News for hackers. Stuff that matters.
Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by jerf on Thursday February 09, 2023 @03:29PM (#34730920)
It's a bit of a science fiction myth that it is impossible to process a bit of data without executing it, or that data can somehow force itself to be executed by its sheer swaggering potency as data. And a thing that is more true than it should be, because people keep insisting that they are super awesome and totes capable of writing C that can be put on the network. If we'd stop doing this there'd be hardly any truth to it.

It's not actually that hard to process data without executing it.

Regardless, it is certainly science fiction that they could guess an exploit from light years away. That's not what exploits do, it's not how they work. I've never seen anything like a "universal" exploit that you could just fire at anything, even a non-human system, and have some sort of reasonable expectation that it would work. Such a thing is not even something you could sketch out. Even if you think you have something, like, say, https://github.com/payloadbox/xss-payload-list , you're looking at a human list. All I'd have to do to completely scramble that entire list is to have a parallel evolution of ASCII where the letters and symbols are in completely different places than they are now. Nothing in that list would work if all the control characters in ParallelASCII were in 223-255, and the alphabet was 0-52, and all the symbols were from 128 on. And that's still a very human standard that is, for instance, based on bytes instead of, say, collections of 9 trits as the base level of the system. There's an effective infinity of other ways of encoding things and deciding what characters have what characters doing what things... assuming "characters" is even the way to look at the representation in the first place.

As others mention, you could hypothetically send a program that does something that can't be analyzed, through sheer size if nothing else, but it would still be an uphill battle to just guess how to exploit something. You'd be looking more at an AI that is good enough to talk itself out of the box, rather than something that is actually "hacking" anything reliably.

Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by retrac on Thursday February 09, 2023 @03:42PM (#34731101)
Assuming the bandwidth exists, somehow describing enough mathematics to describe a virtual machine, and then sending a program for that virtual machine, might just be the best way to communicate. A package that can help the recipient interpret it by learning and responding to the local environment. I can't put my finger on any specific book but I have the impression of this scenario coming up in science fiction. I've long figured that humans inventing superintelligent AI (whatever that would mean) and humans receiving an alien signal are essentially the same problem - we have no idea what it might tell us.
Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by jjk166 on Thursday February 09, 2023 @04:42PM (#34731953)
I wonder if in the same way you can do statistical analysis of human languages to determine things like which characters are vowels, perhaps if you received enough programs written in some alien brainfuck-like language you could use statistical analysis to guess which symbol is which.

If nothing else you could always brute force it; with 8 logical operators there would only be about 40,000 possible combinations. Maybe figure an order of magnitude larger number to account for idiosyncrasies in their implementation of the language. Running "hello world" a half million times shouldn't be too hard. Of course figuring out which ones are spitting out gibberish and which ones are spitting out perfectly intelligible results for one fluent in alienese would be hard. I presume they'd send a bunch of example programs that compute pi or something similarly universal, but there are a lot of potential gibberish we could fit a pattern to. It might even make sense to just keep running every code sequence in every possible combination until we get something cool.

Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by jerf on Thursday February 09, 2023 @03:50PM (#34731232)
Said AI could certainly be programmed to probe for weaknesses in its runtime environment.

However... the game theory on that becomes very interesting, because the sender can't assume that the AI's probes will be immediately successful and they will instantly run out and take total control over the host network so thoroughly that the hack can't be detected. And sending out an AI that tries to break out and then tries to do something nasty is an act of war against an adversary you know nothing about. For all you know, the psychology of that species is such that they will now dedicate every erg of energy to the sole task of wiping your species out until the threat is gone. For all you know, your AI was first executed in an environment that deliberately left some big holes in it and those holes were completely set up with tripwires. Such is the nature of the virtual world. And if the AI does trigger the tripwire, we can also analyze it to find out what it "would" do if it broke out. So it's definitely not a "ha ha ha we nuked our competitors with no risk to ourselves just by sending out a single trasmission" situation.

I'm not saying there isn't a whole interesting conversation to be had. I am saying the idea that the aliens can somehow send out data that is somehow encoded in SuperIntegers that instantly SuperHack every computer that you try to SuperUse them on... that's a bad computer-animated cartoon for kids, not a realistic threat. There is a real threat, but it's more complicated and generally smaller, perhaps with a super weird spike at the top end, but even then, per my previous paragraph, more complicated than I think people are thinking here, because the aliens do not have access to these SuperIntegers any more than we do.

Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by goatlover on Thursday February 09, 2023 @05:05PM (#34732274)
True, game theory makes it less likely a good strategic first move, but you can always come up with scenarios where a super predatory race has set up the signal a long time ago to target nascent space-faring civilizations to preempt them. If the newer civ gets past that, then the aggressive aliens up the threat level and take more drastic action.
Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by skulk on Thursday February 09, 2023 @04:21PM (#34731675)
https://en.wikipedia.org/wiki/Lincos_language

I have extreme doubts that we would be able to decode something sent by an alien that looks like this.

Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by ly3xqhl8g9 on Thursday February 09, 2023 @03:46PM (#34731166)
What if PHP SQL injection is actually the 10th component of The Great Filter [1], and every civilization is condemned, sooner or later, to suffer from such a vulnerability.

[1] https://en.wikipedia.org/wiki/Great_Filter#The_Great_Filter

Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by akkartik on Thursday February 09, 2023 @04:42PM (#34731951)
Focusing on the non-scifi angle here, there's one other reason besides C that we end up constantly running data when we think we're parsing it: the depth of our computational stack.

https://www.sitepoint.com/anatomy-of-an-exploit-an-in-depth-...

https://gitlab.com/gitlab-org/gitlab/-/issues/371098

So I'd say we need 3 things:

* Stop using unsafe languages

* Use languages that separate parsing from execution. Just follow Lisp, have equivalents for `read` and `eval`. Lua is a notable offender here: https://www.lua.org/manual/5.4/manual.html#pdf-load There is no way to parse a table while guaranteeing no code execution.

* Use languages that forbid monkey-patching, because that's one vector for turning `read` into `eval` because someone had a bright idea.

Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by rmckayfleming on Thursday February 09, 2023 @05:07PM (#34732288)
With the caveat that you don't literally follow Lisp by having a #. reader macro.
Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by shsbdncudx on Thursday February 09, 2023 @04:50PM (#34732048)
Dude, have you even SEEN Independence Day?
Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by jerf on Friday February 10, 2023 @10:13AM (#34740650)
Ironically, the common opinion that that was just sooooo impossible is itself incorrect. There is no problem whatsoever with writing a virus to run on the computer system that was under study for decades and simply delivering it with a Mac. The point is precisely that in this case, this wasn't a blind exploit, and delivering with a Mac is no more particularly challenging than delivering a Windows exploit payload from a Linux scanning machine.

This accusation demonstrates the accuser's own lack of understanding about computers; Hollywood actually got this one right. Personally, I rather suspect this was coincidence rather than anybody on the production sitting down and working out this logic. But nevertheless, the movie is right on this point.

There are similar scenes in other media that are ludicrous. I am pretty sure I recall a scene in Voyager in a later season where the crew encounters a computer they've never seen before, from a species they'd never encountered before, on a piece of hardware they have only a vague idea what it does. They beam aboard, stand in front of a console, discover they're locked out, and "hack" past that in about literally 5 seconds. This is stupid. They shouldn't even be able to read the text on the console, and they've "hacked" it in five seconds. One wonders what the hack exactly was. Hollywood makes this mistake enough that I'm pretty sure that Independence Day getting it right was just a coincidence. Probably if the story didn't include a downed fighter being studied for decades they would still have rolled with the virus idea. Then it would have been silly. But as written, it is not silly.

Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by goatlover on Thursday February 09, 2023 @04:56PM (#34732129)
But what if like Contact, the signal included plans for building a machine? Except it would be a computer to run the embedded code, which turned out to be an alien AGI having the goal of learning our systems so that it could infiltrate them? Would at least make for a decent scifi story, if it hasn't already been written or produced.

I recall how Jody Foster's character in the movie was dismissive of any such concerns, but then we really don't know what the motive of an alien civilization broadcasting a signal would be, and the Dark Forest theory hadn't been espoused yet.

Re:AI Joins Hunt for ET: Study Finds 8 Potential Alien Signals by midoridensha on Thursday February 09, 2023 @08:42PM (#34734544)
Contact was very realistic in showing that it's foolish to spend trillions building a machine in the USA to contact aliens, because some religious crazy will destroy it, and such a machine should be built elsewhere.