all that difficult.

There are several states that have signed up to include every graduating high school senior in the program. They notify all graduating seniors in the fall where they have been accepted, based on their GPAs. Minnesota, for example, has 55 two and four year colleges — both private and public — part of the program. Students then have to complete an application to the school of their choice. Missouri has several schools that take direct admissions, including probably one of the best engineering schools in the state.

CommonApp began testing direct admissions in 2021, and now has more than 70 participating schools. Niche began its program in 2022 and now has its own group of 100 or so schools. (Forbes has more details here.) The two have somewhat different qualification criteria. With CommonApp, students have to live in lower-income households to get app fees waived and be the first in their generation to enter college, and can only apply to in-state colleges. Niche doesn’t have any income or geographic threshold.

As the NY Times wrote earlier this year, colleges want more students and need more applicants to maintain their student population. Idaho, which is one of the states with a program, found that student enrollment increased by several percentage points in the first year.

Now, you might guess that the top tier Ivies aren’t on board with direct admissions: they get plenty of attention from the best students. But for many other schools, this could be a way to attract students that may have never considered or even heard of the school. And who doesn’t like getting a “you may already have been admitted” notice? It could be a big ego and motivational boost for some seniors.

If you have a kid that has used direct admissions, please post your experiences, I would be interested to hear from you.

The AI takeover of photography

Posted on August 27, 2024 by dstrom

I have been a casual camera user for decades, ever since I got a simple box camera in my teens. I actually had a job as a professional photographer when I got out of college, and built my own darkroom in several homes for printing black and white pictures. This obviously was during the pre-digital era. The past few years I have been enjoying my smartphone’s camera, which keeps getting more and more capable. Going digital meant no more darkroom, and being able to print to an online photo processor by uploading my images. Here is a photo that I took recently.

Well, I come bringing bad news, although it initially doesn’t seem that way. First, cameras are getting smarter. It isn’t just a matter of better resolution images, but better software. The new Google Pixel 9 has something called Reimagine, which has some very neat tricks for in-phone picture editing as shown in this threads post by Chris Welch..This used to be the domain of a skilled Photoshop operator. Now you just tap on the right buttons.

Second, AI is moving into more “original” photography. Google’s ImageFX is now available in preview here— you type in a description of a photo that you are interested in, and within a few seconds, it creates a few images that you can choose from. My prompt of a “high-resolution photo-realistic interior of ornate teal art deco living room” brought the following image:

That is a pretty nice setup. Note the lighting effects, and reflections in the glass table and mirror are pretty darn good.

So what is the bad news you may ask? Well, as someone reminded me, what we are seeing here are the absolute worst images that AI has produced, and the quality will only get better, much better given the pace of AI development. Soon the lenses on the back of your phone will be redundant. Those travel photos that you took of your last trip to someplace exotic? Chances are someone else has been there, posted the pix, and some AI engine has gobbled it up. Just a few clicks and you can be added in the foreground. What about pictures of things? Now Google’s Lens has been improved: it is now part of the Android OS and you can do all sorts of tricks with it to identify what you are seeing on a web page or IRL. No need to set up a pesky set of lights or to compose the perfect image. Just crop with your finger.

While you mull that over, I want to leave you with one last image, of a real electric power station near Budapest. At least, I think it is real and not some AI construct. But soon, it won’t matter much, just as we have forgotten all about using stop bath and learning the zone system.

The evolution of how brand impersonation attacks use social media

Posted on August 19, 2024 by dstrom

A new academic study of more than 1.3 million social media accounts was given recently at this month’s Usenix conference in Philadelphia. The paper, entitled The Imitation Game: Exploring Brand Impersonation Attacks on Social Media Platforms, makes for interesting reading and sadly shows just how well developed this ecosystem is. Ironically, as business brands pay more attention to social media interactions with their customers, they also enable imposters to launch attacks because people now expect companies to interact with social media. This means that there are many scam accounts that impersonate the brands to create confusion. These lure customers into providing private data and can result in stolen funds and further attacks. The research claims to be the first large-scale measurement of the social scamming ecosystem.

The research team, which was composed of academics from Germany and the US as well as from Paypal, identified almost 350,000 usernames performing various typosquatting techniques to impersonate more than 2,800 brands across Twitter (I know it is called something else, don’t remind me), Instagram, YouTube and Telegram.

Typosquatting is using deliberate typos in user and domain names to make it appear that paypel_support is really the people answering your connection problems. It is not a new problem when it comes to domain names, but as I wrote earlier this year for DarkReading, its use is proliferating in a variety of ways. One way that I didn’t mention is how fraudsters are using it across social media networks. Twitter “is the primary platform for brand impersonation attacks, with fraudsters frequently using typosquatting in their usernames. Roughly a third of these deceptive profiles also use official logos to appear more legitimate.”

The team found that brand impersonation involves multiple steps: after setting up a fake profile (oftentimes using the real brand’s logo to lend legitimacy), the fraudsters engage with customers through posts and offer phony incentives such as discount cards, free services and the like. But the attackers then collect sensitive data, including identities, credit card numbers and other details that are used to engage them in other fraudulent activities.

The most commonly targeted brand is Netflix, which is troubling because right now Netflix is sending out numerous legit messages heralding a change in their account pricing. Apple is the second most targeted brand.

The researchers have several suggestions to try to stem the tide, but admit these will be tough to implement. One of them is pretty obvious: in their work with Paypal, they found that many brands haven’t done their homework and failed to use Know Your Customer methods and continually scan for stolen identities, monitoring their brand mentions online or check for fraud card usage. One recommendation is to send out a quick autoresponse to a customer query to try to engage them before the scammer does. Another is for social media platforms to validate a brand when a new account is created, so that the owner of the proposed paypel_support account really is someone@paypal.com and not fakeuser123123@gmail.

Building the world’s largest digital camera

Posted on August 13, 2024 by dstrom

The world’s largest digital camera is a 3200 megapixel behemoth that sits on top of a mountain observatory complex in Chile. Ironically, it was created by engineers that in the past have focused on tracking the universe’s smallest subatomic particles. The camera has one acronym (LSST) and goes by two long names — the legacy survey of space and time, or Large-Aperture Synoptic Survey Telescope.

The camera is part of a telescope at the Vera Rubin observatory, named after an American astronomer that studied dark matter. Everything is still under construction and is expected to become operational next year. When it does, it will work in very different ways than its peers. And while the Webb telescope has gotten plenty of press for flying around the sun these past couple of years — and rightly so, I don’t want to diminish its accomplishments — the Simonyi telescope at the Rubin is an interesting science tool in its own right. And yes, that name is familiar to many of you. Charles Simonyi worked in the early years at Microsoft, and both he and Bill Gates were early donors to the project.

The Rubin project has been long in coming, just like the Webb. In fact, pieces of it were built in different factories and labs around the world. The camera came from California (the Stanford Linear Accelerator team), the mount was from Spain, and Chile put together the buildings housing everything.

First off, if you have in your mind this is a place where astronomers go to peer through the eyepiece of the telescope and stare at the night sky, put that picture aside. This is a digital camera, and it operates hands-off for the most part. Its goal is nothing short of extraordinary. Every three nights, weather permitting, it photographs the entire night sky, moving around in a pre-programmed pattern. Most telescopes of the past were firmly anchored to their mountain top aeries.

In the past, telescopes like Webb and other expensive instruments required scientists to schedule time on them to focus on particular areas of the sky, and then download what was collected. Committees would vet proposals and schedule the sessions accordingly. Having a telescope that sweeps the entire sky — and doing it in such high resolution — means that you can approach observations in a completely different way.

First off, you don’t download anything. Given the size of the datasets, that would take time, even on high speed bandwidth. All the data stays intact, and you run your queries remotely.

This is a massive amount of data — petabytes worth — and it is all uploaded to an open source repository. Anyone can access the information for their research or just for curiosity. I imagine that schools will jump on board using this archive. It might change the way we teach astronomy and it certainly will reach a wider audience.

Also, the science team behind the Rubin is developing software that mimics what the early astronomers did manually, to seek out changes in the observations. Did a planet move in front of its star? Is a black hole forming someplace? I remember as a child reading about Clyde Tombaugh and how he discovered Pluto (poor Pluto, now downgraded to a demi-planet) in 1930 by looking at photographs taken on different nights to find its movement. He used a device called a blink microscope to quickly flip back and forth between the two photographic plates. Now we have open source code to do that tedious task.

This means that discoveries will be made almost every night, because the universe is a busy place. Scientists don’t have to depend on picking the right time and piece of sky real estate to observe a supernova, but can have software seek out the possible event.

Another distinction: unlike the infrared-based Webb, Rubin operates in visible light.

Finally, what I also liked is that the project is the first time a publicly-funded astronomy effort has been named for a woman.

Tech+Main podcast: The changing role of today’s CISOs

Posted on August 12, 2024 by dstrom

I spoke to Shaun St. Hill, host of the Tech&Main podcast, about the latest YL Ventures CISO Circuit Report. They have a very strong advisory panel of security professionals and annually poll them about industry trends, what their biggest organizational challenges are, and how they interact with their management and boards of directors to protect their companies.

You can listen to the 30 min. podcast here.

Red Cross: Air Force Veteran Works with SAF to Help Service Members

Posted on August 9, 2024 by dstrom

When a veteran retires, most don’t think of setting up their homes on a military base, but that is what Jill Eaves and her family did at Missouri’s Fort Leonard Wood. The Army post is home to the Sixth Infantry Division and one of four major training centers. For the past 80 years has seen hundreds of thousands of members of all four branches of the armed forces train for active and reserve duty, including specialized engineering training. Eaves and her husband of 10 years both served in the Air Force, and when the time came for retirement, they decided to move back on a military installation. After all, with more than 63,000 acres, there is plenty of room. “It is a great place to raise my two children, too,” she said.

Here she is fixing a helicoper while deployed in California. You can read my profile of her for the Red Cross here.

How to make AI models more processor efficient

Posted on August 6, 2024 by dstrom

I was amused to read that a mathematical method that I first learned as an undergraduate has been found to help make AI models more processing efficient. The jump is pretty significant, if the theories hold in practice: a drop in 50x power consumption. This translates into huge cost savings: some estimate that the daily electric bill for running ChatGPT v3.5 is $700,000.

The method is called matrix multiplication and you can find a nice explanation here if you really want to learn what it is. MM is at the core of many mathematical models, and while I was in school we didn’t have the kind of computers (or built-in to our digital spreadsheets or in Python code) to make this easier, so we had to do these by hand as we were walking miles uphill to and from school in the snow.

MM dates back to the early 1800s when a French mathematician Jacques Binet figured it out. It became the foundational concept of linear algebra, something taught to math, engineering and science majors early on in their college careers.

The researchers figured out that, with the right custom silicon, they could run a billion-parameter model for about 13 watts. How do you make the connection between the AI models and MM? Well, your models are using words, and each word is represented by some random number, which are then organized into matrices. You do the MM to create phrases and figure out the relationships between adjacent words. Sounds easy, no?

Well, imagine that you have to do these multiplications a gazillion times. That adds up to a lot of processing. The researchers figured out a clever way to reduce the multiplications to simple addition, and then designed a special chipset that was optimized accordingly for these operations.

It is a pretty amazing story, and just shows you the gains that AI is making literally at the speed of light. It also shows you how some foundational math concepts are still valid in the modern era.

Web Informant

David Strom's musings on technology