Pocket rockets: NASA turns to hackers for new breed of space apps

7
inShare

NASA isn’t exactly known for thinking small. This is, after all, the agency that’s trying to lasso an asteroid into orbit around the Moon before 2025. But one group at NASA is focused on a far leaner goal: outsourcing the development of new NASA apps to hackers around the world. Earlier this month, they managed to convince 9,000 people in 44 countries to split up into teams and compete against one another to build software and hardware projects that show off NASA data. The goal is to make apps not only for the public audience, but also that NASA may use internally.

Called the International Space Apps Challenge, the second annual event was the largest "hackathon" in world history, according to the agency: Between April 20th and 21st, over 770 submissions poured into NASA’s main Space Apps website. NASA is now combing through these and assembling a panel of judges, and will announce the five global winners in May.

"This is a striking example of what the future of government looks like."

In several cities, participants organized and funded in-person gatherings, with only loose direction from NASA’s Space Apps team. And, as Space Apps’s organizers emphasized, they themselves only spent a few months and $70,000 to get the project off the ground—peanuts for an agency that regularly signs multiyear, multibillion-dollar aerospace contracts. "This is a striking example of what the future of government looks like," said Nicholas Skytland, manager of NASA’s Open Innovation Program, in a phone interview with The Verge. The numbers sound great, but two key questions remain, not only for NASA’s Space Apps contest but for the larger trend of crowdsourcing the agency has embraced: How good are the results? And what do participants think about the process when it’s all said and done?

"They are definitely results NASA will use."

NASA says it’s too early to say which, if any, of the apps developed during this year’s challenge the agency itself will choose to adopt. But at least two of the apps from last year’s hackathon have become staples for NASA's staff. One is an app that converts the obscure image file format VICAR—used by many NASA employees—to PNG format, and the other is a software platform for NASA’s underwater robotic submarines. "Those are getting heavy rotation at NASA," said Sarah Rigdon, the communications leader of the NASA Space Apps Team. "I can tell you that while the results from this year are still being compiled, they are definitely results NASA will use."

Participants in the Space Apps challenge seem to have bought into the concept of free labor—mostly because they’re enthusiastic about space and appreciate competition for its own sake. "It was overall so much fun, and crazy, when you realize the space and time difference between participants," said Arman Atoyan, who led one team and is the founder of the startup software company X-Tech, based in Yerevan, Armenia. His team built an app, called "Feel the Moon Gravity," that uses NASA data and Microsoft’s Xbox Kinect motion controller to simulate jumping on the surface of the moon.

Atoyan and co.’s app is one of the flashier designs to emerge from the challenge, but it’s in good company: other projects include Sol, a beautifully designed iPhone app from Kansas City company Ingenology, which displays the weather on Earth and Mars; and Inbound, a hardware project that consists of a series of LED lights linked together by an Arduino (an open-source microcontroller) to track the path of solar flares and charged particles from the Sun to the Earth.

"We heavily focused on simplifying the complex data that NASA provided, trying to make it a bit more abstract and digestible at a glance," said Matthew Congrove, a developer at the mobile software company Appcelerator in Mountain View, California, who worked with a few colleagues on the Inbound project. "I don't think there's anything more simple than showing the Sun, the Earth, and the coronal mass ejections travelling between the two."

It remains to be seen whether any of these eye-catching apps are among the winners of this year’s challenge, but the fact that they were created by teams of professional developers seems to undermine NASA’s claim that the event was designed for average "citizens from around the world." Still, NASA maintains that the overall goal of making its data more accessible was met, both in this and last year’s challenge.

"Making vast reservoirs of data available to the public."

"Our goal has been to infuse a lot of Open Government's values within NASA," said Rigdon. "Part of the work of the Open Government division has been to make our vast reservoirs of data available to the public." That NASA Open Government effort extends beyond NASA to other federal agencies. In fact, it was catalyzed by an edict from President Obama himself in 2009. But NASA has embraced the idea with vigor, and other branches of the agency are already holding their own contests, including one in March of this year that was focused on video game development.

As for Space Apps, NASA’s plan to effectively "gameify" the development of new apps and hardware seems to have worked out better than the agency could have hoped. Although NASA already produces and commissions many official iOS and Android apps under its own label, the goal with Space Apps was to harness both amateur and professional developers' talent from around the world without forking out for employees. "When you think about a professional developer's salary, it’s about $75 an hour," Skytland said. NASA estimates 60 percent of the participants in Space Apps had professional qualifications, a number Skytland says may have earned the agency about a $14 million return-on-investment.

"Right now, we’re just excited we survived it."

Still, despite its apparent success, the crew of 12 on the Space Apps project aren’t sure whether there will ever be another hackathon. "Who knows?" Skytland said about a Space Apps 2014. "Last year we swore we’d never do anything like this again. Right now, we’re just excited we survived it."

Hackers get root access on Google Glass ahead of retail release

Tinkerers have only had their hands on the Google Glass "Explorer Edition" for a few days, but they've already found a way to achieve root on Google's much-ballyhooed face-computer, granting full access to the device's Android operating system.

The hack comes courtesy of legendary iOS jailbreaker Jay Freeman, aka Saurik, who tells Forbes that he cracked the device using a known exploit used to get root on Android 4.0, first discovered by another hacker named B1nary. Freeman says it was a simple task, accomplished in a matter of hours by fooling the device into thinking it's actually an emulation instead of the real hardware. Since emulations are used for testing, all permissions are granted and root is achieved.

Freeman is not the first to crack Glass, though: just yesterday, another developer, Liam McLoughlin, also got root on his device. Although both jailbreaks were successful on the current Explorer Edition of Glass, it's not clear whether those holes will still be available in the consumer edition. But it's potentially a boon for those concerned about the fact that Google can remotely deactivate the device it you attempt to sell it — or anyone not fond of the fact that Google will be pre-screening all the apps that go on device, unlike its more open app ecosystem on Google Play.

Update: Google X project engineer Stephen Lau has confirmed what was suspected: Google purposely left Glass unlocked "so you guys could hack it and do crazy fun shit with it." It's not clear if consumer versions of Glass after the developer-friendly Explorer Edition will be unlocked as well, but Lau is encouraging early adopters to "show me something cool."

Brazen Crimeware Marketing Branches Out to Social Networks

The secrecy of underground forums where financial malware and crimeware kits are traded is well guarded, to the point that few are able to penetrate them without some kind of internal sponsor. Here, criminals value their privacy as much as those from whom they steal.
That’s what makes a recent discovery from RSA Security’s FraudAction Research Lab all the more jarring. Expert Limor Kessem found this week that a new fraud service was being marketed over Facebook. The developer, an Indonesian-speaking person, was selling a customized botnet panel for the Zeus Trojan.

Kessem said the Facebook page was updated frequently with information about botnets, exploits and their version of Zeus.
“Beyond having compiled a working Zeus Trojan kit, the developer customized an attractive control panel for the admin (basic and familiar in functionality, and taken from previous Zeus versions), the developer and his team created a demo website for potential buyers—which they have no qualms about sharing publicly,” Kessem said.
While this particular criminal is an outlier, the use of social networks to market crimeware speaks to the commodity nature some of the malware used for fraud. Zeus source code was leaked online in 2011, and since then many variants have popped up, each with varying degrees of functionality. While high-end underground forums are out of reach for many, others such as this developer, might be trying to expand their reach with his own version of the banking malware and taking advantage of a market shift where some of the more professional malware dealers have been laying low. Some, such as the keepers of the Citadel Trojan, have sworn off commercially selling their kit and will trade only with current and trusted customers.
“Underground forums are fairly well protected; these folks want to keep a low profile,” said George Tubin, senior security researcher at Trusteer. “But, you can imagine that maybe some want to branch out a little and get into a new market and attract folks who are not part of this secret underground as a way to reach out. Maybe they want to reach out to a new group of folks with no access to forums or don’t know how to get to them.”
In fact, commercial versions of Zeus, SpyEye and Ice IX aren’t for sale either, another trend leading toward crimeware kits and service offerings available online.
“This case shows that the code leak, leading to the availability of the Trojan, makes for an even more diverse crimeware market, one that gives room to new offerings, especially at a time when all the major developers are staying away from the commercial arena,” Kessem said. “Marketing cybercrime in such an open and accessible manner is not something common.”
Crimeware kits and fraud services have become increasingly specialized, Tubin said, and cheaper. Criminals not only sell malware, phishing kits and botnets ready for launch, but have added features such as phone flooding capabilities for denial-of-service attacks, as well as check-forging specialists who can create counterfeit personal checks from stolen online check images. Specialization has also come to malware and botnets, to the point where compromised computers making up a botnet can be sold or rented according to geography if an attacker wants to target a particular regional financial institution.
“It’s amazing how every piece can be bought directly or as a service,” Tubin said, adding that malware writers want to make these kits sellable, therefore, easy to use.
“There are a broad range of kits out there,” he said. “Malware writers want to make them as intuitive as possible in order sell to a wide variety of folks, not just sophisticated programmers. That’s probably what is being sold on social networks and other outlets where they are reaching out to folks they have not before hoping these people just get sucked in once they realize how easy it is to do.”

Hackers Blocked By Stealth Login Scripts For WordPress

After being hacked over a period of several months and as a result, experiencing very high CPU usage on his shared hosting websites, Dr. Peter Achutha has developed several techniques to defeat hackers.
One of these techniques is to use login php scripts that are designed to defeat hackers and make it very difficult to login into software such as WordPress. He has developed two php login scripts that he is giving away freely so that many honest to God hard working bloggers can protect their blogs from hackers. Login php scripts can now operate in stealth mode. His article on stealth login in scripts on his website shares more details and the free download.
The other technique he has explained is how to generated powerful easy to remember passwords. From experience he has found that good passwords can take years to hack. He says “A government or private institution had used 30 PC’s or more to break my passwords. They had tried more than 28,000,000 attempts over a 24 hour period to log into my websites and then gave up. My sites are still running.” His other article on secure hack proof passwords teaches users how to make passwords more difficult to hack.
Dr. Achutha states that some other application other than WordPress is still able to use his php login scripts. As long as there is a separate php login script for the application package one can substitute his login scripts to block hackers. Having installed his login scripts you can then go into stealth mode and hide from potential hackers. He says, “Techniques similar to password protection methods can be used to go into stealth mode. In addition if your software is not WordPress but you have a wp-login.php login script then hackers will be misguided and try to hack your site as a WordPress site. This will increase the difficulty level for hackers.”

Military grooms new officers for war in cyberspace

 

AIR FORCE ACADEMY, Colo. – The US service academies are ramping up efforts to groom a new breed of cyberspace warriors to confront increasing threats to the nation’s military and civilian computer networks that control everything from electrical power grids to the banking system.
Students at the Army, Navy and Air Force academies are taking more courses and participating in elaborate cyber-warfare exercises as the military educates a generation of future commanders in the theory and practice of computer warfare.
The academies have been training cadets in cyber for more than a decade. But the effort has taken on new urgency amid warnings that hostile nations or organizations might be capable of crippling attacks on critical networks.
James Clapper, director of national intelligence, called cyberattack the top threat to national security when he presented the annual Worldwide Threat Assessment to Congress this month. “Threats are more diverse, interconnected, and viral than at any time in history,” his report stated. “Destruction can be invisible, latent, and progressive.”
China-based hackers have long been accused of cyber intrusions, and earlier this year the cyber-security firm Mandiant released a report with new details allegedly linking a secret Chinese military unit to years of cyber-attacks against U.S. companies. This year, The New York Times, The Wall Street Journal and The Washington Post all reported breaches in their computer systems and said they suspected Chinese hackers. China denies carrying out cyber-attacks.
On Tuesday, hackers compromised Associated Press Twitter accounts and sent out a false tweet. AP quickly put out word that the report was false and that its accounts had been hacked. AP’s accounts were shut down until the problem was corrected.
Once viewed as an obscure and even nerdy pursuit, cyber is now seen as one of the hottest fields in warfare – “a great career field in the future,” said Ryan Zacher, a junior at the Air Force Academy outside Colorado Springs, Colo., who switched from aeronautical engineering to computer science.
Last year the US Naval Academy in Annapolis, Md., began requiring freshmen to take a semester on cyber-security, and it is adding a second required cyber course for juniors next year.
The school offered a major in cyber operations for the first time this year to the freshman class, and 33 midshipmen, or about 3 percent of the freshmen, signed up for it. Another 79 are majoring in computer engineering, information technology or computer science, bringing majors with a computer emphasis to about 10 percent of the class.
“There’s a great deal of interest, much more than we could possibly, initially, entertain,” said the academy’s superintendent, Vice Adm. Michael Miller.
Since 2004, the Air Force Academy has offered a degree in computer science-cyberwarfare – initially called computer science-information assurance – that requires cadets to take courses in cryptology, information warfare and network security in addition to standard computer science. The academy is retooling a freshman computing course so that more than half its content is about cyberspace, and is looking into adding another cyber course.
“All of these cadets know that they are going to be on the front lines defending the nation in cyber,” said Martin Carlisle, a computer science professor at the Air Force Academy and director of the school’s Center for Cyberspace Research.
About 25 Air Force cadets will graduate this year with the computer science-cyberwarfare degree, and many will go on to advanced studies and work in their service’s cyber headquarters or for US Cyber Command at Fort Meade, Md., the Defense Department command responsible for defensive and offensive cyberwarfare.