Google Search

Showing posts with label allegedly. Show all posts
Showing posts with label allegedly. Show all posts

Friday, June 13, 2014

"Turing Test" allegedly defeated - is it time to welcome your robot overlords?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

I'm sure you have heard of, and indeed at some time faced up to and solved, a CAPTCHA.

All over the web, you'll see people telling you CAPTCHA is a pun on "capture," since it's meant to catch out automated software, but actually stands for Completely Automated Turing Test for Telling Computers and Humans Apart.

That's nonsense, of course, or else the acronym would be CATTTCHA, which would be a perfectly good play on words itself.

CAPTCHA is better expanded as Completely Automated Procedure for Telling Computers and Humans Apart.

Briefly put, a CAPTCHA falls a long way short of a real Turing Test, which sets much higher human-like behavioural standards on computers that attempt it.

The Turing Test, as you can probably guess, is named after British computer pioneer Alan Turing.

Turing proposed his now famous test back in a seminal paper published in 1950, entitled Computing Machinery and Intelligence.

The test was presented as a way of answering the question, "Can machines think?"

To bypass the complexity of defining "thinking," and of deciding through philosophical argument that an entity was engaging in it, Turing proposed a practicable systematic alternative in the form of a test.

He based it on an imaginary contest called The Imitation Game.

A man and a woman are sitting in separate rooms, each in front of a teleprinter, so they can't be seen or their tone of voice heard.

One of them is denoted by X and the other by Y; a questioner gets to interrogate them, directing each question at either X or Y.

That means he can group all of X's answers together, and all of Y's answers together; at the end, he has to work out who's who.

But here's the tricky part: the man must convince the questioner he's the woman, and so must the woman. (You could do it the other way around, but one person is being themselves, and the other is trying to imitate someone they aren't.)

The idea is that if the questioner can tell them apart, the man hasn't played a convincing enough role.

Since the woman's job is to convince the questioner that she is, indeed, female, thus exposing the man as a fraud, her best approach is to be as truthful and accurate as possible.

She is effectively on the questioner's side, so misleading him won't help.

It sounds like a parlour game - it might even have been a 1940s parlour game - but once you think about the sort of tactics the man would need to adopt, you can see where Turing was going.

Replace the man in the game with a computer, and see if the questioner can distinguish the computer from the woman. (Or from a man. This time the differentiation is not gender based: it's computer versus human.)

Turing's suggestion was that if you can't tell the computer from the human, then you have as good as answered the question, "Can computers think?" with the word, "Yes."

In other words, given the right sort of questions, the human participant would have to perform what we call "thinking" in order to answer.

So, if a computer could give sufficiently human-like answers, you'd have to concede it was "thinking," too.

Clearly, to pass a proper Turing test, a computer program would need a much broader set of skills than it would need to read the following CAPTCHA:

Make no mistake: programming the sort of software than can read modern CAPTCHAs is a serious challenge in its own right.

You might even decide to refer to a computer that could do it as "clever," but it still wouldn't be thinking.

Interestingly, in the paper in which he introduced the Imitation Game, Turing estimated that by the year 2000, computers would able to survive his eponymous test for five minutes at least 30% of the time.

? Generally speaking, the longer the questioning goes on, the more likely the questioner will tell the human and the computer apart, as he has more opportunity to catch the computer out. So the longer a computer can last, the more we should accept that it is "thinking."

Furthermore, Turing guessed that his fin de siècle test-beating computers would need about 128MB (1Gbit) of memory to do the job.

He was a trifle optimistic, but nevertheless surprisingly close.

It actually took until 07 June 2014 for a serious claim to surface that a computer, or more precisely a program, had passed a Turing Test.

It happened in a contest organised by the University of Reading in England, and the "thinking software" was called Eugene Goostman.

Just how seriously the world of computer science will take the claim remains to be seen: Reading University's machine intelligence experts are no strangers to controversy.

Indeed, the spokesman in Reading's latest press release is none other that Professor Kevin Warwick, a media-savvy cyberneticist who promotes himself as the man who "became the world's first Cyborg in a ground breaking set of scientific experiments."

And University of Reading research fellow Mark Gasson proudly announced, in 2010, that he was the first human to infect himself with a computer virus.

? What Gasson actually did, as far as we can see, is to inject himself with an RFID chip containing executable code that could, in theory, be considered an exploit against a vulnerable RFID reader, if Gasson were to find (or build) a vulnerable RFID reader to match his "infected" chip.

The Eugene Goostman software was developed in Saint Petersburg, Russia, by a team including Vladimir Veselov, an American born in Russia, and Eugene Demchenko, a Russian born in Ukraine.

This year's competition took place, fittingly if slightly sadly, on the 60th anniversary of Turing's death.

Eugene, reports the University of Reading, tricked 33% of the judges into thinking he was human in a series of five-minute conversations.

Fans of TV Sci-Fi shows will enjoy that fact that one of the judges was Robert Llewellyn, the actor who played the intelligent robot Kryten in the cult comedy series Red Dwarf.

Will 07 June 2014 become, as one of my Naked Security colleagues joked (at least, I assume he was joking), the day we first welcomed our robot overlords?

I'm saying, "No."

One trick the programmers used was to make Eugene a 13-year-old boy, which almost certainly gave them much more leeway for "believable mistakes" than if they had simulated a person of adult age.

As Veselov pointed out:

Eugene was 'born' in 2001. Our main idea was that he can claim that he knows anything, but his age also makes it perfectly reasonable that he doesn't know everything. We spent a lot of time developing a character with a believable personality.

As Turing Tests go, this one feels a bit more like getting a learner's permit for a moped than qualifying for your unrestricted car licence.

Eugene has a few years to go before he can do that.

So Naked Security's message to our new robot overlord is, "Stop showing off on the internet and go and tidy your bedroom!"

That's what it told me to say, anyway.

Follow @duckblog


View the original article here

Saturday, May 25, 2013

Reuters journalist who allegedly conspired with Anonymous hackers is suspended

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Matthew KeysA Reuters journalist has been indicted by a US federal grand jury for allegedly handing over the login credentials of his former employer, Los Angeles Times parent company Tribune Co., to people claiming allegiance to the hacker movement Anonymous.

Reuters.com, which currently employs 26-year-old Matthew Keys as a deputy social media editor, suspended him with pay on Friday.

An employee at the company's New York office said that Keys's workstation was being dismantled and that his security pass had been deactivated, according to subsequent reporting from Reuters.

The US Department of Justice announced the indictment [PDF] on Thursday.

Keys was indicted on three criminal counts:

Conspiracy to transmit information to damage a protected computer, Transmitting information to damage a protected computer, and Attempted transmission of information to damage a protected computer.

Prosecutors claim that Keys promised to give hackers access to Tribune Co. websites, and that one went on to deface a story on the company's Los Angeles Times website.

From a Department of Justice statement:

"Keys identified himself on an Internet chat forum as a former Tribune Company employee and provided members of Anonymous with a login and password to the Tribune Company server... After providing log-in credentials, Keys allegedly encouraged the Anonymous members to disrupt the website."

The exact wording of said encouragement, according to the indictment, being Keys telling the hackers to "go f**k some s**t up."

Part of indictment against Matthew Keys

On Thursday, Keys tweeted that he had found out about the indictment the same way most of us did: via Twitter.

The story told by court filings is of a disgruntled former employee who acted as a double agent with Anonymous hackers, working both with them and against them.

The case began in December 2010, when Keys allegedly provided the login credentials for a computer server belonging to KTXL FOX 40's corporate parent, the Tribune Company.

The indictment maintains that Keys identified himself on an Internet chat forum as a former Tribune Company employee and that he handed over a login and password for the server.

According to the indictment, the hacker ultimately defaced a Los Angles Time news story, changing its headline, byline and sub-headline to include the name "CHIPPY 1337".

Also, a line in the article was changed to read:

"House Democratic leader Steny Hoyer sees 'very good things' in the deal cut which will see uber skid Chippy 1337 take his rightful place, as head of the Senate, reluctant House Democrats told to SUCK IT UP."

The indictment further claims that Keys chatted with the hacker who claimed credit for the defacement, offering to try to regain access for him after system administrators fended off the hacker and locked him out.

When he learned of the hacker's ultimate success in defacing the Los Angeles Times page, Keys allegedly responded, "nice."

It's a long and twisty story, involving famed (and subsequently busted) former Anonymous top dog Sabu having outed Keys back in March 2011.

Buzzfeed has done a great job of pulling together all the intricacies of Keys's story, including an image of the defaced Los Angeles Times new story, a blog post from Keys about losing his job at the local FOX Affiliate in Sacramento, California, and more, including this statement from Keys's current employer, Thomson Reuters:

"We are aware of the charges brought by the Department of Justice against Matthew Keys, an employee of our news organization... Thomson Reuters is committed to obeying the rules and regulations in every jurisdiction in which it operates. Any legal violations, or failures to comply with the company's own strict set of principles and standards, can result in disciplinary action. We would also observe the indictment alleges the conduct occurred in December 2010; Mr. Keys joined Reuters in 2012, and while investigations continue we will have no further comment."

Will Keys get fired from Reuters? Should he?

Reuters logoBuzzfeed checked in with a Reuters employee who said that yes, if Keys is found guilty of divulging login credentials while at Reuters, he will have violated the company's Trust Principles, which is grounds for immediate dismissal.

What if Keys is found guilty of working with Anonymous only before Reuters hired him?

It's hard to imagine any reputable news venue countenancing the type of betrayal alleged in these charges.

If I were a Reuters editor or lawyer, I'd be finding ways to ensure Keys didn't come back from his suspension in the eventuality of a guilty verdict.

This case may look a little muddy given that journalists working undercover can act as double agents, but the fact is, Keys wasn't working for the news outlet at the time of the breach he allegedly helped to bring about.

As far as what non-journalists can take away from this, the lesson is this: priority No. 1 should be to shut down accounts for terminated employees.

Shuttering accounts should be a priority, but it often isn't.

You can't assume that a disgruntled former employee won't open up your systems to spammers, plant malware, or replace the CEO's presentation with porn.

If found guilty, Keys is looking at a maximum of 10 years in prison and a fine of up to $250,000.

Follow @LisaVaas
Follow @NakedSecurity


View the original article here

Friday, October 5, 2012

Romney tax returns allegedly hacked, supposedly held for $1 million ransom

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Mitt Romney, image from TwitterA team of burglars allegedly broke into a Tennessee PricewaterhouseCoopers office on August 25 and made off with US presidential Republican nominee Mitt Romney's tax returns.

The hackers are supposedly holding the returns for $1 million ransom and have maybe copied the documents onto flash drives, possibly stuck the drives into manila envelopes with handwritten, magic-marker lettering, which they then perhaps slid through the slot in Democrats' and PwC's office doors - if, in fact, any of it happened at all.

The original claim, as posted on Pastebin on Sunday, promises that the thieves will release the files to the public later this month:

Romney's 1040 tax returns were taken from the PWC office 8/25/2012 by gaining access to the third floor via a gentleman working on the 3rd floor of the building. Once on the 3rd floor, the team moved down the stairs to the 2nd floor and setup shop in an empty office room. During the night, suite 260 was entered, and all available 1040 tax forms for Romney were copied. A package was sent to the PWC on suite 260 with a flash drive containing a copy of the 1040 files, plus copies were sent to the Democratic office in the county and copies were sent to the GOP office in the county at the beginning of the week also containing flash drives with copies of Romney's tax returns before 2010. A scanned signature image for Mitt Romney from the 1040 forms were scanned and included with the packages, taken from earlier 1040 tax forms gathered and stored on the flash drives.

The group will release all available files to the public on the 28 of September, 2012

As this was said anonymously, it could be about as factual as an Anonymous-branded claim earlier this week that 12 million iPhone and iPad device IDs had been hacked from an FBI agent's laptop.

And just how factual was that Anonymous claim?

In the FBI's own, fully capitalized, Tweeted words, "TOTALLY FALSE".

What we do know for sure: the Secret Service agency is investigating the matter.

BitcoinsSecret Service spokesman George Ogilvie told CNET that the agency is investigating and had no further comment. There'd been no updates when I called Ogilvie on Thursday.

A followup message posted on Tuesday demanded $1,000,000, paid in Bitcoins.

In return, the poster says, the keys to unlock the data

"will be purged and what ever is inside the documents will remain a secret forever."

The followup post also contained details of the supposed heist, claiming that the thieves gained access to network file servers and copied electronic tax documents for Mitt Romney and his wife, Ann Romney, with the help of some type of security flaw that "will probably get [some people] fired".

The author of the post also claimed that major news media outlets will be sent an encrypted copy of the most recent tax years on file.

PwC released a statement saying that it's working closely with the Secret Service but so far has found no evidence that its systems had been compromised or that the tax returns had been accessed by unauthorized parties.

What we also know for sure: CNET reports that Democratic and Republican party offices in Williamson County, Tennessee, where the PwC office is located, did in fact receive thumb drives in packages late last week.

As far as the Democratic party leaders went, they opened the package, found the hackers' message (which was pretty much the same as the original Pastebin post, with the addition of a rubber stamp impression of Romney's signature at the bottom) and the thumb drive, laughed over how rinky-dink the whole thing was, nearly threw it away, but finally decided to hand it over to the Secret Service without trying to find out what was on the thumb drive.

Peter Burr, chairman of the county Democratic Party, told CNET that the party leaders found the package on the floor, dropped through the mail slot, addressed to "Dem Party Ldrs" in thick green marker, when they went to headquarters for an executive committee meeting last Thursday night:

"It was a small, manila envelope with bubble wrap lining. … I opened it and found inside a piece of paper folded into quarters and a black Cruzer 4 gig thumb drive."

"We almost threw the letter away. We passed it around and it drew some laughs."

"We considered this probably a scam and didn't really think much of it until these inquiries began happening today. Obviously, we would have no interest in obtaining information like this from a source like this as the Democratic Party. We're very interested in knowing what Mitt Romney's tax returns look like, but we would only be interested if it came from official sources."

Of course the Democratic party would be very interested indeed to look at Romney's tax returns, but in the meantime, it's gleefully squeezing Romney's tax reticence as evidence that the presidential nominee pays a lower tax rate than middle-class US families.

Mitt Romney, courtesy of spirit of america/ShutterstockOne hates to blame victims of what might turn out to be extortion if these Pastebin claims are true, but it's hard not to see Romney as bringing this whole tax pickle down on his own head.

Romney's father, George Romney, released 12 years worth of tax returns when he ran for president in 1968. Mitt Romney has released only one, nearly complete 2010 return, with his 2011 return due out in October—that's it, no more returns forthcoming.

So he's called attention to the very documents he'd rather people keep their peepers off of.

If he'd just release his taxes, there wouldn't be anything to raise ransoms about, be they real or be they just Pastebin pipedreams.

And regarding the Democratic party leaders' abstinence vis-a-vis plugging in mysterious flash drives: bravo!

It's nice to hear somebody's paying attention to Naked Security's (et al.) advice on USB drives' unhygienic nastiness.

Follow @LisaVaas

Mitt Romney image courtesy of spirit of america / Shutterstock.com


View the original article here