On Episode 106 of The Edge of Innovation, Jacob Young is sharing some advice for someone starting a business or nonprofit organization.
Hacking the Future of Business!
On Episode 106 of The Edge of Innovation, Jacob Young is sharing some advice for someone starting a business or nonprofit organization.
On Episode 101 of The Edge of Innovation, Paul Parisi & Dan Buckley are talking about the latest tech trends in the news today! They’re discussing vehicle technology & augmented reality!
On Episode 100 of The Edge of Innovation, Paul Parisi & Dan Buckley are talking about the future of autonomous cars!
Introduction
Autonomous Vehicles: Are We Approaching an Age of Self-Driving Cars?
What Happens If An Autonomous Car Gets Hacked?
Are Autonomous Cars Safe?
Why Do People Prefer Their Own Vehicle Over Public Transportation in the US?
Paving the Way For Autonomous Vehicles
Beaconing Technology
Using Waze To Help You Drive
Machine Learning & Artificial Intelligence
More Episodes
Show Notes
Dan: Hello! Welcome to the Edge of Innovation. My name is Dan Buckley and I’m here with Paul Parisi, and we’re going to discuss some tech trends in the news together today.
So welcome, Paul.
Paul: Thanks, Dan.
Dan: Great to have you, as always.
Paul: Oh great to be anywhere!
Dan: So lately, I’ve been doing some research looking at an article in Business Insider about autonomous vehicles. That’ our first topic.
Paul: Okay.
Dan: So, in terms of autonomous vehicles, I see a lot of that in the news, a lot of information about different companies pursuing that market. And my question for you, firstly, is do you think we’re approaching an age of self-driving cars?
Paul: Well, I think that’s an interesting question. I think it’s inevitable in some form or fashion. We already have self-driving cars and there are a lot of people who… I guess what I was surprised about is the accident in Arizona that occurred that, really, no humans were held accountable for it. A woman was killed by a self-driving car that made a mistake.
Dan: Yeah, I think I remember that.
Paul: It’s fascinating to me that no humans were charged with manslaughter or murder or anything like that, which is a very troubling thing because if you made a consumer electronics device or any kind of device that killed somebody, you could get fined or sued for that wrongful death. I don’t know all the technical details of the law and the legal case on that but it was surprising to me that the full latitude they have to test this in the real world and the worst case happened.
Paul: Now, having said that, I do think they will come about. I think that if you look at different portrayals in the media about them, or in TV or science fiction or things like that, we have a lot of – There are subtle things out there – what happens when an autonomous vehicles goes crazy or gets hacked? As we’re learning, it’s so easy to hack things and certainly in ways that are completely unanticipated by the person developing the system. We’ve covered a person on here – I think we’ve talked about it. The “Catch Me if You Can Person.” Frank Abagnale. And he works for the FBI, helping them hack things, if you will – more from a social point of view – but in one of his recent talks, he talked about the fact that the FBI has tools and technology to be able to interrupt the working of a car or take over a car within five hundred feet.
Dan: Wow!
Paul: So, that’s a car that’s not autonomous. So, autonomous has a whole bunch of issues with it. There’s a TV series of a few years ago, a science fiction one by Halle Berry called “Extant.” It’s very much science fiction but it is slightly into the future – might be twenty to fifty years from now – and they have autonomous cars, and one of the main people in there gets into a car and is being driven and is driven right in front of a train. And so, it’s not really giving away anything to it, but he didn’t survive. And so, what’s preventing that from happening? There’s not a lot.
You know, being somebody that’s fairly aware of cyber security and things like that and using things against their original design, I see a whole bunch of issues that around that. I think they will happen but it’s going to be very interesting. I think we’re going to start to see more things like utilizing rails in ways that we hadn’t thought about and I think that has to be a necessary steppingstone to it. But it’s going be interesting because as cars become more autonomous, and they’re out there, there’s going to be more and more legal issues of them having done bad things and somebody is going to be prosecuted for that. It’s going to come down to humans being imprisoned or fined or penalized for that.
Dan: Yeah, that seems a little bit scary to think when programming an app or something, you might have a few bugs that need to be worked out and those are bugs and that’s understandable. But in this case, it’s almost like you have a bug and it kills somebody, are you culpable or who’s fault is that?
Paul: I don’t see why you wouldn’t be. I just don’t see why you wouldn’t be. I couldn’t sight it but I’m sure there’s case law for consumer products failing and causing somebody to die. I mean, if you think back just over the GM issue with the stuck accelerator over the past ten years or fifteen years. I forget what it is, but GM was found liable for that. And that was a completely unintended consequence. It was a software, hardware error.
Right now, they’ve grounded the Boeing 737 because the software in it might have a glitch in it. Airplanes are one of the most protected things in the world. The software isn’t readily accessible. it’s not readily hackable. It’s actually a flaw in the way it takes sensor readings from its sensors on board and tells the plane to do things that are counter productive and it ended up crashing the plane in two cases.
So, when you have that type of autonomy or the engagement of technology in a car – you’re in a car and you press the breaks and it stops. Well, I hack your car and I turn off that flyby wire and now all of a sudden you don’t have it. In fact, twenty years ago when flyby wire was coming out in a car, originally when cars are designed, when you push the break pedal, a lever moved to push the breaks and it was some hydraulics and things like that. But that steering wheel was connected to the wheels that were turning and so there was a tremendous concern that as cars became more flyby wired, that you were turning a wheel that was complete disconnected from the wheels and then an electric motor would turn the wheels or some other linkage would turn that. What happens if that fails? We’ve gotten past that but I guarantee if there was a problem with that, there would be huge liability.
Dan: Yeah, I wonder if – and this is a question that came to mind as well – obviously we have to go through a certain amount of training in order to operate a motor vehicle and we’re expected to do that, whereas if cars become completely automated would we be, maybe, in a place where that training is no longer required? And perhaps that could present some issues as well, if there’s the lack of human understanding in the way that it works and you just expect it to work without any sort of license.
Paul: Well, I would think so. It’s called a bus. We have to know nothing to be able to use a bus. And that autonomous. I mean, they’ll be a phase in which, in order to ride in autonomous vehicles you have to be in the drivers position and you have to be ready to drive. So, I think that you’ll see an adoption curve where you start to see it’s like cruse control. And that’s largely what we have now.
So, if you have a Tesla and you’re driving down the road and you’re getting too close to something, it stops, or it will pull you off the side of the road if something’s going wrong and things like that. So, they’ve given it some autonomy, but a person has to be sitting there and if you start to nod off it will actually pull you off the side of the road. So, those are good things. Those are certainly beneficial in following too closely or things around you, collision avoidance and all that. Those can be very helpful. I haven’t really studied whether they make mistakes or what the implications of the mistakes are, but I do think that eventually if autonomous vehicles live up to any of their hype, that you will have non-licensed drivers that won’t even have a concept of a license. It’ll just be a matter of getting in a going where you need to go.
The thing that I think is going to be interesting is that most people don’t like taking the bus. I live in suburbia outside of Boston and buses don’t come to my house.
Dan: Yeah.
Paul: But you live more in the city and I’m sure buses are a viable alternative for you? Is that true?
Dan: Certainly, yeah. I could get here in the same amount of time I could get to the other side of Boston, driving a car.
Paul: But would you?
Dan: I tend to prefer the autonomy to some extent.
Paul: Well, is it the autonomy or is simply the cleanness of your car? Not having to deal with the people and the smells and the delays and the constraints of that. In America we get we get to superintend all of our outcomes, whether we’re effective at that or not is another discussion but one of the biggest things is that I don’t want to take the bus. I mean, we’ve been watching Seinfeld and there are a lot of comments about the icky things in society that they make great fun of and one of the things is that the buses aren’t the most pleasant place to be. Even if you go to San Francisco and the BART is really well-cared for, or you go to D.C. and you go to the trains. The subway in D.C. is really well-cared for, but it’s not necessarily your first choice.
Dan: Yeah.
Paul: You’d probably say, “Oh, I’d rather take an Uber or a limo and one of the differentiators is that they keep it clean and it’s nice.
Dan: Yeah, I feel like a bus isn’t afraid of getting a bad rating, like an individual bus.
Paul: Right. So, I wonder about autonomous vehicles. I think initially, we will own vehicles that do the driving for us but we still have to have a driver in the seat ready to deal with an emergency. The difficulty for me there is how bad would you feel if you were the driver of an autonomous vehicles and it accelerated and ran over somebody under your watch and it wasn’t your fault, you didn’t do anything, it just made a mistake. I’d feel horrible. And once you divest yourself of that responsibility – maybe you are distracted, maybe it accelerates and you forget or you don’t have the time reaction to disengage. It’s going to be fascinating. Absolutely fascinating.
Dan: Yeah. I think it’s interesting. I think people have certain expectations about what it would look like, perhaps. In the beginning they thought it would be “Chitty Chitty Bang Bang” or something. We’re just going to have everything, flying cars, right away without maybe recognizing that it’s a messy process, that things do happen.
You mentioned maybe an idea of railroads or some steps that we might need to take. So, I guess what are, maybe, some other ways of transportation, a little change or some steps we might need to walk through before we get to that angle or that place where cars are shared and autonomous?
Paul: Yeah, I don’t know. I really don’t know because it depends. If we had a law where everybody had to live in cities and there was public transportation, that’s one way to do it. But it doesn’t seem like we’re as a society into mandating what people do. I tend to agree with that. You know, everybody into their own.
Dan: Yeah.
Paul: But in order for some of that to work… because the issue is like you could sort of see it, the wild-eyed jerk on 128 – a major highway around Boston – playing chicken with autonomous vehicles. Of course, that’s going to happen. I mean, it’s just going to happen. But in all of this sort of negativity, this same conversation was happening a hundred years ago when vehicles were coming out, when iron horses were coming out and how, “Oh my gosh! You could kill somebody by doing that! They’re not going to pay attention!” and “They’re not going to do this…”
Dan: Didn’t they think that going at a certain speed could actually just kill you?
Paul: Yeah! And so, it will be fascinating, I think, they are real issues. I am astonished – I just saw this somewhere, I don’t know where it was, but a thinker who was really commenting on society, said that it is amazing how few car accidents there are and how well people do with driving, because it’s really complicated. There’s a lot to perceived and we all have our pictures, or our view of different people and some people just don’t have it all together and they can get in a car and drive and not kill somebody. Most accidents are because somebody is drinking or doing something really stupid, so it’s really profound that we take these machines that have hundreds of horsepower and the ability to do so much damage and they constantly are driving.
So, I don’t think that there’s a lot of changes that need to come in order for it to be autonomous. I think the convergence of the different technologies, the different radars or lidars which are basically trying to machine vision and things like that. I think also, some of it will be outfitting roadways with guidance like embedded technology, so that the car can know where it is, etcetera. This would be helpful in putting technology in other cars so that now our cars can realize that we’re ten feet away from each other. And so, that’s going to be interesting when you say, “I’ve got an antique. I’ve got a 1970 old mobile. Do I have to put that technology in?”
Paul: That beaconing technology that’s going to say when a driverless car knows it’s there, not just see it, but it actually can use beaconing technology. And then there’s ways to hack that beaconing technology.
Dan: Beaconing? So how does that work? Is it a satellite or is it…?
Paul: No. It’s a general term of some signal that comes on and off and provides a location awareness to something else, so if you see a beacon out in the world the concept of a beacon –
Dan: A lighthouse?
Paul: Yeah, a light. “Oh there it is,” and it gives you some locational – Is that a word? – Locational context of being able to say,” Oh, I’m not near the coast or I am near the coast.”
So, beaconing, beacon technology helps identify something where it is and so that would be useful in vehicles. I’m sure that they’re doing that and putting that kind of stuff in.
Dan: Yeah, that’s fascinating. I think to myself when I drive to work, I use Waze. That’s gamified to some extent. There’s plenty of surprises but I think there might be less than some Waze.
Paul: Yeah, I think Waze is brilliant. I used to commute from the North Shore of Boston down to Waltham and I thought that that correlation of moving node information – so every car is a node and it has, intrinsically, if I’m talking to the cloud, I can tell it, I can infer how fast I’m going. And so, if I’m going really slow on a 55 mile an hour road, they can infer that there’s traffic and then they take that sample from me and then they take that from your car and you’re going 70 miles an hour so there must be something weird going on with me but if they’re all going 5 miles an hour, they understand that there’s traffic. So, it’s a fascinating way to crowd source, really autonomy.
Dan: It seems like there’s machine learning in that to some extent.
Paul: Machine learning is an interesting thing and lot of things are going to be called machine learning and artificial intelligence over the next year to ten years, and it’s hard to really quantify what is real machine learning or not.
Dan: I see.
Paul: It’s not like – what’s Arnold Schwarzenegger’s movie? Terminator – It’s not that level of learning. We really haven’t had that level of breakthrough in something to actually think. And so, machine learning, was it Isaac Asimov who said magic… What was it? He basically said technology is indistinguishable from magic?
Dan: Yeah, “Any significantly advanced technology is indistinguishable from magic.” That was Arthur C. Clark.
Paul: Arthur C. Clark. Yeah. Same thing. Same guy, just different people. So yeah. And so, as we look at that it’s effectively magic until it’s not anymore.
Dan: Yeah, we just call it some word like “woo woo,” like it does something cool we don’t understand.
Paul: Right.
Dan: But that’s fascinating.
This is Part 1 of 2 our Tech Trends Talk about autonomous vehicles. Stay tuned for Part 2, coming soon!
On Episode 85 of The Edge of Innovation, we’re talking with hacker and security expert, Adriel Desautels of Netragard, about whether there is any hope for computer security.
On Episode 84 of The Edge of Innovation, we’re talking with hacker and security expert, Adriel Desautels of Netragard, about why hackers hack!
Why Does the Hacker Hack?
Hackers: Making a Name For Themselves
What’s Interesting at DEF CON & Black Hat
Alternative Conventions to DEF CON and Black Hat
Hacker Conventions Today Versus In The Past
Recommended Places To Find Information On Hacking
Advice For The Budding Hacker
The Definition of Hacking
More Episodes
Show Notes
Paul: So, from your experience and from your experience and knowledge of other people you know, why does the hacker hack?
Adriel: It all depends on who they are and what they’re really, I guess, geographic location is, monetary position, you know. So the majority of bad guys that are hacking right now hack for financial gain. They steal information, and they’re able to sell it on the black market. Some information sells for more than others, and that is always changing.
Then, of course, you have nation states. They’re hacking because they want to know about their foe. They want to learn about their enemy.
And then you have the guys that hack on behalf of their country, but they’re not directly affiliated with their country. They go out, and they steal information. The Chinese are notorious for this. They have groups of people that will hack and steal information about aircraft and all kinds of interesting things, and then they sell it to the next highest bidder within their country. And so that’s sort of a way of trying to say, “Hey, we don’t do this stuff,” but they buy the information. So, they’re not hacking, but they’re funding it by buying the information.
Paul: Sure. Let’s peel that back a layer, though. It’s maybe a superficial view, but why does the person sit down and spend that time searching for these obscure ways to exploit systems. What drives that emotion? Because they’re not necessarily going to get paid. So, I’m not saying they’re evil. I’m not saying they’re bad. But why is it that I’m going to try and do everything I can to break into this house, and I’m not going to give up either.
Adriel: Right. So, for some of us, it’s just a puzzle. It’s just a challenge, and it’s fun. It just boils down to that. Why is my partner, Phillipe, why is he building a robot to take his trash and haul it down his driveway that’s a quarter mile long? I mean, he’s literally doing that. And he’s found a way to build this crazy robot that will take his trash out for him. He’s doing it because it’s fun, and it’s a challenge, and it’s exciting. It’s the same reason why we do a lot of the things that we end up doing too.
The other angle to that is notoriety. Sometimes hackers will hack something because they’re trying to make a name for themselves, and so they’ll perform research against a really challenging target, write up, a white paper or publish something on it. And that makes the press. And all of sudden, those hackers, they’re well known. I can think of some pretty good hacks that happen with DNS and other types of things that they really helped companies promote themselves. So there’s that kind of angle.
And then, you tie it back into the monetary angle when you get to the zero-day market and zero-day exploitation. Hackers will perform research against like your iPhone, for example. They find a single vulnerability in an iPhone. Today that sells from anywhere from four to six million dollars per vulnerability. So, the motivation there is a lot of money. For a single, maybe three months of work, you make $6 million. It’s not a bad payday.
Paul: So it sounds, it sounds sorta like panning for gold.
Adriel: Yeah, in some cases it really can be because you never know what you’re going to encounter. And if you get the big nuggets, you’d be very rich very quickly.
Paul: And it could be that the gold that you get is notoriety. It could be just the fun of doing it, or it could be that you get a big chunk of gold. Interesting. So, I agree. It is interesting to see, and it would be interesting to have the same conversations with executive, CEO levels of saying, “Why wouldn’t you disclose this?”
And I can imagine it’s like “Well, we don’t want to admit that we knew the bridge was going to fall down,” if they were being really honest. And it’s like “What I don’t know, I can’t be held accountable for.” There’s a lot of that, I think.
Adriel: Yeah, there is.
Paul: So, we were talking about Black Hat and DEF CON. And what else did you see there? We heard a lot. I heard a lot in the press because I was listening for it. But our listeners are pretty diverse. What’s new? What’s interesting?
Adriel: Not much.
Paul: Is it like all old news already? Or is it just…?
Adriel: Yeah. I remember we were actually staying at the Caesar’s Palace so we could watch the talks from our rooms for DEF CON. And we were watching the talks. And some of them sounded very exciting. We thought there were new methods of doing things. And, I’d say just about every single time, when we got excited, we were very disappointed because the method that people were talking about were methods that we had already known about for years. That had already been used for years.
Unfortunately, DEF CON and Black Hat, I think they’ve outgrown themselves in much of the same way that the RSA Conference has and things like that.
Paul: I was wondering about that.
Adriel: Yeah. They’ve become very politicized, and they’ve got these vendor booths where vendors are spending a lot of money to advertise their products. That’s not really all that appealing anymore, to hackers that are strictly interested in learning about hacking.
They are still the biggest hacking conferences, and hackers will still go there. I mean, we were hanging out with Kevin Mitnick, and a bunch of other people were out there. But those people go because it gives you the option to meet other people that are going. So, we went there. We ended up meeting with a lot of our friends. And these guys are really hardcore researchers and the hardcore security people. And we also met some of our clients and things like that. So it’s a good team building exercise. From the perspective of learning something new, though, unless you’re talking to somebody or you know people that are going to be doing new research, you’re probably not going to pick it up at Black Hat and DEF CON.
Paul: So is there something else out there? Blacker Hat or DEFfer CON? Something that’s a little better?
Adriel: There should be. DerbyCon is a little bit better.
Paul: DerbyCon?
Adriel: Yeah, DerbyCon. It’s a little bit better. A lot of the people that we associate with will go to DerbyCon. They’re growing in size too, but their content seems to be more aggressive. I guess you could say newer than what you’re seeing at those. And then, of course, there’s BSides, which, unfortunately, I’ve never been to, and I always intend to, but I never make it. BSides, from what I’ve heard, has a pretty good reputation for being fairly serious. A lot of the higher end people — and when I say “higher end,” maybe more capable researchers, more experienced researchers that I know have talked about going to both DerbyCon and BSides.
Paul: Interesting.
Adriel: Yeah. And they seem to really like those. Then you have your obscure conventions in Europe and things like that. I know some of my researchers go to those. Some are really good. Some are not.
It’s a lot different than it was in the ’90s and early 2000s. I mean, in the ’90s and the early 2000s, hackers were driven by curiosity and driven by research, and they met up with each other because they had something to share and something to discuss and, and so on, so forth. These days, it’s become so mainstream that you literally have groupies. You have people that show up in bizarre clothes with purple hair and all kinds of things. And they’re trying to show up and trying to fit in just because they think it’s cool. But they have nothing to offer. And that kind of distills things. And that kind of makes things less interesting.
And when I went to DEF CON, just this past DEF CON, I remember walking through these crowds of people, and I’m looking at these people, and I’m thinking, wow, the majority of these people are probably people working in IT or in security for corporate America. Very few of these people are actually hackers. And it’s unfortunately true. Very few of them were really the kinds of people who would be the researcher, the curiosity-driven kind of person.
It’s not to say that the conferences are useless because people do get a wealth of benefit from them, especially with regard to the training and the courses. And especially for businesses, IT people — IT personnel and security personnel — will learn a lot about the new technologies, the way hackers think and so on and so forth. And they’ll get to meet people that really are the real deal. So it’s much more useful, I think, if you’re going to business purposes now as opposed to if you’re a hacker trying to share knowledge and learn new things and so on, unless, of course, you’re networking.
Paul: So do you have any recommended websites or places that you frequent that give valuable cutting-edge hacker information?
Adriel: There used to be. I mean, now the majority of the information I get is going to be from Reddit and Twitter. There are interesting posts that happen once in a while and conversations that happen once in a while if you follow the right people. You can follow places like The Hacker News and all that stuff. But they tend to not really provide anything that would be underground, as they would say.
IRC still exists, but it doesn’t really live in the same capacity that it did before. Back in the day, you could hang out on IRC, and you could get all kinds of really interesting information about who was being breached and so on and so forth. But now it’s not really working that way. Now what we actually see a lot of is we see different hacking groups. They have their own silk servers or servers or their own Slack setups — whatever it might be. And they kind of chat in a closed group like that.
You know, back in the day, you could login to IRC and, if you do a list search for the word “hacking,” you’d have thousands of hacking posts. And you had people who were doing all kinds of interesting things, and you could engage people in private conversations and private messages and really learn interesting stuff. It’s not quite the same anymore. It’s all been, I guess, distilled or intended it at some level or another.
The way that we stay sharp is literally, we all have Twitter accounts, and we pay attention to what people talk about. People know us through reputation, and so if people who are doing really neat work approach us and they say, “Hey, let’s talk about this. We need some help in this area,” then we learn about something. So, we end up staying in the loop because we’re approached just because of our name, brand, and our names as individuals. People want us to be involved in that stuff.
But unless you’ve established that kind of credibility and unless you already have this networking capability, I couldn’t really point you in any direction for anything that would be particularly eye-opening, aside from pay attention to the new vulnerabilities that are released. Pay attention to the names of the researchers associated with those vulnerabilities. Follow them on Twitter.
Paul: So, if somebody woke up and said, “Hey, I want to be a hacker.” A ten-year old kid says, “I want to grow up to be a hacker,” it’s not like it used to be. You sort of can’t get that initial set of information. So what would your advice be to the budding hacker?
Adriel: Yeah. So anybody that tells me that they want to be a hacker, they’re probably never going to be a hacker. If you want to be a hacker, it’s because you almost already are. You’re born with this innate sense of curiosity. You’re born with this drive, this hunger to learn and tear things apart and solve problems and fix things, and you just love it. And because you love it, it doesn’t matter what you do in life. You’re always hacking something. You could be building the trash robot like Philippe because that just seems like a fun idea. Or maybe, like Kevin Finisterre, you’re building drones and then finding out ways to knock them out of the sky because you’re curious. Or you’ve got some of my researchers that do research on iPhones and all that. And they do it because they think, “Wow, there’s going to be a way to bypass this, even though Apple says we can’t. Let’s do it.” So it’s a curiosity thing.
So anybody who comes to me and says, “Hey, how do I become a hacker?” My answer is, you don’t. You either do this stuff natively—
Paul: You either are or you’re not.
Adriel: Right. You have that drive and you fix things in obscure ways. And, really a definition of hacking is creating an effective and a simple solution to an overly complex problem. And so if you are a solution creator and if you are able to take a problem of some sort — and the word “problem” is defined very loosely — and you were able to solve that challenge using a creative and effective and fairly easy-to-use solution, then you’re a hacker.
And I would argue that there are a lot of hackers that don’t know they’re hackers. Look at these guys that live off the land in Alaska. They have no technology to speak of. But, some of the things they put together to get water and to hunt and to trap, they’re ingenious! They’re hacking. They have a problem. They’re creating an incredible solution to a problem, and a lot of times, that solution gets used by other people in the same community. So that’s really what the essence of hacking is. So yeah. You’re born with it. You’ve got that talent and a gift or you don’t.
Paul: So I guess that in the venerable words of Yoda, “There is no try. Just do.”
Adriel: Right. That’s right.
This is Part 2 of our interview with Adriel Desautels.
Be sure to listen to Part 3, “Computer Security: Is the Sky Falling?,” here!
If you missed Part 1, “What’s New in the World of Cybersecurity,” you can listen to it here!