#schneier

prplcdclnw@diasp.eu

Hacking the “Bike Angels” System for Moving Bikeshares

This is very close to something we used to do in the Navy. See below.

https://www.schneier.com/blog/archives/2024/09/hacking-the-bike-angels-system-for-moving-bikeshares.html

I always like a good hack. And this story delivers. Basically, the New York City bikeshare program has a system to reward people who move bicycles from full stations to empty ones. By deliberately moving bikes to create artificial problems, and exploiting exactly how the system calculates rewards, some people are making a lot of money.

At 10 a.m. on a Tuesday last month, seven Bike Angels descended on the docking station at Broadway and 53rd Street, across from the Ed Sullivan Theater. Each rider used his own special blue key -­- a reward from Citi Bike—­ to unlock a bike. He rode it one block east, to Seventh Avenue. He docked, ran back to Broadway, unlocked another bike and made the trip again.\
\
By 10:14, the crew had created an algorithmically perfect situation: One station 100 percent full, a short block from another station 100 percent empty. The timing was crucial, because every 15 minutes, Lyft’s algorithm resets, assigning new point values to every bike move.\
\
The clock struck 10:15. The algorithm, mistaking this manufactured setup for a true emergency, offered the maximum incentive: $4.80 for every bike returned to the Ed Sullivan Theater. The men switched direction, running east and pedaling west.

OK. So here's the Navy thing mentioned above. It was called a "trim party." On nuclear-powered submarines there was a watch station in the Control Room called Chief of the Watch (the COW, not to be confused with the COB, Chief of the Boat^1^, which was a job title, not a watch station, but I digress). One of the jobs of the COW was to keep the submarine in trim. What does that mean? It means ensuring that if all propulsion is stopped, the submarine will neither slowly sink to the bottom of the ocean or slowly rise to the surface, and that it will remain perfectly level (not list to port or starboard, fore or aft). This is accomplished with trim tanks. Water in trim tanks can be pumped out into the ocean, allowed in from the ocean, or moved from one trim tank to another. Got it?

OK. So here's how a trim party works. Someone finds out that a new person is qualifying to stand COW. This person gets together a crew of about six people who are off-watch, they all go together to the forward end of the torpedo room, as far forward as you can be. One member of the party watches the indicator on the trim tank there to see when the new COW has pumped out water to correct the trim. Then the whole party goes to the aft end of the engine room, as far aft as you can go. Someone monitors the indicator on the trim tank there. This is repeated until the victim catches on and stops reacting to the trim party.

#bikeshare #bike-angels #rewards-system #hack #schneier #bruce-schneier #schneier-on-security #blog


^1^ Submarines, no matter how large, are called boats.

bkoehn@diaspora.koehn.com

From #schneier:

World of Warcraft players wrote about a fictional game element, “Glorbo,” on a subreddit for the game, trying to entice an AI bot to write an article about it.

And it…worked. Zleague auto-published a post titled “World of Warcraft Players Excited For Glorbo’s Introduction.”

[…]

That is…all essentially nonsense. The article was left online for a while but has finally been taken down (here’s a mirror, it’s hilarious). All the authors listed as having bylines on the site are fake. It appears this entire thing is run with close to zero oversight.

https://www.forbes.com/sites/paultassi/2023/07/21/world-of-warcraft-players-trick-ai-scraping-games-website-into-publishing-nonsense/

bkoehn@diaspora.koehn.com

From #Schneier:

Google has backtracked on its plan to delete inactive YouTube videos—at least for now. Of course, it could change its mind anytime it wants.

It would be nice if this would get people to think about the vulnerabilities inherent in letting a for-profit monopoly decide what of human creativity is worth saving.

#google #youtube

bkoehn@diaspora.koehn.com

Here’s an experiment being run by undergraduate computer science students everywhere: Ask ChatGPT to generate phishing emails, and test whether these are better at persuading victims to respond or click on the link than the usual spam. It’s an interesting experiment, and the results are likely to vary wildly based on the details of the experiment.

https://www.schneier.com/blog/archives/2023/04/llms-and-phishing.html

#Schneier #security #llms #chatgpt #scam

prplcdclnw@diasp.eu

Reimagining Democracy

Last week, I [Bruce Schneier] hosted a two-day workshop on reimagining democracy.

https://www.schneier.com/blog/archives/2022/12/reimagining-democracy.html

Be sure to read the comments at the bottom of the linked page. This is where information about what actually happened at the conference is. Notice the #tags contain a partial list of the participants in the conference.

Representative democracies were built under the assumption that travel and communications were difficult. Does it still make sense to organize our representative units by geography? Or to send representatives far away to create laws in our name? Is there a better way for people to choose collective representatives?\
\
Indeed, the very idea of representative government is due to technological limitations. If an AI system could find the optimal solution for balancing every voter’s preferences, would it still make sense to have representatives­—or should we vote for ideas and goals instead?\
\
With today’s technology, we can vote anywhere and any time. How should we organize the temporal pattern of voting—­and of other forms of participation?\
\
Starting from scratch, what is today’s ideal government structure? Does it make sense to have a singular leader “in charge” of everything? How should we constrain power­—is there something better than the legislative/judicial/executive set of checks and balances?\
\
The size of contemporary political units ranges from a few people in a room to vast nation-states and alliances. Within one country, what might the smaller units be­—and how do they relate to one another?\
\
Who has a voice in the government? What does “citizen” mean? What about children? Animals? Future people (and animals)? Corporations? The land?\
\
And much more: What about the justice system? Is the twelfth-century jury form still relevant? How do we define fairness? Limit financial and military power? Keep our system robust to psychological manipulation?

This was a great idea. For decades I've been trying to rethink government from the ground up---including asking whether we need what we usually call "government."

#government #conference #schneier #bruce-schneier #politics #society #state #the-state #james-bridle #claudia-chwalisz #lawrence-lessig #beth-noveck #eli-pariser #bob-reich #robert-reich #cory-doctorow #gideon-lichfield #tim-oreilly #ted-chiang #ada-palmer

bkoehn@diaspora.koehn.com

Russian Software Company Pretending to Be American

Computer code developed by a company called Pushwoosh is in about 8,000 Apple and Google smartphone apps. The company pretends to be American when it is actually Russian.

According to company documents publicly filed in Russia and reviewed by Reuters, Pushwoosh is headquartered in the Siberian town of Novosibirsk, where it is registered as a software company that also carries out data processing. It employs around 40 people and reported revenue of 143,270,000 rubles ($2.4 mln) last year. Pushwoosh is registered with the Russian government to pay taxes in Russia.

On social media and in US regulatory filings, however, it presents itself as a US company, based at various times in California, Maryland, and Washington, DC, Reuters found.

What does the code do? Spy on people:

Pushwoosh provides code and data processing support for software developers, enabling them to profile the online activity of smartphone app users and send tailor-made push notifications from Pushwoosh servers.

On its website, Pushwoosh says it does not collect sensitive information, and Reuters found no evidence Pushwoosh mishandled user data. Russian authorities, however, have compelled local companies to hand over user data to domestic security agencies.

I have called supply chain security “an insurmountably hard problem,” and this is just another example of that.

#security #schneier #russia #supplychain

https://www.schneier.com/blog/archives/2022/11/russian-software-company-pretending-to-be-american.html

bkoehn@diaspora.koehn.com

H/T #Schneier

Prevention is often seen as the responsibility of the software developer, as they are required to securely develop and deliver code, verify third party components, and harden the build environment. But the supplier also holds a critical responsibility in ensuring the security and integrity of our software. After all, the software vendor is responsible for liaising between the customer and software developer. It is through this relationship that additional security features can be applied via contractual agreements, software releases and updates, notifications and mitigations of vulnerabilities.

Software suppliers will find guidance from NSA and our partners on preparing organizations by defining software security checks, protecting software, producing well-secured software, and responding to vulnerabilities on a continuous basis. Until all stakeholders seek to mitigate concerns specific to their area of responsibility, the software supply chain cycle will be vulnerable and at risk for potential compromise.

#security #software #supplychain

https://media.defense.gov/2022/Oct/31/2003105368/-1/-1/0/SECURING_THE_SOFTWARE_SUPPLY_CHAIN_SUPPLIERS.PDF

prplcdclnw@diasp.eu

On the Dangers of Cryptocurrencies and the Uselessness of Blockchain

https://www.schneier.com/blog/archives/2022/06/on-the-dangers-of-cryptocurrencies-and-the-uselessness-of-blockchain.html

This is my basic argument: blockchain does nothing to solve any existing problem with financial (or other) systems. Those problems are inherently economic and political, and have nothing to do with technology. And, more importantly, technology can’t solve economic and political problems. Which is good, because adding blockchain causes a whole slew of new problems and makes all of these systems much, much worse.

#crypto #cryptocurrency #blockchain #schneier #bruce-schneier #regulation #cryptocurrencies