Tag: hacks

From the Archives: Introduction to Cryptocurrency

December 24, 2019 / Hannah / 0 Comments

On Episode 107 of The Edge of Innovation, we’re digging in our archives to bring back our most popular podcast – “Introduction to Cryptocurrency.”

Sections

Introduction
Intro to Cryptocurrency
The Exchange of Currency
How Do You Convert Cryptocurrency?
Agreeing on a Number
How Much is Bitcoin Worth?
Cryptographic Math
Is Cryptocurrency Hard to Hack?
Why Cryptocurrency is Not Secret or Private
What is the Advantage of Cryptocurrency?
Bitcoin and Banks
Ways Entrepreneurs & Startups Can Engage Cryptocurrency in Their Business Model
Is Cryptocurrency Advantageous to Businesses?
Cryptocurrency For Your Business: Risky or Worthwhile?
Arbitrage Opportunities
Show Notes

From the Archives: Introduction to Cryptocurrency

Introduction

Paul: This is the Edge of Innovation, Hacking the Future of Business. I’m your host, Paul Parisi.

Jacob: And I’m Jacob Young.

Paul: On the Edge of Innovation, we talk about the intersection between technology and business, what’s going on in technology and what’s possible for business.

Intro to Cryptocurrency

Jacob: So, Paul, I’ve heard a lot about this idea of cryptocurrencies. It seems like a lot of people have brought that category up, especially as it relates to Bitcoin. I’d be curious to know, what exactly is cryptocurrency. Can you explain what it is? What does it do?

Paul: Sure. First of all, I think it’s important to take a step back and drop the word crypto and look at what currency is. If you go into your pocket and get some change or a dollar bill out, that’s currency. I’m speaking from the United States. If you’re in Europe, you might have euros or another type of currency.

But if I give you a piece of currency from another country, it sort of looks like a toy. You don’t understand what it is. You don’t understand its value. If I give you a yen, a bill, it it’s 1000 yen, you don’t know if that’s $1000; you don’t know if it’s $10. You don’t know if it’s a penny. And same thing: The dollar has a bigger penetration globally, and people tend to want to trade in it. So, we understand, certainly as Americans, the intrinsic value of a dollar.

The Exchange of Currency

Paul: Now, one thing that’s very difficult in currency as I just alluded to is the exchange of currency. You’ve been to an airport, and you can exchange your dollars for euros, and you’re sort of, “What does that mean?” Or dollars for Canadian dollars, or dollars for Australian dollars. I’m going to give you one euro for every $1.50 you give me. So, if I wanted to go buy a can of coke that’s $2 here in America, let’s say, that’s sort of like one and a half euros in Europe.

We’re not used to doing that translation in our head. And so that’s why it’s very difficult for anybody to be sitting there and saying I do that translation. Any new type of currency, whether it’s crypto, euros, whatever it might be is going to face the problem of how do you convert.

How Do You Convert Cryptocurrency?

Paul: The reason why we convert is because the institutions that back those currencies put a value on them. And the world’s view of those institutions puts a value on them. It used to be that the United States had a currency that was based on the amount of gold it had in storage. And that was done away with. So, now we’re working on what’s called the full faith and credit of the United States. And the same thing with the euro zone. They back it, and they have a certain tie-in to value.

As we’ve heard in different discussions of late, different countries can change the value of their currency. And change how much goods are worth to the outside world so that they can make a trade advantage or disadvantage. So now, when we come to cryptocurrency, you say, “I want to buy a bitcoin.” Well, what’s it worth? There is no coin.

Cryptocurrency is based on the idea that is it a string of bits, ones and zeros, that is a large number that represents something. That basically represents a share of the amount of cryptocurrency that’s out there.

Well, why can’t I just make a new set of numbers? And write down a new random string of numbers? And that’s where the bitcoin or the cryptocurrency comes in, because there’s some strong math that has to be done to create those valid strings of numbers. When they’re issued, they’re recorded in a ledger. And they’re recorded in that ledger by more than one person, or really computer. And so, what you have is it’s very difficult to get the needed numbers of people that are out there to agree that this number has been issued. It’s a little bit esoteric as I’m saying it. And it is esoteric.

Agreeing on a Number

Jacob: Yeah. You sort of lost me. So, you have to get people to agree to that number?

Paul: Yes. Exactly. So, if I go and write something in the ledger and say that Paul has $10. The people who control that ledger, because it’s a public ledger, all have to agree that yes, Paul has $10. Now, that sentence is easy for us as humans to understand. But it’s cryptographically significant. And what that means is that we use both private and public key encryption, a way to encrypt something that only the person that has the key can decrypt it.

These journal records are stored in something called the blockchain. The blockchain is really one of the coolest inventions of the past five or ten years, and is ways to record these and have everybody do the cryptographic work on these signings, and record them in the blockchain and say, “Yes, I agree with that.” “Yes, I agree with that.”

So, Paul said something in there with his cryptographic signature and then the other people calculate that and say, “Yes, I confirm that.” And you have to have a majority of people saying, “I confirm that.”

Now, if you’re thinking about that and we’re going at this very surface level because it gets very complicated very quickly… If I could convince more than 50% of the people that are verifying that blockchain to lie and literally take “Paul has $10” and say, “Yep, that’s valid,” I have effectively broken the trust of the blockchain. It other words, I’ve manipulated it. So, I didn’t have $10. I just said I had $10. And you could do that. There’s a thing in computers, never say never. There’s always ways to hack things. It would be hard, but it’s certainly not impossible.

It would be very hard because you’ve got them distributed all across the world and they’re all doing this work. And that’s what a bitcoin miner does. It validates those blockchain entries, among other things.

But the key thing is a person in business looking at bitcoin is to really start to think of it as a different currency. Now, if you’re in America, you probably don’t accept euros on your website. You may not accept Mexican pesos on your website. So, you say, “Why would I? Because the majority of the people that are coming here don’t use those currencies and they wouldn’t know what they are.”

How Much is Bitcoin Worth?

And it’s important to note that our credit card system is not designed to deal with multiple currencies, because there has never been a motivation to do it. If you go down to the restaurant and you want to buy a bowl of soup, and it’s four dollars, you know what $4 of value is. The minute I say that’s one bitcoin, you’re like, “I don’t know. What is one bitcoin worth?”

And coupled with that, bitcoin has been relatively volatile. So, you have indications… Zimbabwe over the past couple of decades has had rampant inflation. So, a loaf of bread could have been a thousand bits of their currency, whereas yesterday it was at one unit of their currency. So, you understand that when you’re going through it, and it’s constrained.

In the whole Greece scenario… I have a friend who’s a developer there and sells his software internationally, and if he sells it with the Greek currency, there’s all sorts of problems. If he sells it in American dollars, that’s relatively stable. But you can check every day with the currencies, the conversion rates between Canadian dollars and US dollars and euros, and they fluctuate.

What’s that fluctuation caused by? That’s caused by the banks saying how much it’s worth and controlling that, and the governments make statements and the Federal Reserve, etc.

So, what controls bitcoin’s value? Well, it’s what anybody is willing to give you. That’s the ultimate judge of value. So, if you have a house you want to sell and you put it on the market for $10 million, and somebody comes along and says, “I’ll give you a dollar for it,” well, it’s worth a dollar. If somebody comes along and says, “I’ll give you $100,000,” well, now it’s worth $100,000. But that is the ultimate definition of what value is.

Cryptographic Math

Paul: So, in the bitcoin world, what they’ve done is there’s a limited number of bitcoins that can be created through this cryptographic math. In the early days, the cryptographic math was very easy, because it was sort of like low-hanging fruit, the easy problems to solve. But as we’ve progressed, it becomes more and more difficult. It’s at the point now, where if you’re generating cryptographic bitcoins, the amount of electricity that you need to do it is very close to the amount of bitcoin value you would get out. So, if you run a computer for a year, and you say it costs me $10 to run that computer in electricity, you may get about $10 worth of bitcoins out.

So, all of these things coalesce to say what is bitcoin worth. Well, if you look at it, they’re about $450. Who knows what day they were recording this or what day you’re listening to this, and it changes wildly. We’ve seen fluctuations anywhere from…just huge fluctuations. That is fundamentally a problem with cryptocurrency, is that people don’t have a sense, or will not have a sense when they take it out of their pocket, or use their phone, of how much they’re actually spending.

If I could convince you to give me one bitcoin for this cup of soup, that doesn’t sound like a lot. Well, it’s worth about $450. So, now it’s like, “Wait a minute. How do I deal with micro-payments? I have to give you 0.0002 bitcoins.” Well, of course, we do this all on our phones or computers. So they handle all of that, sort of chopping it up into bits. But you still don’t know what 0.0002 bitcoin is. You have no concept of that. Well, you say, “I’ll compare it to dollars.” So, that’s an intrinsic problem with cryptocurrency, is it doesn’t have any tie to the real world. And people…we’ve got thousands of years of dealing in the real world.

So, you could have the typical scenario where your kid goes on Amazon and buys all these things, thinking they’re all free, and it’s going on your credit card. They didn’t have a comprehension of how clicking the button changed to money. So, you look at it and say, “It’s only $2. Go ahead and do that.” The whole iPhone and iTunes store is spend a dollar. It’s no big deal. It really prevents you from putting that filter in to say, “Wait. That’s $10. I’m not going to spend that.” You don’t do the value calculation. But now when we present it as a bitcoin or as other cryptocurrency, you’re going to be like, what does that actually mean? So, there are some intrinsic things for it to overcome.

Is Cryptocurrency Hard to Hack?

Paul: One of the reasons people have felt that cryptocurrency would be good is because it’s hard to hack. I don’t know that it is hard to hack. There has been a lot of high-profile people, examples where there have been hacks of people who owned bitcoin on behalf of other people. They broke in a stole it, the digital signatures that represent your bitcoin.

So, if you take an external hard drive or a memory stick and put this big, long cryptographic key on it in a text file and you put that through the wash and it gets destroyed, that’s gone. It can never be returned. Just like if it were a dollar bill and you shredded it, it’s gone. You can’t go back to the US government and say, “Well, I had a dollar bill. Here’s its serial number.” They’re going to say, “Tough.”

So, it has those same attributes. So, there’s no advantage there. But I will say, it’s probably more difficult for me to get your wallet out of your pocket and take the dollar bills out of it than it is for me to potentially hack in and get a file on your computer and copy that off and use those cryptographic keys.

So, there’s a lot to be figured out there. One of the use cases is “it’s really cool” you say, I have a phone. It has a fingerprint reader and I can spend bitcoins. Well, the only way it will let you spend the bitcoin is because you scan your fingerprint. Well, that’s good. I’d have to cut off your finger in order to steal the bitcoin or the cryptographic currency, which isn’t terrible. I could also take a scan of your thumbprint and maybe work around that. It’s got to be worth it. If you only have $10 is bitcoin, why waste my time? So, there’s all of these challenges swirling around cryptocurrency.

Why Cryptocurrency is Not Secret or Private

One of the other advantages that has been extolled is that it’s secret or private. That’s just patently false. The Silk Road prosecutions by the FBI used the blockchain to figure out who spent the money and traced it back. And the blockchain is basically a chain of blocks of information and you can follow them through to figure out who originated the money.

And if you go out and try to say, “I want to buy some bitcoin…” This is one of the things I try and play with is trying to figure out how to be anonymous. You cannot anonymously buy bitcoin. There is no way to do it. They want a credit card number. They want your social security number. They want everything you can. These are government mandated, or at least done in acceptance of government saying something like this needs to be done. Because they want to be able to come in and audit and say, “Who did you sell bitcoin to?”

So, if I go out there and go to anybody, I’ve got to prove who I am. I’ve got to send them a bunch of signatures. I have to send them a phone bill, something that’s got my address on it, that has my name on it… This is really things that I have to do. I can’t just take a credit card and buy some bitcoin.

In the future, we should have a talk about how to be anonymous and different options in there, because it’s a cool thought experiment.

What is the Advantage of Cryptocurrency?

Paul: What’s the advantage? Well, it is a one-world currency. I don’t know if that’s an advantage. There’s talk that the end of the world will be… Part of a one-world currency will be one of the things. Well, are we seeing that happen? I don’t know. But it is the idea that one bitcoin is worth $450 today, for example, here in the United States. And in Australia, at that some moment, it’s worth $450. Whereas, the minute I have to convert a currency, it’s the matter of how much somebody will give you for it.

Bitcoin and Banks

Jacob: In some ways, what you’re describing sounds a bit like the Wild West of currency, which I find interesting. I don’t know if that’s a correct application or analogy, but it does interesting to me that in light of all of those concerns and some of the positives of it, that you recently recommended an article about Bank of America and other large financial industry entities getting into cryptocurrency and trying to get into the blockchain dynamics of that. Can you talk a little bit about why they’re trying to do that and what advantages there are for big banks in doing that?

Paul: Sure. Well, all of these flaws…and there are other flaws which we haven’t talked about, about the scalability and the programming and all kinds of things like that, sort of the soft underbelly. Forget about all those. There’s a lot of money to be made in any new currency. So, any of those entities are going to want to invest and get their pieces of the pie. So, Bank of America… It was Bank of America, right?

Yeah, so they’re out there saying, “Somebody is going to make money on this. We want to have patents that say when you…” Let’s make up a silly patent. Every time you convert bitcoins to dollars, you have to do this lookup on the exchange, and you have to compare it with this exchange, and you may arbitrage some of those exchanges. Well, we’ll write a patent on that. And all the patent is, is a specific way of doing things, a methodology that isn’t generally obvious by just looking at. Like a door, it would be difficult to patent a door now, or a hinge that uses a door. But the first guy who figured out the hinge could have patented it because it wasn’t necessarily obvious by just looking at it.

So, as we develop patents, those things become obvious, and they want to stake their claim, and they certainly have the resources to do that. And this is sort of staking their claim, like the Old West, the gold claim. They’re going to go out there and do everything they can because they have armies of engineers who can think up idiosyncratic ways of doing things and then patent that.

Now, what will happen is they’ll patent things and they will get those patents awarded. And what will happen is people will then come back and say, “No. That’s an obvious application and shouldn’t have been awarded a patent.” So, our patent system is relatively broken in that way. But, of course, they would be doing that. And every big company is doing that.

So, one of the examples I’ve seen being around is it’s so difficult to buy bitcoins. Why don’t you have somebody buy them for you? Well, there’s some regulatory problems there, but I could start an offshore organization that says I’m going to buy bitcoins for you and hold them for you. So, I’m never going to transfer them to you. So, I’m going to put a ledger together that I own that says, “This bitcoin belongs to Jacob. He has one bitcoin.” And I keep them in my bank.

And this is one of the problems that has happened is people have broken into those banks because they didn’t have good security and stole that ledger. And then I have some bad news for you Jacob. I know you have five bitcoins stored here, but I lost the money. I literally lost the bills. So, you can sue me, but usually these organizations don’t have a lot of assets.

Ways Entrepreneurs & Startups Can Engage Cryptocurrency in Their Business Model

Jacob: What are the ways in which you’ve seen entrepreneurs and startups engage cryptocurrency in their business model?

Paul: Well, right now, given it’s such an early stage, very Wild West, you have people that are primarily saying, “How do I get cryptocurrency? How do I take it? How do I accept bitcoin? How do I do that?” That’s where all the innovation is about right now. It’s nothing really sexy. It’s just a matter of…

Here’s the thing. You open a bookstore on the internet, Jacob’s Books, and you go out and find used books and rare books all over, and you list them on your site, and you say, “Here’s a first edition of this book. It’s $500 or 1.1 bitcoins.” If you got a check for $500, or you got $500 on your credit card, you’d feel fine. If you got 1.1 bitcoins, you would feel, “I better go cash it in right now.”

You see, you have a decision now. You can now be a currency trader. You can decide to be the arbitrage person that says, “Based on the indicators, I think bitcoin is going up this week.”

Jacob: Right. So, I can get that and say, “This 1.5 bitcoin does, for today, equate to $500. But I could hold onto this and this book that you would have sold for 500 USD, it could have make $1000, depending on how bitcoin goes up in two years.”

Paul: Yes. Or it could go down. So, you have a huge thing to think about. A whole mind share that you’re not designed, you’re not used to thinking about. You don’t arbitrage currency. You could do the same thing with the Canadian dollar or euros, is say, “Pay me in euros.” Because they’re going up. If you pay me Chinese currency, they’re devaluing their currency. So, if I gave you 100… I don’t even know what the Chinese currency is, but if I gave you one hundred of their pieces of currency, and it was worth ten dollars today, there’s a good chance in six months it might be worth eight dollars.

Well, you would feel bad about that, a 20% loss on it. What in the world am I doing here?

Is Cryptocurrency Advantageous to Businesses?

Jacob: So, is it advantageous for businesses to transition their primary currency over to cryptocurrency, where it’s not just static money, but it could in effect be a bit of a stock option/currency as well?

Paul: You could do that. I think that’s ill-advised because the forces that control the fluctuation in that are very Wild West. There could be a break-in on somebody that steals a bunch, and they’re very volatile. It could go down ridiculously.

Jacob: So then, what are the entrepreneurial future ideas for using cryptocurrency?

Paul: Well, just because it’s not a great idea to use it doesn’t mean people will be smart enough to not use it. It has a lot of pizzazz and appeal right now, and gee-whiz. So, I think building tools and allowing people to use cryptocurrency on your website are good ideas.

Now, if you have a website that sells to children, they’re probably not going to use cryptocurrency. So, you do have to evaluate that, and say where does it make sense. So, if you look at TigerDirect, it accepts bitcoin. Well, their clients are nerds. So, I buy from TigerDirect and I’m a nerd, so I can understand that.

Amazon doesn’t accept it yet. So, it hasn’t really moved into the mainstream. But that leading edge…it’s cool to do. I don’t think most of the people that are running websites or commerce websites out there are going to see a big uptick in conversion because they have added cryptocurrency to their website. But I could be wrong. It’s sort of an underwhelming situation.

Jacob: And would it be advantageous for organizations or companies that are more international, per se, rather than ones that are just domestic?

Paul: Well, it’s not a substitute for accepting local currencies. Because if you go and you say, “I’m going to expand to Mexico. I’m an American. I’m going to expand to Mexico. We only offer bitcoins and dollars.” That’s not a big market. That’s not a lot of people that are carrying bitcoins around or dollars. So, in order for me to do that, I really need to still reach out.

Now, if you fast-forward thirty or fifty years, that may be different. And it more than likely will be somewhat different. The biggest thing with the cryptocurrencies and a proper iteration would be that they couldn’t be manipulated.

So, the scarcity of cryptocurrency is real. There is only a certain number of coins or cryptocurrency that’s available. And it is very much limited to that. Whereas, dollars are largely fictional. There is nothing stopping the US government from printing. If we had a million dollars in circulation, they could print another million dollars tomorrow. There’s nothing stopping them from doing that. What does that do? Does it change the price of a cup of soup from $3 to $6 because we just diluted the money supply? It doesn’t because we’re not programmed that way as people. We interface with money and say, “It’s $3.” Inflation has to happen. That’s a different thing where the costs change and expenses and values change. But when it’s dealing with just currency, I can print as much money as I want.

With a cryptocurrency, you can’t do that. So, I can’t manipulate the value of the currency relative to the world market. And that’s one big advantage to cryptocurrency. It can’t be manipulated as easily , I won’t say it can’t, as easily as a government backed…

Cryptocurrency For Your Business: Risky or Worthwhile?

Jacob: So, for businesses, it would seem to me that potentially for established businesses, it would be risky but worthwhile to explore the idea of cryptocurrency right now. Would it be better to wait for cryptocurrency to develop further?

Paul: No. I think you’re going to have to have some… This is the time where you start to look at it and say, “Do we want to do that?” The real question for a business is when you actually get a customer spending cryptocurrency, do you convert that to your local currency. Do you convert to dollars? That’s the crisis.

Now, you may say, “We’ve got one customer who has a subscription website, and it’s a few thousand dollars.” So, if somebody comes in and buys that in bitcoin, let’s say it’s 10 bitcoin, $4500. That’s what it’s worth today. Tomorrow it goes up to $500. They feel good. Let’s cash out. But tomorrow it goes down to $350. They’ve just lost $1000. We’re not wired that way in our heads. So, you do need to make those decisions as when do you take and convert that money into fungible assets in your currency.

Jacob: So, it would be helpful for CFOs within a company to have a handle on how that stuff works

Paul: Absolutely.

Arbitrage Opportunities

Paul: I do think there’s a huge business opportunity there, is to be the arbitrage organization. And if you offer that with the proper insurances… So, you go and you get an insurance policy from Lloyd’s of London or one of the big insurance companies like that that says, “We will arbitrage. We’re buying currency, using dollars, and we’re buying bitcoin. Today we bought them at $450. Oh, we see it going down.” And they do their magic, and they know it’s going to go down the $350 tomorrow. Well, they would go out and buy a lot of it, because they also know that the next day it’s going to go back up.

Now, they make mistakes, but they do it in such volume that those mistakes are leveled out. Offering that arbitrage service to a small business or a business is a huge advantage. That doesn’t seem to exist right now.

Jacob: And it seems like another advantage for an entrepreneur asset in this area would be basically training and consulting for CFOs and the financial industry in ways that they don’t understand cryptocurrency.

Paul: Absolutely. I think there is an opportunity for that. But I think even more so, there’s an opportunity for these…somebody to offer. We’ll take that offer.

Jacob: I see. Not just consulting but just to take it away.

Paul: We’ll just do it for you. Because arbitraging only works when you have vast amounts of investments. So, if you’re good at that, why not offer that, broker that arbitrage?

Jacob: The Edge of Innovation is brought to you in partnership with SaviorLabs. SaviorLabs exists to help businesses mature and strategize for the future. Learn more about SaviorLabs at saviorlabs.com.

Show Notes:

Cybersecurity: For Better or For Worse?

March 20, 2018 / Hannah / 0 Comments

On Episode 61 of The Edge of Innovation, we’re talking with security expert Adriel Desautels, founder and CEO of Netragard, about whether cybersecurity is getting better or worse.

Show Notes

The Netragard Website

Get in Touch With Netragard

Find Netragard on Facebook

Find Adriel Desautels on Twitter

Find Adriel Desautels on LinkedIn

Find Netragard on Twitter

Follow Adriel Desautels’ Blog on Netragard

Netragard in the News

“Is Your Data Safe From Hackers?”

“This Year, Why Not Take Your Data Seriously”- Netragard’s Guide to Finding a Vendor

“Cars: The Next Hacking Frontier?”

“How to Find a Genuine Penetration Testing Firm”

“What Is Penetration Testing? Here’s the Right Definition”

“Is Your Data Safe From Hackers?”

“How To Hack A Company With A Trojan Mouse”

“Don’t Become a Target”

Bitdefender’s Website Where You Can Buy Bitdefender, recommended by Adriel Desautels

The Hands Off! Mac Update Download recommended by Adriel Desautels can be found here

VMware Fusion, also recommended by Adriel Desautels, can be found here

Download for Little Snitch

“Honeypots: The Sweet Spot in Network Security” – An article about Honeypots

The Frank Abagnale movie, “Catch Me If You Can”

Link to SaviorLabs’ Free Assessment

Sections

CVE: Common Vulnerability Enumeration
The Watering Hole
You Can’t Detect What You Don’t Know To Look For
Programs and Operating Systems Adriel Uses
Dealing With Data
Is Computer Security Getting Better or Worse?
What is a Honey Pot?
Internet Security: Ten Years From Now
There’s No Excuse
Data With a Long Lifetime
Why Europe is Doing Credit Right
What To Do If You Have Been Compromised
How to Tell If Penetration Services are Genuine

Cybersecurity: For Better or For Worse?

CVE: Common Vulnerability Enumeration

Paul: Hello, everyone. I’m Paul Parisi here with the Edge of Innovation, and our guest today is Adriel Desautels from Netragard.

So now I recently read about a CVE. And just for our audience, CVE stands for…

Adriel: It’s the Common Vulnerability Enumeration, I think it is.

Paul: Something like that. So it was a vulnerability that if you browse to a certain website, to a website with a certain browser, and it loads an ad, your machine is infected. Can you explain? How does that work? And we’ll go through this probably…we’ll unwrap the onion a couple of times on this. How does that work? So I use Chrome and obviously, we think it’s secure today, but six weeks ago, we thought the same thing. And they fixed things in the past six weeks. So what happens? I go to a website. It opens up a news site. What happens? Tell me.

Adriel: So, this goes back into the helper application world. So, let’s use Flash as an example. Flash is a great example because Flash is always being exploited. In fact, our own company is notorious for having sold a Flash exploit. It made the news a while ago. But, Flash is used a lot for ads or videos or things like that on news websites or other websites, or at least it used to be. It’s a way of almost playing movies. Or playing ads and things like that.

Well, you can take Flash and you can embed specialized payloads into Flash. And then the Flash players themselves were vulnerable to these payloads. And when they would load the payload, the payload would exploit a vulnerability in the player, and then give whoever an attacker was — or whatever the end thing was — full access to your system. So in the case of malware, when the system is exploited, rather than give command and control of your compare system to some third party, the malware would be uploaded into the system, and it would do whatever it was going to do. So if it was ransomware, it would encrypt your system. Then maybe propagate it upwards, other directions. So really it’s taking advantage of helper applications.

Any time you browse the web, your browser is the main application that sometimes contains its own vulnerabilities that can be exploited. There are lots of other helper applications that come in. There’s different movie players, there are different content renderers. There are all kinds of things you can plug into a web browser or that you can use in a browser and any one of those things does have vulnerabilities and can be exploited.

So when you browse websites, when you look at anything online, you’re effectively trusting that source to have content that’s safe.

Paul: Okay, but now aren’t you also trusting their ad networks?

Adriel: You are trusting their ad networks, but more importantly, you’re trusting them. The ad networks are less likely… Well, they’re less likely to cause problems for you, than the systems themselves, usually.

Paul: Really?

The Watering Hole

Adriel: Yeah, I think so. I mean, from a theoretical perspective, I suppose anything could be a problem. But, I mean, if you look at…Are you familiar with the term watering hole?

Paul: Not from a computer point of view. I mean, from a wild gazelle point of view, yes.

Adriel: Yeah. Right. Exactly. So, in a safari, you have a watering hole. The animals, they all go to get their water, and they drink from this watering hole. And it’s the one place where the lion won’t eat the gazelle, and all these things are great and happy.

Now imagine some guy comes by with a bio agent that’s designed to wipe out these animals, and he puts it into the water hole. And these animals drink, and then they go back to their herd. And unbeknownst to them, spread this infection and then all of a sudden, their prides and their herds and all that just drop dead. That’s because of a poisoned watering hole.

So a watering hole attack is when you take a website, a common website or a news location or an ad network or anything like that, and you infect it with malware. The people who go and visit that website are then compromised or infected by the malware that exists in that website. If the malware is designed, as we would be at Netragard, if it’s designed properly, then what will end up happening is when that person takes their infected computer to another network, it will notify the controller, the person in charge, whoever deployed the malware, that they’re on a new network, and it will give them access to that network too.

So just like the infected animals that spread their infection to the rest of the herd, the infected computer will spread their infection to the rest of the computers in the network that it connects to. So it’s a watering hole.

This attack has been around… Boy, this type of attack has been around, since probably 2000, 2003, just never really heard about it until, I think it was called the Aurora incident, the Aurora something. It was when Google was targeted by the Chinese with a watering hole attack. And since then watering hole attacks have been happening. I can’t remember any off the top of my head or recall any on the top of my head that were as large-scale as that. That was just one example. I mean, there are, of course, you know… We have the ransomware attacks today that are happening. Bad Rabbit or whatever that was. They’re continuously going. But I don’t remember anything quite the scale of what was going on with Google, only because Google, of course, is massive.

Paul: They are a big target.

Adriel: Yeah. And so they have a lot of viewers. The bigger the watering hole, the more people that feed from it, the greater the impact.

You Can’t Detect What You Don’t Know To Look For

Paul: So now if I’m just a general citizen sitting at my computer, why is it that Google doesn’t catch the fact that their site is infected or CNN or whatever? How come they’re not smarter than me?

Adriel: Yeah. You can’t detect what you don’t know to look for. A weird example. Imagine we somehow encounter extraterrestrials and they come in. “We come in peace.” Shoot to kill. They think they’re friendly. We think they’re friendly. Everything is going great. Meanwhile, they’re offloading masses of weapons, and we don’t recognize the weapons as weapons because we have no idea what they are. Right? And they begin to attack us with these weapons, but they’re not like anything we’ve ever seen before. So we have no idea we’re being attacked. And then all of sudden, people just start dropping dead, and it takes us a while to begin to realize, we’ve been attacked.

Hackers are the aliens. We build weapons that nobody else has seen before. And we attack people in ways that they absolutely don’t expect and in ways that the security industry doesn’t expect. We come up with new things. And so you really can’t defend against the unknown, which kind of goes full circle, and that’s why this whole “I protect you against zero-day things” is ridiculous because zero days are unknown vulnerabilities you can’t defend.

Paul: So it’s all marketing is what you’re saying is…

Adriel: Exactly. That’s exactly right.

Programs and Operating Systems Adriel Uses

Paul: Now what kind of computer do you use? Do you use a PC with Windows or Mac or what?

Adriel: I use a Mac. But within the Mac, I use a hypervisor and I run about four or five different operating systems within that. So I use the virtual machines. Within containers is my real machines.

Paul: Which hypervisor do you use?

Adriel: Right now it’s VMware Fusion.

Paul: Okay. So you’re using VMware Fusion which allows you to run virtual machines, as they’re generally called. Are those sacrificial virtual machines, or are they secure?

Adriel: One of them secure, but it can still be sacrificed if that makes any sense. I take snapshots regularly. So if I’m doing something, and I think anything bizarre happens, I just revert back to the snapshot that I know was good.

Paul: Okay. So this is a good line of discussion. So you have several VMs and you use those. Now in those VMs, do you have any antivirus, antimalware, any software on them that helps you stay secure?

Adriel: Yeah. Only in one of them, in the Mac VM, within the Mac. On my Mac within a Mac, yeah. I use Bitdefender and Hands Off! I use Bitdefender because it is proven to be one of the most effective pieces of antivirus software out there. When we do our own zero-day development, Bitdefender oftentimes will pick up our exploits or our tools and we’ll be able to say, “Hey, well okay. We have to adjust this because Bitdefender just found it.” Others just don’t seem to do it quite as well.

And then Hands Off! Is sort of like Little Snitch, only it’s a bit more advanced. It’s a bit more advanced than Little Snitch. Hands Off! allows me to control what files are accessed, what ports are being connected to, what hosts are being connected to. So if I decide that I want to browse to XYZ.com, Hands Off! is going to say, “Hey, do you want to allow this connection? Do you want to allow this access to this file?” And I have to explicitly allow everything.

And it’s nice because if I actually brought us to a malicious site and I hit a Flash exploit or whatever it might be, when that exploit begins to work, I will see that my system is trying to access files and do things that it shouldn’t normally do. And I’ll say, “Hey, wait a second. Why are you doing all of this stuff? Something just happened. Let me revert back.” So I can catch it, even if I don’t know exactly what’s going on.

Paul: So it sounds like you have to be a little bit smart.

Adriel: Yeah. You do. You have to be vigilant. Absolutely.

Paul: And know what you’re looking at. So if the ordinary user was faced with Hands Off!, they might not know how to respond.

Adriel: Yeah, it’s not trivial, unfortunately.

Paul: So what are the other operating systems you run in these VMs and, and why?

Adriel: So BSD and Linux., BSD just because I like it. There’s not a lot of people that are targeting BSD. I like the port system a lot. And Linux because Kali is great for penetration testing and doing research, and a lot of tools run on it. I run Ubuntu, but I do that largely for administrative reasons because it has some cool functions and features that will help you manage other servers that are similar or systems that are similar.

Paul: And do you run Windows at all?

Adriel: I don’t. I mean, I do have a Windows VM, but I use that specifically for signing malware. So we have a code signing certificate and we sign all the malware that we push out, which is interesting. So I use Windows specifically for signing malware.

Dealing With Data

Paul: So how do you deal with your data?

Adriel: What kind of data?

Paul: Well, I mean, you’re doing work. You’re a productive member of society. You probably have a bank account. You probably have photos. You have business files, an agreement with a client, a contract here and there, etc. Where are those? Are they on the machine? Are they in a VM? Are they somewhere else? Are they on a flash drive?

Adriel: No. So everything that we have is stored in our data center that is related to the business. And it’s stored in different ways. If something is highly sensitive, it’s stored on an encrypted disk, and it’s also PGP encrypted. And there are only three people that can decrypt those files. If it’s medium sensitivity, then it’s stored in the system with an encrypted file system or it’s stored in a system with an encrypted file system within an encrypted database.

The idea of encryption, though, on end points like that, kind of promotes a false sense of security also. If you were to walk into our data center, and you were to lift one of our machines, the drive would be encrypted, and you wouldn’t know the passphrase to unlock the drive, so of course, it wouldn’t be useful. But if you’re a hacker, and you were to hack one of these systems, the contents are already decrypted because the system is running, and you’re going to gain access to the system and its respective data.

Likewise, encrypted databases, everybody always talks about them. “Oh, let’s use encrypted databases. They’re great.”

Well, if you hack a system with an encrypted database, the key exists somewhere because the database users, the people that are responsible for using that system, they have to have a way of decrypting the data. Right? And we have yet to find it an instance where we breached a network, counter encrypted the database, and couldn’t find a way to decrypt it. So really, encryption is not going to protect. It’s going to slow things down. The best way to encrypt something and protect is with something like PGP. But again, that’s not trivial. You know, I mean, PGP and managing that kind of…I mean, you lose your keys, you’re screwed.

Paul: Right. What do you do with your photos, your personal stuff?

Adriel: That goes into that Mac VM that I have that’s protected by Little Snitch and Bitdefender. Aand I, I just have those there.

Paul: Do you back them up?

Adriel: Yeah. I back them up.

Paul: How do you do back up?

Adriel: I back them up to the cloud. I dump them to the cloud. The iCloud. You just make sure that nothing is sensitive. That’s all. Nothing is compromising or sensitive.

Paul: Right. Okay.

Adriel: So, yeah. That’s the best way. I mean, anything that could ever be compromising or sensitive or somehow used to harm my family or harm myself, I just don’t put on computers. I try to make sure that that stuff you do stays in memory or is on paper in a vault or it just doesn’t exist.

Paul: Right. Well, it’s interesting. I’ve had, being a computer person, everybody asks you to solve their computer problems, and the number of people I’ve seen become infected, I’m like, “I don’t know. How did you get infected?” And it almost always comes down to they didn’t know what they were doing. They didn’t realize that doing this was going to do this. And, there’s really no way to give them that level of scrutiny that things that you and I might do, certainly you more than I would just say, “Wait a minute. That doesn’t seem right.” And they don’t perceive it. They don’t even see it.

I just saw a good example of the WPA Crack hack where they got in the middle and basically redirected somebody to a non-SSL site and captured their username and password. And that’s a good, for me, that really make it plain that, yeah, we really shouldn’t have any non-SSL sites. And that would have fixed that problem.

Is Computer Security Getting Better or Worse?

Paul: So what is your prognosis? Is computer security getting better, getting worse?

Adriel: No, it’s getting convoluted unnecessarily so, and it’s getting complex. And more and more difficult to understand because of the security market. Good security should follow the KISS rule. Right? Keep It Simple, Stupid.

The reason why our customers keep coming back to us, for example, is because we Keep It Simple, Stupid. We look at very efficient solutions. We don’t focus on bloatware because of security fatigue, which apparently is a new thing that people are talking about. We focus on effectiveness. The solutions that exist today are really pretty. And they look really cool.

And maybe they are catching a really high volume of attacks. The problem is, is they’re also catching a lot of non-attacks. And so somebody sitting down and staring at a screen with stuff scrolling by all the time is going to get worn out pretty quickly. Right? And so the interface of the person or the data that’s presented to the person is ineffective. And so the whole solution becomes ineffective.

Your network intrusion prevention systems, they make a lot of sense. But the part that’s not being considered there is the person that has to sit there and churn through all of that data every single day. You just can’t do it. Right?

So the security industry is chock full of solutions, which you really don’t call solutions. They’re, chock full of distracted new technologies, distracted technologies like this and these technologies are continually being marketed, pushed by other businesses. And in the end, if you follow it at all, it has to do with money. Everybody wants to make their money. The breaches that are happening today are also beneficial to the security industry because these breaches mean people are going to come and look for more technology, more services, more solutions.

In all reality, people don’t need to do a lot to be secure. And in all reality, people should not be focusing on breach prevention. They should be to a degree. But the real thing they should be looking at is preventing a damaging breach. It’s impossible to prevent the breach. Someday, somehow, somebody is going to breach your network. But if you can detect that breach when it happens, before it becomes damaging, you can prevent the damage, and you can prevent yourself from ever making the news. That’s how you protect networks.

What is a Honey Pot?

And the way that you detect a breach, right after it happens, is with things like internal honey pots and solutions that can pick up on lateral movement.

Paul: Well, so explain that to me.

Adriel: So a hacker breaks into a network…

Paul: You mentioned that. And so explain that to me. I’m a small business. I make semiconductors. I’ve got 50 employees. What is an internal honey pot?

Adriel: Well, actually, so we sell these now. It’s something that we’ve started manufacturing and selling and developing — whatever you want to call it — probably about a year ago because of their effectiveness. So what it is, it’s a computer system that does absolutely nothing except to sit there and look like other computer systems. You deploy these fake computer systems in different parts of the network, depending on how threats are likely to enter your network and move through your network. And they’re tempting.

So a hacker breaks into an infrastructure, and a hacker begins to probe the network. The very act of probing the network when it contacts one of these systems, these honey pots, is going to set off an alarm. That honey pot is going to say, “Hey, user Joe just connected to me.” Now there’s absolutely no reason for any legitimate user to ever connect to a honey pot because they do nothing. Right? So any time anybody connects to a honey pot, by default, it’s illegitimate. So there is no false positive. There is no continuous streams of data like you’re going to see with other solutions. A hacker breaks in, hacker probes network, hacker trips two or three of these things. System admin will get an alert within seconds likely of a hacker breaching a network, maybe within minutes of a hacker breaching a network.

If that admin responds to those alarms and in quick time, that admin can likely kick that intruder out of the network before any damage is every caused. They can say, “Hey, my web server just started scanning my network. That should never happen. Let me go and kill the connection, and let me go put up a temporary site, or let me revert to a back to a backup and just see what will happen.” But this was a breach. It was a breach that doesn’t matter because sensitive information was never captured.

Meanwhile, what’s going on is the inverse of this. People are focusing on breaches, and this is why I say the industry is convoluted. People are focusing on breach prevention. We hear this all the time. It’s an impossible task. But they’re not focusing on post-breach detection. And so what ends up happening is they suffer a breach, and the hacker sits there and says, “Okay. Was that detected?” It’s almost never detected. I mean, I can’t think of the last time that we were detected breaking into a network. So hacker says, “Okay. Were we detected? The answer is no. Great. Now let’s just spread like wildfire throughout the network because nobody has any post-breach detection capabilities.” And it’s true.

Paul: Right. I see.

Adriel: So there’s this gap. Mind the gap. There’s a gap that exists, and that’s what we’re exploiting. The security industry as a whole is upside down, and the solutions that it’s providing are also upside down. Rather than providing you with a solution that says, “Hey, you’re being hacked and it’s real. Do something about it,” they’re providing you with solutions that say, a million times a day, “You might be getting hacked here.”

Paul: Right.

Adriel: So, it doesn’t work.

Paul: Fascinating.

Adriel: So is it getting better, is it getting worse? I think the threats are evolving. I think some of the technology is evolving. I think software vendors like Microsoft are definitely evolving. They’re doing a much better job, and they have a part to do with good security. I think a lot of the other software vendors, especially the ones who build the applications that used by Microsoft need to really catch up and start taking security seriously. But I think that rather than being something that could be a fairly simple type of thing, I think it’s become a big convoluted mess. And I think that convoluted mess is making it hard for normal, everyday people to be able to really understand where to go, what to do.

Internet Security: Ten Years From Now

Paul: Sure. So alright. Let’s take the crystal ball out here. Ten years from now, is it going to be better or worse?

Adriel: Oh, boy. I don’t know. If we keep on allowing bureaucrats to dictate the direction of the industry and if we keep on allowing entrepreneurs that are financially motivated rather than technically motivated to dictate the direction, as long it’s being directed by really policies and money, it’s going to continue to get worse.

Paul: So that sounds like it’s going to get worse.

Adriel: Yes, that’s exactly right. And so inevitably, I think that that’s the case.

Paul: Do you think that there’s some period or some event or inflection point that we’ll reach where we just have to do something differently?

Adriel: I think we’ve already passed that point.

Paul: Okay. That’s fair.

Adriel: Yeah, there’s no reason why businesses should be suffering breaches.

There’s No Excuse

Adriel: Yeah, there’s no reason why businesses should be suffering breaches the way they have, the Equifax breach in my opinion along with Target, and the multiple breaches of Sony and Hanaford and Ashley Madison, these stand out because these were the ones that were particularly silly. And these breaches shouldn’t have happened. Knowing what I know about how these businesses operate, the reasons why these breaches most likely happened is that either the CEO or some senior level executive didn’t do their job properly and didn’t pay attention to what they were supposed to be paying attention to or didn’t give security people enough of a budget or there was a political reason. Or they believed that they were doing their job properly and they were listening to the advice of bonified experts when in fact they were just being fed Coolaid and they were given a false sense of security.

Paul: So with the Exquifax – ill say it – it was just industrial strength stupidity on their part. It wasn’t clever. They drove with their door open and their seatbelt off.

Adriel: Yeah, with a big neon sign that said, “Hey come take it.” Yeah that’s exactly right.

Paul: It’s almost like manslaughter if not murder. Its manslaughter.

So just briefly talk about the Equifax thing. A lot of people don’t understand what actually happened. I’m not really concerned with the details of the technical of thing.

Data With a Long Lifetime

So I recently attended a conference by Frank Abagnale. I don’t know if you know who he is? “Catch Me If You Can?” There was a movie about him. And he works for the FBI. And when he was arrested, he was in prison and the FBI came to him and said if you work for the rest of your prison term for us we’ll let you get out of prison and he’s been working with them now for 45 years. He made the point, the distinction that is obvious again, when I say it, that what hackers are interested in, is data that has a long lifetime. Your name, your address, your eye color, your social security number. He said credit cards are great for people to steal, there’s zero liability for users. So he made the example, for my kids, I had them get a credit card when they went off to college, and I said to them I’ll pay it off every month, don’t spend – you can spend what you want to spend, but I’m actually going to be paying for things through that. So, when they got out of college they had a great credit rating. His point, was he said there’s no risk with a credit card, if someone steals it, they give you a new one. But with your social security number, they don’t give you a new one and Equifax lost 150 million people’s social security numbers.

Adriel: Exactly.

Paul: And it’s not just a number like I could say 1,2,3,4,5,6,7,8,9, that’s a social security number of someone but that’s not the point. The point is that they, Equifax wrote it down on a piece of paper and said, “Oh this is Bob Smith and he lives at 123 Main Street and oh by the way he has this car and this house.” I don’t see a way to recover from that.

Adriel: You can’t. There’s no way. And it’s not the kind of thing where we’re going to begin seeing the impact of it until several years go by. But if you think about the information that Equifax has, how many banks and how many healthcare providers and how many wealth management firms use that exact same information to authenticate you and forget your password.

Paul: Right. What was the first car you owned and of the five addresses which one have you lived at.

Why Europe is Doing Credit Right

Adriel: Right and this information, I’d be surprised, if it wasn’t at some point used for some major heists. You can clean people out with this information if you do it carefully and thoughtfully and spend some time doing it. Of course, you have social security fraud and all kinds of other things that could be happening in the future. People die and you take their identities. The scale of what this could do is significant and what is almost laughable, and really ridiculous about the whole thing is that you look at Europe and they don’t have a credit bureau. Europeans have credit cards but they don’t have credit bureaus like Equifax. They don’t need this person’s place, this business, to maintain all this history. They have different ways of doing things. I know this because my business partner came over here from Europe, bought a house here not too long ago with his wife and all that. The whole process, you don’t have any credit yet I can still do all this stuff in Europe. Why do I need to have this thing called credit over here? So it’s interesting.

Paul: Interesting. Given all of this data is out there and all these financing companies have to continue to do business, doesn’t it almost become their problem now? Because how are they going to, they can’t just say well we’re not going to lend to you because your identity was released on the internet? Well if they stop lending to everyone they stop making money.

Adriel: Yeah, well honestly, I think we should follow suit with what most of Europe is doing. Getting rid of these credit agencies and I think we should go into a more modernized way of tracking and verifying credit. From the little that I understand, I believe that what happens that if you take a credit card in Europe and if you don’t pay off that card there’s a way of communicating to other credit card companies, without a credit score, that there’s this debt that exists. The level of information that Equifax has is too much. They have way too much information.

Paul: It’s criminal, t seems like! It’s centralized.

Adriel: Yeah and they don’t need that level of information to know that you are a good buyer and really, they don’t need to know that Paul or Adriel – They don’t need to know their name, they just need to know credit card score and some kind of unique identifier. That’s all they need yet, because they are using this antiquated system and because they are collecting information and because they make most of their money by reselling our information without us really being aware if it to god knows who, they have that and they’ve put us all at risk! And now here they are. So yeah, those companies should be done away with and that we should have a more modernized way of doing this.

What To Do If You Have Been Compromised

Paul: Do you have any suggestions somebody who was potentially compromised? What should they do?

Adriel: Freeze your credit. Call Equifax, call Trans Union, call Experian, and pay the 15 dollars or whatever it is to freeze it. And quite frankly, Equifax should be doing that for free. They shouldn’t be charging you to freeze your credit, but do that. Because if you freeze your credit it will at least help to prevent people from taking loans out and things out in your name because it won’t be possible to pull your credit history. Doesn’t mean your safe though because people can still use that information to access resources that belong to you, financial things like wealth management, retirement funds, whatever, you can still use that and if you get in, there’s no reason why you can transfer out and steal money that way. It’s unfortunate.

How to Tell If Penetration Services are Genuine

Paul: So things are worse. We’ve passed the inflection point. Things are not necessarily getting any better. We still want to use the internet. Be careful of what you share because it could be used against you. Boy it sounds like, it doesn’t sound too positive here. I guess one of the things is through your services companies can be a lot more secure. So that’s a positive thing.

Adriel: It is but you have to be careful even with that. When you purchase penetration services, you have to make sure that you’re purchasing genuine services that produce a realistic level of threat and not services that give you a squirt gun test. The analogy is that penetration tests are the equivalent of testing body armor with a squirt gun. And there are ways to do it and we actually published a white paper that was published on Forbes, that was picked up by Forbes, and the article was “This Year Why Not Take Data Security Seriously” and if you google that, you’ll find a white paper that we published and it really gives you non biased key points on how to identify a genuine penetration testing, and how to differentiate between the people that are going to be selling snake oil. One of the most important differentiators there is that the snake oil vendors will sell based on the number of IP address or the number of web applications that you have. It’s called count-based pricing. And if you have ten Ips, like I said initially, and you bill five hundred dollars per IP address, that’s all great and good, you’re going to have a five hundred dollar price tag but what happens if zero of those IPs are providing any services. You just spent five grand on zero seconds worth of work.

Paul: Right.

Adriel: Likewise, what happens if each one is offering 40 man hours worth of service. Well no pent tester is going to be working for 12 dollars and 50 cents an hour so any vendor that uses count-based pricing as part of their pricing methodology, you can rest assured that youre going to be getting that squirt gun test. There’s a lot you can do and it’s a lot of stuff you have to cut through to understand before you can get to the good stuff.

Closing Words

Paul: Is there anything you’d like to cover that we haven’t talked about?

Adriel: No, I think this was pretty thorough. There’s a lot of stuff!

Paul: There’s a lot of stuff, we could do this a couple more times I’m sure. We’ve been talking with Adriel Desautels of Netragard. He’s a security expert. You’re based in Boston right?

Adreil: Yes.

Paul: But I know you work internationally and are pretty well known. And we’ve been exploring security and penetration testing and security testing and all of the different things that coalesce to mean security, what is security and what isn’t security. There will be a tremendous amount of links that will be in our shownotes, that I think will be worth looking at. Many of the articles that Adriel mentioned and many of the sites and of course a link to Netragard as well, and ways to contact Adriel.

So Adriel thank you very much for your time. We really appreciate it! It’s really been fascinating and I think a lot of people will learn a lot today and I really look forward to doing it again.

Adriel: My pleasure, any time.

Paul: Thank you Adriel.