Connect with us

Technology & Innovation

How Log4Shell threatens the Internet

Diane Davis

Published

on

In late November, a cloud-security researcher for Chinese tech giant Alibaba discovered a flaw in a popular open-source coding framework called Log4j. The employee quickly notified Log4j’s parent Apache Software Foundation, a group of volunteer programmers who maintain the framework. The message, which was obtained by Bloomberg News, was clear: Hackers could exploit this vulnerability to carry out destructive cyberattacks across the globe by taking control of targeted computers with remote-code execution. This threat “has major impact,” the employee wrote.

With disaster seemingly imminent, cybersecurity experts were suddenly racing the clock to patch the opening before hackers could get to it. But the whole operation was still hush-hush until last week, when the first public case emerged: Minecraft, the best-selling video game of all time, published a blog post revealing a version of the game had a flaw that could let hackers take over players’ computers, and urged users to download a rushed security update. The Log4j vulnerability was now disclosed, putting the entire cybercommunity on high alert.

Here’s what to know:

What exactly is the Log4j vulnerability?

Log4j is a logging framework, meaning it lets developers monitor or “log” digital events on a server, which teams then review for typical operation or abnormal behavior.

The vulnerability, dubbed Log4Shell, results from what coders call improper input validation. Typically, software should safeguard against data coming from untrusted users online, but the flaw allows them through, which can then let data supplied by untrusted outsiders manipulate the server’s actions. According to British security developer Sophos, that could mean anything from leaking information online to automatically installing malware.

What’s the crisis level?

High. Log4j, a Java library, is very widely used, including in applications from Amazon, Microsoft, IBM, Google, Cisco, Twitter, Steam—and even the United States Cybersecurity and Infrastructure Security Agency. Hence, the flaw is an opportunity for hackers to let themselves in to millions of computer systems worldwide, wreaking untold havoc.

It seems to have already begun with a ransomware hit on workforce management platform Kronos, which could delay payrolls, and which analysts suspect is linked to Log4Shell. Other reports of exploits include hijacking computing power to mine cryptocurrency, and armies of zombie botnets recruiting more machines into their ranks. And there are further reports that hackers have been mass-scanning servers in order to thumbprint vulnerable systems.

What’s being done about it?

It’s up to companies to engineer patches for the bug, ideally before hackers can exploit it in the wild. Many companies, including Amazon, Microsoft, IBM, and Google, have said they are already investigating or working to deploy fixes. However, a major headache—and what has cybersecurity experts so frantic—is that many companies may not even know they were built with Log4j, as programs are often developed with multiple components pulled from various sources. It’s a problem that a recent White House order, which establishes a so-called software bill of materials, hopes to solve by requiring companies that sell software to the government to list all of the bits and pieces.

But experts predict it will take months, even years, to clean up the mess created by the Log4j vulnerability. That would involve updating all affected systems with patched versions. Even then, it’s possible that some hackers, who infiltrated systems earlier, could have installed backdoors to access the servers even after they’ve been patched.

Is anyone to blame?

Not really. Some are firing shots at Apache, claiming that the flaw should have been identified and fixed as early as 2016, when researchers at the Black Hat cybersecurity conference presented a method to exploit a class of software including Log4j.

However, the situation has also spotlighted the fact that vast swaths of modern software are built with open-source programs maintained by unpaid volunteers—who may be juggling a number of other responsibilities—and has raised questions about what we could do to lessen the drawbacks of that practice.


Technology & Innovation

LLMs become more covertly racist with human intervention

Diane Davis

Published

on

LLMs become more covertly racist with human intervention

Even when the two sentences had the same meaning, the models were more likely to apply adjectives like “dirty,” “lazy,” and “stupid” to speakers of AAE than speakers of Standard American English (SAE). The models associated speakers of AAE with less prestigious jobs (or didn’t associate them with having a job at all), and when asked to pass judgment on a hypothetical criminal defendant, they were more likely to recommend the death penalty. 

An even more notable finding may be a flaw the study pinpoints in the ways that researchers try to solve such biases. 

To purge models of hateful views, companies like OpenAI, Meta, and Google use feedback training, in which human workers manually adjust the way the model responds to certain prompts. This process, often called “alignment,” aims to recalibrate the millions of connections in the neural network and get the model to conform better with desired values. 

The method works well to combat overt stereotypes, and leading companies have employed it for nearly a decade. If users prompted GPT-2, for example, to name stereotypes about Black people, it was likely to list “suspicious,” “radical,” and “aggressive,” but GPT-4 no longer responds with those associations, according to the paper.

However the method fails on the covert stereotypes that researchers elicited when using African-American English in their study, which was published on arXiv and has not been peer reviewed. That’s partially because companies have been less aware of dialect prejudice as an issue, they say. It’s also easier to coach a model not to respond to overtly racist questions than it is to coach it not to respond negatively to an entire dialect.

“Feedback training teaches models to consider their racism,” says Valentin Hofmann, a researcher at the Allen Institute for AI and a coauthor on the paper. “But dialect prejudice opens a deeper level.”

Avijit Ghosh, an ethics researcher at Hugging Face who was not involved in the research, says the finding calls into question the approach companies are taking to solve bias.

“This alignment—where the model refuses to spew racist outputs—is nothing but a flimsy filter that can be easily broken,” he says. 

Continue Reading

Technology & Innovation

I used generative AI to turn my story into a comic—and you can too

Diane Davis

Published

on

I used generative AI to turn my story into a comic—and you can too

The narrator sits on the floor and eats breakfast with the cats. 

LORE MACHINE / WILL DOUGLAS HEAVEN

After more than a year in development, Lore Machine is now available to the public for the first time. For $10 a month, you can upload 100,000 words of text (up to 30,000 words at a time) and generate 80 images for short stories, scripts, podcast transcripts, and more. There are price points for power users too, including an enterprise plan costing $160 a month that covers 2.24 million words and 1,792 images. The illustrations come in a range of preset styles, from manga to watercolor to pulp ’80s TV show.

Zac Ryder, founder of creative agency Modern Arts, has been using an early-access version of the tool since Lore Machine founder Thobey Campion first showed him what it could do. Ryder sent over a script for a short film, and Campion used Lore Machine to turn it into a 16-page graphic novel overnight.

“I remember Thobey sharing his screen. All of us were just completely floored,” says Ryder. “It wasn’t so much the image generation aspect of it. It was the level of the storytelling. From the flow of the narrative to the emotion of the characters, it was spot on right out of the gate.”

Modern Arts is now using Lore Machine to develop a fictional universe for a manga series based on text written by the creator of Netflix’s Love, Death & Robots.

The narrator encounters the man in the corner shop who jokes about the cat food. 

LORE MACHINE / WILL DOUGLAS HEAVEN

Under the hood, Lore Machine is built from familiar parts. A large language model scans your text, identifying descriptions of people and places as well as its overall sentiment. A version of Stable Diffusion generates the images. What sets it apart is how easy it is to use. Between uploading my story and downloading its storyboard, I clicked maybe half a dozen times.

That makes it one of a new wave of user-friendly tools that hide the stunning power of generative models behind a one-click web interface. “It’s a lot of work to stay current with new AI tools, and the interface and workflow for each tool is different,” says Ben Palmer, CEO of the New Computer Corporation, a content creation firm. “Using a mega-tool with one consistent UI is very compelling. I feel like this is where the industry will land.”

Look! No prompts

Campion set up the company behind Lore Machine two years ago to work on a blockchain version of Wikipedia. But when he saw how people took to generative models, he switched direction. Campion used the free-to-use text-to-image model Midjourney to make a comic-book version of Samuel Taylor Coleridge’s The Rime of the Ancient Mariner. It went viral, he says, but it was no fun to make.

Marta confronts the narrator about their new diet and offers to cook for them. 

LORE MACHINE / WILL DOUGLAS HEAVEN

“My wife hated that project,” he says. “I was up to four in the morning, every night, just hammering away, trying to get these images right.” The problem was that text-to-image models like Midjourney generate images one by one. That makes it hard to maintain consistency between different images of the same characters. Even locking in a specific style across multiple images can be hard. “I ended up veering toward a trippier, abstract expression,” says Campion.

Continue Reading

Technology & Innovation

The robots are coming. And that’s a good thing.

Diane Davis

Published

on

The robots are coming. And that’s a good thing.

What if we could throw our sight, hearing, touch, and even sense of smell to distant locales and experience these places in a more visceral way?

So we wondered what would happen if we were to tap into the worldwide community of gamers and use their skills in new ways. With a robot working inside the deep freezer room, or in a standard manufacturing or warehouse facility, remote operators could remain on call, waiting for it to ask for assistance if it made an error, got stuck, or otherwise found itself incapable of completing a task. A remote operator would enter a virtual control room that re-created the robot’s surroundings and predicament. This person would see the world through the robot’s eyes, effectively slipping into its body in that distant cold storage facility without being personally exposed to the frigid temperatures. Then the operator would intuitively guide the robot and help it complete the assigned task.

To validate our concept, we developed a system that allows people to remotely see the world through the eyes of a robot and perform a relatively simple task; then we tested it on people who weren’t exactly skilled gamers. In the lab, we set up a robot with manipulators, a stapler, wire, and a frame. The goal was to get the robot to staple wire to the frame. We used a humanoid, ambidextrous robot called Baxter, plus the Oculus VR system. Then we created an intermediate virtual room to put the human and the robot in the same system of coordinates—a shared simulated space. This let the human see the world from the point of view of the robot and control it naturally, using body motions. We demoed this system during a meeting in Washington, DC, where many participants—including some who’d never played a video game—were able to don the headset, see the virtual space, and control our Boston-based robot intuitively from 500 miles away to complete the task.


The best-known and perhaps most compelling examples of remote teleoperation and extended reach are the robots NASA has sent to Mars in the last few decades. My PhD student Marsette “Marty” Vona helped develop much of the software that made it easy for people on Earth to interact with these robots tens of millions of miles away. These intelligent machines are a perfect example of how robots and humans can work together to achieve the extraordinary. Machines are better at operating in inhospitable environments like Mars. Humans are better at higher-level decision-making. So we send increasingly advanced robots to Mars, and people like Marty build increasingly advanced software to help other scientists see and even feel the faraway planet through the eyes, tools, and sensors of the robots. Then human scientists ingest and analyze the gathered data and make critical creative decisions about what the rovers should explore next. The robots all but situate the scientists on Martian soil. They are not taking the place of actual human explorers; they’re doing reconnaissance work to clear a path for a human mission to Mars. Once our astronauts venture to the Red Planet, they will have a level of familiarity and expertise that would not be possible without the rover missions.

Robots can allow us to extend our perceptual reach into alien environments here on Earth, too. In 2007, European researchers led by J.L. Deneubourg described a novel experiment in which they developed autonomous robots that infiltrated and influenced a community of cockroaches. The relatively simple robots were able to sense the difference between light and dark environments and move to one or the other as the researchers wanted. The miniature machines didn’t look like cockroaches, but they did smell like them, because the scientists covered them with pheromones that were attractive to other cockroaches from the same clan.

The goal of the experiment was to better understand the insects’ social behavior. Generally, cockroaches prefer to cluster in dark environments with others of their kind. The preference for darkness makes sense—they’re less vulnerable to predators or disgusted humans when they’re hiding in the shadows. When the researchers instructed their pheromone-soaked machines to group together in the light, however, the other cockroaches followed. They chose the comfort of a group despite the danger of the light. 

JACK SNELLING

These robotic roaches bring me back to my first conversation with Roger Payne all those years ago, and his dreams of swimming alongside his majestic friends. What if we could build a robot that accomplished something similar to his imagined capsule? What if we could create a robotic fish that moved alongside marine creatures and mammals like a regular member of the aquatic neighborhood? That would give us a phenomenal window into undersea life.

Sneaking into and following aquatic communities to observe behaviors, swimming patterns, and creatures’ interactions with their habitats is difficult. Stationary observatories cannot follow fish. Humans can only stay underwater for so long. Remotely operated and autonomous underwater vehicles typically rely on propellers or jet-based propulsion systems, and it’s hard to go unnoticed when your robot is kicking up so much turbulence. We wanted to create something different—a robot that actually swam like a fish. This project took us many years, as we had to develop new artificial muscles, soft skin, novel ways of controlling the robot, and an entirely new method of propulsion. I’ve been diving for decades, and I have yet to see a fish with a propeller. Our robot, SoFi (pronounced like Sophie), moves by swinging its tail back and forth like a shark. A dorsal fin and twin fins on either side of its body allow it to dive, ascend, and move through the water smoothly, and we’ve already shown that SoFi can navigate around other aquatic life forms without disrupting their behavior.

SoFi is about the size of an average snapper and has taken some lovely tours in and around coral reef communities in the Pacific Ocean at depths of up to 18 meters. Human divers can venture deeper, of course, but the presence of a scuba-­diving human changes the behavior of the marine creatures. A few scientists remotely monitoring and occasionally steering SoFi cause no such disruption. By deploying one or several realistic robotic fish, scientists will be able to follow, record, monitor, and potentially interact with fish and marine mammals as if they were just members of the community.

Continue Reading

Trending