Security Confidential S11 E10 Chris Rock

Manoj: So now tell me, how do you think—let’s talk about something scary: terrorism. Why haven’t terrorists taken down a government? Can they, with a cyber breach or breaches or a well-crafted attack? Can terrorism or cyber mercenaries overthrow a government?

Chris Rock: Yes, definitely. Definitely. The beauty of cyber is you can control every narrative. And what I mean by that is when you start breaking down society and you think government, and then you think finance, and you think telecommunications, and everything in your life—if you can control those layers, then you essentially can control overthrowing your government.

And what I mean by that is—I’ll pick an example. Have you ever gone through an area—let’s say you’re driving through California and there’s a cell tower—well, they broadcast information out to you, and that information might be that the cell tower is going for upgrades and is going to be out of signal between these hours. We get that all the time in Australia.

Now, if you can control that, if you can then broadcast to anyone who goes within a certain region—you can actually broadcast a text message. And if everyone—then they’ve seen a cell tower before. They’re not well protected. I know they’re classified as critical infrastructure, but they’re not actually well secured. So if you could actually—then anyone who comes in range of that cell tower broadcast message—is that single point of pull? I call that a lever.

So that’s level one. Level two is then compromising a bank and then freezing everyone’s bank account, and that would be another lever. So when you talk about how you would do it, you essentially need to compromise everything that you could then trigger all at once.

For example—I’m rambling—but if you’re driving into an area and all of a sudden you get an SMS saying your account—the government has frozen your accounts due to XYZ—and then you try to log on to your bank account and see that you’ve got a zero balance, all of a sudden you can then trigger an emotional response. Everyone hates it when they think they have no money. That is probably the worst thing I’ve seen. When internet banking is down, it’s catastrophic. They think the money’s gone forever, and then all of a sudden you can bring people to the streets.

That’s a basic example. But when you start doing things like shutting off electricity to back it up, shutting off water, shutting off gas supplies—that whole critical infrastructure—you can then get people into action, and they’re the ones who are going to overthrow the government.

Manoj: Wow. So cause cancer from within. What a brilliant strategy.

Chris Rock: Correct. And if you look at my QA talk, I look at things like reserve banks, banks, utilities—all that sort of stuff—things that you can then control and pull levers to then do that cyber mercenary cool effect.

And then you add AI, where you start adding in: “Wagner has taken over this town,” and then you’ve got fake footage and tanks rolling in. It’s all created by AI. And then supporting messages and, you know, “Here’s in Russian, here’s the Signal conversation.” All of a sudden your Twitter feed and news feed is just what you want to present. You can then trigger a reaction, whether you can get a president flying out of the country or whatever you need to do.

Manoj: Yeah, you know, parts of this have been executed, but it’s never been done in a coordinated fashion.

Chris Rock: Correct. And that’s why my 2016 talk, Defcon 24, “How to Overthrow a Government,” I relied on people who had actually done this from a mercenary point of view. So I worked with a guy called Simon Mann, who’s done coups in Africa, just to work out what the mindset of these people is—how they do it from a force point of view. But to then extrapolate force to our power—which is not physical force, but computer power—which I think has more power than force, only because you can put fear in people just by killing their bank accounts. I mean, for me and everyone else, the biggest fear is having no money.

Manoj: Yeah, and why—I mean, what you’re citing is absolutely 100% correct. What should we be doing about it?

Chris Rock: I don’t think there’s anything you can do. I honestly don’t think there’s anything you can do, because someone like myself or other groups will always circumvent that. They will do what I do, and other researchers do—they will circumvent that approach.

Manoj: Should we not, though, make the public hyper-aware, or at least do some education so they understand and at least have some critical thinking that maybe this is—not. I know that’s asking for a lot.

Chris Rock: You raise a great point. So you’re telling me the government is asking their people, “Don’t trust sometimes what I have to say and not others”? You know, if you start pushing that message, then I can take advantage of that by hacking certain government departments and saying, “Don’t trust me that this is happening.”

I mean, people don’t trust their government in a majority, especially Americans versus Australians. But can you imagine telling the American people, “Don’t trust us sometimes; be aware of this; this may be a fraud”? And all of a sudden the next COVID-24 comes out, and then the message is “vaccinate.” I mean, you guys—sometimes this could happen, and then all of a sudden COVID-24 comes out—I mean, people don’t know where they’re going to live or…

Manoj: Right. Well, and you know what? You’re absolutely right. And a lot of that stems from that lack of transparency, right? Because there are a lot of mandates but no explanation, and no admission of the why or how or what. I mean, it’s just not there.

So, to me, I’ll cite the dumbest example on the planet. If I tell you, “You work in a company. Chris, don’t go to Starbucks and conduct company business on their open Wi-Fi. That’s against our policy.” And I just put that into your employee handbook and I made you sign this shitty document—you said, “Yeah, fine, this is a paycheck.” You know, you probably didn’t even think twice about it.

Now, well, you’re probably a bad example, but Person X—will they even think about that when they walk into Starbucks and they’re sitting there having their coffee for the next two hours? They’re probably going to connect to that Wi-Fi and do business on it.

As opposed to if I said, “Hey, Chris, look, I don’t want to be a jerk here, but the reason is there are so many attack vectors. You could be the victim of a man-in-the-middle attack, and here’s how this would work: this is what would go down.” Right? That’s why I don’t want you doing it. I’m not being transparent. Why just give you a policy? I’ve taken away the transparency. That policy must be coupled with transparency on the back end of why and what’s really going to happen.

Chris Rock: You’re right. And that’s why I said, if you’ve been out of work for, say, two months and you get a job, you’ll sign whatever the employee has. You won’t even read it. Your first focus is, “I’ve been out of work for two months, I need a paycheck, I’ll go do the work.” And I’ll go to Starbucks because I haven’t even read the stupid thing. I don’t even know that I’m supposed to have read the thing.

But you’re right. I mean, what you could do as a firm, knowing that people aren’t going to read it, is just enforce an agent to be installed on your device that has a VPN for wherever you are. So if you use open Wi-Fi, you’ve got your VPN. And you know—I hate to use the term “zero trust”—but you’ve actually got some protections on that computer to protect not only the company but also the user themselves, because the user is going to be the biggest flaw in your company.

Manoj: Absolutely. And they’re the ones that are often—most companies think a cyber awareness program is doing some phishing training. That’s about it.

Chris Rock: Yeah, I mean, I’ve done an exercise where I targeted an individual within an organization to get access to their computer and then own the company. But what I didn’t know was this person had actually been a victim of identity theft before. Now, I thought having been attacked once before, you’d be more vigilant, but that wasn’t the case.

Now, I put them into a mental breakdown situation because they got hit and the company was blaming them for the attack, and it was just bad luck. But you can educate so far, but attackers will get around that system.

Manoj: Sure they will, right. And then the example you just gave: if the company is blaming that individual, they probably have a really shitty cybersecurity program going. Because now everybody else is going to see that and they’re going to be like, “You know what? I just don’t want to report anything, talk about anything. Let them go figure it out.”

And attribution is a big problem in our industry anyway, so I’ll roll the dice.

Chris Rock: Exactly, yeah.

Manoj: You know, I’d rather get stuck doing nothing.

Chris Rock: Yeah.

Manoj: So, one of the things that you’ve talked about or you’ve used quite extensively is SIEM logic and extensive, advanced methods. For our cybersecurity engineers that listen to this podcast, what are some tips and guidance you can give that might be things—food for thought—that they wouldn’t have thought about in tuning or writing rules or things of that sort?

Chris Rock: Yeah, definitely. So my first thing is—I’m a hacker by trade, so that’s my primary function. And we created a SIEM platform. So for those who are in the SIEM space, the job that we try to do—and what other vendors do too—is try to make their life as easy as possible. And what I mean by “easy as possible” is: look for things like playbooks. Playbooks will save your life.

If you have an extensive playbook—and what I mean by playbook is essentially it’s a bunch of “ifs.” If something happens, do the following. And if those are automated processes, it can make your life a hell of a lot easier.

So my key for any SIEM, XDR, or SOAR users out there is to spend all the time you have focusing on SOAR playbooks. And what I mean by that is have something that’ll automatically open a ticket for you, that will pre-fill the details for you, that’ll bring in information from other outside sources such as the FBI and those sort of open-source feeds to fill out that request for you, to take the workstations offline that—you know, in case it’s a ransomware attack—to lock out the people’s accounts in AD that were affected by the attack, and do things like automatic recall of email addresses.

If you can spend your career—I want to say “career” in this period of your career—focusing on playbooks, that will really save time in your life. Which is what I focus in on—the end user. The security analyst is already under a lot of pressure anyway with the amount of attacks coming in, both false positive and true positive. Just make your life a hell of a lot easier with playbooks.

Manoj: That’s great advice. Security orchestration is a big deal.

Chris Rock: Yes, it is. It is the biggest deal. I mean, security—I’m going to say I’m lazy by nature, and if you can make your life a hell of a lot easier so you can do other stuff—you can do research, you can go present at Defcon—then your playbooks are your must-haves.

Manoj: Yeah, and I don’t think you’re lazy. The amount of thought that you put into probing various processes and saying, “You know what? I want to break this thing.”

Chris Rock: But the one-eyed man is king in the land of the blind.

Manoj: Well, you’re just being humble there. But we all know that you come with a great experience record and a great track record of proving people wrong for the right causes. Is there anything that from a policy perspective governments can do to facilitate more security for their citizenry and their infrastructure, or is that a lost cause, Chris?

Chris Rock: That’s a good question. I don’t know if I’m the best person to answer that. I’m gonna say I’m very right-wing on this one. What I mean by that is my thoughts are—especially in America, when I say “everyone,” a lot of people join the military. They go straight into the military; they want to tour the world; they want to do all that sort of stuff. And I think that’s great, but I think we really need to start putting those people straight into cyber.

So when you’re 18, if you want to see the world—yeah, we’ll get you to see the world, but I want you learning these skills. Not firearm skills, but I want you to learn these skills because this is going to be the next generation of people that protect not only our citizens but also our critical infrastructure as well.

And you’ll start to see things like critical infrastructure start to expand. All of a sudden, we’re talking about—well, in the old school, critical infrastructure was power and water and gas and telecommunications. But we’re starting to see that—especially in the legal profession—they’re trying to expand on things like that. They want things like personal data to be critical infrastructure.

Like protecting that sort of—I’m starting to see legislation put in front of people. I had that “I’m doing that” look too, thinking that’s a big stretch. But yeah, it’s a huge threat. It’s unfathomable that they could even try and do that. So I think: train early and get them—so this is normal for them. If it’s normal for an American to go into the military—if that’s normal—then we need to put them into cyber training and start from the start.

Manoj: What about, Chris, going with a thought that—and this might seem rather extreme too—but we accept certain inefficiencies for real critical infrastructure? Like in the United States, that’s power. If we lose power, that’s the end. I mean, I don’t know that this society would really survive without electricity. My grandparents’ generation—absolutely, they were tough—but these guys? I don’t know.

We go back to the old school. Like, some things are not on the web. That’s it, end of story. We realize it’s not sexy, it’s not convenient, it may not even be the most efficient, but if you’re going to risk-score things, it might be better, given the level of risk, to accept a certain degree of inefficiency to keep things operational in critical situations.

Chris Rock: What are you envisaging for protecting power?

Manoj: Well, with power, we’ve automated so many things. You look at the way all the switching, load balancing—everything—is managed. The whole damn thing is computerized. And that’s fine when everything’s running right, but how about having some old-fashioned mechanical switches that you can’t hack?

If things go down, that fella can go into the power plant and just throw the metaphorical switch, if you will, and say, “Okay, I’m taking the computer offline. We’re going to go back to the old analog dials here, and we’re going to manage this thing.”

Maybe it’s a bad example, but have that notion that maybe we shouldn’t trade everything for convenience. Maybe some things are important enough that you accept the inconvenience it’ll cause by not enabling a lot of automation that becomes hackable.

Chris Rock: Yeah, I mean, unlike the unmanned substations—because they’re all automated now, you don’t need anyone doing anything. There was a case in America where people were shooting at the transformers and draining them of machine oil, which would then cause a failure.

Manoj: And those cost millions of dollars, and there are only so many of those transformers. They’re all made in China, and if you don’t have one in storage, it’s going to take you several months to get a new one. I mean, there’s a whole litany of things with that example.

Chris Rock: You get a group of 100 individuals taking out hundreds of transformers across substations in California. Your critical infrastructure doesn’t really mean much after that at all, does it? It’s not really critical if it’s an unmanned substation that’s not protected.

Manoj: That’s right. Well, you’ll have a mass migration out of California—that is what would happen. People would just leave. And maybe Australia is closer than New York, so they might just take—hey, we have not even scratched the surface, Chris.

I mean, look, you’ve got to come back. There’s so much to chat about here, but I do want to—I love talking to you, man. I do want to give you the last couple of minutes to plug whatever the hell it is that you want to plug and let our audience know about. So it’s your floor, my friend. Go for it.

Chris Rock: Thank you, thank you. Actually, I have nothing to plug. I did my last talk in Defcon 30 last year, and I’m now in a research space. I’m going to be in a research space probably for the next three to four years, so I won’t—I’ve got no talks, no books, no anything coming forward over that time. So, sorry to cut you off—nothing.

Manoj: Yeah. So, can we ask what you’re researching?

Chris Rock: Yeah, and I touched on it right at the start of the conversation: banking licenses and private equity firms. So I’m researching that whole setting up of a PE firm, banking license, banking charter, hedge fund type sort of stuff. I’m going through that whole process of what does that look like—setting it up.

Manoj: It can go to work. I’m looking forward to it. It’s a very interesting process. I’m not familiar with all of it, but I’m familiar with bits and pieces of it. I’m going to be eager to see what you find, because there are some parts of it where you actually have to deposit cash, and lots of it.

Chris Rock: I agree, I agree. Right. But again, if you’re knocking over people for a couple million here, a couple million there—I mean, the kind of cash that you’re going to find is pocket change compared to how little money you need to put in to create a banking charter.

Manoj: Exactly.

Chris Rock: And I don’t know if your listeners know that you can get on the dark web right now and for $2,000 in cash, you can buy $10,000 worth of Bitcoin because it’s stolen Bitcoin. So there’s just—you know, you look at that sort of thing there and all of a sudden that sort of $5 million deposit for a banking license is not so extreme after all.

Manoj: It’s not so extreme. You just have to be in a non-extraditable country when you do all this stuff.

Chris Rock: Exactly. Using a fake ID.

Manoj: If I caught anything from my first talk—oh yeah, if you get Kermit the Frog, who’s the head of the banking charter, and that’s Donald Duck’s second cousin, you know, more power to you then.

Chris Rock: Exactly right. And poor Miss Piggy died, and then all of a sudden you got her insurance money and you got a $10 million kick for the insurance payout.

Manoj: Oh yeah, that’s brilliant. We’re going to put a link to that Defcon talk. You described the entire process in pretty decent detail. And your book really gets into it in a lot more detail on how you can create, assume, and delete an identity, quote-unquote.

Chris Rock: Yeah. And in the United States, it’s really easy.

Manoj: It’s actually really easy to do.

Chris Rock: Yeah, and you can still do it. Nothing has changed.

Manoj: Well, it would require an act of Congress, and we know where that’s going today. There is no act of Congress happening per se. Yeah, I mean, you look at the most basic thing, and I’ll end it on this: our Social Security numbers, right? The fact that you can’t actually change those or nullify those—it’s created a huge advantage for the hacker.

Chris Rock: I agree.

Manoj: Because once that’s out there—and it’s absolutely out there—they’re… okay. You can buy them online in any database around the world.

Chris Rock: Yep, absolutely. Absolutely.

Manoj: Well, Chris, it was a pleasure. We won’t keep you much longer. We’ll let you get to your coffee or tea—I don’t know what it is in your part of the world.

Chris Rock: Coffee.

Manoj: Coffee, is it? So you guys departed from the Brits there a little bit, huh?

Chris Rock: Yeah, a long time ago.

Manoj: Well, enjoy that fresh cup, and it was a real honor to have you here. Thank you so much.

Chris Rock: Lovely to talk to you, mate.

Manoj: Take care, man.