Biography:Cris Thomas (Space Rogue)

From HandWiki
Short description: American cybersecurity researcher and hacker

Cris Thomas
Headshot of Space Rogue
NationalityAmerican
Other namesSpace Rogue
Alma materUniversity of Massachusetts Lowell, Boston University
OccupationCyber Security Researcher, White hat hacker
Years active25
Known forHacker News Network (HNN), CyberSquirrel1 (CS1), Cyber Security

Cris Thomas (also known as Space Rogue) is an American cybersecurity researcher and white hat hacker. A founding member and researcher at the high-profile hacker security think tank L0pht Heavy Industries, Thomas was one of seven L0pht members who testified before the U.S. Senate Committee on Governmental Affairs (1999) on the topic of government and homeland computer security, specifically warning of internet vulnerabilities and claiming that the group could "take down the internet within 30 minutes".[1]

Subsequently, Thomas pursued a career in Cyber Security Research while also embracing a public advocacy role as a cyber security subject-matter expert (SME) and pundit. Granting interviews and contributing articles,[2] Space Rogue's advocacy has served to educate and advise corporations, government, and the Public about security concerns and relative risk in the areas of election integrity, cyber terrorism, technology,[3] the anticipation of new risks associated with society's adoption of the Internet of things,[4] and balancing perspective (risk vs. hype).[5]

Personal life

Career

Cyber Security

A founding member of the hacker think tank L0pht Heavy Industries, Thomas was the first of L0pht's members to leave following the merger of L0pht with @Stake in 2000, and the last to reveal his true name.[6][7] Thomas was one of seven L0pht members who testified before the U.S. Senate Committee on Governmental Affairs (1999). Testifying under his internet handle, Space Rogue, the testimony of Thomas and other L0pht members served to inform the government of current and future internet vulnerabilities to which federal and public channels were susceptible. The testimony marked the first time that persons not under federal witness protection were permitted to testify under assumed names.[1]

While at the L0pht Thomas created The Whacked Mac Archives and The Hacker News Network. In addition he released at least one security advisories detailing a flaw in FWB's Hard Disk Toolkit.[8] [9]

Thomas continued a career in Cyber Security Research at @Stake,[10] Guardent, Trustwave (Spiderlabs),[11] Tenable,[12] and IBM (X-Force Red).[13] Selected to serve as a panelist during a 2016 Atlantic Council cyber risk discussion series,[3] and a webinar speaker for the National Science Foundation's WATCH series,[14][15] Thomas has embraced a public advocacy role as a cyber security subject-matter expert (SME) and pundit, granting interviews and contributing articles[2] to educate the public about security concerns and relative risk. Topics include election integrity, cyber terrorism, technology,[4] password security,[16] the anticipation of new risks associated with society's adoption of the Internet of things,[5] and balancing perspective (risk vs. hype).[17]

In response to a 2016 United States Government Accountability Office report[18] revealing the nation's nuclear weapons were under the control of computers that relied on outdated 8" floppy disks,[19] Thomas argued that the older computers, data storage systems, programming languages, and lack of internet connectivity would make it more difficult for hackers to access the systems, effectively reducing the vulnerability of the weapon control systems to hacking.[20]

Following cyber security mega-breaches at Target,[21] Home Depot,[22] and the U.S. Office of Personnel Management,[23] Thomas advocated for proactive implementation of basic security measures as the most effective means to thwart similar mega-threats.[24] Bluntly stating that the gap between knowledge and implementation leaves companies and individuals at unnecessary risk, Thomas’ recommendation focused on simple measures that have been known for one to two decades, but which organizations have not implemented universally.[24] Thomas had identified retail cyber security breaches, including that at FAO Schwarz, as early as 1999.[25][26]

In 2017, at the Defcon hacker conference Thomas assisted with escorting Rep. Will Hurd (R) and Rep. Jim Langevin (D) around the conference area through the various villages.[27]

At Defcon 27 in 2019 Thomas appeared on a panel with Rep. Langevin (D-RI),[28] Rep. Lieu (D-CA),[29] and former Rep. Jane Harman[30] entitled "Hacking Congress: The Enemy of My Enemy Is My Friend."[31] During the panel Thomas was quoted as saying “It’s up to us as a community to engage with those people…to educate them”, "But Congress doesn't work that way; it doesn't work at the 'speed of hack'. If you're going to engage with it, you need to recognize this is an incremental journey” [32] and “it takes 20 years to go from hackers in Congress to Congress at DEF CON”.[33]

The Whacked Mac Archives

The Whacked Mac Archives logo

The Whacked Mac Archives was an FTP download site managed by Thomas with the world's largest collection of Apple Macintosh hacking tools.[34] The total size of all the tools on the site was 20MB.[35] A CD copy of the contents of the FTP site was advertised for sale in 2600: The Hacker Quarterly.[36]

Hacker News Network

Serving as Editor-in-Chief,[37] Thomas founded and managed L0pht's online newsletter and website, known as the Hacker News Network[38] (or simply Hacker News or HNN).[7] Originally created to rapidly share discoveries about computer security, Hacker News also became a forum for users to post security alerts as vulnerabilities were identified.[39] The publication grew, eventually supporting paid advertising and an audience that included technology journalists and companies with an interest in cybersecurity.[1] The website can be seen in several background shots of the video "Solar Sunrise: Dawn of a New Threat"[40] produced by the National Counterintelligence Center in 1999.[41]

After L0pht's merger with @Stake in 2000, the Responsible disclosure-focused Hacker News Network was replaced with Security News Network.[1][42]

Hacker News Network, after a decade offline, set for a launch on Jan. 11, 2010, with video reports about security,[43] the last videos were published in 2011.[44] Hacker News Network in 2018 redirects to spacerogue.net[45][46]

CyberSquirrel1 (CS1)

Cyber Squirrel 1.png

In 2013, Thomas created the project CyberSquirrel1 as a satirical demonstration of the relative risk of Cyberwarfare attacks on critical infrastructure elements such as the North American electrical grid.[47] Started as a Twitter feed, the CyberSquirrel1 project expanded to include a full website and CyberSquirrel Tracking Map;[48] as the dataset grew, Attrition.org's Brian Martin (alias “Jared E. Richo” a/k/a Jericho) joined the project in 2014.[17] CyberSquirrel1's results disrupted public perception regarding the prevalence of nation-based hacking cyberwarfare attacks, concluding that damage due to cyberwarfare (for example, Stuxnet) was "tiny compared to the cyber-threat caused by animals".[47][49]

Election Security

As the 2015-2016 alleged Russian interference in the 2016 United States elections unfolded, public and media interest in hacking and hackers increased.[50] Leading up to the 2016 election, Thomas was interviewed for mainstream media productions, including CNBC 's On the Money.[51][52] [53] After the release of the Joint Analysis Report, Thomas called for expanded detail on Indicators of Compromise in Federal Joint Analysis Reports, indicating that increased transparency and IP address reporting were instrumental for enhancing security.[54]

Prior to the 2018 election Thomas continued his advocacy speaking with CBS News and other outlets about securing our elections and the vulnerability of voting machines.[55][56][57][58]

References

  1. ↑ 1.0 1.1 1.2 1.3 Timberg, Craig (22 Jun 2015). "A disaster foretold — and ignored. LOpht's warnings about the Internet drew notice but little action". The Washington Post (USA). https://www.washingtonpost.com/sf/business/2015/06/22/net-of-insecurity-part-3/. 
  2. ↑ 2.0 2.1 Article examples
    *Rogue, Space (1 Jul 2015). "Opinion: An Underwriters Laboratories for cybersecurity is long overdue". The Christian Science Monitor. https://www.csmonitor.com/World/Passcode/Passcode-Voices/2015/0701/Opinion-An-Underwriters-Laboratories-for-cybersecurity-is-long-overdue. 
    *Thomas, Cris (1 Sep 2015). "Understanding malware". Network Computing. http://www.btc.co.uk/Articles/index.php?mag=NC&page=compDetails&link=5865. 
    *Thomas, Cris (19 Sep 2016). "Zero trust policy the answer to fed cybersecurity challenges". Capitol Hill Publishing Corp.. http://thehill.com/blogs/congress-blog/technology/296531-zero-trust-policy-the-answer-to-fed-cybersecurity-challenges. 
  3. ↑ 3.0 3.1 Sweeney, Terry (10 Aug 2016). "Government, Hackers Learn To Make Nice". Dark Reading (Washington, D.C., USA). https://www.darkreading.com/analytics/government-hackers-learn-to-make-nice/d/d-id/1326570. 
  4. ↑ 4.0 4.1 Naraine, Ryan (26 June 2007). "The iPhone security non-story". ZDNet. http://www.zdnet.com/article/the-iphone-security-non-story/. 
  5. ↑ 5.0 5.1 Raywood, Dan (10 Apr 2014). "Inadequate 'Internet of Things' Security Puts Our Lives at Risk". International Business Times. http://www.ibtimes.co.uk/inadequate-internet-things-security-puts-our-lives-risk-1444254. 
  6. ↑ McMillan, Robert (23 Jul 2009). "Hacker Group L0pht Makes a Comeback, of Sorts". PC World (USA). https://www.pcworld.com/article/168979/article.html. 
  7. ↑ 7.0 7.1 "Space Rogue". Forbes (USA). 7 Feb 2000. https://www.forbes.com/2000/02/07/penenberg_0207.html#2692fae510da. 
  8. ↑ Anonymous (2003). Maximum Security. Sams Publishing. p. 571. ISBN 978-0672324598. https://books.google.com/books?id=3jqBnS4b3EgC&dq=space+rogue+fwb+hard+disk&pg=PA571. Retrieved 2018-09-29. 
  9. ↑ Rogue, Space (1998-10-30). "[L0pht Advisory MacOS - FWB passwords easily bypassed"]. https://packetstormsecurity.com/files/19788/l0pht.macos.fwb.hdtoolkit. 
  10. ↑ Penenberg, Adam (7 Feb 2000). "Space Rogue". Forbes (USA). https://www.forbes.com/2000/02/07/penenberg_0207.html#2692fae510da. 
  11. ↑ "A cyber terrorist ate my hamster". Reed Exhibitions, Ltd.. 20 Jul 2012. https://www.infosecurity-magazine.com/news/a-cyber-terrorist-ate-my-hamster/. 
  12. ↑ "Space Rogue from L0pht and Hacker News Network Joins Tenable Network Security". Tenable, Inc.. 7 Jan 2014. https://www.tenable.com/press-releases/space-rogue-from-l0pht-and-hacker-news-network-joins-tenable-network-security. 
  13. ↑ Thomas, Cris (27 Jul 2017). "Hello, My Name Is Space Rogue". IBM. https://securityintelligence.com/hello-my-name-is-space-rogue/. 
  14. ↑ "The Washington Area Trustworthy Computing Hour (WATCH) seminar series". National Science Foundation. 2017. https://www.nsf.gov/cise/cns/watch/. 
  15. ↑ "WATCH - 35 Years of Cyberwar: The Squirrels are Winning". National Science Foundation. 20 July 2017. https://www.nsf.gov/events/event_summ.jsp?cntn_id=242457&org=NSF. 
  16. ↑ Brown, Leah (28 Nov 2017). "IBM's Space Rogue explains how hackers easily crack your password". TechRepublic. https://www.techrepublic.com/article/ibms-space-rogue-explains-how-hackers-easily-crack-your-password/. 
  17. ↑ 17.0 17.1 Gallagher, Sean (16 Jan 2017). "Who's winning the cyber war? The squirrels, of course. CyberSquirrel1 project shows fuzzy-tailed intruders cause more damage than "cyber" does.". Ars Technica (USA). https://arstechnica.com/information-technology/2017/01/whos-winning-the-cyber-war-the-squirrels-of-course/. 
  18. ↑ Powner, David. "INFORMATION TECHNOLOGY: Federal Agencies Need to Address Aging Legacy Systems". U.S. Government Accountability Office Report. https://www.gao.gov/products/GAO-16-696T. 
  19. ↑ Szoldra, Paul (25 May 2016). "America's nukes are still controlled by 8-inch floppy disks". Business Insider. http://www.businessinsider.com/americas-nukes-floppy-disks-2016-5. 
  20. ↑ Szoldra, Paul (16 May 2016). "A hacker explains why US nukes controlled by ancient computers is actually a good thing". VentureBeat. https://venturebeat.com/2016/05/28/a-hacker-explains-why-us-nukes-controlled-by-ancient-computers-is-actually-a-good-thing/. 
  21. ↑ Roman, Jeffrey (26 Mar 2014). "Senate Report Analyzes Target Breach - Pinpoints Apparent Missed Opportunities to Prevent Incident". databreachtoday.com. http://www.databreachtoday.com/senate-report-analyzes-target-breach-a-6677. 
  22. ↑ Kitten, Tracy (1 Jun 2016). "Court Clears Way for Banks' Home Depot Suit to Proceed - Judge Rejects Dismissal, Citing Security Negligence Allegations". databreachtoday.com. http://www.databreachtoday.com/court-clears-way-for-banks-home-depot-suit-to-proceed-a-9161. 
  23. ↑ Chabrow, Eric (2 Dec 2015). "China: Chinese Criminals Hacked OPM - American Experts Skeptical About Chinese Claim of No Government Involvement". databreachtoday.com. http://www.databreachtoday.com/china-chinese-criminals-hacked-opm-a-8720. 
  24. ↑ 24.0 24.1 Schwartz, Mathew (15 Jun 2016). "'Space Rogue' on Déjà Vu Security Failures Old Security Mistakes Keep Getting Repeated, Says Tenable's Cris Thomas". Bank Info Security (USA). https://www.bankinfosecurity.com/interviews/space-rogue-on-deja-vu-security-failures-i-3216. 
  25. ↑ Glave, James (3 Feb 1999). "FAO SCHWARZ SPRINGS A LEAK". Wired (magazine). https://www.wired.com/1999/02/fao-schwarz-springs-a-leak/. 
  26. ↑ Beckett, Jamie (5 Feb 1999). "FAO Schwarz Patches Hole In Web Site". San Francisco Chronicle. http://www.sfgate.com/business/article/FAO-Schwarz-Patches-Hole-In-Web-Site-2948599.php. 
  27. ↑ Strom, David (13 Jun 2017). "Space Rogue: A Security Rebel Turned Pen Tester". securityintelligence.com. https://securityintelligence.com/space-rogue-a-security-rebel-turned-pen-tester/. 
  28. ↑ Robinson, Teri (12 Aug 2019). "Def Con: Lieu, Langevin call on security community to help fed gov't bolster cyber, harden election security". https://www.scmagazine.com/home/government/def-con-lieu-langevin-call-on-security-community-to-help-fed-govt-bolster-cyber-harden-election-security/. 
  29. ↑ Brumfield, Cynthia (9 Aug 2019). "U.S. Rep Lieu hopeful for election security bill prospects". https://www.csoonline.com/article/3430906/u-s-rep-lieu-hopeful-for-election-security-bill-prospects.html. 
  30. ↑ Peterson, Scot (12 Aug 2019). "Black Hat 2019: Election Security Gets Top Billing at Black Hat, Def Con". https://www.itprotoday.com/data-security-and-encryption/black-hat-2019-election-security-gets-top-billing-black-hat-def-con. 
  31. ↑ Sheridan, Kelly (12 Aug 2019). "Security Pros, Congress Reps Talk National Cybersecurity at DEF CON". https://www.darkreading.com/endpoint/security-pros-congress-reps-talk-national-cybersecurity-at-def-con/d/d-id/1335497. 
  32. ↑ Thomson, Iain (12 Aug 2019). "US still 'not prepared' in event of a serious cyber attack and Congress can't help if it happens". https://www.theregister.co.uk/2019/08/12/defcon_politicians_hackers/. 
  33. ↑ Peterson, Scot (12 Aug 2019). "Black Hat 2019: Election Security gets Top Billing at Black Hat, Def Con". https://www.itprotoday.com/data-security-and-encryption/black-hat-2019-election-security-gets-top-billing-black-hat-def-con. 
  34. ↑ This Machine Kills Secrets: Julian Assange, the Cypherpunks, and Their Fight to Empower Whistleblowers, p. 199, at Google Books
  35. ↑ Rogue, Space (2012-06-11). "The Return of Zuc.A and Ancient OSX Viruses?". Trustwave. https://www.trustwave.com/Resources/SpiderLabs-Blog/The-Return-of-Zuc-A-and-and-Ancient-OSX-Viruses-/. 
  36. ↑ 2600 Magazine Vol 13, p. 49, at Google Books
  37. ↑ Glave, James (12 Jan 1999). "CONFUSION OVER 'CYBERWAR'". Wired (USA). https://www.wired.com/1999/01/confusion-over-cyberwar/. 
  38. ↑ "HNN - H a c k e r N e w s N e t w o r k". 17 August 2000. http://www.hackernews.com/. 
  39. ↑ Timberg, Craig (27 Jun 2015). "In 1998, these hackers said the Internet would become a security disaster. Nobody listened". The Daily Herald (USA). http://www.dailyherald.com/article/20150627/business/150629234/. 
  40. ↑ Kevin Poulsen (September 23, 2008). "Video: Solar Sunrise, the Best FBI-Produced Hacker Flick Ever". Wired News. https://www.wired.com/threatlevel/2008/09/video-solar-sun/. 
  41. ↑ Solar Sunrise Dawn Of A New Threat (VHS) (Video). National Counterintelligence Center. 1999. Event occurs at 3:18. Retrieved October 30, 2018. Alt URL
  42. ↑ "(Sort of) New Hacker Resource site - Geek.com". 27 July 2000. https://www.geek.com/news/sort-of-new-hacker-resource-site-565489/. 
  43. ↑ "Hacker Group L0pht Makes a Comeback, of Sorts". https://www.pcworld.com/article/168979/article.html. 
  44. ↑ "HackerNewsNetwork". https://www.youtube.com/user/HackerNewsNetwork. 
  45. ↑ "Old Site Archive - SPACE ROGUE". https://www.spacerogue.net/wordpress/?page_id=47. 
  46. ↑ "Space Rogue from L0pht and Hacker News Network Joins Tenable Network Security". 7 January 2014. https://www.tenable.com/press-releases/space-rogue-from-l0pht-and-hacker-news-network-joins-tenable-network-security. 
  47. ↑ 47.0 47.1 "Squirrel 'threat' to critical infrastructure". BBC. 17 Jan 2017. https://www.bbc.com/news/technology-38650436. 
  48. ↑ Hern, Alex (14 Jan 2016). "The power grid's greatest enemy has four legs and a bushy tail". The Guardian. https://www.theguardian.com/technology/2016/jan/14/power-grid-cybersquirrel1-hackers-cyberwarfare. 
  49. ↑ Wagenseil, Paul (14 Jan 2017). "Worried About Cyberwar? Worry About Squirrels Instead". Tom's Guide (USA). https://www.tomsguide.com/us/cyberwar-squirrels-shmoocon,news-24283.html. 
  50. ↑ "2016 Presidential Campaign Hacking Fast Facts". CNN. 31 Oct 2017. http://www.cnn.com/2016/12/26/us/2016-presidential-campaign-hacking-fast-facts/index.html. 
  51. ↑ CNBC On the Money: Hacking the Vote (Television production). CNBC. 5 Nov 2015. Retrieved 10 Dec 2017.
  52. ↑ Grubbs, Alex (15 Aug 2016). "Experts Fear Possible Voting Machine Tampering in November". CNSNews.com (USA). https://www.cnsnews.com/news/article/alex-grubbs/experts-fear-possible-voting-machine-tampering-november. 
  53. ↑ Muradian, Vago (14 Oct 2016). "Tenable's Space Rogue on Hacking US Elections, Cyber Vulnerabilities". https://defaeroreport.com/2016/10/14/tenables-space-rogue-hacking-us-elections-cyber-vulnerabilities/. 
  54. ↑ Lamb, Eleanor (19 Jan 2017). "Tenable Expert Urges Stronger Language for 'Grizzly Steppe' Report". Meritalk: Improving the outcomes of government IT. https://www.meritalk.com/articles/tenable-expert-urges-stronger-language-for-grizzly-steppe-report/. 
  55. ↑ Patterson, Dan (19 Sep 2018). "Why voting machines in the U.S. are easy targets for hackers". CBSNews.com (USA). https://www.cbsnews.com/news/why-voting-machines-in-the-u-s-are-easy-targets-for-hackers/. 
  56. ↑ Patterson, Dan (27 Sep 2018). "Campaign 2018: Voting machines are vulnerable to hacking". CNet.com (USA). https://www.cnet.com/news/campaign-2018-voting-machines-are-vulnerable-to-hacking/. 
  57. ↑ Nexstar Media Group (25 Oct 2018). "Report: Americans concerned about cyber attack on voting systems as midterms near". wtnh.com (USA). https://www.wtnh.com/news/politics/report-americans-concerned-about-cyber-attack-on-voting-systems-as-midterms-near/1549943165. 
  58. ↑ Patterson, Dan (29 Oct 2018). "Election hacking: The myths vs. realities". techrepublic.com (USA). https://www.techrepublic.com/article/election-hacking-the-myths-vs-realities/. 

External links




Retrieved from "https://handwiki.org/wiki/index.php?title=Biography:Cris_Thomas_(Space_Rogue)&oldid=3408089"