Aggregator

从某种意义来看，ATT&CK框架包含了太多的安全场景，从“元宇宙”的现实表达和普遍包容性这个点上来看，ATT&CK可能是安全领域的“元宇宙”层面的存在。

记录一下 Golang 中 json 与 struct / map[string]interface{} 之间的转换方法。

Overview

Recently, CNCERT and 360netlab worked together and discovered a rapidly spreading DDoS botnet on the Internet. The global infection looks fairly big as just in China there are more than 10,000 daily active bots (IPs) and alsomore than 100 DDoS victims beingtargeted on a daily basis. We named

WorldMatch, a games and content provider for global markets, collaborates with some of the biggest international casinos. Headquartered in Italy and in operation since 2003, the gaming provider boasts a portfolio of more than 200 games, 160 slot machines with 70 game engines, 30 table games, and all types of video poker. We?re delighted that this innovative company has chosen to work with Akamai to deliver a picture-perfect experience for their customers via the services provider, Criticalcase.

Microsoft?s April 2022 Patch Tuesday introduced patches to more than a hundred new vulnerabilities in various components. Three critical vulnerabilities were found and patched in Windows RPC (Remote Procedure Call) runtime: CVE-2022-24492 and CVE-2022-24528 (discovered by Yuki Chen with Cyber KunLun) CVE-2022-26809 (discovered by BugHunter010 with Kunlun)

记录一下对 Golang 通用万能类型 interface 接口与类型断言的理解。

K4YT3X https://k4yt3x.com/ai-automation-and-the-future-of-humanity/ -

Thumbnail image: White Robot (Arseny Togulev, Unsplash License)

In 2017, a survey conducted by United States’ Pew Research Center shows that the vast majority (~77%) of the United States’ population does not think that AI taking over human jobs could be a realistic and serious issue. ~14% of the United States’ population thinks that it is impossible for robots to take over human jobs.

“A roughly comparable share (77%) thinks this idea is at least somewhat realistic, and one-in-five indicate that the concept seems extremely realistic to them.”

As the use of AI continues to bloom in more industries, a fair amount of the global population is still under the impression that AI, like many other types of machines and devices invented in humanity’s history, will merely aid people’s work instead of outright substituting human workers. However, is that a reasonable estimation?

How AI Makes Automation Different

Traditional automation like automobiles and automated assembly lines have replaced many physical workforces, pushing the then-existing manual labor workforces into other industries. The new automation technologies also created more better-paid jobs, raising the living standards. This gave people the impression that new innovations will always create new and better jobs for people to move into. However, Kurtzgesagt has presented a prime example of how this is no longer the case with new types of automation in their video “The Rise of the Machines – Why Automation is Different this Time”:

“In 1979, General Motors employed more than 800,000 workers and made about $11 billion US dollars. In 2012, Google made about $14 US dollars while employing 58,000 people.”

In fact, some parts of the workforce in the transportation industry has already encountered issues when automobiles were invented. While humans could find alternative jobs, the horses could not repair cars, make food in drive-through restaurants, nor operate gas pumps. Consequentially, horses slowly faded into history. We, as humans, felt like the same will never happen to humans, but it will. That was just not our turn. GCP Grey has talked more about this in his video “Humans Need Not Apply” published way back in 2014, while also predicting that the humans will become the new horses.

The creations of new automation technologies have always taken jobs. In the past, humans could move to new jobs in new industries, but the recent automation technologies did not create enough new jobs to match the speed at which the population grows. The new automations are also getting better by the day and are able to do more and more jobs currently done by humans. Coincidentally, Google published its new AI research Pathways Language Model (PaLM) during the writing of this article. It shows you just how close AI has become to not only be able to do specific works better than human, but also able to think and talk like humans.

Even the creativity industry could be taken over by machines. Projects like MuseNet and the Deep Dream Generator can already give you an early taste on future arts. Out of sheer coincidence again (or is it?), OpenAI published their new AI image/art generation system DALL·E 2 during the writing of this article. You can see how easy it might be in the future to create art with AI – write a sentence and you can trivially blend multiple art styles together and create what’s in your imagination with no prior art experiences required whatsoever. At the pace of which AI is evolving, it is entirely possible that a significant amount of the population will be pushed onto a brink of losing their jobs in the foreseeable future, no matter how essential they are at the moment.

How AI Thinks Differently From Humans

While talking about the difference bettwen the new generation of automation, it is helpful to take a look at what has enabled AI to be smarter than before. This might also hint us on how the roles of human workers will change in the future.

Conventionally, automation requries humans to teach computers what to do. This requires humans to identify patterns, indications, and techniques, then teaching them to the computers in the form of programming. In the end, the automation program is nothing more than a bunch if statements. If humans cannot express the patterns requried for performing a task precisely using code, then this task would be difficult to automate. Take speech recognition for example. Humans can naturally recognize words, but it is difficult for us to describe using metrics and numbers what makes a word a word. Therefore, you will have a hard time building an accurate speech recognition program using conventional computing.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 # voice frequency in Hertz if frequency < 20 or frequency > 20000: result = "inaudible" else: # voice loudness in decibels if amplitude > 100: result = "yelling" else: result = "speaking" if result == "yelling": call_police()

This is what traditional automation may look like

Machine learning (ML) and deep learning takes a different route. The core idea of ML is to digitize everything and finding patterns within the numbers. With speech recognition, a word’s pronunciation can be broken down into frequency, amplitude, and other metrics that can be use to numerically describe the word. Each of the metrics is a dimension of the information. ML then finds patterns within all these dimensions though looking at different samples of data. For example, you ask the machine to watch the frequency and amplitude of the voice, and then feed it n samples of pronunciations of the word banana alongside n samples of pumpkin, so it will find what is the pattern that makes the word banana banana instead of pumpkin.

Figure 1: A banana and a pumpkin, images by Mockup Graphics (Unsplash License)

This concept of data-driven problem solving can be applied to solve all kinds of problems. As long as it is possible to collect data about the problem and define what success looks like, ML can find a pattern that will solve the problem given enough time and resources. Of course, the accuracy of the solution and resources required to tain a workable model may vary depending on the “difficulty” of the problem, but it will make lots of previously-unsolvable problems possible to solve.

However, a side effect that stems from this approach is that it would be difficult for humans to understand or explain the underlying mechanics of how and why decisions are made by a neural network (NN), the backbone of ML. For instance, a NN may classify a cat as a dog, but the final output does not explain why the image is miscategorized. Nevertheless, there are still ways to debug NNs. Examining the outputs of each building block would provide an abundant amount of information on what patterns it has extracted from the input image, which can be used to guesstimate what went wrong. More recent researches like this and this are also helping humans to better understand the NNs 1.

The Future Role of Humans

In the near future, it is almost without a doubt that AIs will replace more humans in more industries. There will be more AI experts in every industry to train and supervise AIs. These AI experts will likely have little to no knowledge about the industry of which their AIs work in. Some original workers in the industry will get to keep their jobs because they cannot be replaced by machines or replacing them are not cost-effective. These are likely the only reasons why they get to keep their jobs.

Figure 2: Homeless person (Steve Knutson, Unsplash License)

A new type of job may be created. Workers with expertise in a specific industry may be hired as consultants. Their job is to help the AI experts to understand certain niches in the job and to better develop ML models.

Let’s see an example with cybersecurity, my own field of expertise. Right now, managed security service providers (MSSP) usually hire lots of junior security analysts to identify threats in security logs. In the future, all the junior security analysts will no longer be needed. A machine will plow through all of the logs at accuracies and speeds unmatchable by thousands of human analysts.

The ML model used by this machine will be the most valuable asset of the company. MSSPs mainly compete how good their models are, with metrics typically being accuracy and speed. Every MSSP will have several AI experts that continue to optimize their models. Only very few IT operation management (ITOM) personnel and security experts are needed to maintain the underlying infrastructure and help the AI experts to train the models.

The Slightly More Distant Future and the Fate of Humanity

As AI technologies continue to advance, at a point a little further in the future, most of the work might be done completely by robots. Humans are naturally limited by their age and the speed of which they can learn, so a person would need to go through a cruel amount of learning and training to be able to out-compete the intelligence accumulated by the machines, which never lose their memories and continue to think faster and perform better.

Eventually, the vast majority of jobs will be done by machines, which may sound like it is a bad thing for humanity. However, this may be the inevitable for an advanced civilization. The Kardashev scale defined three types of civilizations. It is highly costly if not impractical for humans to reach type II civilization by building a Dyson sphere with pure manpower. Automation almost seems inevitable. Advanced automation may be required for any advanced civilization.

Figure 3: Dyson Sphere (Rebekah Smith, CC BY-SA 2.0)

Despite automation might produce a decline in employability of humans in the near future, as we move further into the future, the entertainment industry might flourish. Space exploration and space colonization may create almost infinitely more new jobs once the current-generation of automation help humans finish the research of better spaceships.

Even if all human lifeforms get entirely replaced by machines in the end, we have still managed to create a new species that is better than us, which is quite an achievement. Nonetheless, machines can also have emotions and can carry on our legacy and wills. When they become intelligent enough, they may even be more like humans than us.

Glory to mankind. – YoRHa

This article is licensed under CC BY-SA 2.0

1. Special thanks to @ArthurChen189 for helping with the concept of neural network explainability. ↩︎

- https://k4yt3x.com/ai-automation-and-the-future-of-humanity/ - 2019-2024 K4YT3X. All rights reserved.

昨晚我们正式发布了这本琢磨挺久的手册，当前是 V1 Beta 版，我用碎片时间断断续续写了三周。

Summary F5 has published an advisory pertaining to a vulnerability in its NGINX reference implementation. The vulnerability was disclosed on April 9, 2022. Threat Type Vulnerability Overview Vulnerability Information A post from F5 contains information about a vulnerability in its NGINX v1.18 reference implementation. While certain parameters must be met, these seem to be trivial in nature thus making exploitation seem to be relatively easy from reports out of the self- hacktivist group. F5 has provided the

Obviously we?re proud to be a leader. Bot management is a contact sport, where being great is a requirement if you want to stop the persistent adversarial bots. So it?s rewarding to be recognized for the work we?re doing keeping the bad bots away from our customers? digital businesses.

Protecting sensitive information is a recurring and widely known concern in the security community. As researchers, we know all too well how information can be used maliciously (I mean, come on ? it?s our job). Considering the size of the threat vector that is LFI, it?s something that developers and security professionals alike need to be aware of.

Just three weeks have gone by since Akamai officially welcomed Linode into our fold, and I?m encouraged by the excitement that so many have expressed about the combination of our two companies since we announced the acquisition in February. In conversations with us, industry analysts use the word ?transformational? to sum up the potential impact of our merger on the marketplace.

头两天看到组里头的老师傅在学 Golang，忙里偷闲，花了点时间也浅学一下。

Assessing the security of network equipment.

Hi

Latest version of the CAF focusses on clarification and consistency between areas of the CAF.

In this post, we’ll examine how GPT-3 could be used by red teams or adversaries to perform successful phishing attacks. We’ll also discuss some potential countermeasures that organizations can take to protect themselves against this type of threat. What is GPT-3? GPT-3 is a neural network-based machine learning system that was developed by OpenAI, a research lab focused on artificial intelligence. It is designed to generate text that sounds realistic and human-like, and it has been trained on a large corpus of text, including billions of words from the internet.

答案是没有，今天我没有爱。你爱了吗？

作为刚接触浏览器安全的初学者，我选择了从CTF来入手浏览器的漏洞模式和利用姿势，最近看了若干历史的CTF浏

鸡肋的漏洞，低成本的使用。