BONUS INTERVIEW: Sophos CISO talks Pacific Rim and dropping implants on Chinese APTs

Summary

In this engaging conversation, cybersecurity expert Ross McCaa discusses the benefits of transparency in threat-hunting practices, specifically focusing on the use of kernel implants to identify exploits. He highlights the importance of sharing telemetry data to improve security outcomes, even at the cost of some privacy. McCaa emphasizes that vendors who are proactive in addressing vulnerabilities can significantly reduce harm to their customers. The discussion also touches on the challenges of implementing such transparency, the criticism from privacy-conscious individuals, and the positive impact this initiative had on vulnerable organizations facing targeted cyberattacks.

Takeaways

• 😀 Telemetry collection, including crash dumps, can significantly enhance security by allowing vendors to identify and patch exploits. Enabling telemetry helps protect users against attacks.
• 😀 Transparency in security practices is essential. Vendors should be open about the measures they take, even if it means using terms like 'kernel implant' to describe their actions.
• 😀 Some users disable telemetry for privacy reasons, but this could reduce their protection from potential threats. Vendors should encourage customers to share data for better security outcomes.
• 😀 The reaction to transparency in security practices has been mixed. Some critics misunderstand or underestimate the benefits of openness in security measures.
• 😀 Vendors must balance privacy concerns with the need for security. Being open about security practices can help establish trust and ensure accountability.
• 😀 The hacking back debate is complex, with various shades of gray. Cybersecurity practices are not simply binary and should be approached thoughtfully and responsibly.
• 😀 Good cybersecurity teams are essential for any organization, but vendors face constraints that may limit their ability to implement fully transparent security measures.
• 😀 Organizations that trust their vendors to be transparent in their security practices are more likely to benefit from effective protections. Privacy concerns should be addressed carefully in light of these practices.
• 😀 The use of virtual machines (VMs) in testing was crucial for maintaining controlled environments when studying threats like boot kits. Physical devices were used only when necessary for testing specific vulnerabilities.
• 😀 Identifying and mitigating threats early can significantly reduce the harm caused by large-scale cyberattacks. Ross’s team helped protect tens of thousands of customers from such attacks.
• 😀 Proactive security measures, such as detecting exploit attempts and stopping them before they spread, are especially beneficial for organizations involved in sensitive geopolitical negotiations or dealing with high-risk threats.

Q & A

What is the speaker's stance on sharing telemetry when setting up new devices?

The speaker advocates for sharing telemetry when setting up new devices, as they believe it helps improve security by enabling the identification and mitigation of potential threats. They see it as a necessary step, especially considering the potential risks from state-backed attacks.

Why does the speaker believe sharing telemetry can enhance security?

The speaker believes that sharing telemetry, such as crash dumps, enables threat-hunting teams to analyze potential exploits and vulnerabilities. They see it as a proactive measure, particularly in detecting malicious activities that could otherwise go unnoticed.

What concerns do some individuals have about sharing telemetry data, and how does the speaker respond?

Some individuals express privacy concerns about sharing telemetry data, fearing that it could lead to unwanted exposure of personal information. The speaker responds by emphasizing that reputable vendors prioritize privacy and that telemetry data typically involves low-level system information, not sensitive personal data.

What is the significance of the speaker's decision to refer to telemetry collection as a 'kernel implant'?

The speaker's decision to call the telemetry collection a 'kernel implant' was intentional for transparency. By using this direct language, they aimed to make it clear that they were being open about their actions, even though the technical impact was minimal and the telemetry was only deployed on a small number of devices.

What challenges did the speaker's team face while pursuing this level of transparency?

The team faced internal resistance from some vendors who were cautious about embracing full transparency, due to concerns about legal and security implications. However, the speaker mentions that many vendors are now watching their approach closely and considering similar actions.

Why does the speaker believe that organizations should trust vendors who openly share their security practices?

The speaker argues that customers should prefer vendors who are transparent about their security measures, as it allows for greater accountability and trust. They also suggest that if customers do not trust their vendors, they should reassess their threat model and security strategy.

How does the speaker view the debate surrounding 'hacking back'?

The speaker sees the 'hacking back' debate as complex and nuanced. They believe it's not a binary issue and that there are many shades of gray in how to approach cybersecurity defense, which makes discussions about it valuable for establishing clearer norms and guidelines.

What was the real-world impact of the speaker's research and actions in the cybersecurity space?

The research significantly reduced harm from cyberattacks that targeted vulnerable organizations, including governments and businesses involved in geopolitical issues. The speaker emphasizes that the work helped protect these entities from further exploitation and harm, particularly during critical negotiations.

What role did virtual machines (VMs) play in the speaker's research on cybersecurity?

Most of the speaker's research was conducted using virtual machines (VMs), which allowed for controlled testing and containment of potential risks. VMs provided a clear boundary for the experimentation, particularly when testing exploits and malware behavior in a safe environment.

How does the speaker assess the effectiveness of their actions in reducing cyberattacks?

The speaker believes their actions were highly effective, as they prevented large-scale exploitation of vulnerabilities that had previously impacted tens of thousands of customers. By identifying and addressing these exploits early, they reduced harm significantly, especially for high-profile targets.