James Plouffe | Vox

‘Mr. Robot’ may be fiction, but its hacking plots are all too real

2016-09-20T17:51:40-04:00

Actor Rami Malek accepts Outstanding Lead Actor in a Drama Series for “Mr. Robot” onstage during the 68th Annual Primetime Emmy Awards. | Kevin Winter / Getty

With the Season 2 finale of “Mr. Robot” upon us this Wednesday — and Sunday’s Emmy Award win for Rami Malek as Outstanding Lead Actor — it feels like an appropriate time to reflect on my own involvement with the show as a technical consultant, and, more broadly, the show’s implications for information security.

The technical questions I was asked by the show’s writing staff threw me off balance on several occasions, because what they wanted the characters to do was on a larger scale than the types of attacks I was accustomed to contemplating. Thinking about how to compromise a web server and then pivot to a database server to get at some data, for example, pales in comparison to executing a crypto-ransomware attack like the one against E Corp. And that attack, as it turned out, was only the beginning.

The exercise of planning some of the show’s hacks is certainly interesting, but the more dire the consequences, the more difficult it becomes, because what’s being shown could — and in some cases has — happen(ed).

The question I get asked most often is “How did you get involved?” with this show that has been praised for its “unusually accurate portrait of hacking” used by our heroes against the evil E Corp.

In addition to making the cyber attacks realistic, we also want them to be timely.

A long time ago, in an office building far, far away, I worked with the (now) staff writer and tech producer Kor Adana. I was responsible for IT security, and Adana was a trusty lieutenant. We worked on a lot of things, but the best project we ever collaborated on was only loosely work-related. Specifically, we may have used some hacking tools in order to remind a free-riding co-worker that, in order to partake of the donuts that magically appeared every Friday, you were supposed to sign up to periodically provide said donuts. When his browser wouldn’t take him anywhere on the internet except the Dunkin’ Donuts website, the message became clear and justice was served. Those high jinks may have been what sealed the deal for Adana and me.

Years after that stunt, we ran into each other at LAX, and Adana mentioned that he had something in the pipeline that he couldn’t talk much about, but which had him very excited; he asked if he could “call with questions” if it came together. A few months later, the call did come with the introduction: “You’re on speaker with the writers’ room …” which is a surprisingly disorienting phrase when your day job is not in Hollywood.

By the way, astute “Robot” watchers may have noticed that a certain minor E Corp executive and I have something in common. The character’s name — James Plouffe — and his untimely end — he committed suicide on live TV — were part of the “compensation” for my work during the first season.

Kor had intended this as a surprise which, owing to the studio’s legal obligations, got revealed earlier than planned: It turns out that someone insisting “he’ll totally think this is hilarious” does not provide attorneys with the same level of comfort as a signed agreement promising not to sue over things my namesake does on screen. In hindsight, it made me wonder what trauma I had inflicted to warrant being dispatched in such a fashion but — for the record — I did think it was hilarious. Though my character was short-lived, you can see nods to my continued involvement in the Season Two references to the water contamination in Flint, Mich., seen throughout the E Corp Risk Management department.

How does it all come together?

Like most successful enterprises, making it happen is a team effort. The writers’ room for “Mr. Robot” typically starts up in mid-fall, and after they’ve sketched out some of the broad arcs, the tech consulting team (led by Adana and comprised of Michael Bazzell, Ryan Kazanciyan, Andre McGregor, Marc Rogers and myself) get to work. In many ways, we’re in a parallel writers’ room: While the rest of the writing staff are working on the what, where and why, we’re focused on the how (with Adana as our conduit to the show’s universe).

Hacking is how other shows get from Point A to Point B without doing a lot of heavy lifting; if one character needs something, a second character can “hack” something to get it so that things can move forward.

When I’m asked what it’s like to work on the show, I share the IT urban legend about an angry customer demanding that a technology vendor send its 10 best engineers to help the customer design a fix for a problem introduced by the vendor’s hardware. The vendor account executive politely declines by explaining that if you put 10 smart people at the same whiteboard, one will be writing and the other nine will be erasing.

That’s exactly the way it feels sometimes as we hammer out the particulars of how the characters will perpetrate their various miscreant acts. Each member of our team has a different background and perspective, so we come at the objectives from different angles. As such, we usually have to spend a little time arguing to make sure the ideas we’re proposing account for the latest security research, and that they pass a “MythBusters litmus test”: Is it Busted, Plausible or Confirmed?

Obviously, Busted is an immediate disqualification, Confirmed is usually acceptable, and Plausible is the subject of additional scrutiny, research and debate. We spend a lot of time on this because, in addition to making the attacks realistic, we also want them to be timely.

Why do other shows (and movies) get it so wrong?

Much has been made of “Mr. Robot’s” fanatical attention to technological detail, which stands in stark contrast to the depiction of technology in most other forms of visual media. Executive producer and head writer Sam Esmail deserves a lot of credit for empowering Kor to get it right. They have the dedication of documentarians when it comes to showing technology and hacking as they are. The amount of time we spent vetting which actual models of smartwatches could be successfully compromised to attack Susan Jacobs’s home automation system in the Season Two premiere, the construction of Samy Kamkar’s Magspoof, as well as the “cantennas” (Wi-Fi signal boosters made from Pringles cans) that Elliot and Darlene use are just a few testaments to that dedication.

We usually have to spend a little time arguing to make sure the ideas we’re proposing account for the latest security research, and that they pass a “MythBusters litmus test.”

The particulars of the show’s devotion to accuracy have gotten a lot of coverage elsewhere, but it begs the question, “Why isn’t that devotion shared?” It’s probably less a case of not sharing and more a case of not understanding, combined with the wrong people being in the right place at the right time.

Early depictions of computers in movies were confined to “green screens” (text-based terminals that were the interface to mainframes, not to be confused with the green screens that are used for image compositing and visual effects). As computer technology matured and Hollywood began to rely more on computer generated images (CGI), the folks recruited to be technical consultants were often computer graphics wonks — as opposed to IT professionals — so they had a feel for some operating system fundamentals, and they knew a lot about building and animating amazing 3-D models, but they didn’t really have a perspective on how technology got used in a typical corporate setting. As such, the depiction of computers evolved into a lot of dazzling (if unrealistic) animations.

One other way that popular entertainment misses the boat is by treating “hacking” as a deus ex machina. Because hacking isn’t usually the centerpiece of a typical drama, it is easily relegated to the role of shortcut. Hacking is how other shows get from Point A to Point B without doing a lot of heavy lifting; if one character needs something, a second character can “hack” something to get it so that things can move forward. It doesn’t need to be right, it needs to be fast because it is a tool of convenience, not plot development.

Will it make a difference?

The late, great playwright Edward Albee is credited as having said, “the function of art is to bring people into greater touch with reality …” I certainly hope that “Mr. Robot” accomplishes that. The show is tackling a lot of issues that are relevant to all of us, not the least of which is cyber security.

Technology is so pervasive that it has become an afterthought in spite of the fact that, at the risk of sounding melodramatic, it’s the center of an arms race. Technology has become inextricably intertwined with our business and personal lives, but we don’t always exercise appropriate levels of caution or skepticism with regard to how we use that technology. In fact, we often use technology in a way that would be analogous to driving without seat belts or not having door locks on our homes.

I hope that “Mr. Robot” has helped make people more mindful by illustrating the potential dangers, and that we will all place greater value on cyber security as a result.

James Plouffe has worked in networking and IT security for more than 15 years, in organizations ranging from startups to the Global 10. He is a lead solutions architect with MobileIron, and a technical consultant for the award-winning hacker drama “Mr. Robot.” Reach him @MOBLAgentP.

This article originally appeared on Recode.net.

The Internet of (insecure) Things and other inside observations from the Black Hat hackers conference

2016-08-11T19:21:25-04:00

Attendees line up for credentials at the 2016 Black Hat hackers conference at the Mandalay Bay Resort & Casino, Las Vegas. | Black Hat Briefings & Training / Flickr

The annual Black Hat hackers conference returned to Las Vegas last week, and was bigger than ever, with attendance up as much as 30 percent, according to the show’s organizers. This year’s attendees were an eclectic bunch, running the gamut from cyberpunks to IT security management suits. At the risk of finding myself on the bandwagon of bemoaning how “commercial” the conference has become — more speakers came from IT vendor, and there werere a lot more golf shirts, with decidedly fewer piercings, mohawks and tattoos — it certainly did feel like a lot has changed since I attended my first Black Hat 10 years ago.

It doesn’t feel like we’re quite ready for all this stuff to be connected yet.

Even so, I suppose it’s what hasn’t changed that’s really worth remarking on: Despite the presence of more and more “corporate types” — and, yes, I am one of those — the conference remains true to its mission, and continues to attract many talented security professionals (that’s the nom de guerre du jour, isn’t it?) presenting talks on on a wide range of topics. Even if the minutiae of cyber-security insurance feel a little too “suit-and-tie,” it’s still possible to roll up the sleeves of your hoodie and get down in the guts of crypto, hypervisors, memory heaps and more.

I wish I could have taken in more of the presentations, but in my path through the conference I encountered a few topics that appeared consistently:

Car Hacking

This has been a theme at security conferences for a couple of years, and the safety and security of increasingly computerized and autonomous cars has been making some big headlines recently. The sexiest car hack this year was fairly spectacular, in that it allowed almost total control of the vehicle in question, with the caveat that it required physical access to the diagnostic port. Insofar as cyber security is the 21st century equivalent of seat belts and airbags, and the automotive industry has a vested interest in safety and reliability of its products, this area highlights the best type of engagement between the security community and original equipment manufacturers (OEMs).

Cloud (Read: AWS)

The promises of the cloud for redefining IT and facilitating business transformation are many and compelling: Better performance and reliability, more agility — the list goes on and on. Along with all this promise come a few pitfalls, some old and some new.

If there are common threads in our adoption of any new technology, they would most likely be:

We often adopt it before we fully understand the security implications.
Our bad habits from legacy technologies are highly portable.
We don’t avail ourselves of the new and/or improved security capabilities that are part and parcel of new technology.

This year’s presentations suggested that cloud is no exception. In many ways, cloud bears a resemblance to our existing data centers. In order to prevent the risks from outweighing or overshadowing the benefits, it is critical to understand the ways in which cloud is different, with particular attention to security capabilities available directly from cloud providers. The reality is that there are robust security features and tools already built in to most cloud platforms, but an apparent lack of corresponding good practices, something we must overcome to safely embrace this new form of computing.

The Human Element

It should come as no surprise that wetware (our pet term for “people”) is still one of the leading attack vectors and the easiest to reliably exploit. There were no earth-shattering revelations here, only the reminder that people, process and technology often break in roughly equal measure but some combination of the three typically yields the most successful recipe for a breach. The subtext is that an average user’s increased comfort with technology is not the same as understanding what is happening behind the scenes. The path forward is two-pronged: More and better education coupled with better security UX so that users know what (and what not) to do, and doing it isn’t punishingly complicated.

Internet of (Insecure) Things

To repurpose a line from one of my favorite comedians, Patton Oswalt: “[Technology] we’re all about coulda, not shoulda” which in this context means the ubiquity of Ethernet or Wi-Fi in common household objects (e.g., light bulbs). Much has been made of the lack of security in many internet-enabled consumer products. It’s unclear just how serious a problem this will become, but what is clear is that time-to-market — and not security —- is the overriding concern for these products. It’s also clear that bad actors are devoting a great deal of time and energy to finding exploitable vulnerabilities, whether these devices are ultimately the target or simply a position from which to pivot from and attack other, higher-value targets. In any case, it doesn’t feel like we’re quite ready for all this stuff to be connected yet. Exploitable vulnerabilities on isolated devices (i.e., not connected to a network) have limited attack vectors and, therefore, limited utility. It also seems like we’re reluctant to acknowledge the inherent risk that all this connectivity creates.

Machine Learning

I, for one, welcome our new robot overlords. Partly because they aren’t cranking out T-800s to exterminate us, but mostly because, right now, it appears that they offer some promise for helping us identify and thwart emerging threats. While the true utility of “deep learning” in the context of security remains to be seen, better tools for doing the heavy lifting of identifying the patterns in attacks or isolating polymorphic malware are definitely a requirement if we’re going to have any hope of successfully defending against the continually evolving tactics of bad actors.

Mobile Security

Perhaps nearest and dearest to my heart, the state of mobile security is frequently one of the most maligned topics discussed at security conferences. At Black Hat this year, it was, by turns, the subject of very practical discussions and purely theoretical (and occasionally misleading) exercises. The result: Some aspects of mobile security aren’t nearly as dire as we may have been led to believe while some are much, much worse.

Closing Thoughts

Throughout the event, I kept thinking back to a keynote given by Chris Roberts at another hacker conference late last year. In it, he noted that, as security professionals, we talk a lot about problems and not enough about solutions. He then posited that we have a responsibility to go beyond simply identifying the problem, and suggested that we should also fix it if it is within our power to do so.

That theme was similar to a message delivered by Robert Stephenson Smyth Baden-Powell in his farewell letter to the Boy Scouts: ” … leave this world a little better than you found it.”

And that, frankly, is where it feels like we may be coming up short. Black Hat was a cavalcade of creativity and inventiveness with regard to breaking things, but too many presentations ended without a proposal for how to fix them or, better still, a way to prevent the problems they’d identified in the first place. While the “gotcha” moments are certainly the most fun and exciting, as an industry we need to be more concerned with creating less opportunity for those gotchas to occur and, if or when they do, how we go about fixing them.

This article originally appeared on Recode.net.