Dawn of the Bot Hunter

It’s raining and the morning sky is still dark, but the light is slowly shifting from ebony to blue. 

I’m thinking about Bladerunner as I listen to the rain. Harrison Ford narrates my near-future dystopian fantasy as a billion drops per second shower the world. I imagine each drop a malware-loaded bot, a digital armada with greater power than humanity has yet amassed but smaller than an atom, slamming against my firewall. 

Good morning, it’s a great day to hunt bots.

The information security company WhiteOps is the genesis of this daydream. Claim to fame: authenticating trillions of online interactions. The service: determine if it’s a bot or not. 

That’s what reminds me of Bladerunner, the Voight-Kampff test from Ridley Scott’s cyberpunk masterpiece. A digital detective tasked with identifying bots imitating humans. Sounds like another way of saying non-human investigations. So spooky and suspenseful, I’m definitely going to need a trench coat.

Detecting and defending against bots isn’t the future. It’s now. These bots are the new tanks and the next-generation super-cyber bombers. Consider how devastating the German u-boats were to the battles in the Atlantic. Bots are cyber-dimensional submarines exploiting the trade routes of the internet. They are electric ideas driven by algorithms with ambitions. And one of their greatest powers is passing as human.   

WhiteOps has a position open: Threat Intelligence Investigator. That sounds slick enough to me. If there is an AI that loves me, then there will be a bright and shiny circuit-badge with this gig. Just once, I want to unfold my wallet, flashing my ID, and say, “I’m Investigator Twitchell, this is my partner, we’re looking for some bots that were spotted in the neighborhood.”

I sent in a resume and cover letter a few days ago. Not just because Threat Intelligence Investigator sounds badass, it does, but also because figuring out what is human online is essential.  

If you find my words dramatic, well then don’t read this report on fraud and definitely don’t read this article on the AI-containment problem. And most definitely don’t read this one about Facebook being a Doomsday Machine with 90 million bots lurking around trying to friend the planet to death.

I hope to hear back from WhiteOps, but if not, I’m still going to hunt bots! 

And once I find them, game on. Ding ding goes the boxing-ring bell, let the match begin. In this corner hailing from 3-dimensional space fighting for humanity and weighing in at 170-pounds of bravado and hyperbole, Jay “The Bot Hunter” Twitchell. 

Well, like my grandfather used to say, “If you’re going to fight robots, you need to go to robot fighting school.” So, before my certificate of completion as a Digital Detective (artistic license with title) arrived, I was already signed up for a 4-day SOC analysis course with Black Hills Information Security taught by John Strand. 

SOC is short for Security Operations Center. It’s where the cybersecurity team responds to possible intrusions into the network. Picture a cyber-war room. Kinda like a NASA launch control room, with a two-story wall covered in screens, flashing red and green lights, maps from missile command, and graphs and dashboards keeping the score of the living and the dead. In the heat of it, sweat flowing from every brow, a dozen people furiously typing on keyboards, faces aglow in the wash of screen light, whispering battle commands into their microphones. 

SOC Analyst Level 1...gets that team’s coffee. Everybody’s got to start somewhere. As a coffee-dog and bot spotter, you let the team know about a flashing alarm and then Level 2 and 3 deal with capture, containment, and neutralization. You survey the network like a bushman on the savannah scanning for evidence of predators’ digital skat, dissecting packets, and looking for paw prints of persistent connections in silicon. 

Information security is totally hunting the hunter, spy vs spy. Just not the fast cars and jet packs, but instead SQL injections and rootkits. And If you're going to hunt down the enemy, you have to learn how to read the threat landscape and appreciate the tactics. To hunt a fox you must become a fox, yes? You need to know the methods so you can spot the signs that you are being stalked. 

John Strand is a great resource for honing cyber-safari skills. John is formerly a SANs institute instructor (15yrs) and runs BHIS, a cadre of devious cyber ruffians. 

A quick summary of the 4-day course:

There is no one product or strategy that is foolproof. Anything, given time and persistence, can be bypassed. The trick is layering the network with enough security gambits that it costs too much time and/or sets off enough alarms that an attack can be prevented or quickly resolved. The idea is to create a layered web. A spider uses more than one string to catch a fly. 

Endpoint analysis and common command-line magic tricks combined with a slew of open-source network monitoring tools and Shazam, you can respond to an incident. Right?   

Hmmm...not so fast. Even a good plan won’t help you if you aren’t used to responding to threats. There are a couple of fun quotes about this,  “Everyone has a plan until they get punched in the face.” and “No battle plan survives meeting the enemy.”

This is why you hire penetration specialest-teams like BHIS, and run attack simulations. If you can’t afford that, then attack your own system and test the defenses. Sounds like martial arts to me. Seeing as how I’ve paid professionals to beat me up most of my life, I totally get this principle. When you're getting your ass kicked isn’t the time to discover you're not ready for an ass-kicking. No one has time to think when they are getting pummeled. It takes practice to learn to roll with the punches. 

And if you're going to pay someone to cyber punch you, John and his team seem like the right kinda people. 

My takeaway from the 4 days: John is a passionate and generous instructor. The class was pay-what-you-can. So, the cost wasn’t an obstacle for the education. And I’ve rarely seen someone outside of a Pentecostal tent so evangelized about their work. It’s great to see that this field can keep a fire alive in the belly. Borders on inspiring.

My favorite quotes from the course were:

“You don’t get paid for the good days, you get paid for the bad ones.”  

and

“You don’t train until you get it right, you train until you can’t get it wrong!” 

To get your own dose of John, listen to this Darknet Diaries podcast where he shares stories about all kinds of penetration testing. One story involves his mother popping shell on a prison system. Below is the podcast and an article from Wired for the extra curious (it’s totally worth it).

Darknet Diaries - 67: The Big House (google.com)

(Darknet Diaries is my favorite podcast)

How a Hacker's Mom Broke Into a Prison—and the Warden's Computer | WIRED

I signed up for another course in March: Active Defense & Cyber Deception. I also enrolled in BHIS’s Cyber Range where you can build your cyber skills and supposedly compete for a position on the BHIS team. I also bought a t-shirt. I know it’s not quite a trench coat, but it’s a good start for the newest bot hunter on the block. Watch out, robots. I’m coming for you.

Sandworm

The Solarwind hack is all over the news. How bad is it? Hmmm. Say you’re at the grocery store and some random person walks up to you, hands you an envelope, and then walks away. You open that envelope and inside is a picture of your young child asleep at night taken from inside your child’s room. There is a timestamp at the top of the picture. According to the time and date, this picture was taken last night. Someone snuck into your house and took that picture while you were there. They could still be there. I’m simplifying things of course, but you get the picture.

Sandworm is an excellent history primer for current events. But before we chat about the present, let’s take a stroll back in time. A time just a little while ago that already feels eons past. And answer the question: why did I get into cybersecurity?

End of Summer 2020, Portland, amidst other trials, suffered from the forest fire smoke. On the radio, NPR reported the air was toxic. Those traveling from homes for necessities were specters in an ochre haze. All of us foragers under a road-rash sky. The sun a blood-orange orb dragged across heaven into the howling darkness of night where megaphones and sirens sounded across the river coming from the protests at the Federal Court House. The civil rights activism hadn’t let up for months. The news reported the feds responded with tear gas, rubber bullets, and unmarked vans snatching people off the streets.  

Things looked bleak when I started Bootcamp. And it wasn’t just Portland. Much of the world seemed on fire and headed to hell as well. Honestly, the whole planet was feeling a wee bit dystopian. I made a mental apocalyptic checklist: Global pandemic (check), financial crisis (check), social unrest (check), runaway wildfires (check), and expanding authoritarian rule (check, double-check).  

Part of me wanted to believe that things really couldn’t get worse. After a run of bad luck the world was going to get a break, right? Ummm…not likely. In fact, I felt we were actually on a break and things were going to get weirder. But I am biased.

Quick insight about me. I grew up in the South with Christian narratives of many interesting persuasions. The most mentally potent versions blended Pentecostal absolutism, evangelical exaltations, and rapture debates. Yes, there were rapture debates. As a senior In high school, I worked at a Christian radio station. My role was to review and identify possible links between biblical prophecy and international events in the news. These “threat assessments” were for a news report designed to inform those concerned with calibrating their rapture clocks. I was entrenched, mind and soul for a long time. It’s the kinda thing that sticks with you.

So, that End-Time part of my mind had the sneaky suspicion things could easily get tougher, weirder, or just plain worse. If there was anything I learned in the sweet arms of the church it was that there is always enough room to fit the devil.  

My faith was renewed by the patron saint of cyberpunk, Sir Mr. William Gibson. Since starting school, when I slept, Neuromancer danced in my dreams. Why cybersecurity? Because if I’m going to be stuck sitting on my ass in front of a screen watching the world burn and crumble, then I damn well need to figure out a way to interact rather than eating popcorn and binge-watching movies about the end of the world. Look out your window. It’s surreal for real.

How do you handle the end of the world? Get a new job, and I needed something amazing to do. Something that offered a sense of control. Maybe even a little bit of agency, Something that I can do to make my family and friends safer without buying a gun. 

With cybersecurity, I imagined, I could punch people on the other side of the planet with a digital fist. It was/is energizing to be in school again. Juiced! My brain feels like it’s on steroids. The metaphor is literal. When I flip open my laptop it feels like I am going to train at the martial arts school. I mean you are learning how to fight with a keyboard. Dare I say Kung-fu Console training.

Anyway, it felt like the world was getting kicked around and I could hear the ghost of 80’s heroes calling to me. In the back of my head, the opening phrase to the Last Starfighter video game was looping: “Greetings, Starfighter. You have been recruited by the Star League to defend the frontier against Xur and the Ko-Dan armada.” (My wife thinks I should mention this to my therapist). I know I’m not really saving the world. But who knows, their time left yet.

To expand my understanding of the cyber-landscape in which I dream of doing battle I read Sandworm. 

The title is from Frank Herbert’s Dune. Dune is a science fiction novel from the late 1950’s.  I studied the book as part of a focus on messiah narratives in science fiction. Loved it. David Lynch made a movie of Dune in the 80’s and a remake is scheduled next year by Denis Villeneuve (directed Arrival and 2049, the Blade Runner sequel).  

Sandworm references the leviathan worms that rule the desert planet known as Dune. And for our cyber history purposes, it represents a group that is responsible for possibly the most costly cyberattack to date.

Sandworm is riveting. Who are the good guys and bad guys? It’s murky. But one thing is for sure, nerds rule the world now. Maybe they have ever since Oppenheimer, but these nerds aren’t splitting atoms, they are creating code, combining with python, and developing whole new paradigms without making people evaporate inside of nuclear clouds

This first is a story of nations hacking nations. From there it gets complicated fast. A couple of disclaimers about the book. If you are paranoid at all, do not read this book. If you have a hard time getting to sleep because you wonder about government and shadow governments, do not read this book. If you wanna have a whole bunch of reasons why you should learn as much about cybersecurity as possible, do read this book. Your country may need you.

Let’s look at the broad strokes: 

1) In general, it would appear every nation is spying on every other nation as much as they (or we) can get away with. Anyone who has the power to listen is. Some nations are doing more than just listening, they are analyzing and influencing. But honestly (sarcasm),  most of this shouldn’t bother us since we signed away our privacy by using social media. Oops. No judgment, I’m included on that list.

2) Now little guys, countries with tiny little armies, who could never win a toe-to-toe can get digital leverage by hiring or training a few hundred evil nerds to hack. You don’t need all the overhead anymore when you can create an army of a trillion bots made out of people’s smart fridges. A revolution with crushed ice.

3) Arguably the most immediate danger is industrial sabotage, causing catastrophic failure to highly sensitive and critical structures. Like, say, power grids. There has been evidence of intrusion into these systems for some time, well before Solarwind.  No one has made a move but everyone is wondering who is going to push the button first.

4) The US government has a plethora of smart people working for them (probably the smartest people ever assembled in history) and, historically speaking, they/we might have a little “Han Solo shot first” issue as far as technological warfare goes. It all depends on how you look at it. 

5) Spoiler: Russia is Sandworm and has been (and probably still is) digitally terrorizing Ukraine. Ukraine is target practice for destabilizing the EU.

Ukraine is where Sandworm cut its digital teeth, but they were just breadsticks before the buffet. Now with the Solarwind breach, Russia is done looking at the menu and ready to order the all-you-can-eat-data-plan meal.  In this particular case we are really worried they have seen all our secret recipes and now can they make better-fired chicken than we can. That would be my no jargon way of describing it.

Not to worry though, Russia isn’t trying to make better chicken/take over the world. Running a world is way too difficult. They just want to cripple all global authority structures and do backstrokes in a wave-pool of political chaos. 

5) There are many private players who hold the proverbial Firewall. Every day hacker is keeping an eye on the electrical-wire of things and companies with good hearts and good intentions trying to protect us physically and digitally. And then there are mercenaries and institutions that are actively disrupting and disturbing the minds and hearts of citizens around the world with an array of hacking methods.

6) It is very difficult to tell who is doing what.

7) Basically, world war has already broken out and is being fought online. It’s a battle for data that every nation and corporation in the world is playing. Make no mistake, this isn’t a game. It is war, just a new kind. Fewer bullets, but lives are still on the line. When you shut down the electricity to a hospital, people die (particularly in the middle of a pandemic). Unlike past wars fought for territory and material resources, this war is all about controlling information and obscuring perception. 

To win this war, you don’t need to defeat your adversary, you just need to distract and confuse them. Erode trust, destroy certainty, and you nurtures unrest. Why is unrest the goal? It’s a whole lot easier to sneak in and rob a bank (or a government) when the cops are busy dealing with protesters outside.  

Next, enough government nation-states, it’s time for the hacktivist. It’s time for you to discover the Cult of the Dead Cow.