last talk so i've only got 150 slides
and we'll go to drinks in a little bit
i'm not kidding but yes
so that was my intent right i submitted
this talk and i was like this is going
to be awesome nobody's seen this before
but
you know
i'll get to kind of do a little bit of
attention whoring which is what i like
to do on stage
uh but no john holdquist had other plans
for me john holdquist
was not having this this plan of mine
he insists that this is about cyber war
and that we need to talk about you know
this sort of cyber war theme that
there's not enough things you know
blowing up in the stage and that makes
all of us uncomfortable
so we're gonna go for a different
uh kind of talk today i'm afraid it's a
lot more boring than it would have been
but you know that's what john holdquist
wants
um
in all honesty not giving john you know
that hard a time uh it was actually
pretty perfect to put me in the last
slot because there are elements of at
least five different talks that were
mentioned today um that i'm gonna try to
kind of breeze over and and discuss so
it all kind of ties in together nicely
so we're gonna talk about this boring
thing called hacktivism um the reason
we're going to talk about it is
that it's i feel like it's rolling
counter threat until sorry and cyber
throat intelligence has kind of been
misunderstood
there's a lot of ways in which we're
still trying to map normal intelligence
concepts to this new paradigm of cyber
threat intel
we have our deficiencies you know this
is kind of an unexpected transition into
dealing with intelligence stuff when in
reality we're just a bunch of nerds
doing malware analysis
we're still struggling right so
i'm sure in a dc audience something like
cover for status is fairly well known
you know
alex and katie were here and they were
talking about cover for action so
simple heuristic uh cover for status
right an identity someone pretending to
be an affable lovely professor uh who is
interested in these sorts of things
cover for action being more of the
justification for you know why you're
doing what you're doing and how you fit
in more naturally into the space that
you're supposed to be in so why are you
here
um
why should we not think you an odd duck
in this space
so the reason i want to talk about that
is i think hacktivism has kind of become
this attempt to
given give a sense of kind of grass root
um
fervor coming out of the you know the
masses that that just justifies what it
is that we're seeing right so
think about the
the arab spring right it was this
beautiful romantic notion that the
people had had enough and they rose up
and it was it wasn't a
uh you know a foreign thing but rather
this sort of fervor that spreads through
the masses and decides that it's time to
do something and hacktivism is starting
to become that or has been treated as
that um in a lot of these sort of
operations and a lot of the things that
were discussed today and i'm kind of
hoping that we can treat it a little
differently so going back to the before
time right 2008 um when we were still
enamored with this idea of anonymous and
it was you know still in its crunchy
4channy kind of incarnation and there
might have even still been some hacking
skills involved
this kind of became the gateway uh
the gateway drug for a lot of this sort
of hacktivism as a cover for stuff
obviously that isn't really the case for
anonymous anymore and it's sort of
bastardized a bunch of ways uh but what
remained was the notion of abusing that
cover you know whether it is anonymous
in many cases it's still anonymous in
some way uh but the notion of sort of
having a hacktivism front allows you to
clear some stuff
so
the other thing i really want to avail
myself of is the benefit of hindsight
so
any of you that are familiar with my
research you know that i like looking
backwards and sort of being able to see
you know what we can find out now about
operations from 10 years ago and some
folks think it's pointless but the
benefit of hindsight is fantastic it's
amazing how many things we put together
over the years and you know be good for
us to go and reassess
uh what we figured out then what we know
now so
i'm going to run through a few things a
little quickly
mostly because there are great resources
already and some of the folks that
actually did that work are in this room
whether it's the eyesight mafia that
then became the fire eye mafia which is
now the mandiat mafia um or you know
a bunch of other great folks like the
eset researchers and so on that worked
on these sorts of things so you'll have
folks to discuss them with if you want
and you can always ask questions
uh but let's let's run through kind of a
whirlwind tour of hacktivism being
abused
and what i want to focus on is how we
then became aware
that it wasn't a real activism from that
it was a front that it really wasn't a
hacktivism uh type of activity so 2012
this should set off some alarms already
saudi aramco and rass gas you know in
response to the wonderful stars wiper we
get this sort of conceptual
proliferation of the notion of wiper
sort of in the region
you get these two
industry
giants getting hit with a wiper if you
remember correctly
simmons brought this up at the time they
were claiming that it was you know the
the cutting sword of justice right this
group uh coming out of nowhere to kind
of retaliate for god knows what um and
the thing that immediately busted that
cover for a lot of folks is first and
foremost there was no pedigree right
we'd never seen this group before
they've never existed in forums before
we've never seen them involved with
other hacks before
uh and
the persona was relatively quickly
discarded right it was used for a couple
of other things and just kind of left
there to languish
except maybe to email dave i tell from
time to time
and more importantly there's now in the
benefit of hindsight we've got this code
reuse with other nation state operations
that weren't veiled in the same way
shamoon comes back at some point shaman
2 it connects to stone drill connects to
other iranian operations so yes at the
time we couldn't have possibly known
maybe we could have
but you give it three four more years
and they get sloppier and sloppier than
they were in the past so interesting
there you go
uh 2014 things start getting a little
spicier other folks got the same ideas
right they have the infamous sony
pictures entertainment hack uh if you
remember in the beginning this was all
done under the cover of the guardians of
peace
you know there's been some fantastic
t-shirts made of this graphic
and what was interesting about the
guardians of peace
was that they didn't exist we hadn't
seen them before
you know there's no pedigree once again
the persona was discarded right away
they weren't even used in other hacks
they weren't even used for the exposure
of the data like it was just this flash
in the pan kind of cover
um the qui bono was fairly
straightforward i mean jd might throw
something at me for saying that but
who the hell cares about a stoner comedy
uh except under the circumstances right
um and there was a really inconsistent
objective like in the beginning it was
supposedly a ransom thing then it was
you know attempting to stop this sort of
extortion with the data that they had
then it was you know don't publish the
movie then we're gonna bomb the movie
theaters you know you could just see the
whole thing kind of unraveling as a very
poorly thought out operation
more importantly and jaime velasco is
not here
we did a lot of research at the time to
say well where the hell did this group
come from and this is the thread that
starts to connect
what we then came to know as the lazarus
group at the time we didn't have that in
our vocabulary we just had a ton of
disparate operations whether it's dark
soul or you know dust over and all these
different things and it turns out that
there was a shared code base of
operations going back to 2008 all of
which were related to north korea go
figure
so that
then you get cyber coup and this is the
beginning kind of the russia section in
a lot of ways and a lot of you i expect
are fairly familiar with what happened
here in like the summer of election
hacks and so on um but it's worth
mentioning because i think the russians
kind of tend to do this a bit better you
have a
you have a proper practice of active
measures as you may have read
and a lot of experience
as to how to conduct these sorts of
operations and it shows uh in that they
know how to develop them a little
further how to carry them a little
further how to be a little more
consistent right so cyber burkett came
along tons of hacks uh in the ukraine it
was supposed to be sort of the cyber
component of this police force that had
been disbanded
kind of interesting
a lot of the stuff was very
niche focused on ukraine and i think in
the beginning it kind of flew under the
radar in a lot of ways false pedigree
not really related to burkut um
there was overlap with nation state
operations we start to see this is going
to be a theme in a lot of sort of the
russian related hacktivism right you've
got this great hacktivism front but it
doesn't count on the fact that
researchers are actual and incident
responders are getting involved with the
actual hacks where the data comes from
so even though you've got this great
cohesively put together hacktivism front
we're sitting there like we just saw
sofa see roll through here like you want
to tell us that it's someone else it's
kind of hard right um
so of course you know that got
publicized and you can read a a
relatively
wonderful paper by brian bartholomew and
i uh on all the stuff right the next one
saudi and saudi league so you can see
why i really was very invested in
simmons talk apart from being great um
it's just that you know you had yca or
the yemeni cyber army as yet another one
of these fronts that at the time
we have a lot of reasons to suspect
we're the russians
i much prefer simmons treatment in the
sense that
you have a much more nuanced way of
looking at this just because you stole
the data doesn't mean that you're the
one doing the amplification and taking
advantage of what it is but
at the time at least for a lot of us we
believe that yca
was again fake front no pedigree was
discarded overlapped with other nation
state operations for how they sourced
some of the data as was mentioned in the
last talk you know
they were in certain
saudi institutions
uh predating this and i'll leave it at
that
so
then you have tv sangmond and you know
john holdquist around here might uh
throw something at me but
you know they had this devastating
attack in in this news channel in france
um
again overlap with nation state
operations you see sofisi toolkit in
there whether it's uh i believe from the
eyesight the researchers at the time or
even ansi that responded to this and you
know was kind enough to provide us with
some indicators
and this is all done under the guise of
the cyber caliphate
the cyber caliphate this being sort of
this russian hacktivism
operation or this russian front uh they
didn't think of it as being burned
with tv sank bond which is interesting
because then they went on to do other
things like
hacking the us centcom twitter account
you know i love isis and whatever
nonsense defacements using this wboc
maryland
texting system to spread some some fun
to
folks in the maryland area
about you know how isis was coming
but interestingly enough you know we if
you already know that tv snack monday's
done by the russians and it's claimed by
cyber caliphate then everything else
claimed by cyber caliphate to that
extent um kind of fits in that mold
whether you like it or not right so
2016. uh guccifer 2.0 this was kind of
the most ridiculous one right
as much as we might appreciate them you
know taking a stab at crowdstrike
beyond that being funny for about 30
seconds
it actually began this sort of
ridiculous thing of um
blatant denial of things that we were
all fairly familiar with as far as ops
go again false pedigree if any of you
know who guccifer was in the beginning
it's this romanian taxi driver who at
the time was in prison and he
had dumped some you know
clinton emails in the past and it was
just sort of this ridiculous figure but
it's obvious that it has nothing to do
with him you're trying to borrow the
pedigree of a different
hacker that's relatively well known
and then you start making these like
inconsistent claims right like lorenzo
was in the crowd he had the chance to
talk this guy realize he doesn't speak
romanian
you know he's sort of google translating
the romanian as well as we are
um and you have overlapped with nation
state ops uh for a variety of reasons i
think at the time also uh upon all the
things matt tate did some great work
sort of looking at some of the original
stuff that had been released and how it
had some sort of inconsistent metadata
so we'll leave it up in the russia stack
as well obviously dc leaks podesta
emails you're talking about the same
hack that we all know came from sofa c
toolkit it's being released under other
domains so no pedigree overlap with
nation state ops russia
um this one was particularly fun we had
just seen sofa c roll through wada and
task cass and then all of a sudden this
uh
you know we get this bizarre thing with
anonymous poland and i like this picture
in particular because i guess i was
enough of a loudmouth on twitter where
they were tweeting out to me as if i
would care um about the fact that they
were releasing documents from wada they
did this to other journalists and
researchers as well
which is the beginning of the real theme
of this talk which is the notion of
amplification and what role we end up
playing in secondary and tertiary
effects for these things
so straightforward krimono i mean who
the hell cared about the doping in the
olympics to this extent well the only
folks that have been kept out because of
systematic doping
overlap with nation state ops we
literally saw them rolling through those
networks like weeks before
um put it in the russia bin and this is
kind of where you lose me right like at
this point they're just trolling us
right so at some point they just pick up
the fancy bear's name and like you know
they roll with fancy bears hack team
twitter and website and it's like we're
not even going to pretend anymore um i
suppose it you know falls into this sort
of trolling that has become part of our
political milieu now but at the time it
was
it was kind of a facepalm moment and you
know that was it
so
after seeing all that for years and
years and years um i did get to a point
where it's like
is there even real hacktivism anymore is
that a thing that even exists
and i think that's just sort of being a
little too jaded or maybe the real
effect of being dunked in a tank of
active measures that you start to think
that nothing is real
so i wanted to kind of say like what
might examples modern examples of that
look like for us so i think the hacking
team might be a really good example um i
don't want to be or sound naive about
any of these all of them i have
reservations about but if we're going to
approximate something that might look
like real hacktivism
if any of you missed this it was a
fantastic popcorn moment um
and it was done by this wonderful figure
phineas fisher um i i wish i'd had the
foresight bruno was kind enough to get
me my own version of the sock puppet but
i didn't bring it
the whole sock puppet thing if you
didn't see there was an episode of vices
cyber war where phineas fisher insisted
that they would be interviewed that they
would give answers but they had to be
represented by a sock puppet so that is
what phineas fischer looks like in the
collective consciousness um
so what was interesting about this is
that it's not the only hack right you've
got first the gamma groups and fisher
hack where he you know they get their
name then comes the hacking team one
then there's like the uh guardian
nacional like uh
the police in barcelona and there's a
bunch of other sort of interesting hacks
that are related to
phineas fisher in one way or another
so let's do the same kind of analysis to
me the reason i would say this is it
looks a lot more like hacktivism is
frankly the qui bono is complex like who
actually benefits from the hacking team
dump uh is questionable right you have
just about
30 40 governments that are rolled up in
that people's emails are in that you've
got competitors like one of the reasons
we became aware of the existence of
candiru for example was the mention in
one of those emails about the
competition who the hell are these guys
um there's a lot that happens in there
that isn't really straightforward as to
why you would drop this unredacted
nuclear bomb on the industry
um it's a really irresponsible dump in a
lot of ways
not only did you have all the source
code put out there and all these things
that folks could reuse
but there are literal live odays in
there uh that several groups including
some of the chinese apts uh sofa sea and
dark hotel as well were used within days
so you know it's not like it wasn't
without some fallout
and there's a consistent motif for all
these things i mean as much as we might
want to be skeptical of it
if there is such a thing as an
anarcho-marxist
hacker out there that really commits to
this idea of like sticking it to
capitalist institutions and using cyber
as a great equalizer well that seems to
be what phineas fischer is consistently
leaning into
the other example that i would point to
is the panama papers and now the pandora
papers this sort of saga that continues
about the release of
a glimpse into how folks hide their
money and avoid paying taxes and how bad
all that is
what folks
miss about this story myself included at
first is that there's supposedly a
hacker behind all this called john doe
and there's you know some short
manifesto about it but we really don't
know anything about who john doe might
be
um
so hacktivism or non-hacktivism some
folks are really uh passionate about the
idea that it isn't that it's a
nation-state thing uh but if we do the
same kind of idea there is a certain
amount of suspicious coordination right
like going to the icij and having every
journalist from every country take their
piece and responsibly write something
over a year and releasing this in a very
coordinated fashion
is suspicious
it's interesting i if any of us
conducted this operation and got this
material i think we'd be at a loss for
how to do that kind of dissemination
quite so perfectly
there is a complex quivono i mean
sure
you could say that you stuck it to the
russians or you stuck it to the saudis
but in the process you rolled up david
cameron and the you know prime minister
of iceland and a bunch of other folks
that presumably you wouldn't have an
issue with so you know how do you weigh
the fallout of something like this
and then there's angry putin and angry
putin is you know the one who is most
fervently saying oh this is clearly the
cia trying to mess with me which is
interesting because he's not mentioned
in there so i don't know whose money
he's really concerned about
so what have we learned
i think after all this time we really
learned nothing um
because after years and tons of
operations we're still thinking about
this the same way somebody comes out and
says we're hacked to this and we're like
yes you are what have you got for us
um
so i was kind of hoping that you know we
could at least take a minute to assess
and say what could we have learned from
all these things right
so i think there's a series of metrics
or coordinates that keep popping up in
our assessments of these previous uh
abuses of hacktivism right there's the
notion of does this group have a
pedigree is there a continuity to their
operations uh is there a coordination
about their releases or are they doing
them willy-nilly uh is there a
consistency to those operations
how is the material being sourced is it
a nation state op that collects the
material and then releases it through a
hacktivism front or are they doing it
themselves you know who benefits from
these things and more importantly
secondary effects and targeting i think
that's something we haven't talked about
as much but is actually really really
important
how's my time anybody
13 minutes oh perfect that's almost too
much um
so take-home exercises and some of these
are going to be familiar if you all want
to play at home uh well you know
intrusion truth right we saw it today
interesting uh little shop are they
clearing
classified data for doj indictments are
they just sick of watching the chinese
do whatever they want who knows
um
you also have lab ducta gun
really interesting right somebody
suddenly comes out and starts dropping
iranian tools and source code and all
this stuff
what the hell
and then green leakers which i think
we've kind of forgotten about maybe
they're not as active anymore but uh
this is sort of relevant to us right
this is where folks are leaking things
that i think we're meant to pay
attention to we are meant to sift
through figure out you know why like
where these tools came from and how they
were being used and to kind of um give
it substance the same way that
journalists give substance to you know
email troves that were dropped from the
bradley foundation for wherever else
like nobody in the public is going to go
read through 20 gigs of emails but some
art investigative journalists might make
hay out of it
these operations are in some ways meant
for us i think intrusion truth and
reality is in a lot of ways meant for
the doj
but
interesting right
so what's why is this relevant today why
are we still having this conversation
right all these examples that i
mentioned for the most part 2012 2014
2016 we're pretty far ahead the reason i
said we haven't learned anything is we
have some ongoing examples right now and
i'd love to do the same kind of analysis
about some of them and in some cases you
know maybe i'll be naive and others
maybe i'm paranoid but you know we can
talk about it over drinks
in a little bit
and a little bit um
so the first one is the bill of russian
cyber partisans i don't know how
familiar some of you are uh with this
group they are actually quite charming
in their kind of pluck and seal and
attempt to deal with such a
horrendous regime
um so what makes these guys interesting
well i mean the quimono is kind of clear
they're sort of part of a larger
operation
that's trying to
sort of cease back
uh belarus from this horrible regime and
try to they're they're trying all sorts
of different things right you know one
day you're trying to drop data to see if
that's what journalists are going to
pick up and the next one you're talking
about well what if we encrypt all the
machines with ransomware until the you
know the government's out and they're
trying uh desperately to kind of figure
out what's going to have an impact uh i
think they also have understandable
capabilities like they're talking about
how like oh you know it's a group of i.t
administrators and other folks in the in
the industry who are unhappy with what's
going on and they're trying their
darndest to get to some of these targets
even though they can't reach all of them
they don't necessarily know how to
amplify all the stuff that they get
um
the targeting is actually really
important here
they don't necessarily know what to hit
and i think that's something that we
really need to remember here because we
forget it every time we're talking about
hacktivists
if this if folks in one of these tables
decided that tomorrow they're going to
start a hacktivism collective and maybe
they're super elite hackers that doesn't
imbue you
with the
knowledge of how a government is
structured where its stuff is kept what
actually matters to that government what
is going to have an actual crippling
effect where um some of the real
material uh conditions and mechanisms of
that government lie you might stumble a
bit you'll do some stupid defacements or
get at some stupid databases or make
some mistakes here and there as you like
figure out what your stride is gonna be
and with some of these groups we never
see that right they just show up and out
the box they know exactly what they're
supposed to be doing and i find that to
be some of the most suspicious stuff so
on the part of the belarusian cyber
partisans what's really interesting is
that they admit that they didn't know
what to hit so what did they do well
they partnered with bipol which is this
group of like security officers who have
left the government and you know sort of
conscientiously you know are against the
regime and they tell them what to hit
right if you just left the place you can
go uh there's a database there you might
want to look at um
it at least gives us a cohesive story of
how this stuff is happening
and i think it's important to say that
they're a small part of a larger effort
right they are the hacktivism arm
of
several groups including the kind of
students who
have the balls of steel to go throw
rocks on the street and fight with the
police and still you know try to mount
some kind of offensive and that's how
you see an actual
grassroots movement that's fumbling and
trying and failing and trying and
failing and trying to figure out what's
going to work that's more organic so
again maybe i'm being naive
i'll take that but in this case um
there's another thing that really hits
me which is they were kind enough to
provide us with samples like they they
keep getting sent really shitty malware
uh trying to collect all their telegram
stuff and whatever um maybe we should
talk about ghost rider and see if
there's anything shared there it's
really not good um but
you know for me
you know they get sort of a facebook
like of approval
but we'll see
um how about a better one and this is
one that i've been obsessing over
recently
so if anybody was paying attention to
iran not just what the iranians do to
the rest of the world but actually
what's happening in iran
um you might have noticed uh in july
9th
there was a hack of the iranian railway
system and it was actually kind of
hilarious
because
somebody wiped the machines at this
at the iranian railway system and put up
a bunch of screens that just said uh
trains delayed due to cyber attack call
64411 which is the office of the supreme
leader
which is pretty funny uh and you know we
all kind of laughed about it for a bit
uh and i was kind of hoping that we
would kind of stop laughing about it and
take a look at what had just happened
because if somebody had pulled this [ __ ]
in chicago we would have lost our
goddamn minds so just keep in mind that
like it's easy to throw rocks at like
north korea and iran but as far as
precedent goes there's a lot more there
that we should probably discuss so
when digging and um with some guidance
from pardas which is kind of their local
security vendor
for lack of a better one
we're able to kind of rebuild a lot of
this toolkit it is a pretty interesting
toolkit we call the meteor express based
on some strings there and what they were
doing
and you can find the blog post online if
you want to take a look at this full
hashes and all this stuff really
interesting toolkit
the way that i would describe it is like
a really smart toy that was given to a
very dumb child
like the operators clearly don't know
like what the functionality is and like
they're throwing things in ways that
like are packaged in ways that you know
i don't think somebody was experienced
would know how to use it and like it's
externally configurable but then they
don't remove the debug strings so you
can see every it's just
okay you can read the blog post don't
worry about it so
okay well that's interesting right this
looks like a nation stayed up maybe not
the best nation state but somebody's
kind of involved somebody's making a
message um
what jd work notices and actually a
great piece about
sort of what it takes to be more of a
measured actor you might want to check
out is that there's this group called
kojanjika dharan
sorry
predatory sparrow that claims credit for
this attack
okay
the persona appears to be discarded
immediately it didn't have any pedigree
as we're used to at this point but it
turns out that there were previous
attacks when you roll back from the
toolkit that we found in meteor express
um
ty cohen figures out that oh scott sorry
um
that
there's a previous toolkit previous
versions uh called stardust and comet
that have a string that refers to indra
indra the god of war indra the god of
war who has a facebook page
and in that facebook page they were
actually taking credit for a series of
attacks in syria that none of us in the
west seem to have noticed um so
another group with no pedigree with
pinpoint targeting
i mean these guys the the whole point of
the attacks in syria were like this is a
company that launders money for the irgc
and this is an airline that flies
soleimani and other people from the irbc
and it's like how the hell do you know
this like where did the sudden leg
how did you know precisely what to hit
they get hit with a similar
functionality wiper uh it code base is
almost exactly the same
but
that persona gets discarded if you look
at the facebook profile indra claims all
these attacks all this stuff is going on
and then november comes around and they
stop like the whole thing just goes dark
around the same time they modify the
toolkit to go from stardust to meteor
remove all the references to it and then
all of a sudden it's predatory sparrow
then we get this which if any of you
recognize that video the evan prison
hack um
i mean i was fascinated by this
evan prison is one of the darkest places
on earth i don't have a problem with
people hacking into it and
showing how awful it is
but if i'm if you're going to let me
watch what the cyber attack looks like
unfolding on the machines i'm at least
going to note that like this looks an
awful lot like the malware we're just
dealing with which is externally
configurable you just change the picture
on the screens i'm not going to claim
it's the same because i don't know i
didn't do the ir i don't have any
samples i have no idea um but we're like
okay so indra right like what how many
groups are out there attacking uh iran
with wipers at any given moment uh no
not indra predatory sparrow no
um
ali whole new group awesome so
you know you look at it no pedigree
immediately discard it we never see them
again they never they just tweet out a
couple of things and they're gone so
this is where
you know i'm running out of time there's
too many slides
um and hocus doesn't like it so we're
not done not yet but we're almost done
so then there's this if anybody was
paying attention two weeks ago
um the
subsidized
gas uh system in iran was taken down
just to kind of explain the context i
had to figure this out thanks to mostly
hameed kashvi who's helped me a lot
understands the country a lot better
than i do
basically no one in iran can actually
afford gas at normal gas prices so
there's this little card system and you
go and they give you subsidized gas and
the government keeps track of all of it
and that's how most people in iran buy
gas so that system was taken down
country-wide and when you look at the
little pos system it said cyber attack
call six four four one one cute um
and uh actually having with hamid we've
been able to kind of at least
reconstruct what that system looks like
i can tell you it's basically swiss
cheese like we haven't published
anything on this yet but it
it's a garbage stack of just
the worst possible system you could
imagine to manage something for a whole
country
it doesn't mean that the attack is any
less pointed but you know it's not like
we have to deal with the most
sophisticated attacker ever um we'll get
into this later so adelaide ali
no
predatory sparrow you know gojunki duran
um and we're like okay fine familiar
face we're back to these guys but wait
it's not even the same gojek duran from
the first attack they didn't keep the
account they lost access to it i don't
know what the hell happened but it's
misspelled differently
credit to jd work for noticing that in
the first place so
let's talk about the fact that you can't
even keep a single account rolling for
the whole thing
um so
why why does this matter to this
audience beyond the fact that we're you
know kind of analyzing these things all
the time well you can have this sort of
simple attribution right if you ask the
iranians you know oh the big devil the
americans and the little devil were
involved in all this and everything's
their fault
and that's not really what matters here
the attribution isn't actually the issue
that we're
discussing cyber attacks are discreet by
default when for the most part when you
design an attack um it doesn't present
itself to your victim the way that like
i don't know blowing up a hotel does
right so
when you make a cyber attack overt
that's the only time that i think we can
have a legitimate argument about
signaling the fact that the attack
itself isn't necessarily the end goal
but rather secondary and possibly
tertiary effects so we have to ask
ourselves you know what's the signal
what are you trying you know maybe
you're destabilizing the government
you're making the regime look uh weak
you're trying to upset people sure um
what's the intent of the attackers the
intent is different right it's it's one
thing to upset folks uh because they
can't get gas it's different to say well
to what end
do we want these people to be upset
um and to what extent are we the
audience and that's not sort of getting
all self-centered and like oh security
researchers and journalists are the
end-all be-all but when you look at
their posts they're tagging some of our
best and brightest you know you see
kinzetter and lorenzo and chris they
want them to pay attention they're
translating their own messages and
they're actually misleading us with how
they did the hack because that ingenico
breach is not not how they did it
so i think we have to have a different
conversation
that we're at least partially the
audience and we're at least partially
the mechanism of amplification for these
things
which means that we're the vessel for
secondary effects
and i know that
that makes people uncomfortable we
usually have a hard time as an industry
accepting that we have some active
ethical role in what's happening um in
this industry and in this sort of cyber
war space pulquist
um but we're gonna have to have some
tough conversations about this so
on that note i think
that's it thank you guys
thank you for the talk jax um
i'm surprised you left out ddos secrets
one of the most
successful hacktivist groups like right
now especially in this country but um my
question is actually simple uh what's
your take on donk and b
on
don't talk nb
um
i mean it i think it's right by this
generation standards it's cool to be gay
and do crimes and
it's a good time to like you know have a
certain amount of resistance
um
i don't know i don't judge it i think
there's a lot of complex conversations
to be had about those drops about the
epic hack which you might want to
discuss
with silas who knows it better than i do
um
i don't know how to morally
gauge these ops
right like the hacking team hack was six
years ago and lorenzo and i have
discussed it nonstop for months
and to this day
i don't know where the moral equities
process puts me on it right there's a
indefinite amount of fallout it's
incredibly unpredictable uh hacks that i
think the hardest part is seeing a full
dump out there right you really don't
know who you're putting out there for
whatever right like
some of these things are easy for us to
stomach but then you look at like in
israel right now like
you can dump a database of like
lgbtq folks in a dating app
and it's not as cute right those moments
are like i understand that these are uh
sort of nation states playing tit for
tat but
it's not a database dump as a database
as a database dump there's obviously a
lot more going on there
i don't judge it i think the lulls are
great uh i'm all for folks messing with
you know the alt-right
but if i take a step back like the whole
iranian thing right it it's funny to see
somebody take down the trains but i have
to remind myself that if somebody
carried out an attack like that
somewhere western with white people we'd
be pretty pissed so
yeah
what
i don't know i have an entertaining
twitter account
like it's as much as i can say and i
think that's part of sort of the
take-home test right i definitely don't
have eyes everywhere i
barely have eyes anywhere so
to some extent i'm just hoping that
we'll be a little more circumspect about
this because what happened with meteor
express is we found the attack
and other folks came rushed to say oh
look activist group and there's their
facebook page and we figured it out it's
like no we didn't this is way more
complicated than what we're talking
about
um and we kind of have to like close one
eye and squint the other to believe that
it's real
okay time for one more
hey jags so uh just comments uh and
questions so
what you're kind of talking about is
like content moderation for like
hacktivists like is this a government
behind it or is it like actually
hacktivist
the only organization that i'm aware of
that actually like
cleans through like leaked data to make
sure it's not government tied is like
ddos secrets but they don't really talk
about like how they discern whether
something is an apt or government or
like actual hacktivist do you have any
thoughts on like how organizations like
that could better
be more transparent or like at like
differentiate between the the data that
they do release through ddos secrets
um yeah thank you so i mean
i'll take mild objection in saying that
they're not the only one right like
belly cat does great stuff in that front
i hope they'll do more of it but yes the
ddos secrets does good work on this
look i don't even have much judgment
towards them because when you look at
organizations like that they're giving
themselves a time frame to understand
what they're looking at
the issue we're dealing with is between
the rat race of being the first security
vendor to call something out and
you know trying to cover things in the
space as a journalist before anybody
else scoops you
we really aren't giving ourselves a
space to properly understand the data
that's being dumped on us i mean you
don't
people were covering the hacking team
hack
way faster than they could have
downloaded 400 gigs you know like
there's no way you had downloaded the
whole thing but people wanted the scoops
everybody wanted to jump on it
and i think that's where
the worst of the amplification happens
right trite saying about like you know a
lie travels twice around the world
before the truth puts depends on
applies here because you know it takes
almost no time for us to come out with a
a hot take and a nice tweet and maybe
write a cool blog and say oh my god but
we've already seen the russians
manipulate the data that gets dropped
and we've already seen how some of these
things are intentionally sifted to make
things look worse than they are and
there's no way that you're going to
assess that in three hours so
i'm sure those folks are doing great
work they're probably doing it better
than i would i think the biggest issue
here is saying you know give yourself a
little time to understand what you're
looking at and have some healthy
skepticism before you buy the story
if we're honest the reason the story's
so appealing is because it takes the
moral quandary out of our hands it's
activism somebody just dropped this on
my lap i'm not working
as part of an operation from a foreign
country
and it's convenient so we like it but
it's not true
on that positive note
thanks everybody
[Applause]