Avi Rubin: All your devices can be hacked

Translator: Joseph Geni Reviewer: Morton Bast

翻译人员: Xue Chen 校对人员: Kwok Ping Lau

I'm a computer science professor,

我是一个计算机科学教授

and my area of expertise is

我的专业领域是

computer and information security.

计算机与信息安全

When I was in graduate school,

当我还在研究生院的时候

I had the opportunity to overhear my grandmother

我有次听见了我祖母

describing to one of her fellow senior citizens

向她的一位高龄同乡描述

what I did for a living.

我的工作。

Apparently, I was in charge of making sure that

没想到，她说我的工作是确保

no one stole the computers from the university. (Laughter)

学校的计算机不被小偷偷走 (笑声)

And, you know, that's a perfectly reasonable thing

但你也会觉得她这么想是完全合理的

for her to think, because I told her I was working

因为我告诉她我工作内容是

in computer security,

计算机安全，

and it was interesting to get her perspective.

但是能够得知她的观点真的很有趣。

But that's not the most ridiculous thing I've ever heard

但这并不是我所听过对我工作

anyone say about my work.

最离谱的叙述。

The most ridiculous thing I ever heard is,

我听过最谱奇的版本是，

I was at a dinner party, and a woman heard

我在一个晚宴上，然後有一位女士听说

that I work in computer security,

我是负责计算机安全的，

and she asked me if -- she said her computer had been

于是她问我如果－她的电脑

infected by a virus, and she was very concerned that she

感染了病毒，所以她十分担心自己

might get sick from it, that she could get this virus. (Laughter)

会因此而生病，会感染到这个病毒 (笑声)

And I'm not a doctor, but I reassured her

虽然我不是个医生，但我向她再三保证

that it was very, very unlikely that this would happen,

这种事不可能会发生

but if she felt more comfortable, she could be free to use

但如果她还是不放心，她或许可以考虑

latex gloves when she was on the computer,

在用电脑的时候带着橡胶手套，

and there would be no harm whatsoever in that.

而且这无论如何都是无害的。

I'm going to get back to this notion of being able to get

我一会儿会回过头来谈谈这种能够被

a virus from your computer, in a serious way.

自己电脑的病毒感染的想法，用一个更严肃的角度来谈

What I'm going to talk to you about today

今天我要讲的是

are some hacks, some real world cyberattacks that people

一些在我领域，学术研究界的人员

in my community, the academic research community,

所进行大多人所不知的

have performed, which I don't think

黑客活动

most people know about,

和一些真实世界的网络攻击，

and I think they're very interesting and scary,

我觉得它们既有意思又可怕，

and this talk is kind of a greatest hits

而这次的演说就有点像是 学术的安全共同体中的

of the academic security community's hacks.

经典黑客案例

None of the work is my work. It's all work

这些都不是我个人的工作。这全部都是

that my colleagues have done, and I actually asked them

我同事做的，而我其实还向他们要了一些

for their slides and incorporated them into this talk.

幻灯片并把它们加到我的演讲里。

So the first one I'm going to talk about

那么，我要讲的第一个案例就是

are implanted medical devices.

植入性医疗器械。

Now medical devices have come a long way technologically.

当今的医疗器械是经历了 一段很长的科技发展。

You can see in 1926 the first pacemaker was invented.

你可以看到，第一款心脏起搏器发明于1926年。

1960, the first internal pacemaker was implanted,

1960年，第一个体内心脏起搏器被植入，

hopefully a little smaller than that one that you see there,

希望是比大家在这看到的要小一些，

and the technology has continued to move forward.

之后，这方面的技术一直在不断地发展。

In 2006, we hit an important milestone from the perspective

到了2006年，我们迎来了一个重要的里程碑，

of computer security.

对于电脑安全而言。

And why do I say that?

那我为什么这么说呢？

Because that's when implanted devices inside of people

那是因为这正是植入人体的器械

started to have networking capabilities.

开始具备联网能力的时候。

One thing that brings us close to home is we look

一件带我们回主题的事就是当我们

at Dick Cheney's device, he had a device that

看到迪克·切尼的仪器，他拥有一可以

pumped blood from an aorta to another part of the heart,

将血液从一个大动脉输送到 心脏的另一个部分的仪器，

and as you can see at the bottom there,

就如你在底部所看到的，

it was controlled by a computer controller,

它是被一个电脑控制器所控制的，

and if you ever thought that software liability

如果你认为软件责任

was very important, get one of these inside of you.

非常重大的话，你可以给自己装一个这个。

Now what a research team did was they got their hands

现在有一支研究团队所做的就是得到了一个

on what's called an ICD.

被称作 ICD 的器件。 (植入型心律转复除颤器)

This is a defibrillator, and this is a device

这是一个复除颤器，而且这是个

that goes into a person to control their heart rhythm,

用在人体体内来控制他们心率的仪器，

and these have saved many lives.

而且这仪器还救过不少人的命。

Well, in order to not have to open up the person

那麽，为了不用每次给装置重新编程

every time you want to reprogram their device

或者进行某些其他的检测的时候

or do some diagnostics on it, they made the thing be able

都要剖开病人的胸腔，他们让这个装置

to communicate wirelessly, and what this research team did

可以无线通讯，而这个研究团队所做的

is they reverse engineered the wireless protocol,

就是对无线协议做逆向工程，

and they built the device you see pictured here,

并制作出你现在所看到的图中所显示的仪器，

with a little antenna, that could talk the protocol

它还有一个小天线用于与设备

to the device, and thus control it.

进行交流，从而进行操控。

In order to make their experience real -- they were unable

为了让他们的试验更真实－他们无法

to find any volunteers, and so they went

找到任何志愿者，所以他们找来

and they got some ground beef and some bacon

一些牛肉馅儿和培根肉

and they wrapped it all up to about the size

弄成一个大小和人体内

of a human being's area where the device would go,

安放这个装置差不多大小的区域，

and they stuck the device inside it

然后他们把这个装置放了进去

to perform their experiment somewhat realistically.

从而使他们的实验近乎真实。

They launched many, many successful attacks.

他们进行了很多很多成功的攻击。

One that I'll highlight here is changing the patient's name.

我特别想重点讲一下的是他们成功地修改了病人的姓名信息。

I don't know why you would want to do that,

我不清楚为什么有人要这么做 ，

but I sure wouldn't want that done to me.

但是我肯定不愿意有人对我这么做。

And they were able to change therapies,

他们还能够更改治疗方案，

including disabling the device -- and this is with a real,

包括使设备失效－而这些都发生在一个真的

commercial, off-the-shelf device --

营利的、市场上能买到的心率仪上 --

simply by performing reverse engineering and sending

仅仅是通过反向破解以及向其

wireless signals to it.

发送无线指令就能实现。

There was a piece on NPR that some of these ICDs

NPR 上曾经有过一则新闻报到了 (美国国家公共广播电台)

could actually have their performance disrupted

一些ICD的运行甚至可以被

simply by holding a pair of headphones onto them.

放在其上面的一副耳机扰乱

Now, wireless and the Internet

如今，无线技术和互联网

can improve health care greatly.

能够大大改善医疗服务

There's several examples up on the screen

屏幕上显示的几个例子是一些

of situations where doctors are looking to implant devices

医生要为病人体内植入医疗装置

inside of people, and all of these devices now,

的情况，而现今所有这方面的仪器，

it's standard that they communicate wirelessly,

无线联网已经成为了标准配备，

and I think this is great,

我认为这很了不起，

but without a full understanding of trustworthy computing,

但是如果没有全面的了解和可靠的计算，

and without understanding what attackers can do

和没有认识到攻击行为所造成的影响

and the security risks from the beginning,

以及固有的安全隐患，

there's a lot of danger in this.

这就会带来很多危险。

Okay, let me shift gears and show you another target.

好的，让我换个机械向你们展示另外一个攻击对象。

I'm going to show you a few different targets like this,

我将向你们展示几个类似的攻击对象，

and that's my talk. So we'll look at automobiles.

它们是我演讲的主要部分。我们接下来看看汽车。

This is a car, and it has a lot of components,

这是一辆车，它拥有很多组成部分，

a lot of electronics in it today.

如今还拥有许多的电子零件。

In fact, it's got many, many different computers inside of it,

事实上，它里面有很多很多台不同的电脑，

more Pentiums than my lab did when I was in college,

它所拥有的奔腾处理器比我大学时期的实验室里的还多，

and they're connected by a wired network.

而且这些电脑之间是由内部线路相连。

There's also a wireless network in the car,

车内也有一个无线网络，

which can be reached from many different ways.

它可以通过不同的方式与外界相连。

So there's Bluetooth, there's the FM and XM radio,

包含了蓝牙，有FM广播和XM广播，

there's actually wi-fi, there's sensors in the wheels

甚至还有wi-fi，车轮里面有传感器

that wirelessly communicate the tire pressure

可以通过无线网络监测轮胎气压

to a controller on board.

并传输给控制板。

The modern car is a sophisticated multi-computer device.

现代汽车是非常复杂的多电脑设备

And what happens if somebody wanted to attack this?

那如果有人想攻击这台设备的话 会发生什么呢？

Well, that's what the researchers

这就是今天我演讲中的

that I'm going to talk about today did.

研究者们所做的。

They basically stuck an attacker on the wired network

他们很根本地在汽车的有线和无线网络上

and on the wireless network.

都安装了攻击装置。

Now, they have two areas they can attack.

现在，他们可以通过两种方式进行攻击。

One is short-range wireless, where you can actually

一种是短程无线网络，这样你可以直接

communicate with the device from nearby,

和附近的装置进行通信，

either through Bluetooth or wi-fi,

比如通过蓝牙或 wi-fi，

and the other is long-range, where you can communicate

另一个是远程网络，让你可以

with the car through the cellular network,

通过移动网络

or through one of the radio stations.

或者通过某个无线电电台与车进行通信。

Think about it. When a car receives a radio signal,

想想看。当一辆汽车接收到无线电信号，

it's processed by software.

软件会对这信号进行处理。

That software has to receive and decode the radio signal,

这软件必需对信号进行接收和解码

and then figure out what to do with it,

从而弄明白如何进行处理，

even if it's just music that it needs to play on the radio,

即便那只是电台音乐，

and that software that does that decoding,

而那进行解码的软件，

if it has any bugs in it, could create a vulnerability

如果存有任何漏洞，就有机会

for somebody to hack the car.

让他人入侵汽车的电脑系统中。

The way that the researchers did this work is,

研究人员试验的方法就是，

they read the software in the computer chips

他们读取了车内电脑芯片中的软件

that were in the car, and then they used sophisticated

之后他们运用复杂的

reverse engineering tools

反向破解工具

to figure out what that software did,

来弄明白了这个软件的功能，

and then they found vulnerabilities in that software,

并且找到了软休的漏洞，

and then they built exploits to exploit those.

之后他们利用这些漏洞建造后门。

They actually carried out their attack in real life.

他们真的在现实生活中试验了这些攻击。

They bought two cars, and I guess

他们买了两辆车，

they have better budgets than I do.

我猜他们的经费比我要宽裕一些。

The first threat model was to see what someone could do

第一个攻击计划是想看看一个人能在

if an attacker actually got access

攻击者得到许可进入汽车的

to the internal network on the car.

内部网络时做些什麽。

Okay, so think of that as, someone gets to go to your car,

好的，假设有一个人可以接近你的车，

they get to mess around with it, and then they leave,

在车中做了一些手脚，然后离开，

and now, what kind of trouble are you in?

那现在，你会遇到些什么麻烦呢？

The other threat model is that they contact you

另一个计划是他们通过

in real time over one of the wireless networks

无线网络进行实时交流

like the cellular, or something like that,

就像手机或是其他类似的方式，

never having actually gotten physical access to your car.

根本不需要跟你的车有任何的物理上的接触。

This is what their setup looks like for the first model,

这是他们第一个模型设置的样子，

where you get to have access to the car.

在这他们可以接触到车。

They put a laptop, and they connected to the diagnostic unit

他们放了一个笔记本电脑， 并把它连接到车内部网络的

on the in-car network, and they did all kinds of silly things,

诊断单元，他们利用这些做了各种各样好玩的把戏，

like here's a picture of the speedometer

像这张车速表的照片

showing 140 miles an hour when the car's in park.

在车静止的情况下显示每小时140英里。

Once you have control of the car's computers,

当你控制住车内电脑系统，

you can do anything.

你可以做任何事。

Now you might say, "Okay, that's silly."

你也许会觉得，“这只是搞笑而已。”

Well, what if you make the car always say

那如果你让车总是显示

it's going 20 miles an hour slower than it's actually going?

比真正的速度慢了20英里每小时呢？

You might produce a lot of speeding tickets.

这样会拿到很多超速罚单。

Then they went out to an abandoned airstrip with two cars,

之后他们开了两辆车到一个废弃的简易机场，

the target victim car and the chase car,

一辆目标车，一辆追踪车，

and they launched a bunch of other attacks.

他们并进行了更多其他的攻击。

One of the things they were able to do from the chase car

其中一件可以从追踪车里做到的是

is apply the brakes on the other car,

在目标车中进行刹车，

simply by hacking the computer.

这只需要侵入目标车的电脑就可以了。

They were able to disable the brakes.

他们可以废掉刹车系统。

They also were able to install malware that wouldn't kick in

他们还可以安装一些恶意软件要在车子

and wouldn't trigger until the car was doing something like

做出特定的指令下，比方说车速在20英里每小时

going over 20 miles an hour, or something like that.

或类似的指令才会启动。

The results are astonishing, and when they gave this talk,

这个结果非常的震撼，而当他们做这个演讲时，

even though they gave this talk at a conference

即使是在一个充满

to a bunch of computer security researchers,

电脑安全研究人员的会议，

everybody was gasping.

所有人都难以之信。

They were able to take over a bunch of critical computers

他们成功的控制了车内很多

inside the car: the brakes computer, the lighting computer,

重要的电脑系统：刹车系统，照明系统，

the engine, the dash, the radio, etc.,

发动机，仪表盘，无线电台，等等，

and they were able to perform these on real commercial

而且他们可以在他们所购买的商务车中

cars that they purchased using the radio network.

利用无线网络来做这些事情。

They were able to compromise every single one of the

他们可以妥協每一个

pieces of software that controlled every single one

操控每一项

of the wireless capabilities of the car.

车内无线功能的软件。

All of these were implemented successfully.

所有的实验都成功的实施了。

How would you steal a car in this model?

你要怎样去偷这类型的车呢？

Well, you compromise the car by a buffer overflow

首先你从内部软件缓冲区溢出的

of vulnerability in the software, something like that.

漏洞开始侵入，就像这样。

You use the GPS in the car to locate it.

你再用车内置的导航器确定它的位置。

You remotely unlock the doors through the computer

再用电脑遥控打开车门，

that controls that, start the engine, bypass anti-theft,

启动发动机，绕过防盗系统，

and you've got yourself a car.

这样你就弄到了一辆车。

Surveillance was really interesting.

监控是很有意思的。

The authors of the study have a video where they show

这个研究的作者们有一个影像显示

themselves taking over a car and then turning on

他们侵入一辆车，然后打开

the microphone in the car, and listening in on the car

车内的话筒，听著车内的声音

while tracking it via GPS on a map,

并同时用导航器跟踪车的位置，

and so that's something that the drivers of the car

而这些是车的司机

would never know was happening.

绝对不会知道的。

Am I scaring you yet?

我吓到你们了吗？

I've got a few more of these interesting ones.

我还有几个很有趣的实验。

These are ones where I went to a conference,

这些是我从一个我去过的会议所知道的，

and my mind was just blown, and I said,

我当时惊呆了，我说

"I have to share this with other people."

“我得跟其他人分享这个信息。”

This was Fabian Monrose's lab

这是北卡大学 Fabian Monrose 教授的实验室，

at the University of North Carolina, and what they did was

他们做的实验

something intuitive once you see it,

是一个当你看了之后会觉得很直观，

but kind of surprising.

但也会很惊讶的实验。

They videotaped people on a bus,

他们录下了在公车上的人们，

and then they post-processed the video.

然后后期处理这些视频。

What you see here in number one is a

你在一号所看到的是

reflection in somebody's glasses of the smartphone

在输入手机的某人的眼镜中所反射

that they're typing in.

出来的智慧型手机映像。

They wrote software to stabilize --

他们编了一个软件来稳定 --

even though they were on a bus

即使他们在公车上

and maybe someone's holding their phone at an angle --

或是有人会把手机摆在一个特殊的角度 --

to stabilize the phone, process it, and

来稳定这个手机，处理它，

you may know on your smartphone, when you type

你也许知道，当你在智慧型手机上输入

a password, the keys pop out a little bit, and they were able

密码时，对应键会放大一点，因此他们可以

to use that to reconstruct what the person was typing,

利用这一点去重组那个人所输入的东西，

and had a language model for detecting typing.

还有一个语言模型去检测输入行为。

What was interesting is, by videotaping on a bus,

有意思的是，利用公车上的录像

they were able to produce exactly what people

他们可以准确无误的得到他人在

on their smartphones were typing,

手机上输入什么，

and then they had a surprising result, which is that

之后他们还发现了一个意外结果，就是

their software had not only done it for their target,

他们的软件不但会对他们的目标进行处理，

but other people who accidentally happened

也可以对那些意外入镜的

to be in the picture, they were able to produce

人进行分析出

what those people had been typing, and that was kind of

那些人都输入了什么，而这些

an accidental artifact of what their software was doing.

是这软件进行中所得到的意外收获。

I'll show you two more. One is P25 radios.

我再给你们看两个例子。一个是P25无线电。

P25 radios are used by law enforcement

P25无线电是执法部门

and all kinds of government agencies

和种种政府机构

and people in combat to communicate,

以及战场上的人们交流所使用的，

and there's an encryption option on these phones.

而这些电话里都会有加密选项。

This is what the phone looks like. It's not really a phone.

这电话就是长这个样子。这不是真正的电话。

It's more of a two-way radio.

它比较像是双向无线电。

Motorola makes the most widely used one, and you can see

摩托罗拉是这电话的最大生产商，你也会看到

that they're used by Secret Service, they're used in combat,

它们是被秘密机构以及战场上所使用，

it's a very, very common standard in the U.S. and elsewhere.

它在美国和其他地方都非常~非常的常见的标准。

So one question the researchers asked themselves is,

所以研究员们自问的一个问题就是

could you block this thing, right?

可以阻止这个东西~~~吧？

Could you run a denial-of-service,

可以执行拒绝服务吗？

because these are first responders?

因为这些都是抢险救生员。

So, would a terrorist organization want to black out the

那么，恐怖组织会想要阻断

ability of police and fire to communicate at an emergency?

警察和火警的紧急联系功能吗？

They found that there's this GirlTech device used for texting

他们发现有个叫GirlTech的信息设备

that happens to operate at the same exact frequency

所使用的频道和 P25 是一样的，

as the P25, and they built what they called

然後他们建造了一个叫

My First Jammer. (Laughter)

"我的第一干扰"。（笑声）

If you look closely at this device,

如果你仔细看这个设备，

it's got a switch for encryption or cleartext.

这里有个开关可以切换加密或是明文。

Let me advance the slide, and now I'll go back.

让我先到下一页，然後现在我再回去。

You see the difference?

你看到那差异了吗？

This is plain text. This is encrypted.

这是明文，这是加密。

There's one little dot that shows up on the screen,

屏幕上出现一个小点，

and one little tiny turn of the switch.

而开关也转了一点点。

And so the researchers asked themselves, "I wonder how

那些研究员们就自问，“我猜想

many times very secure, important, sensitive conversations

有多少非常保密的，重要的，敏感的谈话

are happening on these two-way radios where they forget

是在这些他们忘记加密

to encrypt and they don't notice that they didn't encrypt?"

而且没有注意到这回事的双向无线电的情况下进行呢?

So they bought a scanner. These are perfectly legal

他们买了一个扫描仪。这些都是完全合法的

and they run at the frequency of the P25,

他们并在P25的频率下运行这扫描仪，

and what they did is they hopped around frequencies

之後他们在这个频率周围不停地转动

and they wrote software to listen in.

然後用他们所写的软件来监听。

If they found encrypted communication, they stayed

如果他们找到了加密的对话，他们就停留

on that channel and they wrote down, that's a channel

在那个频道，然后写下这是

that these people communicate in,

那些人交流的频道，

these law enforcement agencies,

那些执法机构，

and they went to 20 metropolitan areas and listened in

他们去了20个大都市区监听

on conversations that were happening at those frequencies.

这些频道上的所进行的对话。

They found that in every metropolitan area,

他们发现在每一个大都会区

they would capture over 20 minutes a day

他们每天都能捕捉到至少20分钟的

of cleartext communication.

明文交流。

And what kind of things were people talking about?

那他们都交流些什么呢？

Well, they found the names and information

他们得到了秘密举报人的

about confidential informants. They found information

名字和信息。他们得到了

that was being recorded in wiretaps,

正在被窃听的信息，

a bunch of crimes that were being discussed,

一堆正在被讨论的犯罪案件，

sensitive information.

敏感的消息。

It was mostly law enforcement and criminal.

大多数都是执法和犯罪类的。

They went and reported this to the law enforcement

他们向执法机构说明了这件事，

agencies, after anonymizing it,

当然是在匿名之后，

and the vulnerability here is simply the user interface

而当中的漏洞很纯粹的只是用户界面

wasn't good enough. If you're talking

不够好。如果你是在讨论

about something really secure and sensitive, it should

一些非常保密或者敏感话题，你应该

be really clear to you that this conversation is encrypted.

清楚的知道这个谈话是被加密的。

That one's pretty easy to fix.

这个很容易修正。

The last one I thought was really, really cool,

最后一例子我认为是非常，非常的牛，

and I just had to show it to you, it's probably not something

所以我必须得给你们看这个，这可能不是一些

that you're going to lose sleep over

会使你们失眠的东西，

like the cars or the defibrillators,

像是汽车实验和心脏去颤器那样，

but it's stealing keystrokes.

但这个是窃取击键。

Now, we've all looked at smartphones upside down.

至今，我们都彻底的观察过智慧型手机。

Every security expert wants to hack a smartphone,

每个安全专家都想要侵入这样的手机系统，

and we tend to look at the USB port, the GPS for tracking,

而我们一般都会去看USB插头，跟踪GPS，

the camera, the microphone, but no one up till this point

相机，话筒，但目前为止没有人

had looked at the accelerometer.

看过加速规。

The accelerometer is the thing that determines

加速规是那个决定

the vertical orientation of the smartphone.

手机垂直方向的东西。

And so they had a simple setup.

因此他们有个很简单的设置。

They put a smartphone next to a keyboard,

他们把手机放在键盘旁边，

and they had people type, and then their goal was

然後他们让人们去打字， 而他们的目标是

to use the vibrations that were created by typing

利用打字而产生的震动

to measure the change in the accelerometer reading

去测量加速规的数据的变化

to determine what the person had been typing.

由此来判断这个人输入的是什么。

Now, when they tried this on an iPhone 3GS,

那么当他们在用iPhone 3GS做这实验时，

this is a graph of the perturbations that were created

这是他们从打字所得到的

by the typing, and you can see that it's very difficult

扰动图，而你可以了解到这是很难

to tell when somebody was typing or what they were typing,

判断什么时候有人在打字 或者他们打过了什么字，

but the iPhone 4 greatly improved the accelerometer,

但是iPhone 4在加速规上有很大的提高，

and so the same measurement

因此同样的测量

produced this graph.

所得到的图是这样的。

Now that gave you a lot of information while someone

这么现在有人在打字时 就会给出更多的信息了，

was typing, and what they did then is used advanced

那他们接下来用了一个先进的

artificial intelligence techniques called machine learning

人工智能技术，称作"机器学习"

to have a training phase,

来进行一个培训阶段，

and so they got most likely grad students

然后他们极有可能是找了一些研究生

to type in a whole lot of things, and to learn,

去输入一大堆的东西，然后去学习，

to have the system use the machine learning tools that

让这个系统利用已有的机器学习工具去

were available to learn what it is that the people were typing

了解这些人输入的是什么

and to match that up

并结合了

with the measurements in the accelerometer.

加速规所测量的数据。

And then there's the attack phase, where you get

接下来就是攻击阶段了，你找

somebody to type something in, you don't know what it was,

一些人来输入一些东西， 但是你不知道输入的是什麽

but you use your model that you created

但你利用之前在培训中

in the training phase to figure out what they were typing.

所编写的模式来得出输入的内容。

They had pretty good success. This is an article from the USA Today.

他们有很好的成功几率。 这是一篇出至《今日美国》的文章。

They typed in, "The Illinois Supreme Court has ruled

他们输入了“伊利诺伊州最高法院裁定

that Rahm Emanuel is eligible to run for Mayor of Chicago"

伊曼纽尔拥有参加芝加哥市长竞选的资格”

— see, I tied it in to the last talk —

－看，我结合了上一个演讲－

"and ordered him to stay on the ballot."

“并且命令他必需留在选票上”。

Now, the system is interesting, because it produced

这个系统很有趣，因为它分析出了

"Illinois Supreme" and then it wasn't sure.

“伊利诺伊州最高” 而之后的它就不确定了。

The model produced a bunch of options,

这个模式给了一堆的选择，

and this is the beauty of some of the A.I. techniques,

这也就是人工智能技术厉害的地方，

is that computers are good at some things,

也就是电脑在某方面很在行，

humans are good at other things,

而人类则是在别的方面很强，

take the best of both and let the humans solve this one.

结合双方的优势， 并让人类去解决这一个问题。

Don't waste computer cycles.

不去浪费电脑的周期。

A human's not going to think it's the Supreme might.

一个人是不会认为那会是 "最高可能" 。

It's the Supreme Court, right?

当然是"最高法院"，对吧？

And so, together we're able to reproduce typing

也因此，人们和机器一起 可以只测量加速规的

simply by measuring the accelerometer.

数据来得出打出来的内容。

Why does this matter? Well, in the Android platform,

这有什么重要的呢？好吧，用安卓平台来

for example, the developers have a manifest

举个例子，开发者们有一个清单，

where every device on there, the microphone, etc.,

当中的每一个设备，像是麦克风等等，

has to register if you're going to use it

都需要注册，如果有你要用它

so that hackers can't take over it,

好让黑客无法侵入它的话，

but nobody controls the accelerometer.

但是没人控制加速规。

So what's the point? You can leave your iPhone next to

那重点在那呢？ 你可以把你的iPhone放在

someone's keyboard, and just leave the room,

某人的键盘旁边，然后就离开房间，

and then later recover what they did,

之后再回来复原他们所做过的事，

even without using the microphone.

就连麦克风都不需要。

If someone is able to put malware on your iPhone,

如果有人能够把入侵软件装入你的iPhone，

they could then maybe get the typing that you do

他们也就可能得到你所输入的内容，

whenever you put your iPhone next to your keyboard.

每当你把你的iPhone放在你的键盘旁边。

There's several other notable attacks that unfortunately

另外还有几个值得注意的攻击，但我很不幸的

I don't have time to go into, but the one that I wanted

没有时间去说，但有一个我想点出

to point out was a group from the University of Michigan

的是在密西根大学的一组人员，

which was able to take voting machines,

他们成功的侵入了投票机，

the Sequoia AVC Edge DREs that

这是 Sequoia AVC Edge DRE (美国最大的电子投票机制造商之一)

were going to be used in New Jersey in the election

准备在新泽西州选举中用，

that were left in a hallway, and put Pac-Man on it.

它被留在了一个走廊里， 他们在里面安装了吃豆人游戏。

So they ran the Pac-Man game.

他们安装了吃豆人游戏，所以呢？

What does this all mean?

这些都有什么意义呢？

Well, I think that society tends to adopt technology

我觉得我们的社会往往很快的采用新技术

really quickly. I love the next coolest gadget.

我非常喜欢下一个最炫的小玩意儿。

But it's very important, and these researchers are showing,

但是更重要的是，这些研究人员所显示的，

that the developers of these things

这些东西的开发者

need to take security into account from the very beginning,

需要从一开始就把安全考虑在内，

and need to realize that they may have a threat model,

也需要意识到它们可能会有的威胁模型，

but the attackers may not be nice enough

但是那些攻击者也许不会好心到

to limit themselves to that threat model,

只把他们局限于这些威胁模型中，

and so you need to think outside of the box.

所以你需要跳脱传统思维。

What we can do is be aware

我们所能做得就是要意识到

that devices can be compromised,

设备是可以被妥协的，

and anything that has software in it

而任何有软件的东西

is going to be vulnerable. It's going to have bugs.

都是会有弱点的。它们是会有错误的。

Thank you very much. (Applause)

非常感谢。（掌声）