I have some bad news I’m here to scare the hell out of you I
I’m here to scare the hell out of you I
I’m here to scare the hell out of you I mean that’s what the media does right so
mean that’s what the media does right so
mean that’s what the media does right so it must be the way to talk about
it must be the way to talk about
it must be the way to talk about cybersecurity
cybersecurity
cybersecurity is to scare the hell out of you I don’t
is to scare the hell out of you I don’t
is to scare the hell out of you I don’t think so
think so
think so and I actually think that’s why we have
and I actually think that’s why we have
and I actually think that’s why we have a shortage of what I call security
a shortage of what I call security
a shortage of what I call security ninjas security ninjas being people in
ninjas security ninjas being people in
ninjas security ninjas being people in the cybersecurity profession that are
the cybersecurity profession that are
the cybersecurity profession that are here to protect us from cyber security
here to protect us from cyber security
here to protect us from cyber security threats I’m very passionate about
threats I’m very passionate about
threats I’m very passionate about cybersecurity
cybersecurity
cybersecurity it’s something I’ve literally been doing
it’s something I’ve literally been doing
it’s something I’ve literally been doing more than half my life and I’ll take you
more than half my life and I’ll take you
more than half my life and I’ll take you through that journey very shortly but
through that journey very shortly but
through that journey very shortly but we’re screwed
we’re screwed
we’re screwed that’s more bad news we don’t have
that’s more bad news we don’t have
that’s more bad news we don’t have enough cyber security professionals and
enough cyber security professionals and
enough cyber security professionals and if I leave here having recruited just
if I leave here having recruited just
if I leave here having recruited just one of you I’ve done my job
one of you I’ve done my job
one of you I’ve done my job so before I scare the hell out of you
so before I scare the hell out of you
so before I scare the hell out of you let me tell you a little about myself it
let me tell you a little about myself it
let me tell you a little about myself it would only be rude not to I was born in
would only be rude not to I was born in
would only be rude not to I was born in Poland my parents moved me to the US
Poland my parents moved me to the US
Poland my parents moved me to the US when I was three years old
when I was three years old
when I was three years old shortly thereafter they had actually
shortly thereafter they had actually
shortly thereafter they had actually divorced and my mom met my stepdad my
divorced and my mom met my stepdad my
divorced and my mom met my stepdad my mom worked at a factory that produced
mom worked at a factory that produced
mom worked at a factory that produced lights for airplanes so the strobe
lights for airplanes so the strobe
lights for airplanes so the strobe lights that you see on airplanes she
lights that you see on airplanes she
lights that you see on airplanes she would hand hand produce and after hours
would hand hand produce and after hours
would hand hand produce and after hours heard my stepdad actually ran a cleaning
heard my stepdad actually ran a cleaning
heard my stepdad actually ran a cleaning service one that they’d go in clean
service one that they’d go in clean
service one that they’d go in clean offices and and a Polish family I kind
offices and and a Polish family I kind
offices and and a Polish family I kind of get it so after at the sleight
of get it so after at the sleight
of get it so after at the sleight factory my dad was actually the manager
factory my dad was actually the manager
factory my dad was actually the manager we had moved out of the town that they
we had moved out of the town that they
we had moved out of the town that they were actually doing this work and and my
were actually doing this work and and my
were actually doing this work and and my dad started this business full-time and
dad started this business full-time and
dad started this business full-time and so he was cleaning offices oftentimes
so he was cleaning offices oftentimes
so he was cleaning offices oftentimes medical offices and unfortunately as you
medical offices and unfortunately as you
medical offices and unfortunately as you guys know medical offices can’t be clean
guys know medical offices can’t be clean
guys know medical offices can’t be clean during the day so they’d have to be
during the day so they’d have to be
during the day so they’d have to be cleaned at night so my parents would
cleaned at night so my parents would
cleaned at night so my parents would have to bring me along as an 8-year old
have to bring me along as an 8-year old
have to bring me along as an 8-year old nine year old child into these doctors
nine year old child into these doctors
nine year old child into these doctors offices and what am I supposed to do
offices and what am I supposed to do
offices and what am I supposed to do right so apparently for some reason
right so apparently for some reason
right so apparently for some reason nurses doctors have this tendency of
nurses doctors have this tendency of
nurses doctors have this tendency of using the stapler and missing the paper
using the stapler and missing the paper
using the stapler and missing the paper I don’t know how it happens but staples
I don’t know how it happens but staples
I don’t know how it happens but staples end up in the carpet jammed into the
end up in the carpet jammed into the
end up in the carpet jammed into the carpet and the vacuum cleaner we had was
carpet and the vacuum cleaner we had was
carpet and the vacuum cleaner we had was pretty busted and
pretty busted and
pretty busted and not actually pick up those staples so my
not actually pick up those staples so my
not actually pick up those staples so my dad my stepdad made me a deal why don’t
dad my stepdad made me a deal why don’t
dad my stepdad made me a deal why don’t you go around while we clean into the
you go around while we clean into the
you go around while we clean into the doctor’s office I’ll give you a penny
doctor’s office I’ll give you a penny
doctor’s office I’ll give you a penny for every staple you pull out of the
for every staple you pull out of the
for every staple you pull out of the actual carpet I said all right so that’s
actual carpet I said all right so that’s
actual carpet I said all right so that’s how I became an entrepreneur shortly
how I became an entrepreneur shortly
how I became an entrepreneur shortly thereafter written I shortly thereafter
thereafter written I shortly thereafter
thereafter written I shortly thereafter resigned the pay was not that great my
resigned the pay was not that great my
resigned the pay was not that great my we’re still on good terms my parents and
we’re still on good terms my parents and
we’re still on good terms my parents and I so that’s how I learned how to be an
I so that’s how I learned how to be an
I so that’s how I learned how to be an entrepreneur however one time my parents
entrepreneur however one time my parents
entrepreneur however one time my parents did catch me in one of the side offices
did catch me in one of the side offices
did catch me in one of the side offices with a stapler in my hand making extra
with a stapler in my hand making extra
with a stapler in my hand making extra cash and that’s how I learned ethics so
cash and that’s how I learned ethics so
cash and that’s how I learned ethics so so cybersecurity you got to be at the
so cybersecurity you got to be at the
so cybersecurity you got to be at the goal cybersecurity you kind of get the
goal cybersecurity you kind of get the
goal cybersecurity you kind of get the point so that’s number one okay so how
point so that’s number one okay so how
point so that’s number one okay so how did malwarebytes get started
did malwarebytes get started
did malwarebytes get started malwarebytes malwarebytes mal writes
malwarebytes malwarebytes mal writes
malwarebytes malwarebytes mal writes okay so I was 13 14 years old loved to
okay so I was 13 14 years old loved to
okay so I was 13 14 years old loved to pirate videogames everybody here’s done
pirate videogames everybody here’s done
pirate videogames everybody here’s done it don’t look at me like that and and
it don’t look at me like that and and
it don’t look at me like that and and pirating these video games is risky
pirating these video games is risky
pirating these video games is risky business back in the day we had LimeWire
business back in the day we had LimeWire
business back in the day we had LimeWire we had Kazaa I think many hopefully many
we had Kazaa I think many hopefully many
we had Kazaa I think many hopefully many of you have used those products before
of you have used those products before
of you have used those products before but you can download a lot of free stuff
but you can download a lot of free stuff
but you can download a lot of free stuff say there’s torrents but back in the day
say there’s torrents but back in the day
say there’s torrents but back in the day these video games would come with
these video games would come with
these video games would come with malware it was a 50/50 shot so I
malware it was a 50/50 shot so I
malware it was a 50/50 shot so I downloaded a video game and
downloaded a video game and
downloaded a video game and unfortunately had gotten the parents
unfortunately had gotten the parents
unfortunately had gotten the parents computer in fact that we shared one
computer in fact that we shared one
computer in fact that we shared one computer one of those Dells under the
computer one of those Dells under the
computer one of those Dells under the table
table
table and I didn’t know what to do I felt
and I didn’t know what to do I felt
and I didn’t know what to do I felt helpless obviously my parents were upset
helpless obviously my parents were upset
helpless obviously my parents were upset and and this we had the best antivirus
and and this we had the best antivirus
and and this we had the best antivirus money could pay for how could this have
money could pay for how could this have
money could pay for how could this have happened
happened
happened how could the best security software
how could the best security software
how could the best security software money could pay for running on my
money could pay for running on my
money could pay for running on my computer have gotten my computer
computer have gotten my computer
computer have gotten my computer infected had no idea so I went online I
infected had no idea so I went online I
infected had no idea so I went online I searched for my symptoms and and I found
searched for my symptoms and and I found
searched for my symptoms and and I found a group of volunteers helping people
a group of volunteers helping people
a group of volunteers helping people like me remove malware from their
like me remove malware from their
like me remove malware from their computer and doing it so for free these
computer and doing it so for free these
computer and doing it so for free these people were heroes and I wanted to be
people were heroes and I wanted to be
people were heroes and I wanted to be one of those heroes so after three days
one of those heroes so after three days
one of those heroes so after three days of working with these people online my
of working with these people online my
of working with these people online my computer was clean everything was happy
computer was clean everything was happy
computer was clean everything was happy and I decided to ground that community I
and I decided to ground that community I
and I decided to ground that community I built automation into some of the
built automation into some of the
built automation into some of the processes that they had been running and
processes that they had been running and
processes that they had been running and somebody gifted me the malwarebytes
somebody gifted me the malwarebytes
somebody gifted me the malwarebytes domain name I actually thought it was
domain name I actually thought it was
domain name I actually thought it was pretty cheesy today I actually loved it
pretty cheesy today I actually loved it
pretty cheesy today I actually loved it I stuck around this community and met a
I stuck around this community and met a
I stuck around this community and met a guy named Bruce Harrison Bruce was this
guy named Bruce Harrison Bruce was this
guy named Bruce Harrison Bruce was this 35 year old guy in the middle of
35 year old guy in the middle of
35 year old guy in the middle of Massachusetts
Massachusetts
Massachusetts and he would drive an hour to work to
and he would drive an hour to work to
and he would drive an hour to work to clean computers I mean his whole role at
clean computers I mean his whole role at
clean computers I mean his whole role at this tech repair shop was computers
this tech repair shop was computers
this tech repair shop was computers would come in with a virus he would
would come in with a virus he would
would come in with a virus he would manually remove it after several hours
manually remove it after several hours
manually remove it after several hours it was very anti-climatic to start
it was very anti-climatic to start
it was very anti-climatic to start tomorrow right sigh just said do you
tomorrow right sigh just said do you
tomorrow right sigh just said do you want to build an anti-virus and he said
want to build an anti-virus and he said
want to build an anti-virus and he said yes so that’s how we got started
yes so that’s how we got started
yes so that’s how we got started now imagine telling your mother your
now imagine telling your mother your
now imagine telling your mother your fourteen-year-old kid that you met a guy
fourteen-year-old kid that you met a guy
fourteen-year-old kid that you met a guy online and together and he’s 35 and
online and together and he’s 35 and
online and together and he’s 35 and together you’re going to build an
together you’re going to build an
together you’re going to build an anti-virus now imagine telling your wife
anti-virus now imagine telling your wife
anti-virus now imagine telling your wife that you met a kid online that’s 14 and
that you met a kid online that’s 14 and
that you met a kid online that’s 14 and together we’re gonna build an anti-virus
together we’re gonna build an anti-virus
together we’re gonna build an anti-virus somehow it worked we hadn’t actually met
somehow it worked we hadn’t actually met
somehow it worked we hadn’t actually met for a couple years until until the
for a couple years until until the
for a couple years until until the company got going anyway so the start to
company got going anyway so the start to
company got going anyway so the start to malwarebytes was quite an interesting
malwarebytes was quite an interesting
malwarebytes was quite an interesting one today we’re about 500 people
one today we’re about 500 people
one today we’re about 500 people worldwide we’re based in Santa Clara I
worldwide we’re based in Santa Clara I
worldwide we’re based in Santa Clara I actually moved here from from Chicago
actually moved here from from Chicago
actually moved here from from Chicago went to University of Champaign the
went to University of Champaign the
went to University of Champaign the University of Illinois in Champaign the
University of Illinois in Champaign the
University of Illinois in Champaign the whole point of that story is there’s a
whole point of that story is there’s a
whole point of that story is there’s a lot of threats out there and the
lot of threats out there and the
lot of threats out there and the traditional antivirus the traditional
traditional antivirus the traditional
traditional antivirus the traditional security approaches are no longer
security approaches are no longer
security approaches are no longer working they’re failing in fact the
working they’re failing in fact the
working they’re failing in fact the reason is malware used to be lame I
reason is malware used to be lame I
reason is malware used to be lame I don’t know if many of you look young but
don’t know if many of you look young but
don’t know if many of you look young but and I look young but I don’t know if
and I look young but I don’t know if
and I look young but I don’t know if many of you remember when internet
many of you remember when internet
many of you remember when internet search toolbars were our biggest problem
search toolbars were our biggest problem
search toolbars were our biggest problem where we open Internet Explorer and half
where we open Internet Explorer and half
where we open Internet Explorer and half of our screen was search toolbars I
of our screen was search toolbars I
of our screen was search toolbars I don’t know if any of you remember bonsai
don’t know if any of you remember bonsai
don’t know if any of you remember bonsai buddy anybody here remember bonsai buddy
buddy anybody here remember bonsai buddy
buddy anybody here remember bonsai buddy no bonsai buddy was a purple gorilla
no bonsai buddy was a purple gorilla
no bonsai buddy was a purple gorilla that would infect your computer jump
that would infect your computer jump
that would infect your computer jump around on your screen and try to sell
around on your screen and try to sell
around on your screen and try to sell you stuff all day long those were the
you stuff all day long those were the
you stuff all day long those were the threats of 2005 through 2010
threats of 2005 through 2010
threats of 2005 through 2010 those were the threats we were dealing
those were the threats we were dealing
those were the threats we were dealing with those were the threats that
with those were the threats that
with those were the threats that traditional security was designed to fix
traditional security was designed to fix
traditional security was designed to fix and protect against and the pace of
and protect against and the pace of
and protect against and the pace of innovation by those criminals has far
innovation by those criminals has far
innovation by those criminals has far exceeded the pace of innovation of
exceeded the pace of innovation of
exceeded the pace of innovation of security ninjas or rather the lack of
security ninjas or rather the lack of
security ninjas or rather the lack of security ninjas I firmly believe there’s
security ninjas I firmly believe there’s
security ninjas I firmly believe there’s not enough of us to keep up with that
not enough of us to keep up with that
not enough of us to keep up with that innovation let’s level set let’s talk
innovation let’s level set let’s talk
innovation let’s level set let’s talk about some of the problems of today I
about some of the problems of today I
about some of the problems of today I actually think they’re they’re far more
actually think they’re they’re far more
actually think they’re they’re far more advanced than many people think I think
advanced than many people think I think
advanced than many people think I think the media uses fear to portray a lot of
the media uses fear to portray a lot of
the media uses fear to portray a lot of the threats out there
the threats out there
the threats out there but I don’t think they do it with
but I don’t think they do it with
but I don’t think they do it with clarity and so I think I’ll give it a
clarity and so I think I’ll give it a
clarity and so I think I’ll give it a shot one of the biggest threats that I
shot one of the biggest threats that I
shot one of the biggest threats that I think faces society today is our
think faces society today is our
think faces society today is our exploits and exploits are really a
exploits and exploits are really a
exploits and exploits are really a vector of attack a method by which a
vector of attack a method by which a
vector of attack a method by which a criminal can do something that they want
criminal can do something that they want
criminal can do something that they want to do I’ll give you an example or rather
to do I’ll give you an example or rather
to do I’ll give you an example or rather let me tell you a little more about
let me tell you a little more about
let me tell you a little more about exploits so software engineers write
exploits so software engineers write
exploits so software engineers write tens of thousands of lines of code
tens of thousands of lines of code
tens of thousands of lines of code software engineers are not perfect
software engineers are not perfect
software engineers are not perfect therefore one two or many of those lines
therefore one two or many of those lines
therefore one two or many of those lines of code could cause issues for the
of code could cause issues for the
of code could cause issues for the software application imagine the most
software application imagine the most
software application imagine the most fundamental applications that we use a
fundamental applications that we use a
fundamental applications that we use a browser for example a browsers only job
browser for example a browsers only job
browser for example a browsers only job is to take content from the web parse it
is to take content from the web parse it
is to take content from the web parse it sanitize it clean it up so you can see
sanitize it clean it up so you can see
sanitize it clean it up so you can see pictures graphs texts and so on if it’s
pictures graphs texts and so on if it’s
pictures graphs texts and so on if it’s built poorly that browser could parse
built poorly that browser could parse
built poorly that browser could parse the information incorrectly and do
the information incorrectly and do
the information incorrectly and do something to your computer that it does
something to your computer that it does
something to your computer that it does not desire to do and that’s what an
not desire to do and that’s what an
not desire to do and that’s what an exploit is it’s the use of a
exploit is it’s the use of a
exploit is it’s the use of a vulnerability to basically do something
vulnerability to basically do something
vulnerability to basically do something malicious to that machine now the most
malicious to that machine now the most
malicious to that machine now the most severe cases of this are nation-states
severe cases of this are nation-states
severe cases of this are nation-states governments using exploits to target
governments using exploits to target
governments using exploits to target individuals like us other nation-states
individuals like us other nation-states
individuals like us other nation-states if you guys remember Stuxnet Stuxnet was
if you guys remember Stuxnet Stuxnet was
if you guys remember Stuxnet Stuxnet was the first virus that actually went after
the first virus that actually went after
the first virus that actually went after infrastructure it got delivered and
infrastructure it got delivered and
infrastructure it got delivered and destroyed Iranian centrifuges allegedly
destroyed Iranian centrifuges allegedly
destroyed Iranian centrifuges allegedly by Americans by the United States of
by Americans by the United States of
by Americans by the United States of America and it used for zero-day
America and it used for zero-day
America and it used for zero-day exploits that were unknown at the time
exploits that were unknown at the time
exploits that were unknown at the time if you look at the hacking team really
if you look at the hacking team really
if you look at the hacking team really bad company name but the hacking team
bad company name but the hacking team
bad company name but the hacking team was a company in Italy that mass and not
was a company in Italy that mass and not
was a company in Italy that mass and not mass-produced mass distributed exploits
mass-produced mass distributed exploits
mass-produced mass distributed exploits that only they knew about two
that only they knew about two
that only they knew about two nation-states to use as attacks so they
nation-states to use as attacks so they
nation-states to use as attacks so they got hacked the hacking team got hacked
got hacked the hacking team got hacked
got hacked the hacking team got hacked and those exploits the only revenue
and those exploits the only revenue
and those exploits the only revenue source that they had was now public and
source that they had was now public and
source that they had was now public and companies fixed it they were gutted
companies fixed it they were gutted
companies fixed it they were gutted overnight but I do believe that the use
overnight but I do believe that the use
overnight but I do believe that the use of these exploits in browsers in office
of these exploits in browsers in office
of these exploits in browsers in office products in your cars the jailbreak on
products in your cars the jailbreak on
products in your cars the jailbreak on the iPhone is the use of an exploit now
the iPhone is the use of an exploit now
the iPhone is the use of an exploit now we use it to jail
we use it to jail
we use it to jail break our iPhones criminals use it to
break our iPhones criminals use it to
break our iPhones criminals use it to read our emails to read our text
read our emails to read our text
read our emails to read our text messages which brings me on to the next
messages which brings me on to the next
messages which brings me on to the next threat which is ransomware a little bit
threat which is ransomware a little bit
threat which is ransomware a little bit more familiar I hope to the group here
more familiar I hope to the group here
more familiar I hope to the group here so ransomware is basically a piece of
so ransomware is basically a piece of
so ransomware is basically a piece of malware that could be delivered via an
malware that could be delivered via an
malware that could be delivered via an exploit or you just clicking on it and
exploit or you just clicking on it and
exploit or you just clicking on it and it encrypts all of your documents takes
it encrypts all of your documents takes
it encrypts all of your documents takes everything that you have on your
everything that you have on your
everything that you have on your computer that’s really important to you
computer that’s really important to you
computer that’s really important to you and locks it with military-grade
and locks it with military-grade
and locks it with military-grade encryption and then brings up a little
encryption and then brings up a little
encryption and then brings up a little prompt that says if you don’t pay me
prompt that says if you don’t pay me
prompt that says if you don’t pay me $500 in the next 24 hours your data is
$500 in the next 24 hours your data is
$500 in the next 24 hours your data is gone now imagine being a student working
gone now imagine being a student working
gone now imagine being a student working on your PhD and you come back to your
on your PhD and you come back to your
on your PhD and you come back to your computer with a prompt that says if you
computer with a prompt that says if you
computer with a prompt that says if you don’t pay me $500 your PhD is gone
don’t pay me $500 your PhD is gone
don’t pay me $500 your PhD is gone and you don’t have backups of it now the
and you don’t have backups of it now the
and you don’t have backups of it now the FBI had changed their mind a little bit
FBI had changed their mind a little bit
FBI had changed their mind a little bit on this they said first pay the ransom
on this they said first pay the ransom
on this they said first pay the ransom then don’t pay the ransom now this is a
then don’t pay the ransom now this is a
then don’t pay the ransom now this is a several hundred million dollar industry
several hundred million dollar industry
several hundred million dollar industry this is not a friend of a family member
this is not a friend of a family member
this is not a friend of a family member that I know that got infected with
that I know that got infected with
that I know that got infected with ransomware this is a tens of millions of
ransomware this is a tens of millions of
ransomware this is a tens of millions of people globally hundreds of millions of
people globally hundreds of millions of
people globally hundreds of millions of dollars if not more it’s an economy and
dollars if not more it’s an economy and
dollars if not more it’s an economy and it’s becoming a very very businesslike
it’s becoming a very very businesslike
it’s becoming a very very businesslike there’s ransomware as a service I can
there’s ransomware as a service I can
there’s ransomware as a service I can get any one of you online today selling
get any one of you online today selling
get any one of you online today selling ransomware or rather getting money
ransomware or rather getting money
ransomware or rather getting money through ransomware we would buy a ransom
through ransomware we would buy a ransom
through ransomware we would buy a ransom or kit we would buy an exploit kit we
or kit we would buy an exploit kit we
or kit we would buy an exploit kit we would do some advertising and by the end
would do some advertising and by the end
would do some advertising and by the end of the day we have we have victims and
of the day we have we have victims and
of the day we have we have victims and that’s how easy it is to get into this
that’s how easy it is to get into this
that’s how easy it is to get into this game and that’s the pace of innovation
game and that’s the pace of innovation
game and that’s the pace of innovation around ransomware now the next threat I
around ransomware now the next threat I
around ransomware now the next threat I want to talk about and hopefully I’m
want to talk about and hopefully I’m
want to talk about and hopefully I’m succeeding and scaring you a little bit
succeeding and scaring you a little bit
succeeding and scaring you a little bit here the next threat I want to talk
here the next threat I want to talk
here the next threat I want to talk about is botnets again yet another
about is botnets again yet another
about is botnets again yet another misunderstood threat a botnet is
misunderstood threat a botnet is
misunderstood threat a botnet is machines worldwide acting as zombies
machines worldwide acting as zombies
machines worldwide acting as zombies ready to be pointed at a target and to
ready to be pointed at a target and to
ready to be pointed at a target and to take that target down there are hundreds
take that target down there are hundreds
take that target down there are hundreds of millions of computers today that are
of millions of computers today that are
of millions of computers today that are part of botnets where the owner of the
part of botnets where the owner of the
part of botnets where the owner of the device has no idea and at the command of
device has no idea and at the command of
device has no idea and at the command of the person that owns the botnets they
the person that owns the botnets they
the person that owns the botnets they pointed at an asset like a website or a
pointed at an asset like a website or a
pointed at an asset like a website or a server and take it down through just the
server and take it down through just the
server and take it down through just the sheer amount of traffic if they wanted
sheer amount of traffic if they wanted
sheer amount of traffic if they wanted to take the White House website down
to take the White House website down
to take the White House website down today I assure you they could
today I assure you they could
today I assure you they could and just recently actually two weeks ago
and just recently actually two weeks ago
and just recently actually two weeks ago the first botnet attacked the internet
the first botnet attacked the internet
the first botnet attacked the internet backbone that used I oh t devices
backbone that used I oh t devices
backbone that used I oh t devices refrigerators Barbie dolls video cameras
refrigerators Barbie dolls video cameras
refrigerators Barbie dolls video cameras we are a society that connects
we are a society that connects
we are a society that connects everything to the Internet why is a
everything to the Internet why is a
everything to the Internet why is a Barbie doll connected to the Internet I
Barbie doll connected to the Internet I
Barbie doll connected to the Internet I answer that quite know idea why a Barbie
answer that quite know idea why a Barbie
answer that quite know idea why a Barbie doll is connected to the Internet but
doll is connected to the Internet but
doll is connected to the Internet but it’s part of an attack it’s part of an
it’s part of an attack it’s part of an
it’s part of an attack it’s part of an attack today and these devices are
attack today and these devices are
attack today and these devices are created without cyber security in mind
created without cyber security in mind
created without cyber security in mind they are provisioned with default
they are provisioned with default
they are provisioned with default credentials username admin password
credentials username admin password
credentials username admin password password that’s not really hard to
password that’s not really hard to
password that’s not really hard to discover is it and these criminals wrote
discover is it and these criminals wrote
discover is it and these criminals wrote a little script that scoured the entire
a little script that scoured the entire
a little script that scoured the entire internet looking for those kinds of
internet looking for those kinds of
internet looking for those kinds of devices routers Barbie dolls video
devices routers Barbie dolls video
devices routers Barbie dolls video cameras with default credentials like
cameras with default credentials like
cameras with default credentials like admin and password and made them part of
admin and password and made them part of
admin and password and made them part of the botnet and they pointed it at dine
the botnet and they pointed it at dine
the botnet and they pointed it at dine which is basically the lookup table of
which is basically the lookup table of
which is basically the lookup table of what converts an IP address to a domain
what converts an IP address to a domain
what converts an IP address to a domain Google com has a bunch of numbers on the
Google com has a bunch of numbers on the
Google com has a bunch of numbers on the back end that you never want to know
back end that you never want to know
back end that you never want to know about and they took the internet down
about and they took the internet down
about and they took the internet down for a full day reddit Facebook Twitter
for a full day reddit Facebook Twitter
for a full day reddit Facebook Twitter YouTube all of these websites had
YouTube all of these websites had
YouTube all of these websites had connectivity issues that day that was
connectivity issues that day that was
connectivity issues that day that was disrupting business and that’s what all
disrupting business and that’s what all
disrupting business and that’s what all this is about it’s about money all right
this is about it’s about money all right
this is about it’s about money all right so talk a little bit about the threats
so talk a little bit about the threats
so talk a little bit about the threats of today we went from bonsai buddy to
of today we went from bonsai buddy to
of today we went from bonsai buddy to that in eight years you gotta admit
that in eight years you gotta admit
that in eight years you gotta admit that’s some pretty fast innovation what
that’s some pretty fast innovation what
that’s some pretty fast innovation what what does the next eight years hold I
what does the next eight years hold I
what does the next eight years hold I mean I can only speculate but the amount
mean I can only speculate but the amount
mean I can only speculate but the amount of attacks that are occurring today and
of attacks that are occurring today and
of attacks that are occurring today and you hear about in the news is just the
you hear about in the news is just the
you hear about in the news is just the the scratching the service imagine a
the scratching the service imagine a
the scratching the service imagine a botnet being utilized against United
botnet being utilized against United
botnet being utilized against United Airlines ticketing system United
Airlines ticketing system United
Airlines ticketing system United Airlines ticketing system produces
Airlines ticketing system produces
Airlines ticketing system produces hundreds of millions of dollars in
hundreds of millions of dollars in
hundreds of millions of dollars in revenue per day imagine if you can take
revenue per day imagine if you can take
revenue per day imagine if you can take it down for a full day would United
it down for a full day would United
it down for a full day would United Airlines not pay five million dollars
Airlines not pay five million dollars
Airlines not pay five million dollars instead of a hundred million just to
instead of a hundred million just to
instead of a hundred million just to make that tax stop using botnets for
make that tax stop using botnets for
make that tax stop using botnets for ransom this happened with the SF Muni I
ransom this happened with the SF Muni I
ransom this happened with the SF Muni I don’t know if you guys remember six
don’t know if you guys remember six
don’t know if you guys remember six weeks ago the SF Muni the ticket kiosk
weeks ago the SF Muni the ticket kiosk
weeks ago the SF Muni the ticket kiosk completely taken down
completely taken down
completely taken down using ransomware you come up to the
using ransomware you come up to the
using ransomware you come up to the machine and it basically said we will
machine and it basically said we will
machine and it basically said we will not let you use this machine until they
not let you use this machine until they
not let you use this machine until they pay the ransom
pay the ransom
pay the ransom this is affecting our everyday lives and
this is affecting our everyday lives and
this is affecting our everyday lives and these criminals need to be stopped
these criminals need to be stopped
these criminals need to be stopped now imagine it also going after
now imagine it also going after
now imagine it also going after infrastructure we’ve already seen that
infrastructure we’ve already seen that
infrastructure we’ve already seen that it’s it’s possible with Stuxnet
it’s it’s possible with Stuxnet
it’s it’s possible with Stuxnet destroying the centrifuges we’ve seen
destroying the centrifuges we’ve seen
destroying the centrifuges we’ve seen hospitals taken offline e-911 call
hospitals taken offline e-911 call
hospitals taken offline e-911 call centers taken offline these are threats
centers taken offline these are threats
centers taken offline these are threats these threats are real and they’re
these threats are real and they’re
these threats are real and they’re affecting each and every one of us and I
affecting each and every one of us and I
affecting each and every one of us and I firmly believe it’s a people problem in
firmly believe it’s a people problem in
firmly believe it’s a people problem in many ways we click on everything all of
many ways we click on everything all of
many ways we click on everything all of us email got a click it attachment I
us email got a click it attachment I
us email got a click it attachment I don’t care who it’s from I want to see
don’t care who it’s from I want to see
don’t care who it’s from I want to see it we click on everything there was a
it we click on everything there was a
it we click on everything there was a study done not a study I met a internet
study done not a study I met a internet
study done not a study I met a internet security leader basically somebody in
security leader basically somebody in
security leader basically somebody in charge of running security for entire
charge of running security for entire
charge of running security for entire organization he took 12 USB sticks
organization he took 12 USB sticks
organization he took 12 USB sticks sprinkled them around campus 11 got
sprinkled them around campus 11 got
sprinkled them around campus 11 got plugged in within 6 hours the last one
plugged in within 6 hours the last one
plugged in within 6 hours the last one got run over by a car we will plot my
got run over by a car we will plot my
got run over by a car we will plot my alma mater did the same thing every USB
alma mater did the same thing every USB
alma mater did the same thing every USB was plugged in every every USB was
was plugged in every every USB was
was plugged in every every USB was plugged in we’re the problem we’re also
plugged in we’re the problem we’re also
plugged in we’re the problem we’re also the solution but we are the problem I I
the solution but we are the problem I I
the solution but we are the problem I I got an email I was on a work trip I got
got an email I was on a work trip I got
got an email I was on a work trip I got an email or a voicemail from my CFO the
an email or a voicemail from my CFO the
an email or a voicemail from my CFO the guy that runs finances for the company
guy that runs finances for the company
guy that runs finances for the company and he said Marcin this is inappropriate
and he said Marcin this is inappropriate
and he said Marcin this is inappropriate I don’t think we should be approving
I don’t think we should be approving
I don’t think we should be approving wires this way what the hell are you
wires this way what the hell are you
wires this way what the hell are you talking about what wires what so it
talking about what wires what so it
talking about what wires what so it turns out I had sent an email to mark
turns out I had sent an email to mark
turns out I had sent an email to mark saying if you don’t approve this $52,000
saying if you don’t approve this $52,000
saying if you don’t approve this $52,000 wire we’re gonna have a problem and I
wire we’re gonna have a problem and I
wire we’re gonna have a problem and I apparently was very very rough with him
apparently was very very rough with him
apparently was very very rough with him through email now I notice no quotes I
through email now I notice no quotes I
through email now I notice no quotes I had no idea what he was talking about so
had no idea what he was talking about so
had no idea what he was talking about so I asked him and turns out he put a
I asked him and turns out he put a
I asked him and turns out he put a $52,000 wire into the system to some
$52,000 wire into the system to some
$52,000 wire into the system to some bank account overseas and it was pending
bank account overseas and it was pending
bank account overseas and it was pending my approval had we not had that approval
my approval had we not had that approval
my approval had we not had that approval process locked down $52,000 would have
process locked down $52,000 would have
process locked down $52,000 would have disappeared from Malwarebytes his bank
disappeared from Malwarebytes his bank
disappeared from Malwarebytes his bank account never to be seen again
account never to be seen again
account never to be seen again this has happened
this has happened
this has happened to the tune of tens of millions of
to the tune of tens of millions of
to the tune of tens of millions of dollars from some of the biggest
dollars from some of the biggest
dollars from some of the biggest companies in the world and it’s called
companies in the world and it’s called
companies in the world and it’s called wire fraud CFO fraud and social
wire fraud CFO fraud and social
wire fraud CFO fraud and social engineering makes it easy
engineering makes it easy
engineering makes it easy all they had to do is go to our LinkedIn
all they had to do is go to our LinkedIn
all they had to do is go to our LinkedIn website where you can see Malwarebytes a
website where you can see Malwarebytes a
website where you can see Malwarebytes a CFO Mark Harris gee I wonder how to
CFO Mark Harris gee I wonder how to
CFO Mark Harris gee I wonder how to guess his email address it’s pretty darn
guess his email address it’s pretty darn
guess his email address it’s pretty darn easy so be careful as people listen to
easy so be careful as people listen to
easy so be careful as people listen to me here
me here
me here what you expose online because it will
what you expose online because it will
what you expose online because it will come back and bite you so the lack of
come back and bite you so the lack of
come back and bite you so the lack of cybersecurity professionals is real
cybersecurity professionals is real
cybersecurity professionals is real there’s there’s an estimate of 200,000
there’s there’s an estimate of 200,000
there’s there’s an estimate of 200,000 people missing in that profession and if
people missing in that profession and if
people missing in that profession and if we can’t attract that talent and if we
we can’t attract that talent and if we
we can’t attract that talent and if we can’t innovate we as a society are not
can’t innovate we as a society are not
can’t innovate we as a society are not going to be in great shape and we’re
going to be in great shape and we’re
going to be in great shape and we’re already seeing it in day to day life not
already seeing it in day to day life not
already seeing it in day to day life not that we haven’t but you look at the
that we haven’t but you look at the
that we haven’t but you look at the presidential election I mean
presidential election I mean
presidential election I mean cybersecurity was at the forefront with
cybersecurity was at the forefront with
cybersecurity was at the forefront with allegedly you know Russia’s involvement
allegedly you know Russia’s involvement
allegedly you know Russia’s involvement in the DNC hacks so again if I leave
in the DNC hacks so again if I leave
in the DNC hacks so again if I leave here having convinced just one of you to
here having convinced just one of you to
here having convinced just one of you to join the fight and cybersecurity I’ve
join the fight and cybersecurity I’ve
join the fight and cybersecurity I’ve done my job thank
”
Be First to Comment