Entries Tagged "contests"

Page 6 of 7

Third Annual Movie-Plot Threat Contest Winner

On April 7—seven days late—I announced the Third Annual Movie-Plot Threat Contest:

For this contest, the goal is to create fear. Not just any fear, but a fear that you can alleviate through the sale of your new product idea. There are lots of risks out there, some of them serious, some of them so unlikely that we shouldn’t worry about them, and some of them completely made up. And there are lots of products out there that provide security against those risks.

Your job is to invent one. First, find a risk or create one. It can be a terrorism risk, a criminal risk, a natural-disaster risk, a common household risk—whatever. The weirder the better. Then, create a product that everyone simply has to buy to protect him- or herself from that risk. And finally, write a catalog ad for that product.

[…]

Entries are limited to 150 words … because fear doesn’t require a whole lot of explaining. Tell us why we should be afraid, and why we should buy your product.

On May 7, I posted five semi-finalists out of the 327 blog comments:

Sadly, two of those five was above the 150-word limit. Out of the three remaining, I (with the help of my readers) have chosen a winner.

Presenting, the winner of the Third Annual Movie Plot Threat Contest, Aaron Massey:

Tommy Tester Toothpaste Strips:

Many Americans were shocked to hear the results of the research trials regarding heavy metals and toothpaste conducted by the New England Journal of Medicine, which FDA is only now attempting to confirm. This latest scare comes after hundreds of deaths were linked to toothpaste contaminated with diethylene glycol, a potentially dangerous chemical used in antifreeze.

In light of this continuing health risk, Hamilton Health Labs is proud to announce Tommy Tester Toothpaste Strips! Just apply a dab of toothpaste from a fresh tube onto the strip and let it rest for 3 minutes. It’s just that easy! If the strip turns blue, rest assured that your entire tube of toothpaste is safe. However, if the strip turns pink, dispose of the toothpaste immediately and call the FDA health emergency number at 301-443-1240.

Do not let your family become a statistic when the solution is only $2.95!

Aaron wins, well, nothing really, except the fame and glory afforded by this blog. So give him some fame and glory. Congratulations.

Posted on May 15, 2008 at 6:24 AMView Comments

Third Annual Movie-Plot Threat Contest Semi-Finalists

A month ago I announced the Third Annual Movie-Plot Threat Contest:

For this contest, the goal is to create fear. Not just any fear, but a fear that you can alleviate through the sale of your new product idea. There are lots of risks out there, some of them serious, some of them so unlikely that we shouldn’t worry about them, and some of them completely made up. And there are lots of products out there that provide security against those risks.

Your job is to invent one. First, find a risk or create one. It can be a terrorism risk, a criminal risk, a natural-disaster risk, a common household risk—whatever. The weirder the better. Then, create a product that everyone simply has to buy to protect him- or herself from that risk. And finally, write a catalog ad for that product.

[…]

Entries are limited to 150 words … because fear doesn’t require a whole lot of explaining. Tell us why we should be afraid, and why we should buy your product.

Submissions are in. The blog entry has 327 comments. I’ve read them all, and here are the semi-finalists:

It’s not in the running, but reader “False Data” deserves special mention for his Safe-T-Nav, a GPS system that detects high crime zones. It would be a semi-finalist, but it already exists.

Cast your vote; I’ll announce the winner on the 15th.

Posted on May 7, 2008 at 2:33 PMView Comments

Third Annual Movie-Plot Threat Contest

I can’t believe I let April 1 come and go without posting the rules to the Third Annual Movie-Plot Threat Contest. Well, better late than never.

For this contest, the goal is to create fear. Not just any fear, but a fear that you can alleviate through the sale of your new product idea. There are lots of risks out there, some of them serious, some of them so unlikely that we shouldn’t worry about them, and some of them completely made up. And there are lots of products out there that provide security against those risks.

Your job is to invent one. First, find a risk or create one. It can be a terrorism risk, a criminal risk, a natural-disaster risk, a common household risk—whatever. The weirder the better. Then, create a product that everyone simply has to buy to protect him- or herself from that risk. And finally, write a catalog ad for that product.

Here’s an example, pulled from page 25 of the Late Spring 2008 Skymall catalog I’m reading on my airplane right now:

A Turtle is Safe in Water, A Child is Not!

Even with the most vigilant supervision a child can disappear in seconds and not be missed until it’s too late. Our new wireless pool safety alarm system is a must for pool owners and parents of young children. The Turtle Wristband locks on the child’s wrist (a special key is required to remove it) and instantly detects immersion in water and sounds a shrill alarm at the Base Station located in the house or within 100 feet of the pool, spa, or backyard pond. Keep extra wristbands on hand for guests or to protect the family dog.

Entries are limited to 150 words—the example above had 97 words—because fear doesn’t require a whole lot of explaining. Tell us why we should be afraid, and why we should buy your product.

Entries will be judged on creativity, originality, persuasiveness, and plausibility. It’s okay if the product you invent doesn’t actually exist, but this isn’t a science fiction contest.

Portable salmonella detectors for salad bars. Acoustical devices that estimate tiger proximity based on roar strength. GPS-enabled wallets for use when you’ve been pickpocketed. Wrist cuffs that emit fake DNA to fool DNA detectors. The Quantum Sleeper. Fear offers endless business opportunities. Good luck.

Entries due by May 1.

The First Movie-Plot Threat Contest rules and winner. The Second Movie-Plot Threat Contest rules, semifinalists, and winner.

EDITED TO ADD (4/7): Submit your entry in the comments.

EDITED TO ADD (4/8): You people are frighteningly creative.

Posted on April 7, 2008 at 3:50 PMView Comments

Second Movie-Plot Threat Contest Winner

On April 1, I announced the Second Annual Movie-Plot Threat Contest:

Your goal: invent a terrorist plot to hijack or blow up an airplane with a commonly carried item as a key component. The component should be so critical to the plot that the TSA will have no choice but to ban the item once the plot is uncovered. I want to see a plot horrific and ridiculous, but just plausible enough to take seriously.

Make the TSA ban wristwatches. Or laptop computers. Or polyester. Or zippers over three inches long. You get the idea.

Your entry will be judged on the common item that the TSA has no choice but to ban, as well as the cleverness of the plot. It has to be realistic; no science fiction, please. And the write-up is critical; last year the best entries were the most entertaining to read.

On June 5, I posted three semi-finalists out of the 334 comments:

Well, we have a winner. I can’t divulge the exact formula—because you’ll all hack the system next year—but it was a combination of my opinion, popular acclaim in blog comments, and the opinion of Tom Grant (the previous year’s winner).

I present to you: Butterflies and Beverages, posted by Ron:

It must have been a pretty meadow, Wilkes thought, just a day before. He tried to picture how it looked then: without the long, wide wound in the earth, without the charred and broken fuselage of the jet that gouged it out, before the rolling ground was strewn with papers and cushions and random bits of plastic and fabric and all the things inside the plane that lay like the confetti from a brief, fiery parade.

Yes, a nice little spot, just far enough from the airport’s runways to be not too noisy, but close enough to watch the planes going in and out, fortunately just a bit too close to have been developed. When the plane rolled over and angled downward, not even a mile past the end of the runway, at least the only people at risk were the ones on the plane. For them, it was mercifully quick, the impact breaking their necks before the breaking wing tanks ignited in sheets of flame, the charred bodies still in their seats.

He spotted the NTSB guy, standing by the forward half of the fuselage, easy to spot among the FAA and local airport people—they were always the only suits in the crowd. Heading over, Wilkes saw this one wasn’t going to be too hard: when planes came down intact like this, breaking in to just a few pieces on impact, the cause was always easier to find. This one looked to be no exception.

He muttered to the suit, “Wilkes,” gesturing at the badge clipped to his shirt. No need to get too friendly, they’d file separate reports anyway. As long as they were remotely on the same page, there wasn’t much need to actually talk to the guy. “What’s this little gem?” he wondered aloud, looking at the hole in the side of the downed jet.

“Explosion,” drawled the NTSB guy; he had that Chuck Yeager slow-play sound, Wilkes thought, like someone who could sound calm describing Armageddon. “Looks like it was from the inside, something just big enough to rip a few square feet out of the side. Enough to throw it on its side”

“And if the plane is low enough, still taking off, with the engines near full thrust, it rolls over and down too fast…” he trailed off, picturing the result.

“Yep, all in a couple of seconds. Too quick for the flight crew to have time to get it back.” The NTSB guy shook his head, the id clipped to his suit jacket swaying back and forth with the motion. “Always the best time if you’re going to take a bird down: takeoff or landing, guess whoever did this one wanted to get it over with sooner rather than later.” He snorted in derision, “Somebody snuck in an explosive, must have been a screener havin’ an off day.”

“Maybe,” said Wilkes, not ready to write it off as just a screener’s error. The NTSB guys were always quick to find a bad decision, one human error, and explain the whole thing away. But Wilkes’ job was to find the flaws in the systems, the procedures, the way to come up with prophylactic precautions. Maybe there was nothing more than a screener who didn’t spot a grenade or a stick of dynamite, something so obvious that there was nothing to do but chalk up a hundred and eighty three dead lives to one madman and one very bad TSA employee.

But maybe not. That’s when Wilkes spotted the first two of the butterflies. Bright yellow against the charred black of the burned wreckage, they seemed like the most incongruous things—and as he thought this, another appeared.

As they took photos and made measurements, more showed up—by ones and twos, a few flying away, but gradually building up to dozens over the course of the morning. Odd, the NTSB rep agreed, but nothing that tells us anything about the terrorist who brought down that plane.

Wilkes wasn’t so sure. Nature was handing out a big fat clue here, he was sure of that. What he wasn’t sure of was what in the hell it could possibly mean.

He leaned in close with the camera on his phone, getting some good close images of the colorful insects, emailing back to the office with a request to reach out to an expert. He needed a phone consult, someone who knew the behavior of this particular butterfly, someone who could put him on the right track.

Within minutes, his phone was buzzing, with a conference call already set up with a professor of entymology, and even better one local to the area; a local might know this bug better than an academic from a more prestigious, but distant university.

He was half-listening during the introductions, Wilkes wasn’t interested in this guy’s particulars, the regional team would have that all available if he needed it later. He just wanted answers.

“Pieridae,” the professor offered, “and all males, I’d bet.”

“Okay,” Wilkes answered, wondering if he this really would tell him anything. “Why are they all over my bomb hole?”

“I can’t be sure, but it must be something attracting them. These are commonly called ‘sulfur butterflies’, could there be sulfur on your wreckage?”

Yeah, Wilkes thought, this is looking like a wild goose chase. “No sulfur, we already did a quick chem test for it. Anything else these little fellas like?”

“Sure, but not something you’d be likely to find in a bomb—just sodium. They package it up with their sperm and deliver it to the female as an extra little bonus—sort of the flowers and candy of the butterfly world.”

“Okay, that’s…wow, the things I learn in this job. Sorry to bother you, sir, I guess it’s just…yeah, thanks.”

Butterfly sperm—now this might set a new record for useless trivia learned in a crash investigation. Unbelievable.

The NTSB guy wandered over, seeing Wilkes was off the phone. “Get anything from your expert?” he queried, trying and failing to suppress a grin. Wilkes suspected there would soon be a story going around the NTSB office about the FAA “butterfly guy”; ah well, better to be infamous than anonymous.

“Nah, not much. The little guys like sulfur,” Wilkes offered, seeing his counterpart give a cynical chuckle at that, “and sodium. Unless there was a whole lot of salt packed around the perp’s explosive, our little yellow friends are just a mystery.”

The NTSB rep got a funny look on his face, a faraway look. “Sodium. An explosive that leaves behind sodium. Well, that could be…”

They looked at each other, both heading to the same conclusion, both reluctant to get there. Wilkes said it first: “Sodium metal. Cheap, easy to get, it would have to be: sodium metal.”

“And easy,” the NTSB rep drawled, “to sneak on the plane. The stuff is soft, but you could fashion it in to any simple things: eyeglass frames, belt buckles, buttons, simple things the screeners would never be lookin’ at.”

“Wouldn’t take much,” Wilkes offered, an old college chemistry-class prank coming to mind. “An couple of ounces, that would be enough to blow out the side of a plane, enough for what we’re seeing here.”

“With the easiest trigger in the world,” the NTSB man added, putting words to the picture forming in Wilkes mind. A cup of water would be enough, just drop the sodium metal in to it and the chemical reaction would quickly release hydrogen gas, with enough heat generated as a byproduct of the reaction to ignite the gas. In just a second or two, you’d have an explosion strong enough to knock the side out of a plane.

“Sounds like a problem for you FAA boys,” his counterpart teased. “What ya gonna do, ban passengers from carrying more than a few grams of anything made of metal? ”

“No,” Wilkes shot back, “we can’t ban everything that could be made of sodium metal. Or all the other water-reactives,” he mused aloud, thinking of all the carbides, anhydrides, and alkali metals that would cover. “Too many ways to hide them, too many types to test for them all. No, it isn’t the metals we’ll have to ban.”

“Naw, you don’t mean,” the NTSB man stared in disbelief, his eyes growing wide. “You couldn’t, I mean, it’s the only other way but it’s ridiculous.”

“No, it’s not so ridiculous, it’s really the only way. We’re going to have to ban water, and anything containing a significant amount of water, from all passenger flights. It’s the only way, otherwise we could have planes dropping out of the sky every time someone is served a beverage.”

Ron gets signed copies of my books, a $50 Amazon gift certificate contributed by a reader, and—if I can find one—an interview with a real-live movie director. (Does anyone know one?) We hope that one of his prizes isn’t a visit by the FBI.

EDITED TO ADD (6/27): There’s an article on Slate about the contest.

Posted on June 15, 2007 at 6:43 AMView Comments

Second Annual Movie-Plot Threat Contest Semi-Finalists

On April 1, I announced the Second Annual Movie-Plot Threat Contest:

Your goal: invent a terrorist plot to hijack or blow up an airplane with a commonly carried item as a key component. The component should be so critical to the plot that the TSA will have no choice but to ban the item once the plot is uncovered. I want to see a plot horrific and ridiculous, but just plausible enough to take seriously.

Make the TSA ban wristwatches. Or laptop computers. Or polyester. Or zippers over three inches long. You get the idea.

Your entry will be judged on the common item that the TSA has no choice but to ban, as well as the cleverness of the plot. It has to be realistic; no science fiction, please. And the write-up is critical; last year the best entries were the most entertaining to read.

Well, the submissions are in; the blog entry has 334 comments. I’ve read them all, and here are the semi-finalists:

Cast your vote; I’ll announce the winner on the 15th.

Posted on June 5, 2007 at 12:01 PMView Comments

Announcing: Second Annual Movie-Plot Threat Contest

The first Movie-Plot Threat Contest asked you to invent a horrific and completely ridiculous, but plausible, terrorist plot. All the entrants were worth reading, but Tom Grant won with his idea to crash an explosive-filled plane into the Grand Coulee Dam.

This year the contest is a little different. We all know that a good plot to blow up an airplane will cause the banning, or at least screening, of something innocuous. If you stop and think about it, it’s a stupid response. We screened for guns and bombs, so the terrorists used box cutters. We took away box cutters and small knives, so they hid explosives in their shoes. We started screening shoes, so they planned to use liquids. We now confiscate liquids (even though experts agree the plot was implausible)…and they’re going to do something else. We can’t win this game, so why are we playing?

Well, we are playing. And now you can, too. Your goal: invent a terrorist plot to hijack or blow up an airplane with a commonly carried item as a key component. The component should be so critical to the plot that the TSA will have no choice but to ban the item once the plot is uncovered. I want to see a plot horrific and ridiculous, but just plausible enough to take seriously.

Make the TSA ban wristwatches. Or laptop computers. Or polyester. Or zippers over three inches long. You get the idea.

Your entry will be judged on the common item that the TSA has no choice but to ban, as well as the cleverness of the plot. It has to be realistic; no science fiction, please. And the write-up is critical; last year the best entries were the most entertaining to read.

As before, assume an attacker profile on the order of 9/11: 20 to 30 unskilled people, and about $500,000 with which to buy skills, equipment, etc.

Post your movie plots here on this blog.

Judging will be by me, swayed by popular acclaim in the blog comments section. The prize will be an autographed copy of Beyond Fear (in both English and Japanese) and the adulation of your peers. And, if I can swing it—I couldn’t last year—a phone call with a real live movie producer.

Entries close at the end of the month—April 30—so Crypto-Gram readers can also play.

This is not an April Fool’s joke, although it’s in the spirit of the season. The purpose of this contest is absurd humor, but I hope it also makes a point. Terrorism is a real threat, but we’re not any safer through security measures that require us to correctly guess what the terrorists are going to do next.

EDITED TO ADD (6/15): Winner here.

Posted on April 1, 2007 at 6:46 AMView Comments

A New Secure Hash Standard

The U.S. National Institute of Standards and Technology is having a competition for a new cryptographic hash function.

This matters. The phrase “one-way hash function” might sound arcane and geeky, but hash functions are the workhorses of modern cryptography. They provide web security in SSL. They help with key management in e-mail and voice encryption: PGP, Skype, all the others. They help make it harder to guess passwords. They’re used in virtual private networks, help provide DNS security and ensure that your automatic software updates are legitimate. They provide all sorts of security functions in your operating system. Every time you do something with security on the internet, a hash function is involved somewhere.

Basically, a hash function is a fingerprint function. It takes a variable-length input—anywhere from a single byte to a file terabytes in length—and converts it to a fixed-length string: 20 bytes, for example.

One-way hash functions are supposed to have two properties. First, they’re one-way. This means that it is easy to take an input and compute the hash value, but it’s impossible to take a hash value and recreate the original input. By “impossible” I mean “can’t be done in any reasonable amount of time.”

Second, they’re collision-free. This means that even though there are an infinite number of inputs for every hash value, you’re never going to find two of them. Again, “never” is defined as above. The cryptographic reasoning behind these two properties is subtle, but any cryptographic text talks about them.

The hash function you’re most likely to use routinely is SHA-1. Invented by the National Security Agency, it’s been around since 1995. Recently, though, there have been some pretty impressive cryptanalytic attacks against the algorithm. The best attack is barely on the edge of feasibility, and not effective against all applications of SHA-1. But there’s an old saying inside the NSA: “Attacks always get better; they never get worse.” It’s past time to abandon SHA-1.

There are near-term alternatives—a related algorithm called SHA-256 is the most obvious—but they’re all based on the family of hash functions first developed in 1992. We’ve learned a lot more about the topic in the past 15 years, and can certainly do better.

Why the National Institute of Standards and Technology, or NIST, though? Because it has exactly the experience and reputation we want. We were in the same position with encryption functions in 1997. We needed to replace the Data Encryption Standard, but it wasn’t obvious what should replace it. NIST decided to orchestrate a worldwide competition for a new encryption algorithm. There were 15 submissions from 10 countries—I was part of the group that submitted Twofish—and after four years of analysis and cryptanalysis, NIST chose the algorithm Rijndael to become the Advanced Encryption Standard (.pdf), or AES.

The AES competition was the most fun I’ve ever had in cryptography. Think of it as a giant cryptographic demolition derby: A bunch of us put our best work into the ring, and then we beat on each other until there was only one standing. It was really more academic and structured than that, but the process stimulated a lot of research in block-cipher design and cryptanalysis. I personally learned an enormous amount about those topics from the AES competition, and we as a community benefited immeasurably.

NIST did a great job managing the AES process, so it’s the perfect choice to do the same thing with hash functions. And it’s doing just that (.pdf). Last year and the year before, NIST sponsored two workshops to discuss the requirements for a new hash function, and last month it announced a competition to choose a replacement for SHA-1. Submissions will be due in fall 2008, and a single standard is scheduled to be chosen by the end of 2011.

Yes, this is a reasonable schedule. Designing a secure hash function seems harder than designing a secure encryption algorithm, although we don’t know whether this is inherently true of the mathematics or simply a result of our imperfect knowledge. Producing a new secure hash standard is going to take a while. Luckily, we have an interim solution in SHA-256.

Now, if you’ll excuse me, the Twofish team needs to reconstitute and get to work on an Advanced Hash Standard submission.

This essay originally appeared on Wired.com.

EDITED TO ADD (2/8): Every time I write about one-way hash functions, I get responses from people claiming they can’t possibly be secure because an infinite number of texts hash to the same short (160-bit, in the case of SHA-1) hash value. Yes, of course an infinite number of texts hash to the same value; that’s the way the function works. But the odds of it happening naturally are less than the odds of all the air molecules bunching up in the corner of the room and suffocating you, and you can’t force it to happen either. Right now, several groups are trying to implement Xiaoyun Wang’s attack against SHA-1. I predict one of them will find two texts that hash to the same value this year—it will demonstrate that the hash function is broken and be really big news.

Posted on February 8, 2007 at 9:07 AMView Comments

Notes from the Hash Function Workshop

Last month, NIST hosted the Second Hash Workshop, primarily as a vehicle for discussing a replacement strategy for SHA-1. (I liveblogged NIST’s first Cryptographic Hash Workshop here, here, here, here, and here.)

As I’ve written about before, there are some impressive cryptanalytic results against SHA-1. These attacks are still not practical, and the hash function is still operationally secure, but it makes sense for NIST to start looking at replacement strategies—before these attacks get worse.

The conference covered a wide variety of topics (see the agenda for details) on hash function design, hash function attacks, hash function features, and so on.

Perhaps the most interesting part was a panel discussion called “SHA-256 Today and Maybe Something Else in a Few Years: Effects on Research and Design.” Moderated by Paul Hoffman (VPN Consortium) and Arjen Lenstra (Ecole Polytechnique Federale de Lausanne), the panel consisted of Niels Ferguson (Microsoft), Antoine Joux (Universite de Versailles-Saint-Quentin-en-Yvelines), Bart Preneel (Katholieke Universiteit Leuven), Ron Rivest (MIT), and Adi Shamir (Weismann Institute of Science).

Paul Hoffman has posted a composite set of notes from the panel discussion. If you’re interested in the current state of hash function research, it’s well worth reading.

My opinion is that we need a new hash function, and that a NIST-sponsored contest is a great way to stimulate research in the area. I think we need one function and one function only, because users won’t know how to choose between different functions. (It would be smart to design the function with a couple of parameters that can be easily changed to increase security—increase the number of rounds, for example—but it shouldn’t be a variable that users have to decide whether or not to change.) And I think it needs to be secure in the broadest definitions we can come up with: hash functions are the workhorse of cryptographic protocols, and they’re used in all sorts of places for all sorts of reasons in all sorts of applications. We can’t limit the use of hash functions, so we can’t put one out there that’s only secure if used in a certain way.

Posted on September 11, 2006 at 3:30 PMView Comments

Stupid Security Awards Nominations Open

Get your nominations in.

The “Stupid Security Awards” aim to highlight the absurdities of the security industry. Privacy International’s director, Simon Davies, said his group had taken the initiative because of “innumerable” security initiatives around the world that had absolutely no genuine security benefit. The awards were first staged in 2003 and attracted over 5,000 nominations. This will be the second competition in the series.

“The situation has become ridiculous” said Mr Davies. “Security has become the smokescreen for incompetent and robotic managers the world over”.

Unworkable security practices and illusory security measures do nothing to help issues of real public concern. They only hinder the public, intrude unnecessary into our private lives and often reduce us to the status of cattle.

[…]

Privacy International is calling for nominations to name and shame the worst offenders. The competition closes on October 31st 2006. The award categories are:

  • Most Egregiously Stupid Award
  • Most Inexplicably Stupid Award
  • Most Annoyingly Stupid Award
  • Most Flagrantly Intrusive Award
  • Most Stupidly Counter Productive Award

The competition will be judged by an international panel of well-known security experts, public policy specialists, privacy advocates and journalists.

Posted on August 28, 2006 at 7:39 AMView Comments

Sidebar photo of Bruce Schneier by Joe MacInnis.