#89, Chris Wysopal, Founder and CTO @ Veracode: Ethical Hacking and Cyber Safety

0:00And we told them we could take the internet down in 30 minutes if we wanted to. And that was the headline. I mean, if you're saying you can take the internet down 30 minutes out. So that was the big takeaway from the hearing. And then we told people how to fix this.

0:20so we were lucky enough to have the opportunity to interview one of the chief protagonists of the loft group one of the most important ethical hacker groups in the history of software and cybersecurity. Back in 1998, a group of young elite ethical hackers went to Capitol Hill and in front of a puzzled US Senate committee, warned of the impending threat around the evolution of hacking, especially adversarial hacking. One of those protagonists was a chap called Chris Weissopal. Chris is a seasoned veteran in the cyberspace, as well as an entrepreneur in his own right, and general oracle when it comes to anything related to penetration testing and ethical hacking.

1:13We really had some fun doing this interview. We talked about the history of hacking and the cybersecurity space generally. We talk about that moment of infamy when they chillingly professed to the US Senate committee that they could take down the internet in 30 minutes and how profound that was and how impactful it was on Chris and his peers. We talk about the real threat of quantum computing. Chris tells us how robust the Bitcoin network really is to hacking. And also we discuss how impactful generative AI is going to be on the cyberspace and also on the SaaS business model. There was so much value in this episode.

1:54I took so much from it. I'm sure you will too. It is Chris Weissopal.

2:04Chris, I've been really excited to talk to you. I mean, your background is incredible. I've been through some amazing experiences in your career, and I'm looking forward to unpacking those. But before we dip in too much, I just want to ask you the question we always start on. What does good leadership mean to you, Chris? Okay. Well, Gareth, thanks for having me on the podcast. Good leadership for me is letting your people be their best, letting them do the problem solving, letting them work out how to be cross-functional within an organization, and really being there for vision and guiding. And then when there's execution challenges, maybe helping there.

2:47But I think the real thing is you want to see your people grow. You want to see your successor grow into that role. You want to see everyone grow. And that's a source of pride to see people take on more challenges and leave the company you're at and go start their own company. I mean, that's leadership, I think. That's fantastic. Yeah, I think leaving people in a better place, having known you, I suppose, is probably another way to put it, isn't it? Is empowering them to fulfill their potential. So I love that, Chris. That's really, really great answer. So Chris, for the listeners who are not familiar with yourself, could you maybe give us a little bit of an overview of your background?

3:28Sure. So as a teenager, I was really interested in deconstructing things and hacking and learning about how things worked. The personal computer had just come out, so I'm really dating myself and trying to figure out how that worked and all that. And so I got a taste for sort of reverse engineering and hacking and taking things apart, but there was really no career in that. So I went to school for computer engineering. I went to Rensselaer Polytechnic Institute and got a bachelor of science in computer engineering. And I was interested in both hardware and software. I didn't pick one over the other, but eventually all the jobs were in software.

4:11So I became a software engineer, and that's what I kind of did in the 90s for a while. And then I realized my passion really was hacking. Oh, wow. So I kind of segued in the mid-90s to the late 90s to a career in cybersecurity when there really wasn't any careers in cybersecurity. I kind of had to pioneer the way to be, you know, I'm just not a compliance guy. I'm not going to just check boxes. I'm actually going to hack things and break into things and find vulnerabilities and figure out how hackers do things. That was all new in the 90s. So that was really how I started was moving from software engineering to figure out how to make a career in hacking.

4:52Wow. So I got to ask you this, Chris. What was the first computer you had? So my first computer that I actually owned was the original IBM PC. Oh, wow. It didn't even have a hard drive. It was just two floppies. Oh, wow. So it was pretty basic. But before that, I played around a lot with the Radio Shack TRS-80 because that was something that was available at the mall. So I would go there at the mall and be able to play on a computer before anyone even really even had one at home. It was in the very, very early days. And so I was hooked. Oh, wow. I've not heard of that. You were obviously in early then, and you were hooked early then.

5:32I'm amazed. Just to quickly talk about those early days as well. I can't believe you foresaw that there would be a vocation within cybersecurity at that time, in the mid-90s. You must be a bit of an out there thinker to even consider that that was an option for you. Yeah, that was the thing. So I was involved. I ended up finding a group of hackers in Boston that sort of had a like mindset. We weren't like, we're going to figure out how to steal money by credit cards or something. we were trying to figure out like how does cyber security even work like how are these companies protecting themselves from the bad guys how can we figure out how the bad guys work so that's why we called it a hackers think tank we were really kind of pushing the envelope of this and at some point we said you know companies would want to hire guys like us first but at first we realized that they didn't want to hire guys with hacker handles and hacker names.

6:32And they wanted to hire people who look like IBM professionals. So that was the gap between our skill set and our mindset and what companies would hire. And that's the gap we kind of had to bridge in the late 90s and say, no, actually, you should take us seriously. You should listen to us. We actually know how hackers work. We can actually find the same problems and write the same tools they do. you should hire us. And it really took, I think, that US Senate hearing that I got invited to with my colleagues from the loft to sort of wake people up to the fact that people from our background could be trusted and should be listened to.

7:13Yeah, absolutely. So can you tell us about how that group then that you joined, how did that come about? And what was it like in the early days? And can you elaborate a little bit more about, sorry, I don't know how you say it, L0PHT, yeah? We spell it that way because that's hacker elite speak. Like, you know, hackers were the first ones with online culture, right? So we pronounced it loft. Yeah, sure. Online culture really started with hackers because we were using any vehicle we could to communicate to each other over text, even before the internet, right? With bulletin board systems where you would use a modem.

7:49The older folks, remember, that's how you connected to the internet before broadband. There was actually, you would use a modem to dial up to a bulletin board system and share files, share text files, communicate, chat with people. And that's how I met the people at the loft was through these bulletin boards that were focused on technology, focused on, you know, computer cybersecurity, focused on hacker techniques. And so I found people by going to different bulletin boards and finding a little community there that was people interested in like, well, how does the cell phone system work? Like, can we reverse engineer that?

8:25Can we take a phone apart? Can we learn how the firmware on that works? Can we look at the radio and understand how it's communicating? That was like the hacker mindset I was interested in. It's like figuring out how to reverse engineer things. And then you can figure out how you can manipulate them, where the weaknesses are. And so we had seven, eight people at different times come together at the loft, all with slightly different skill sets. I was more on the software side. Other people were more on the hardware side, the radio side. We came together and we started to do projects and learn how Microsoft Windows worked, how Internet Explorer worked, and we figured out how to break it.

9:03And we started to publish what we were doing. And we were like, everyone should know this. Everyone should know if they're using Microsoft's Internet Explorer that your computer can be compromised and taken over unless you patched. Or there was vulnerabilities that Microsoft doesn't even know about. These were all new concepts back then in the 90s. And that's what got the press interested in what we were doing and eventually got us invited to speak at the Senate because the Senate was like, computer security is going to be important to the US federal government. We need to understand this. And I think they had a lot of foresight to say, we want to hear from hackers.

9:42We don't want to hear from people that worked for AT &T's security department or Microsoft's security department, even if there was such a thing back then. There might have been a few people or a bank. We want to hear the people that were trying to break in. And that was how we kind of changed and made jobs for ourselves because we showed that you need to understand the adversary. You need to understand the offense or you clearly can't do cybersecurity. And we were the ones that you should be talking to if you want to understand that. I'm assuming Loft wasn't the only hacker group around at that time.

10:18I don't know if the cypherpunks were around then and a couple of other groups. Yeah, the cypherpunks were a little bit earlier. There were some other groups out there, like Legion of Doom was one. That was a WWF wrestling tag team, wasn't it? Yeah, I know. It's just so funny. The names back then, like people's hacker names were Kingpin. Yeah, yeah. And, you know, there was a guy, Eric Bloodaxe. Like everything was overdramatic, right? But yeah, there were people that were before us. But to be honest, they were a little bit early. Like society wasn't quite ready yet. Like it took a few years of sort of sanitizing hackers to be like, you know, we're not all, you know, evil masterminds trying to steal all your data and take all your money.

11:05That the techniques of hackers were the value. And it could be used for good or bad. I mean, that's one of the big lessons I've learned is everything is dual use. Like people are like, well, isn't Gen. I going to let the bad guys do all this stuff. I'm like, well, what about like the internet and microprocessors? Yeah. Like they're in, they're in missiles. Right. And, and, and communication networks. So like technology has always been used for good or bad. So I'm, I'm all for the good guys using the technology. Yeah. And that's why we need to leverage things like Gen. AI. So I think understanding how things can be used for bad is part of solving for the good.

11:49Yeah, sure. This episode was brought to you by Be Digital. Be Digital support leadership teams to optimize cost and get more out of technology investments. Be Digital and the team have unrivaled expertise with technology license management and data remediation and are therefore perfectly positioned to help prepare organizations for AI technology capability. And on the last point, BDigital have just developed a cutting edge AI readiness assessment, which provides tech leaders with a platform they need to make well-informed decisions about AI adoption strategy in 2024 and beyond. Go to BDigitalUK.com to find out more and get in touch.

12:39So, reflecting on the time with Loft Group then, Chris, okay, what were some of the most challenging or most profound sort of ethical hacking discoveries you made? And how did they shape the cybersecurity landscape from the work that you guys did? And how did that shape how cybersecurity was approached and thought about? Yeah, so I think some of the important stuff was what we were doing with Microsoft Windows, because it wasn't esoteric. It wasn't like only banks use this, and we could only break into banks with this piece of software or technique. It was something that was becoming the foundation of all business.

13:20You were doing penetration testing, basically, on Windows. on the software, right? So that was the big discovery was you didn't say, oh, I have a target, it's this bank. Let me learn what they're doing, how they're doing it and how to break in. It was the big profound discovery was I'm gonna target the software that I know is widely used. So if I set up a lab environment and I set up two Windows machines talking to each other, a web server and a web browser, and I set this up in my environment, I can legally hack on this. Like I legally purchased the software, I'm legally running it, I can hack on this, I can find vulnerabilities and then when I find that vulnerability, I can write a tool that will exploit that vulnerability and now I have something that if anyone is using that software anywhere, I can attack them and everything I've done is ethical and legal and what I'm doing is I'm pointing out problems.

14:20Now, some people will say, well, what if you distributed that tool? Right? Like now people can hack into things. And I would say, well, but now people can see if they're vulnerable. Right? They can test it out and they don't have to believe me. They don't have to believe the vendor. They don't have to believe the government. They can run the tool and see how it works and what it's doing. And they can see if they're vulnerable. So it was sort of that understanding that you could hack on software legally, and then you could demonstrate with full force of working proof of concepts that this stuff is real.

14:53And I think that was very powerful. And that was when a lot of businesses woke up and the government woke up to say, like, you know, there's a new breed of hacker out there and they're reverse engineering software and they're building exploits. And so the other profound thing that really happened was Microsoft actually came to us and said, you know, we want to fix the problems that you're pointing out. We know we have to fix them. We want to fix them. Would you let us know about the problem before you told the world? And that way we could protect our customers from this problem. And they didn't quite say the problem that we created, that we should have found.

15:35And they weren't like, oh, thank you for finding this and thank you for bringing it to our attention, which later companies started to do. But at the beginning, it was like, just please tell us so we can protect our customers. Protect their brand as well. It's the PR thing, isn't it? It's a big PR thing because then you're controlling it, right? You're controlling it. When we start talking about it, they're like, yes, and we fixed that a few weeks ago and the patch is available and our customers can be protected. But that was a phase that we had to evolve through before companies would start to do this themselves and realize that they should be doing it themselves.

16:13So this was the other big evolution was we needed external hackers to point problems out to these big vendors and kind of shame them a little bit and to say, you know, you guys need to do better. And I think that's what we were doing when we went to the Senate. We were saying these companies like Microsoft and IBM and Oracle, they can find the same things we're finding. You might think we're super geniuses, but actually people can be trained to do this and the tools are available. So we said, anyone can do this and the vendors themselves should be doing it. You shouldn't be relying on us to do it because if they don't do it, we're going to do it or someone at an adversary will do it.

16:54A very big moment when we were at the Senate was Senator Fred Thompson, who was the chairman. You might know him from Hunt for Red October and other T and some TV shows. But he said, what's to stop a adversary like Russia or China from getting a group of individuals like you and attack and doing the exact same thing, finding vulnerabilities in software and using that to attack the United States government. And we actually hadn't thought of that. It was actually a new thought because no one was doing it back then, right? No one was doing it. It was the early days. And we said, you know what, that's a really good point.

17:35We think that they could absolutely do that. And it really kind of changed the calculus of protecting the United States government and the military. It changed the calculus to see that this was possible. So what were you thinking about? What threats were you guys discussing? Like attacking national infrastructure, just attacking military systems, satellites, NASA, I suppose, could be something they could attack? Were these the kind of conversations you were having? Absolutely. I mean, the big conversation was like, can you take down the internet? That was really the punchline. We came knowing that we knew vulnerabilities in internet routing and the internet routing protocols.

18:11And we told them we could take the internet down in 30 minutes if we wanted to. And that was the headline. I mean, if you're saying you can take the internet down in 30 minutes, so that was the big takeaway from from the hearing. And then we told people how to fix this in the government. But yeah, we were talking about taking down the internet, we were talking about taking down the GPS system, satellite communications, we were talking about hacking the power grid. And so yeah, critical infrastructure. And I think that was the start of the federal government really taking this seriously. Yeah, sure.

18:43I mean, taking the internet down in 30 minutes, that was very, that was a very impactful thing to say, which I think caught a lot of the imagination of a lot of journalists, didn't they? And I think you did get a bit of notoriety as a result of that. So can you tell us a little bit about that, reflecting on that sort of testimony before the Senate committee? This was 1999. Was it 98? 1998. So a little over 25 years ago. I think we were scared going into it because we didn't know if we were going to be thought of as the bad guy. They were going to say, all our problems are due to people like you, like you shouldn't be publishing any of this.

19:24All you're doing is hurting, pointing out problems is hurting, you know, and that, that is one viewpoint. And, you know, when you, when you think about maybe the federal government, you, you think like you might be, you know, a scapegoat, right? A lot of these hearings, they turn on the people. And, and so we had no idea what was going to happen and why we were invited. Should we really believe why we were invited there they even let us testify with our hacker aliases like i had a placard that said weld pond in front of me my to my left was a guy with a placard that said mudge and to my right was a placard with a with a guy that said space rogue i thought they would have had your real names in the senate committee no and they told us we were the only ones allowed up to that point to use our fake names uh testifying the other people were in the witness protection program yeah That's incredible.

20:17You made history there then, Chris, yeah? We made history. So, I mean, the whole air of the whole thing was very special. It wasn't a run of the mill. We have hackers with their hacker names here. And so it was a lot of these hearings, not all the senators show up. They all showed up for this. It was a packed house and packed audience. So it was very exciting. I thought we were making a difference. I thought the, we were really connecting with some of the senators, like Senator John Glenn was there. I got to meet John Glenn, which was amazing. And, you know, he had a question about the global positioning system.

20:55And he said, he started, he says, hi, hi, gentlemen. I don't know if you know this, but I'm a pilot. And, you know, obviously - John Glenn was an astronaut, wasn't he? He was one of the - John Glenn was an astronaut and a test pilot. So, you know, there was some laughter in the room when he said, I'm a pilot, because obviously everyone in there knew that John Glenn was a famous astronaut. First guy to circle the earth, I think. Yeah, yeah, I think so. First human to circle the earth. You know, he was obviously technically adept at technology. And he asked about the GPS system. He says, you know, he's a pilot.

21:29He flies all the time and he relies on GPS. And we talked about that. So, you know, a lot of it was like very concrete stuff, right? It wasn't like esoteric. It was things that were going to impact people's lives. Yeah. And they wanted to understand how technology is brittle and vulnerable and what we should do about it. Yeah, I suppose if you've got someone like John Glenn pointing out concerns around an adversarial's ability to hack into GPS systems, I think people start to listen and take things seriously then, don't they? Absolutely. And little did they know this was going to become such a huge subject matter and give birth to the cybersecurity space, I suppose, as the internet and everything evolved.

22:11But how do you currently see government involvement in regulation around cybersecurity? Have you got any thoughts on how that has played out today? Are government doing enough? Are we still a little bit behind the curve? I'm talking about the US, I suppose, or globally. What was your thoughts on the current status quo? Obviously, there was no regulation back in 1998 or very, very little. We saw that that was a problem because we saw that there was real risks. And we saw with using software and internet and connecting it up to critical infrastructure was going to cause some real risks. I mean, we saw the colonial pipeline.

22:52We've seen the power grid go down in places like Ukraine and Estonia with cyber attacks. So it's like no laughing matter. It really is life or death. And there was absolutely no regulation back then. And basically, we said that vendors need to do better, right? Like vendors need to do this. This concept of having external researchers find some things and having those few things be fixed just isn't sustainable. But then again, regulation is challenging around technology because you want the innovation, right? Maybe big companies can handle regulation with teams of lawyers and compliance people, but startups, it's very challenging to comply to different things.

23:37So we understood that regulation was going to be a challenge. I think we're still, some things have changed over time, but we're starting to see some motion in regulation in the United States, at least, I think in a good way, which is where the buyer expects things of the seller, right? And so the regulation we're starting to see in the United States came out of the US. Biden had an executive order two years ago, the cybersecurity executive order, and said, the US federal government is going to make vendors of technology attest that they have security processes. And they've tried to make their software and hardware secure.

24:19And they're going to show us with facts about what they did. And then we're going to make a judgment. Did they do a good enough job? And that's going to be part of the buying process. And I think that's a good way to not be heavy handed, yet have expectations for vendors. And I think most vendors out there do build stuff securely now, but there's a lot that don't, a significant amount that don't. And so I'm hoping this level of regulation gets everyone on board with, we can make things significantly more secure. Not perfect. No one's looking for perfection. Yeah. No one's looking for a plane to never have any problem, but we don't want people to die.

24:57We don't want them to fall out of the sky. And so regulation around a dangerous technology seems to make a lot of sense to people. I think we're heading in the right direction. I think it's just taken so long. We talked about holding vendors accountable 25 years ago, and we're starting to see that now, at least with the federal government. And we're starting to see it in the EU with the Cyber Resiliency Act. And I know the UK is also working on something very similar to hold, especially makers of connected technology like smart TVs and all these IoT devices that are peripherating and controlling our doors, our locks, and parts of our lives make those more secure.

25:38Yeah, sure. Can you just maybe in quite simple terms, where is the border between secure and insecure? What do you mean by being secure? Have you got a specific thing that sort of means it's secure? What is the provision you need to take in order to be categorized as secure? Yeah, so I would say put the software through or the hardware through the kind of attacks that an adversary would do. So we know of a whole bunch of different classes of vulnerabilities, right? If you're making a jet engine, you know one of the vulnerabilities is cracks or bubbles in the castings of the metal. If you're making a fan blade, you know that things can go wrong in the casting process.

26:26So what do you do? You test it. You X-ray it and you look for those cracks and you look for those air bubbles and you X-ray it to do that. So once you know of a known weakness or vulnerability, you can design a test to now test for that. So we know of all these different attack methodologies. So you design tests that test if that attack works. I understand. Or if the vulnerability is present, you can actually look for the vulnerability in different ways. Like you don't need to spin the fan blade. You can x-ray it. Both will detect failure. One's a non-destructive test and one's a destructive test in the case of failure.