DARPA Cyber Grand Challenge

by bra-ket • 11 years ago

82 32 11 years ago

Will be interesting but a distraction from real INFOSEC work. DARPA and NSF have been leading the way with programs investing in real security. All kinds of results from SAFE processor to CHERI capability architecture to self-diversifying systems to inherently secure programming have come from this. Their HACMS work, for example, was even integrated into a UAV software.

It's that sort of work that's really delivering and needs more support. Smart people at institutions with good grant writers should stay watching all the DARPA and NSF security funding announcements. Plenty of money going around to solve fundamental problems. Great results so far that just need more development and adoption. And more bright men and women in the trenches fighting the rest of the hard problems.

minthd3• 11 years ago

I wonder , are those technologies scalable to micro-controllers ? because there the problem of backward compatibility is significantly reduces - as long as you supply a tcp/ip stack and an efficient compiler, the rest of the code is relatively easy , in many cases.

nickpsecurity5• 11 years ago

Yes, actually. Heck, the very limited PDP-1 was a capability machine of sorts. Most microcontrollers run circles around it. The simplest of the new schemes check small tags with hardware that runs in parallel to the processor. Essentially, the processor executes the instruction and the result is not written unless parallel unit says "All good." This should have little performance, latency, and chip area overhead. I'm not saying every microcontroller of every cost and such can be done this way: probably just mid- to high-end microcontrollers will be secure by design.

Also, there's long been chips design to run languages that are type- or memory-safe by design. Sandia Labs recently made a high assurance processor for a Java subset: the Sandia Secure Processor (SSP) or "Score" processor. It doesn't allow new code in production mode, resists all kinds of errors, has assured tool sets, has a converter from legacy Java to its, speaks JVM natively with associated benefits, uses asynchronous interrupts for determinism, and is fabbed in a rad-hard process. They aimed at safety & assurance over throughput so the specs are 25Mhz from 35,000 logic gates (110K with memory). Their ASSET framework and its high assurance design also led to amazing feet of 3 weeks from synthesis to working ASIC with no timing errors. They said similar projects normally take 6 to 18 months (!!!).

In closing, the above is evidence embedded can benefit. Yet, two in embedded just popped into my mind: CodeSEAL and smartcards. CodeSEAL combines custom hardware with a processor to (a) encrypt and hash memory pages to stop leaks or attacks outside SOC; (b) control flow whitelist produced by compiler to block all attempts to hijack it. MicroSEMI sells this commercially. Other one is smartcards: microcontrollers with strongly assured hardware, firmware, VM's, and so on for small prices. I should've thought of them first because they kind of answer the whole question, don't they?

Guess it doesn't hurt to spread more info on high assurance security tech. ;)

schoen2• 11 years ago

This is a neat idea, nicely presented. The proposal appeals to a wide audience by explaining the defensive significance of the tools it asks participants to develop. Is there any reason to think that people who were directly or indirectly involved in proposing this challenging are also interested in offensive applications, and chose not to talk about them?

irl_zebra• 11 years ago

> Is there any reason to think that people who were directly or indirectly involved in proposing this challenging are also interested in offensive applications, and chose not to talk about them?

Yes, the competition is run by DARPA.

avoutthere• 11 years ago

nicely presented

I couldn't disagree more.

schoen2• 11 years ago

Sorry, I didn't actually go through the entire scrolling graphics thing, I just read the explanation of the idea. I'll agree that that part didn't add to my understanding and I didn't intend to praise it.

daveloyall2• 11 years ago

The Skynet Funding Bill is passed. The system goes on-line August 4th, 1997. Human decisions are removed from strategic defense. Skynet begins to learn at a geometric rate. It becomes self-aware at 2:14 a.m. Eastern time, August 29th. In a panic, they try to pull the plug.

fapjacks4• 11 years ago

Jesus. This site hurts to use. What's with the UI pigeonholing?

tim333• 11 years ago

Plus it was using about 30% CPU for the one page.

fapjacks4• 11 years ago

Or, less formally, the "Build An Internet That Pwns Itself For The Government" contest.

daveloyall2• 11 years ago

I read it as the "Build an Auto-Pwner for the Government" contest.

fapjacks4• 11 years ago

Yes, in the immediate sense of the story, you're right. But when I look into my crystal ball, I see so many of these machines running continually that it becomes an internet that hands control of itself to the US government (and any of our "allies" paying the ante of, say, forty F-35s, or whatever newfangled hardware they build to burn up on the runway).

ENGNR• 11 years ago

Pwning is easy for a skilled attacker vs an unskilled defender (the current situation).

With the focus on automatic evaluating and healing, it could seriously help out unskilled defenders.

colinthompson• 11 years ago

Where would silicon valley, and the world in general, be without DARPA? Not that I am trying to support any big brother agenda, but it's hard to deny that your smartphone and computer owe at least some part of their existence to efforts on the part of the US defense budget. Again, I am not trying to take sides, I just find it shortsighted to cast a disapproving eye on government projects....or at least funding.

fapjacks4• 11 years ago

You are reading words that aren't there. I didn't actually say whether or not I thought that was a bad thing.

nickpsecurity5• 11 years ago

Just agreeing here on the part about DARPA. It's possible, though, that you have no idea just how much DARPA was involved. Despite my research, I just now stumbled onto the Strategic Computing Initiative which shows most of the coolest stuff I studied was all tied to DARPA. Most people haven't heard of it despite it being much more useful than the other Strategic Initiative they know about. Link below for your enjoyment.

http://monoskop.org/images/d/d4/Roland_Alex_Shiman_Philip_St...

facepalm• 11 years ago

I suppose the challenge is to read through the site and successfully extract it's meaning?

nickpsecurity5• 11 years ago

Lmao. My initial reaction exactly. DARPA's writers are usually better than this if it's something open to the public. Other times, they do it on purpose. Maybe they got mixed up on which style to use.

jmgrosen• 11 years ago

I'm on a team that will be participating in the upcoming qualifier for the finals. I'd be happy to answer any questions about the challenge (that I know the answers to), though not any about our specific techniques ;)

plantbased• 11 years ago

For the love of god give us all the TL;DR, the site is awful.

bahador• 11 years ago

Please let's all agree that scroll-jacking must die.

frik2• 11 years ago

TL;DR: It's about the "Internet of Things"

It's a buzzword with an vision that can have a positive but also a negative outcome for our society.

For example: The nest thermostat learns your behavior and selects your favorite temperature depending the day of time, the ambient light, ... it learns with you - and actually helps to save you energy. The opposite is a "smart meter" forced on you by new regulations that isn't smart at all and doesn't help you to save energy but sends your power usage data (your private life data) in regular intervals over the net to the usual data collectors.

Another example: All Ford automobiles that come with the Sync board computer (2008-2015, Windows CE based) can be optionally set to do the following in the event of a crash (at the time when the airbags go off): use your phone connected via Bluetooth, set a call to the international emergency hotline, speak via the Nuance Text-To-Speech software an emergency text including your current position (car have an inbuilt GPS antenna) and open the microphone so that you can talk with the emergency hotline or at least they can hear the audio if you are unable to speak. On the otherside, some lobbies try to propose in the US/EU a new law where every car has to share its location and some other "metadata" in a short interval (as soon as you turn on your motor) to a central data collector - so that in the event of an accident they know where you are, as they say.

Decide yourself which version of the "Internet of Things" vision you want to have in your everyday life.

darkmighty• 11 years ago

The nest thermostat is a completely different device from an utility smart meter.

For example, I can see smart meters helping provide real time data to the utility about power usage. Utilities are engaged in an enormous task of forescating power demand, which is probably much harder than weather forecasting even (as that is a subtask of demand forecasting!) -- and can net huge savings for the companies; or allowing more fair pricing schemes that discourage usage in times of high demand; etc. That's a real benefit for society.

I don't think there's a need to put a tin foil hat and demand that all personally identifiable information collection be ceased. We instead just have to make sure this info is getting used properly (within the designated scope) with according security for each problem. In other words: scrutiny, not celibacy.

frik2• 11 years ago

completely different device

You can twist it how you like but it doesn't make a difference - it's a device that the PR suggests that it helps you save energy and costs. One device (Nest) lives up the dream and is great, the other (smart meters) is the opposite - but it could be a great device too if it would live up the original PR vision.

enormous task of forescating power demand

Not really, the electrical power transformer stations that are physically located near your home already communicate about the power demand habits to the central power grid network. There is no technical reason to track every single house hold every 15min or every hour.

provide real time data to the utility

Do you believe it's great that a washing machine is running during the night to save costs for the power company (and maybe you) but keeps you and your neighbors awake and you have to deal with wrinkled laundry in the morning?

One can save energy at home, but the biggest power consumers at home are devices that are used at specific times - and that time cannot be deferred to the night - except one wants to be the slave of his own devices. On the other side a lot of energy could be saved in industrial production by optimizing processes.

Next time one buys a device check the energy rating - but be smart and cautious as some very energy efficient rated devices like new electric kettles and vacuum cleaners consume less power by using less Watt which means physically it takes longer to boil the water or the vacuum cleaner is less efficient as the engine is less powerful and it takes longer to clean your home.

Far better for the environment is to install photovoltaic panels near your home yourself. Especially then an electric car makes a lot of sense.

s_baby• 11 years ago

I don't think there's a need to put a tin foil hat and demand that all personally identifiable information collection be ceased. We instead just have to make sure this info is getting used properly (within the designated scope) with according security for each problem

Smart meters are a great example of what can go wrong. Before pot growers were busted based on how much energy they used. The new smart meters can pick up individual devices based on their usage patterns. It can tell how many lights you are running, what kind, when, etc... All of this information is already being analyzed and used to catch people.

charles2013• 11 years ago

TL;DR: It's about the "Internet of Things"

^ this is too ambiguous to be meaningful for anyone who isn't familiar with the cyber grand challenge (CGC).

the CGC, as i understand it, is about developing systems which can autonomously detect and patch vulnerabilities[0].

i believe this is interesting for a couple of reasons:

1. a self-repairing system could prevent data breaches (or mitigate damage).

2. this type of system could use its knowledge to attack other systems.

on a somewhat related note, i'm reminded of elon musk's reaction [1] to prof. nick bostrom's book [2], "superintelligence":

"We need to be super careful with AI. Potentially more dangerous than nukes."

though i don't claim to know the motivation/context behind musk's remark, it's easy to envision the dangers associated with a couple of AI's "duking it out" on the interwebs. (CBS's "person of interest" is a fun, fictional series that covers this scenario [3].)

[0] here are a couple of participating teams:

* http://forallsecure.com/ * https://www.trailofbits.com/

[1] https://twitter.com/elonmusk/status/495759307346952192

[2] http://en.wikipedia.org/wiki/Superintelligence:_Paths,_Dange...

[3] http://en.wikipedia.org/wiki/Person_of_Interest_%28TV_series...

rch• 11 years ago

It's worse than that actually - any of these connected things may ship with malicious components that turn against you or the network at large:

http://www.bbc.com/news/blogs-news-from-elsewhere-24707337

At some point, seemingly innocuous devices might be able leverage access to ambiant sounds and shared AC circuits to compromise local wireless networks in unconventional ways.

DARPA Cyber Grand Challenge

Related Stories