Security Confidential S11 E9 Chris Rock

Manoj Tandon: Hello everyone, this is your host Manoj Tandon, and welcome to another episode of Dark Rhino Security: Security Confidential. Today we have another fantastic guest who really doesn’t need an introduction, but we’re going to be kind to him and give him one anyway. He is Chris Rock.

You guys have probably seen him at DEF CON many times. He’s the author of The Baby Harvest. Chris is a cyber mercenary. He’s presented at DEF CON three times. He has been in cybersecurity for many years, and that kind of tells you the level of experience he had before things were so readily available. He was out there in the field trying to protect organizations, advising governments and private organizations on how to do things right.

Chris is passionate about raising the public’s awareness of modern cybersecurity threats and trends, and we are honored to have him. We really want to hear what he has to say. Chris, welcome to the show. Thank you for being here this early morning in your neck of the woods.

Chris Rock: Thank you for having me. A great introduction; you should be my publicist.

Manoj Tandon: But I’ve got to start off with this, you know, a simple question here. Man, your name belongs to a world you’re famous in—cybersecurity—but it belongs to a world-famous celebrity out there. How the hell did you get away with this? Like, you publish on social media and whatnot. I mean, a lot of times those platforms flag you and they say, “Hey, you can’t use celebrity names.” What’s the story here?

Chris Rock: Yes. It actually gives me great benefits too. So, when I’m checking into a hotel, I get upgrades without even doing anything just by the name. I go through airports really easily until they actually see the photo and do the match. I go “Chris Rock,” and it just puts the security person at ease, so I don’t get any questions because they’re just laughing because they see a white guy going through.

I also have the benefit that his middle name is J and my middle name is J, so—

Manoj Tandon: Christian. Oh my god.

Chris Rock: I get his frequent flyer points on occasions as well.

Manoj Tandon: Well, he’s got to be in God Mode, so I hope you’re not paying for airline tickets.

Chris Rock: No. Every time he does a trip to Europe, sometimes I’ll get his flyer points. It’s fantastic. It’s like, I’m not going to argue with it.

Manoj Tandon: That’s the thing when you’re not cross-referencing and cross-checking and looking and scrutinizing those identities; these kinds of things can happen. But good for you, man.

Chris Rock: Exactly right. That’s great. He flies first class, so all the better for me.

Manoj Tandon: Oh, heck yeah. I mean, there’s no way you’re getting stuck in the back of the bus. No way.

Which brings us—I mean, that’s a threat to society—but give us your three imminent cyber threats to modern society. I’m curious what your take is on that.

Chris Rock: Okay, so imminent for me—some in security even I’m not going to give you imminent, but I’ll do it in my definition of an imminent threat.

I think the most boring one is the cybersecurity shortage, just in terms of skilled staff. I’m not talking about entry-level security staff, but I’m talking about experience—and I’m talking 10 years plus in our industry. Because as a criminal, I look at this: there’s been a deficiency in staff, which means there’s a deficiency in systems. Then all of a sudden you’re getting what’s probably even worse than having nobody: staff who have no idea, who are then setting up systems with not much experience, and they’re making errors.

A bit of background on that: I was IT before security, so I used to look at the mistakes I made as a guy that didn’t know much. Then I put my hacker hat on, and I could then just go through. It’s like, I unticked that box because it was easier; I didn’t enable encryption because it was just quicker. I just wanted to test to see if it worked first and never turned it on because, once things work, you know, don’t mess with something that works. But I think that would be my first thing, and that’s what I’d call imminent; that’s what we’re seeing right now.

Second would be AI. I think AI is going to be a huge threat, and I don’t want to sound like an alarmist—there’s a lot of people being alarmist—but as a hacker, I look at it and think this is awesome. This is going to cause absolute havoc on our industry, absolute havoc to automate things.

For example, if I want to set up a private equity firm with banks around me, that used to be a manual task. I used to have to set up a fake website and play pictures; I had to make brochures, I had to make it look real, and that would take me three or four weeks to set up.

Using AI can then automate that whole function of setup: reciprocating banks, fake banks, PE firms, legal firms that vet my private equity firm, and stuff like that. So I see AI as huge from a criminal point of view.

I liken it to Bitcoin. When you look at Bitcoin, it started off as a science experiment. It was something created by—we don’t know whether it was one person or a group of MIT engineers or physicists, right?

Manoj Tandon: There’s some kind of uniform.

Chris Rock: Yeah, exactly. And then it evolved into what criminals used, because credit cards and moving money is a pain in the ass. But you could then buy things illegally with Bitcoin or ransoms and stuff like that. Then it moved into the investment world. That happened over a period of 15–20 years that we’ve seen that cycle go from science to essentially JPMorgan and BlackRock, and everything in the middle was criminal.

Manoj Tandon: Well, I was just going to say criminal.

Chris Rock: And we’re going to see the same with AI. We’re right at the start of AI, and then we’re going to see the criminals take over, and then we’re going to see a functional product thereafter. That would be my number two.

Manoj Tandon: Now, so give us some—you just highlighted an example where you can use AI to create essentially an identity and then validate that identity through a whole bunch of automation. As I was listening to you, let’s create a company, then let’s verify the company, let’s give that company ratings, let’s make it seem completely legit, and you’re off to the races.

But in what other ways do you think that especially generative AI is going to come in and make a play?

Chris Rock: Yeah, no, that’s a really good point. I’m what you call hyper-focused. So, if I see a deficiency with AI, for me it’s a compliment that’ll make my work easier. Then I’ll focus solely on that factor. I haven’t looked at the other factors, to be honest.

That for me is the quick auto-click. I’ve got, like you said, a complete trust model: lawyers, websites, media reviews, automatic phone calls, all that sort of stuff, and replies. I have not looked at the other side of AI. This would essentially be three or four years’ worth of research that you would have to look at—the attack vectors with AI. What do you think?

Manoj Tandon: I’m thinking, you know, a simple one that comes to mind is CAPTCHAs. I can get generative AI to defeat the CAPTCHAs. You look at the number of processes that’s engaged with now, you just created a gap.

Chris Rock: Yep. That’s brilliant. Absolutely brilliant. Yeah, and I haven’t really put a lot of thought—I really don’t think the human imagination has caught up with what the possibilities here are. You’re spot on. You’re spot on, and that’s why you’re going to get three groups of people.

You’re going to have people who say AI is not a threat, “I can’t see it as a threat,” you know, it’s in its infancy. Then you’ve got people who are going to go the other way, like the doomsayers. And then you’re going to get the people in the middle. I gravitate to not doomsday, but I see it as—you asked about imminent threats, and I think that is one of the highest threats that we have.

Manoj Tandon: Yeah, and I don’t know—I mean, there’s a lot of talk about, you know, there’s a lot of saber-rattling on regulation. I’m not so sure that with AI legislation is going to… this genie is out of the bottle, man. It’s gone.

Chris Rock: It’s the Bitcoin analogy. Let’s go with Bitcoin: you’ve seen how long they’ve taken to wrap some, essentially, some security around that, by a lot of ETFs and stuff like that. That was a long journey to watch companies like FTX all go broke.

And then you get Japanese Bitcoin holders, everyone—hackers stole the money out of there, there was Mt. Gox and stuff like that. We’ve watched that, and there’s been no regulation at all.

Manoj Tandon: Oh, absolutely. So, number three—so that was number two, sorry to take you on a tangent there.

Chris Rock: No, you’re right. And the reason I used—it was imminent, but it’s not really imminent—is Quantum Computing. I think that’s—if we can get Quantum Computing to a state where you and I can use the system, and I’m not saying at home, but I’m saying as a hacker could get into, say, a university that’s trialing Quantum Computing and a hacker can then use Quantum Computing and AI combined, I think that would be huge.

I look for things in history where you get two things combining where you essentially—you’re looking for a pattern. And I want to say Quantum and AI—essentially AI’s got the jump on Quantum, but if you can just envisage years down the track when AI is mature and Quantum is essentially usable, then I think those two together are going to be brilliant for both hackers and cybersecurity people.

Manoj Tandon: I don’t know that it’ll even take that long. I mean, if you look at where we came from in the early 80s to today with computational power, is there any reason to believe that we’re not going to see the same kind of acceleration in both AI and in Quantum computing?

And you know, the interesting thing, Chris, with Quantum is if you look at the number of algorithms that depend on the difficulty a computer has to factor—you know, there’s no easy way for a computer to create factors, to come up with the primes of very large numbers. I mean, that’s the foundation of modern-day encryption, right?

But it goes beyond that. Quantum Computing has the ability, the potentiality, to actually render those things extremely obsolete.

Chris Rock: I agree.

Manoj Tandon: What will that do to all the many processes that depend on it in things like the finance sector and stuff like that, with algorithms doing share prediction and stuff like that? That’s right.

And I don’t know that there’s—you’re in touch with the industry quite a bit—is there any focus out there on people looking at that already, other than, I think, the U.S. federal government put out a directive to agencies that should be looking at Quantum-resistant encryption methods?

Chris Rock: Yeah, but to answer your question crudely, everyone just talks shit. So they’ll use the words “resistance” and all that sort of stuff, but you and I both know that nothing’s really happening because it’s way too early. We can’t even get on top of—well, the government can’t even get on top of events of today, like security attack vectors of today, let alone the future. So to answer, in my view, it’s nothing at all.

Manoj Tandon: Nothing substantial anyway. Yeah, and you know, the technology isn’t even accessible for so many people to even try out different methods and to see what’s going to happen. But I do absolutely believe that probably inside of a decade—10, 15 years out—that technology will be—it may not be available to us at the desktop; certainly maybe 30 years out it may very well be available on a phone or on a desktop, who knows. But it’s going to present challenges that we have not seen before.

But one interesting thing, when we looked at some of the things that you’ve discussed in the past, one common thread that runs through it all is you’re looking for, as an ethical hacker, a flaw in a process. You’re mapping out processes and then you’re meticulously and systematically interrogating each step of that process to find flaws.

Why is it that that same mode of thinking doesn’t apply to the defensive side of the equation in companies and organizations today? Where they should be looking at the type of businesses they conduct and what vectors they may really be vulnerable to and make sure that they’re doing their best to design flaws out. Because you still see today, breach after breach after breach on a daily basis, at companies that have immense cybersecurity departments.

Chris Rock: That’s a great question, and I think it comes down to the way I do my research, which is: I trust nobody. So I don’t trust any statement that’s put in front of me.

I was speaking to somebody about private equity firms, and we’re talking about things like bank licenses and SEC and all that sort of stuff, and someone made the statement to me, “But it’s SEC regulated.” Now, what I hear is “SEC regulated”—for me, that means nothing. That’s just a bunch of words to try to put me off what I’m trying to do.

Yeah, so I don’t trust a single word that comes out. Anything that comes out of anyone’s mouth or book needs to be—I’ll put a legal hat on—it needs to be researched and studied on. “Why do you say that?”

And the reason I say that is: you and I go into a bank, and they ask you for 100 points of identification versus a typical driver’s license. Then the person at the back of the counter essentially just ticks a couple of boxes, and then all of a sudden you’ve got a bank account.

And what you and I were talking off-camera about: driver’s licenses. You know, to forge a driver’s license is difficult, but there’s ways around even that. For me, something like that—if I was trying to get a fake driver’s license, I wouldn’t even bother trying to get a fake driver’s license; I’d get a real one.

So I would get, off the dark web, I’d go and get, say, a Swedish passport, a Swedish driver’s license, and then I’ll go into the DMV and say, “Hey, I’m in your country legally for the next two years. Give me a driver’s license.” And all of a sudden I have an American driver’s license. It’s the same in Australia. So I then get to travel around with a real one.

So back to my original statement: I trust nobody. When someone has a tick box that you need to go through—like to do a banking license you need to do A, B, and C—for me, I’ll then go through A, B, and C, and that’s how I analyze. If you ask why people don’t do that, I think it’s just that once someone says something to you, there’s an inherent trust, and I don’t trust anything that’s said to me.

Manoj Tandon: Well, and I think there’s a—and disagree with me if you think I’m on the wrong track here, but there’s this mentality in our industry that InfoSec is about technology. And there’s a huge focus on technology. I mean, you read all the rags and it’s always about new products. Gartner’s putting out reviews on their quadrants, and you know, analysts are talking about the latest and greatest things.

It’s rare that you actually hear people talk about process, which is at the heart of this conversation.

Chris Rock: Right. Yes, and the same spot myself and other researchers are being so successful in: no one looks at process. And don’t get me started on the Gartner model.

Manoj Tandon: Don’t even get me started on the government. We should create some notes here because, yeah, the Gartner model—for those who don’t know the Gartner model is, Chris, you’ve got a product that you would like in the Gartner review: pay us 50,000 a year for the next three years. We can’t guarantee you’ll actually be in the Gartner report, but you’ve got a good chance. I mean, what kind of… we talk about cyber criminals, that is as criminal as you can freaking get.

Chris Rock: That is.

Manoj Tandon: And you know what, it’s an opportunity. If I’m a well-funded bad actor, maybe—why haven’t I put out a product? Maybe I should put out a legit product that’s completely got holes out the wazoo for my convenience, and get it put in the upper right-hand quadrant of the Gartner report.

Chris Rock: 150 grand in a three-year waiting period—knock yourself out, mate. Go for it.

Manoj Tandon: Well, if I’m knocking over companies for 40 million dollars in ransom, 150… no question.

Chris Rock: You’ve sold me. It’s an investment.

Manoj Tandon: It’s an investment. And then I can turn through that switch whenever I want. But really, you know, and I’m dead serious about that, we talk to so many organizations and it’s almost like…

I guess something that all our listeners would probably be able to relate to is back in the old days when everybody had a camera. You’d always get the odd guy: “What kind of camera do you have? Is Canon better? Is Nikon better?” Well, it was never about the camera. Those brilliant images were all about the photographer; it was about process.

It had very little to do with the device in their hand. You could take the greatest photographer, give them a pile-of-shit camera, and they would produce brilliant art.

Chris Rock: Right, it’s the process.

Manoj Tandon: Yes.

Chris Rock: And you look at all the cybersecurity conferences now, which there’s essentially 300, 400, 500 per year. There’s people doing great talks, but no one’s analyzing those talks. And there’s some really good talks, even at small conferences and large conferences, that you think, “Holy crap, these guys are onto something.” But there’s no media around that, and it just becomes an archival talk, because people just don’t have the time because there’s always something new coming: Black Hat, B-Sides, DEF CON, and then there’s a whole lot of other local events.

Manoj Tandon: Is it laziness, apathy, or indifference? What’s causing the industry to not actually look at this in the right way?

Chris Rock: I don’t think—and you may again disagree with me—I don’t think there’s enough skilled people in our profession. I think we are bottom-heavy with people who have got that basic skill and intermediate skill. And the skilled people, the 10-plus veterans—there’s not enough out there.

And if you then think, “Well, there’s a thousand out there” or ten thousand out there, that’s still a low number in our profession. When you think of a doctor, and you think of doctors who have had many years plus experience, there’s, you know, multi-hundred thousand in the U.S., because they’ve been doing it forever. They don’t do talks when they’re 23 or 24 as soon as they come out of medicine; they do the talks in their 50s and 60s.

I think it’s apathy, but I think there’s not enough skill in our industry at all.

Manoj Tandon: Well, you may be onto a strong point, because one of the things that we’ve even struggled with at our company is always getting our hands on a great architect. Those people are rare, and if you get a good one, you keep them and you hold on to them at all costs. Right?

Chris Rock: And when you ask for an architect, what are you looking for? Pretend you’re the recruiter; what are you looking for in an architect?

Manoj Tandon: I’m looking for someone that understands how information flows, and therefore they can understand how to control that flow regardless of the type of information it may be. At the end of it, we’re transmitting TCP packets of some kind or another that are carrying instruction sets.

I want gated controls on those instruction sets, but in the context of the way in which we execute business. So if someone is going to craft a defense-in-depth strategy for us that’s going to be viable, they must necessarily understand what the revenue chain looks like, how that connects to the supply chain, and how that’s connected to third-party risk.

Then they can start crafting a multi-layered defensive architecture. And then you’re at a point where you can start prescribing an approach as to how to craft a spiderweb that might catch some flies that could kill you.

That’s my thoughts.

Chris Rock: Yeah, it’s a great thought and you’ve articulated it really well. And I’ll say on top of that, you’re looking for somebody who understands commercial gains—understands the end user, that whole process. You know what we can mitigate, because the business is always going to come to you and say, “Well, we accept the risk,” and then you’ve got to come up with a supporting architecture around those risk ratings.

That level of experience… how many years experience do you think really captures that in your mind?

Manoj Tandon: Wow, probably 10 to 15 years, easy. Because you have to have been around the block in different roles.

Chris Rock: Correct, correct.

Manoj Tandon: You can’t just be an IT guy or a security person. You should have done something else; at least you should have touched some other parts of a business to understand a business: how does it actually function?

Chris Rock: Correct. Someone to create a bill of materials, a high-level design, a detailed design, business case documents… they don’t fall off trees. That’s why it’s so hard to get somebody like that.

Manoj Tandon: Well, I didn’t ever think of it in that context, but you stating it that way makes a lot of sense. And framing it that way, we have a dramatic shortage of talent then.

Chris Rock: Correct. And I was an architect myself, so I’ve been in the banking sector, so I know what I had to do in that arena. You can’t go to a bootcamp for six weeks. If you were a bartender and now you’re doing SOC analysis and now you want to be a security architect, it doesn’t work that way.

And I don’t want to disenfranchise anyone in the industry, because there’s a lot of newcomers that’ll be in your audience. It’s a long haul. You guys are going to be here for 30 years plus. Just don’t expect to be the guru in the first five to ten years, but after 10 plus years, the industry is your oyster.

Manoj Tandon: That’s very true, and that comes with a handsome paycheck too.

Chris Rock: It does. And the beauty of that is, then you know what you’re doing. You’re not in a role where you’re thinking, “I don’t belong here.” You actually do belong, because you’ve got the experience to back it up. And then you’ll give your clients or your contract what they’re looking for: someone who knows how to put their hand on their heart and hand on paper saying, “This will fix your problem.”

Manoj Tandon: Couldn’t agree more. Couldn’t agree more. So you mentioned talks. I’ve gotta ask you: you were asked to speak at TED Global and you declined. What’s the back story here, if you can share?

Chris Rock: Yes, I actually didn’t decline. I didn’t decline it; I’m, for lack of a better word, terminated from speaking at TED.

Manoj Tandon: Oh, really?

Chris Rock: Yeah, I got terminated. I had been accepted to speak at TED Global in New York. And I’d gone through everything; I’d gone through legal review. I was talking about cyber mercenaries, so it was a cool topic.

And like I said, we went through legal review. I actually did practice speeches in front of the whole TED crew. And they said, “Look, the material you’re presenting to us was stuff that you did in about 2012. Have you done anything recently?” And I said, “Nothing that I can talk about.”

And they said, “Well, can you please show the audience how good you really are?” And I said, “Leave it with me.” And in that period of time, in about a week’s time, I hacked into all the TED organizers and presented back to them everything I found in their lives: their credit history, the works, where they live, where their parents live, the whole everything.

Now, they weren’t too impressed with that, and then my talk was abruptly terminated at that point. So I didn’t decline.

Manoj Tandon: Share with us some of… how did you do it?

Chris Rock: So that’s, for me, that’s my normal role, like I’m a pen tester. I use the two interchangeably. So for me, that’s just the easy start. I troll through databases of credentials that are already stolen. Then I just grab username passwords that already exist and then I essentially go from no user access to God Mode in their lives—usually what I call penetrating the circles of their life: targeting their friends and their relatives and their workmates and then getting through to them that way.

Manoj Tandon: Well, I’m sure people listening to this are thinking, “Man, that guy is deadly.” He could really…

Chris Rock: Let me ask you a silly question. Talking about cyber mercenaries to show how good you are, what did they want me to do? And show you the evidence? I mean, if you’re playing with a scorpion, you’re gonna get bitten. That’s what I say.

Manoj Tandon: Oh, you know, that’s absolutely fair. You ask a sniper how good they are; they’re gonna put somebody out at over 1.6 kilometers.

Chris Rock: What did you expect?

Manoj Tandon: Exactly, exactly.

Chris Rock: So I’m ready to go. I’ll deliver that talk, whether it be at a future TED or future Black Hat or whatever, but I have a talk ready to go.

Manoj Tandon: Oh yeah, please do deliver it. I think all of yours are so entertaining and highly informative that it’s just… you bring a lot of things out into the daylight that are often not discussed.

And I keep looking back at process, and we keep harping on process, process, process. Look at the process, involve the people, get them to understand what they can do wrong, and tell them why. Just don’t put out policies saying that you can’t do this; tell them why and show them how you can actually really get screwed over if you do something.

And you’ll get people to play along, and then you’ll be a much safer organization. But it always seems to be about tech, tech. “Do you have the latest MFA? Have you put in a zero-trust framework?” All right, that’s great, but have you looked at your processes that actually make you what you are?

Chris Rock: Yeah. And then that comes down to a lack of experience. That comes to the vendor being the tail wagging the dog. The vendor is crapping on at a Black Hat conference about zero-trust this. And we—I say we collectively—we think that these words are important to our group because we don’t have the experience to say, “Shut the fuck up and just let us do our thing. We don’t need your vendor bullshit in the middle.”

Focus as a group on what’s important to us, and don’t have the vendor wagging the dog.

Manoj Tandon: Oh man, I love it. That right there is worth the price of admission for everybody that’s listening. You’ve heard it from the man himself. You know, if there’s nothing else you guys who listen get out of this, following Chris’s methodology: at least take a paper and pencil, write out the process that you’re trying to guard, and then try and poke holes in the damn thing. That might be way better.

Chris Rock: Entirely, entirely. I mean, I’ve seen people’s careers analyzing news articles that are in the news cycle and then talking shit about them on Twitter, and they think that’s their value-add to the industry. I mean, all you’re doing is collecting stuff together and then presenting it. There is a forum for that, but that’s not a career path.

I mean, if you want to do research, solid stuff, analyze a topic of interest. It may not be sexy, it may not be full of your passion, but you’ll find, as you said, the process flaws in that system.

Manoj Tandon: That is phenomenal.