Slashdot Mirror
DARPA Commits To Funding Useful Hacking Projects
Hugh Pickens writes "Fahmida Y. Rashid reports that the Defense Advanced Research Projects Agency will fund new cyber-security proposals under the new Cyber-Fast Track project intended to cut red tape for hackers to apply for funding for projects that would help the Defense Department secure computer networks, says Peiter Zatko, a hacker known as Mudge who was one of the seven L0pht members who testified before a Senate committee in 1998 that they could bring down the Internet in 30 minutes and is now a program manager for the agency's information innovation office. Anything that could help the military will be considered, including bug-hunting exercises, commodity high-end computing and open software tools and projects with the potential to 'reduce attack surface areas, reverse current asymmetries' are of particular interest. Under the Cyber-Fast Track initiative, DARPA will fund between 20 to 100 projects annually. Open to anybody, researchers can pitch DARPA with ideas and have a project approved and funded within 14 days of the application."
Could this be a giant honey pot?
You're an idiot. DARPA has a history of funding technology and has better things to do than make a gigantic trap to destroy their reputation for the purpose of catching a few historically insignificant basement losers.
dont trust
For the cost of a few cruise missiles humanity will be left with something of value from the defense budget.
Hopefully this becomes a superfund for cleaning up vulnerabilities by the best and the brightest. With all the money wasted every year we should not agonize over tiny sums being expedited to people who will catch the bugs and disclose to the public.
The cybercrime gangs are well funded. The bughunters are not.
Prevention is much cheaper and much more friendly towards civil liberties than is having a cyberwar bureaucracy staffed by the sort of reactive code grinders who couldn't make it in cutting edge startups.
If you recall,there was a campaign to make Mudge the USA cyber-czar back when Obama created that post. The guy knows what he's doing, and even now that he's in big-government stuff, the community still trusts him.
The military/intel is totally protected from our debt crisis, no matter how distantly related to protecting us any of its expenses might be. That's why the majority of our debt is owed for past military/intel budgets - so it costs 50% more in interest than what was appropriated on paper. And now that the debt has gotten our credit rating downgraded, it will cost us even more in interest - along with all our borrowing that it's dragged along with it.
So the smart people will turn all their projects into military/intel projects. Which will gradually turn the US into not just a hopeless debtor, but an exclusively warmongering hopeless debtor.
--
make install -not war
Just make sure the funding check clears. It is issued by the US government after all and their credit isn't as good as it once was.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
But what is DARPA, or anyone else for that matter, about making sure chips made in china don't have bugs built in?
I /refuse/ to purchase an item that is known to me to have chips made in china because I believe it to be compromised.
How can one be sure that the hardware in the devices made there are not bugged?
Hurricane Island Outward Bound
OB
But can non-Americans apply ? You know, this category of persons that form 85% of Internet.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
http://sourceforge.net/projects/pointrel/
At least I could spin it that way... :-)
And have:
"The need for FOSS intelligence tools for sensemaking etc."
http://groups.google.com/group/openmanufacturing/msg/2846ca1b6bee64e1
Where do I apply? :-)
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
I'm going to seek a $20k grant to advise police agencies against having their website developed by BJM marketing.
In case you are wondering what the hell I'm talking about: http://www.computerworld.com/s/article/9218961/AntiSec_hackers_dump_data_after_hacking_police_websites
I see where to apply, a link in one of the articles:
https://www.fbo.gov/?s=opportunity&mode=form&id=406db188e0e1935a806c143a5603eb48&tab=core&_cview=0
If slashdot allowed longer tittle I woudl have called it: "Social Semantic Desktop for Sensemaking on Threats AND OPPORTUNITIES"
We'll see if they like some variation on:
http://groups.google.com/group/openmanufacturing/msg/2846ca1b6bee64e1
"Summary: This note is essentially about how civilians could benefit by have access to the sorts of "sensemaking" tools the intelligence community (as well as corporations) aspire to have, in order to design more joyful, secure, and healthy civilian communities (including through creating a more sustainable and resilient open manufacturing infrastructure for such communities). It outlines why the intelligence community should consider funding the creation of such FOSS "dual use" intelligence applications as a way to reduce global tensions through increased local prosperity, health, and with intrinsic mutual security."
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
From the reuters article: "Addressing a key issue for hackers doing government projects, they will be allowed to keep the commercial intellectual property rights while giving the Defense Department use of the project."
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
I skimmed through the solicitation. It has people paid on achieving milestones they set out in advance (and they say ideally for two month or four month working time frames). Essentially, they are insisting on a waterfall development model. That makes difficult any basic research and general creativity in exploring topic areas. I guess someone could get around that a bit by promising a report or something, but that is probably not what they are looking for.
In general it is a rule of thumb in some projects by competent people that those who do not promise delivery dates get done faster. :-)
It's not clear to me how streamlined this is relative to usual government proposals, other than a quicker approval turnaround and shorter project scopes. You still need to do a bunch of paperwork and planning.
For what I want to do, with a social semantic desktop that does some specific things for public sensemaking, where I've worked on related stuff for years, and made some related stuff like that before (for governments), there may be just enough potential for milestone definition for some proposal. I could see some other people might have projects they've long been wanting to do and worked on pieces of that they could try to fit into this too. But for most people, thinking of something new, it would not be easy to plan for those milestones if they were other than work for X hours, and the endeavor could be high risk for the proposer if they don't meet their milestone (they would presumably not get paid?). Anyway, I just skimmed it, so maybe I missed something.
I'd suggest DARPA might have more success if they just asked for resumes from talented people and small groups, said we will fund you to work wherever (home office) for three months on cool free and open source stuff in an area you propose and we find interesting related to security, and if you want more funding after that, we'll decide based on what you deliver in that time period. Call the program "DARPA Cyber-Security Fellows" or something like that.
I'd be curious what other have to say on that.
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
Sarge, is this going to be a stand up fight, or just another bug-hunt?
Fascism: An authoritarian and nationalistic right-wing system of government and social organization. See also: NAZI's
I wrote this up last month as a proposal abstract for an IARPA soliciation, but I have not sent it (someone who had been with the CIA and does public intelligence said it would be pointless essentially as the US intelligence community is so broken). Anyway, I though I'd post it here, as I've written it already, and it seems a shame to waste it, and because it is what I'd like to do maybe for this solicitation. Any constructive feedback would be appreciated. Maybe DARPA might be interested in it if not IARPA, given the structural problems in the US intelligence community it seeks to address and which are part of why the US cyber infrastructure is so at risk? Imagine global security researchers having a tool like this to work collectively for mutual benefit to maximize the intrinsic security of our cyber infrastructure. I know some people may say terrible things about any attempt to engage with the US security apparatus (not without some justification), but, beyond being motivated by running out of cash (in part by doing so much free stuff), I do think the issue is that we all need security -- the issue is how we go about getting it. This proposal attempts to shift the US security paradigm in a more intrinsic and mutual direction, which is more sustainable over the long term than a focus on extrinsic (guarded) or unilateral (dominance) security. Maybe others might find the general concept of shifting the security paradigm useful in their own proposals.
====
Title: "Twirlip: Towards a 21st Century Worldwide Public Intelligence Desktop Platform for Collaborative Sensemaking, Analysis, Risk Assessment, and Horizon Scanning"
Company: Kurtz-Fernhout Software
Organizational form: Woman-owned small business (Cynthia F. Kurtz, CEO)
Prepared: July 12, 2011
Amount requested: US$297,000
Responding to: IARPA Incisive Analysis Office Wide Broad Agency Announcement (BAA) Solicitation Number: IARPA-BAA-10-08, especially these aspects:
* Methods for measuring and improving human judgment and human reasoning
* Understanding and managing massive, dynamic data
* Effective analysis of massive, unreliable, and diverse data
* Assessing relevancy of new data
* Analysis of significant societal events
* Estimation and communication of uncertainty and risk
Summary: As a legacy from the 20th century, there are currently broad institutional barriers in the US intelligence community that make it difficult for intelligence analysts to gain 21st century insights into 21st century issues using 21st century technology and 21st century public data sources. To address the need to move beyond those institutional barriers, we propose a proof-of-concept project called "Twirlip" as a free and open source software (GPL) Public Intelligence desktop platform for the general public. It would use Java/JVM desktop technologies and CouchDB as a backend relay server and indexed archive. It would be built around the idea of a social semantic desktop. The public can then use this system to process open source data to crowdsource sensemaking and analysis about global socioeconomic, technical, and geopolitical trends, with a special emphasis on understanding the likely global consequences of Moore's law. The global community can also expand this platform in various ways by adding new freely licensed modules. The US intelligence community can then build on this public software and public content in its own internal sensemaking and analysis. Supporting this system by IARPA may create both a strategic first mover advantage and a public relations advantage for the US intelligence community. Whether the software is of any use to the US intelligence community directly is not as important as whether the community gets new ideas from seeing what the public does with such tools or seeing how such tools are expanded.
Technical/Administrative contact: ...
Paul D. Fernhout, CTO
Kurtz-Fernhout Software
Website: http://www.kurtz-fernhout.com/
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
Open Protocols for Social Media would be very helpful..
Think along the lines of Diaspora and Google+ but within a military context, where each command/outfit, etc. needs to own it's own data, various aspects of data needs to shared (nor not shared) based on a firm but flexible set of permissions and you have a fairly ideal way of allowing modern war fighting use social tools; all of those still on secure networks but having a wide range of secure sharing. This could include pushing data out to non secure networks from civilian to governmental (e.g, congress, white house, etc.) and NGOs or pushing data to other secure networks (e.g., CIA, NSA, etc.).
http://www.hawknest.com/
You can mark my fucking score down so it's un-readable, but you can't change facts.
A return to the "old" to combat the problems of "the new" & why, in combination with filtering DNS servers (vs. malware-in-general in most ALL forms) that use DNSBL's vs. them! I have done so for YEARS now (since 2002 in my older Delphi model, which used "brute force" dedup methods which was FINE on HOSTS files in those days that only MAYBE hit 16k lines - lately, they're a LOT larger than that, so I switched to a Python system my nephew & I co-wrote that processes MILLIONS @ a time & faster dedup algorithms in place is why because of Python's built in routines).
It does the following things:
---
1.) Data gather from reputable sources for HOSTS data (some listed below, not all though), DNSBL's too!
2.) Alphabetize the data
3.) Removes duplicates/normalizes the data
4.) Changes from the larger & slower 127.0.0.1 "loopback adapter address" to the just as compatible & faster 0.0.0.0 "blackhole routing" address instead
5.) Filtering vs. "problematic" sites that MAY 'disturb' some sites IF their adbanner servers are disrupted (YAHOO, AOL, MSN & quite a few others)
6.) Commits back (from a "temp/scratch" file) to the ORIGINAL HOSTS file for use by the system &/or apps (@ RPL 0/Ring 0/kernelmode level, FAR faster & more efficient than Ring 3/RPL 3/Usermode filtering solutions are mind you) by OVERWRITE, assuring CLEAN COPY & a pristine unaltered (by malware) HOSTS file!
---
As well as a recommendation for this, in combination with it (using the excellent CIS Tool as a guide) -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE
My custom HOSTS file currently protects me vs. 1,554,666++ (& growing every 15 minutes) KNOWN bad sites/servers/hosts-domains that are KNOWN to be either maliciously scripted, or serving up malware-in-general, plus spamming/phishing sources as well as botnet C&C servers.
How/Why? Ok, read on:
20++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:
1.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).
2.) Adblock blocks ads in only 1-2 browser family, but not all (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).
3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.
4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 5-7 next below).
5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via NSLOOKUP, PINGS, &/or WHOIS though, regularly, so you have the correct IP & it's current)).
6.) Hosts files don't eat up CPU cycles like AdBlock does while it parses a webpages' content, nor as much as a DNS server does while it runs. HOSTS file are merely a FILTER for the kernel mode/PnP TCP/IP subsystem, which runs FAR FASTER & MORE EFFICIENTLY th