❌

Reading view

There are new articles available, click to refresh the page.

CUDA Basics for Hackers, Part 1: Getting Started

Welcome back, my aspiring cyberwarriors!

I think it is abundantly clear by now that the future of cybersecurity depends upon AI. This is the reason we are offering the Wittgenstein Award for the best AI cybersecurity agents. It is also the reason we are offering a series of tutorials and classes in using AI in cybersecurity.

As you know, most of the AI models run on NVIDIA GPU’s. These graphics processing units are unique in that they can process thousands of threads simultaneously (your CPU can run (4-16). These means that a GPU can do calculations on many processes at the same time, perfect for generating the graphics in your favorite game.

Artificial intelligence or large language models (LLMs) use neural networks to calculate the best answer to your prompt. Each token (~word) is chosen by the probabilities that it is the right token in the right order. This requires calculating probabilities simultaneously for thousand or even millions of tokens. This where the NVIDIA GPU’s come in.

Many years ago, NVIDIA developed a system they call CUDA or Compute Unified Device Architecture for running general purpose applications on a GPU. It is CUDA that nearly every AI developer started with and why NVIDIA is the GPU of choice. CUDA is perfect for running operations on many pieces of data simultaneously. It’s ideally suited for tasks where the work can be broken into many independent pieces and run the calculations in parallel such as image processing, deep learning, or even password cracking.

The code of any application that executes on the GPU is referred to as device code and those functions are referred as kernels. When a application launches a kernel, it launches many threads. These threads can number as many as millions. These threads are grouped and organized into thread blocks and these thread blocks are organized into a grid. These thread blocks are all exactly the same size with the same dimensions.

Since CUDA is such a key element of artificial intelligence development, we thought you should know at the least the basics of CUDA. This is the first of a series on using CUDA.


Step #1: Getting Started

Before we begin, let’s discuss the pre-requisites.

First, you need a NVIDIA GPU with CUDA support.

Second, as with any compute intensive task or cybersecurity, in general, I strongly recommend you use Linux (see my book, Linux Basics for Hackers from No Starch Press). Ubuntu or Debian is recommended (Kali Linux is Debian).

Third, you need to install the CUDA toolkit.

kali>sudo apt install nvidia-cuda-toolkit -y

Just like creating compiled programs in Linux with gcc, you will need the CUDA compiler or nvcc. You can check to see whether it is already installed by entering:

kali > nvcc --version

If you system responds with the nvcc version, the compiler is installed and we are ready to start!


Step 2: Write the CUDA Program

NVIDIA’s CUDA C++ is an extension of standard C++ designed for using the power of the GPU. Those of you comfortable with C++ should find CUDA C++ familiar and easy to work with. For the rest of you, pay close attention.

Let’s begin by creating a new file called hackers_arise_vector_cuda.cu (note the .cu extension).

Copy this program into that file.


Step 3: Compile the Code

Use the NVIDIA CUDA compiler or nvcc:

kali > nvcc hackers_arise_vector_cuda.cu -o myfirstcuda.cu

If you don’t see an error, your program has compiled successfully and is ready to run as myfirstcuda.cu (all CUDA programs use the .cu extension).


Step 4: Run the Program

Next, let’s run this simple CUDA program.

kali > ,/myfirstcuda.cu

Your output should look something this.


Step 4: What Happened?

Now, let’s look at what happened in our program.

In the first line, the code includes the C++ iostream that runs on the CPU providing standard in and standard out. In the second line, the code includes cuda_runtime.h which is the primary header file for the CUDA Runtime API.

Next, we create a CUDA kernel function that can run on a GPU. the __global__ indicates that this function can be installed from the CPU and run in the GPU.

Our program then calculates the global thread ID.

Next, after boundary checking, we generate the array size and then allocate memory on the host CPU.

Then, we initialize the host (CPU) arrays with sample data.

Next, we allocate memory on the device or GPU.

Then we copy the data from the host CPU to the device, GPU.

Next, we define the execution configuration (threads and blocks). In this case, we are designating 256 threads per block and then calculate how many blocks we need.

Next, we launch the kernel on the GPU using multiple threads

We need to wait for the GPU to complete it’s work before trying to access on the CPU.

Then we copy the results from the GPU to the CPU.

Next we verify the results by sending the first 5 values to standard out.

Finally, before we leave, we need free up the memory.

Summary

CUDA or Computer Unified Device Architecture is a framework developed by NVIDIA to fully utilize the strength of GPU’s. It use an extended C++ (as well as Python) to convert the problem in to a multi-threaded application. It is this framework that makes NVIDIA GPU’s the first choice for AI developers.

CUDA can also be used for many applications in cybersecurity including:

  1. Password cracking and brute-force attacks
  2. Real-time threat detection
  3. Phishing and Malware Analysis
  4. Post-Quantum Cryptography
  5. Network Graph Analysis.

As this world transitions to artificial intelligence, stick to Hackers-Arise for the latest developments and techniques including the awarding of the Wittgenstein Award in 2027 for the best cybersecurity AI agents.



The post CUDA Basics for Hackers, Part 1: Getting Started first appeared on Hackers Arise.

Post-Quantum Network Readiness

The Quantum computing industry is making leaps and bounds towards developing quantum computers that can–among other things–break the encryption that keeps our data safe and confidential. Some say it will take place in as little as two years, but even the most conservative estimates are for four years or 2030. In either case, it is time to begin to prepare your network for the coming post-quantum world.

To learn more about this risk, see my interview with David Bombal on Quantum Computing here.

When that day arrives, all of our encryption– and therefore all our data– will be exposed to anybody who has a quantum computer. Initially, this will be only nation state actors such as the US, China, Israel, and Russia.

No need to fret or stress as people have been preparing for this day for many years and have developed post-quantum cryptography (PQC). This field is in constant flux and recently one of the post-quantum cryptographic algorithms (HAWK) was found to be breakable by quantum computers. The point here is that this field is changing rapidly, not unlike artificial intelligence.

Some people have compared this to the Y2K crisis that took place some 26 years ago. At that time, nearly everybody was looking for a crisis that would break systems once we transitioned from a two-digit year to a four-digit year.The fact that no crises took place in 2000 can be attributed to years of preparedness for that potential crisis. Companies and institutions spent at least two or three years preparing for it and as a result nothing adverse really took place. It all went very smoothly.

For your organization, you need to start preparing now. To help you to prepare, Hackers Arise has developed a course on preparing your network for the post-quantum world. The training will be offered over 3 days October 13-15.

Post-Quantum Network Readiness

Outline

1.What are Quantum Computers are What Makes them Different

2. The Quantum Countdown: Harvest-Now-Decrypt-Later & Why Your Network Is Already Exposed

3. Know Your Attack Surface: Automated Cryptographic Discovery & CBOM

4. The New Arsenal in Action: NIST PQC Standards (ML-KEM, ML-DSA, SLH-DSA) with OpenSSL 3.5 & liboqs

5. Hardening the Wire: Hybrid TLS 1.3 & Quantum-Safe Tunnels

6. Post-Quantum PKI at Scale: Certificates, Signature Bloat & Real Network Performance Impact

7. From Vulnerable to Quantum-Ready: A Phased Migration Roadmap, Crypto-Agility & End-to-EndΒ 

The post Post-Quantum Network Readiness first appeared on Hackers Arise.

Quantum Resistance: Scanning Company Assets for PQC Readiness

Welcome back, cyberwarriors!Β 

Almost a year ago, OTW spoke about quantum computers and the risk of our encryption getting broken within three years. In March, Google shared its concern on the same issue, moving up its own post-quantum migration deadline to 2029. Some companies are migrating to mitigate that risk, but not many are taking it seriously. Eventually, a huge number of companies are going to get left behind with weak and breakable encryption. Hackers will only benefit from that negligence.

To help you minimize the risk and get an actionable plan with recommendations tailored to your company, we want to show you how AC-Scanner works.

AC-Scanner

AC-Scanner is basically a script for post-quantum cryptography exposure assessment. It maps your full cryptographic attack surface across TLS endpoints and SSH services, assesses every asset against NIST post-quantum standards and generates a structured Cryptographic Bill of Materials (CBOM).

Before we continue with the scan, you might want to watch a video by OTW and David Bombal on the risk of quantum computing being able to decrypt things at mass scale and expose session keys.

Setting Up

Docker is the easiest way to get started. We’ll start with the CLI version first, then show you how to get the web version up and running. They both work the same way, so you can choose any.

First install Docker on your system:

ubuntu > sudo apt update
ubuntu > sudo apt install docker.io

Then switch to root and pull it:

root > docker pull qubitac/acscanner:latest
docker pull

Now it’s ready, so let’s see the help menu.Β 

root > docker run --rm -it qubitac/acscanner:latest bash -c 'rm -f /.dockerenv && cd /app/scripts && ./scan.sh -h'
ac scan help menu

We’re only interested in the presets here. As you can see, you can test basically any of your assets.

Scanning Assets – CLI

Let’s choose some random Russian company for this scan. We don’t intend them to benefit from the results, we will just use it for demonstration to show how prevalent the issue is.

For our scan we used –all to scan everything:Β 

root > mkdir -p ~/ac-scans/example.com && docker run --rm -it -v ~/ac-scans/example.com:/app/scripts/example.com qubitac/acscanner:latest bash -c 'rm -f /.dockerenv && cd /app/scripts && ./scan.sh --noinstall example.com --all'
scanning the assets

If you’re testing a big company, it will take time.Β 

results

Results will be stored in ~/ac-scans

files

Here we only need crypto-bom.json that’s hiding in cbom.

Results

Upload crypto-bom.json to the dashboard by clicking Load CBOM. You will see the overview.Β 

dashboard

You can already see the infrastructure is not PQC ready and has several critical issues.Β 

The next step is HTTPS. Although 9 of their endpoints are using HTTPS, it’s vulnerable and the risks are high.

https

The scanner tried to fingerprint the SSH endpoints too, but they weren’t open.

ssh

Let’s look at the issues that the company has. It will show all the affected hosts with severity assigned to each.Β 

issues

Quantum risks may help tracking the progress of your migration. The results below are from a different company, but you can see they have only 3 PQC ready hosts out of 308.Β 

Recommendations will help you address issues by giving you prioritized actions.Β 

The recommendations were intentionally redacted by us to make them unusable. However, you can still clearly see how the page is structured.

Finally, your main goal is migration. Here it lists all the migration phases and gives you deadlines by which they need to be completed.Β 

pqc migration

As you can see, legacy TLS should be abandoned by 2027 and hybrid PQC key exchange should be introduced no later than 2028. That applies to everyone, not just this organization in particular. The report gives clarity and orients your client so there’s no confusion.

Scanning Assets – Web

If you don’t want to work in the terminal, you can use the web version.Β 

root > docker pull qubitac/acscanner
root > docker run -d --name acscanner -p 8080:80 qubitac/acscanner:latest 
docker web version

It’s available in the browser on http://localhost:8080/.

ac scanner web

Summary

AC-Scanner is easy to work with if you use Docker, otherwise you’ll run into some incompatibility issues. The dashboard has all the valuable information and most importantly it’s actionable and orienting. You don’t just see the vulnerabilities, you get a guide with recommendations on how to fix them too. Your client will definitely appreciate that.

Want to learn how to prepare your network for the post-quantum world? Join our Preparing Your Network for the Post-Quantum World training, taking place October 13-15 at 3 PM UTC. Available exclusively to Subscriber PRO students.

The post Quantum Resistance: Scanning Company Assets for PQC Readiness first appeared on Hackers Arise.

❌