While you guys are here, right, we'll give some shout outs. We have, um, anyone in a
DEF CON group? DCG? From local area code? Okay, well this one is gonna happen then. Please go
and check out DCG room. These are all DEF CON groups. DEF CON is year round. We have to plan
year round also, but like, we can do great things, right? DCG, 305, go Miami. Um, so yeah,
like, you know, go there after, get inspired. Um, if you guys are new, the room over here is
the LHC room. They were out partying a little bit last night, so there's nobody in there right
now, but, you know, things happen in Vegas. Um, also, we do have a bar over there, um, you
know, so if anyone is needing a refreshment or what not, we have that. Um, if anyone needs the
bathrooms, they're gonna be right over there, just kind of as a heads up. Um, and then also, um,
as we're getting older, we're gonna have a bar over there. Um, we're gonna have a bar over there.
Right? Some of, we've lost a few great hackers this year. Um, there is a memorial room, right?
So if, you know, you want a place that's quiet to reflect and what not, um, that's also there, and
it, it's just a really fabulous spot for just healing, and it's also a good spot, just quiet
and, um, after our, uh, after our, uh, discussion and our, our talk, right, there'll be a question
answer period. We're gonna go over there in one of the rooms, so that way it's a, a more intimate
environment, and if you have any questions and answers, um, for any of the folks up here, so we'll
let you guys know which room, um, is gonna be that. Um, and so, yeah, in the next, uh, minute or so,
we'll, we'll get started. So thank you guys all for coming and, um, waking up early. I know that
might have been a challenge for some of you, and for those who haven't gotten to sleep, this is gonna
be a great talk, and then, you know, then you guys can get some shut eye. So, thank you very much,
and we'll wait. Let's start one time.
Yeah, let's get started. Hey guys, how's it going? All right, come on, let's wake up.
Come on, cheer up, come on, you made it to DefCon. So this is our thirty-first, thirty-first
year of DefCon. Um, thank you for coming. It all works out because of you guys showing up and
spreading the word, and make sure that everyone's, like, gets excited about learning about what
DefCon is, not just a pack of hackers, and doing crazy stuff, but it's more about the community, and, uh,
and the most important thing is talking about, um, how much work it takes to make everything look
kinda simple and working. Um, and, you know, thanks to these guys, it's something that, uh, we all
should, like, you know, remember. Um, so this is our first talk today, uh, for, this is track five,
uh, it's called A Different Uber Postmortem by Joe Sullivan, um, and, uh, enjoy it.
Welcome, Joe.
Hey, everyone. Uh, my name's Joe Sullivan. I'm currently the CEO of a non-profit, um, but for most of my
career, I've worked in cyber security, like a lot of you, um, and I'm gonna walk you through an experience
I've been going through probably since when I started thinking about it, the beginning of my career, that's
still going on. Um, when I, um, had the chance to be the CSO of some really big companies, one of the
things that I came to realize was that, you know, there's a lot of people out there that, you know,
really appreciate is that you can't do security on your own. It has to be a, I think of it as really a
three-legged stool. Like, there's the commitment that you make inside your organization, but you have to
partner with the government also. And then the third thing that a lot of people don't understand is the
importance of partnering with researchers. Um, so I've had a lot of opportunities to talk with security
leaders about my case.
They often reach out to me when they are
getting nervous because they
have a bunch of lawyers showing up to their meetings,
or they're getting together in kind of
closed rooms. And so I've had
a lot of chances to talk with security leaders
about what my case might mean
for them, and how they
could set up their organization, their company, and their
relationships with government to be better
so that what happened to me doesn't
happen to them. But
as I was thinking about it, there was one
story and perspective that
I don't think got enough attention, and so
that's why I asked to do this talk.
And that's the perspective of the security research
community. And so I'm going to kind of
look at this case, not
from my perspective, but from
maybe the perspective of an outside researcher.
And thinking about it, not
just in terms of this case, but what it means for the future.
Because legal cases are always
about precedent.
Um, one note as I'm getting started,
um,
I'm appealing my case,
so the case is still going on,
which limits what I can say in some contexts.
Also, I was an
employee of Uber during
the whole time that the incident transpired,
and so I had an employment contract
and an NDA and all that, so I'm limited
to what I can talk about from that perspective
as well.
Um, so
when I talk about the case, I'm only going to reference
what's in the public record, and
if you hear me talk about something, it's from the perspective
of what I saw sitting in the courtroom,
not
from what I saw inside the company.
So, uh,
I've
been working in computer security
since 1997. I was actually
a federal prosecutor here in Las Vegas,
and I was asked to
become a cybercrime focused prosecutor
while living here.
And of course, that was in the first
few years where DEFCON was starting
to pick up, and that might have been
one of my first DEFCON experiences,
and I might not have been spotted
as a Fed.
Um, but I got to know a lot
about the security community
by coming here and thinking
about the different perspectives, and that's when I started
thinking about, um,
the research perspective
on working with us. And so I'm going
to touch on a lot of that as I go through this.
But each of these stops
kind of taught me a lesson
that led to some of the things that happened in this case.
But the case for me
really got started, uh, it was in November
of 2017.
I got an email, my personal email
from a reporter,
asking me to go on the record about
me being fired from Uber.
And
I think I hadn't even been fired
when the reporter reached out to me.
It's kind of like, it was a really
strange situation where I was learning as much from
Bloomberg as I was learning
from my company,
or ex-company, depending on whatever
moment that day it was.
And I was up in the mountains,
it was Thanksgiving week, I was on vacation
with my family, I was actually in a grocery store,
we were getting food for Thanksgiving,
and I got
kind of these messages.
And I was like, this
must be a big misunderstanding.
I went out, uh, hiking
that afternoon with my family, and I didn't know
almost immediately articles started coming out
talking about how
I'd been part of a
cover-up, and that I was
fired for covering stuff up.
And that I had paid money
to people to delete data.
And
I didn't really know because
after I was terminated they also
bricked my phone and my laptop
remotely.
So I was kind of up in the mountains with no tech.
But like Twitter and everything else was blowing up
that day, and the narrative
was set, I think.
Jump forward three years later,
uh,
I was, uh,
working as the CSO at CloudFlare
at the time, and
um,
I think my family
and I found out through the news
that I had been charged.
Well, I actually found out because a friend of one of my daughters
heard it on NPR and told
her, and so
it was the second time
I got surprised.
Third time is gonna be on me, I guess.
Um, but it actually wasn't
accurate. I wasn't arrested.
They put out a press release saying I was arrested, but I was actually
at home. And, um,
so they corrected that eventually.
Um, but I did get charged.
And I was charged with two
counts. Uh,
the first count was, um,
basically obstructing
an FTC investigation is the way they
characterized it. And the second count
was something called mis-prison of a felony.
The first count really had
to do with, um,
what our company
said to the FTC and didn't say
to the FTC about our security posture
and whether we were transparent
with them. Uh,
that's a talk for a different day.
What I want to focus on is the second count.
Mis-prison of a felony.
Mis-prison is this really old
common law type thing, and I'm not a legal expert
on this stuff, although I should be
at this point. Um,
but mis-prison is
basically if you help someone else get away
with a felony
in something like that.
And so,
the first part of it, of mis-prison
has to be that there is a different felony.
And in this case,
that different felony
was the actions of the researchers.
And so,
for me to be convicted, the jury
had to believe that
the researchers had committed a crime first.
So, jump forward. We actually, um,
went to trial
last September.
This is a, no cameras in the
courtroom, so this is a picture of one of my daughters
Drew. That's me in my
mask on the left, the judge,
a witness, and a jury on the right.
Um, but
like, I want to narrow down the focus,
so I do want to talk about number one, that
mis-prison count. Um,
but one of the things I really
appreciated when I got sentenced
in May, just a couple months ago,
was the judge
went out of his way to say at the sentencing hearing
to the government,
this was a very unusual case.
There's never been a case like this
before.
He asked the prosecutor, could you think of a case
like this that's ever been brought before?
The prosecutor said, not on all fours.
The judge said, not on all threes.
So they were going at it.
And the judge said,
this is not a white collar case. There was no financial
motivation. Um, it's not
like anything I've ever seen before.
And then he also talked about the investigation
that my team did.
The thing that I was most happy about
from the trial was the way my team
got portrayed, and how the judge
perceived them. What the judge said
was, we're not
the data actually
never got exposed in the wild.
So a lot of times I'll see these lists of biggest
data breaches in history, and up in the
middle of it will be this case.
But those records
were actually all recovered and never
kind of like out on the dark web, if you will.
So, because my team
did a really good job on the investigation.
And the judge recognized that.
The prosecutor even agreed.
Well, the prosecutor I think said
we got lucky.
So,
kind of stepping back again,
I've been thinking a lot about
what I said at the beginning about how security needs
to be a partnership to get it
right inside a company.
And as I think about my case, these are some of the
questions that I worry about.
How do we
tilt against the bias of perceiving
every request by an outside person
as extortion?
And if you talk
to the people at the
bug bounty companies, this is an issue that
comes up on a daily basis, especially with new programs.
And especially
with new researchers.
And we also want to create an ecosystem
where companies feel comfortable
engaging with those researchers.
And one of my biggest disappointments
from the case is
I think I set that backwards.
Because of the way
this case was perceived, because of the way
researchers slash hackers were perceived
and all that.
I've heard lots of stories, especially
in the first year afterwards, of companies
like hitting pause on their bounty programs,
rolling them back,
their lawyers getting very anxious about them.
And then you
layer on top of it kind of the blow up of ransomware
which is, you know,
another level in terms of
intrusion and
extortion.
And then
another question is how do we make sure that
researchers can trust a company?
Like how many people know what a responsible disclosure policy
is? Hopefully a lot of you.
We'll talk about that.
But companies put up these
responsible disclosure policies that says
we won't refer to you
to law enforcement if you give us
all the information
and cooperate and make sure that nobody gets hurt.
That's paraphrasing, I have some examples we'll go through.
And
how do we
make sure that the law protects this engagement
and make sure that
companies can
utilize the researchers and the government
will respect it and then we'll have that really strong
stool for all the consumers who use our products
to stand on.
So, this is where I want
to go way back in time.
So I mentioned I was a federal prosecutor.
I don't know, does anybody remember Napster?
Well, Napster was a
really interesting case from the perspective of me
as the, by the time
the recording industry and
everybody was really upset with Napster, I was
I had left Vegas and I was living
in the Bay Area
and I was working full time
doing tech cases and I think I was the first
federal prosecutor in the country
just like in an office full time
cranking on federal cybercrime cases.
I actually had a folder
in my office that said Napster
because we had been getting pushed
to prosecute Napster.
And I always remember I had this conversation with my
top boss, Robert Muller
who went on from that job his next
one was head of the FBI.
And he said
right now it feels like a bunch of companies
fighting with each other. Let them fight it out
first. And like let's
we need to figure out the dynamic
of our relationship with companies and how
much we should be doing what they ask us to do.
Because cyber
is very different from a lot of
other areas of law enforcement
in that so much of what
happens, happens in third party private
sector hands. So much of the internet
especially in this country
sits in the servers of a bunch of companies.
And so from the government perspective
it's really hard to figure out what the right
dynamic is around
relationships. We need cooperation. If you're on the government
side you need cooperation because you need access
and visibility to protect people.
But if you're on the company side
you're dealing
with like also privacy commitments
and it's a lot going
on there. But then there's also the economic
motivation of the company and wanting to push certain
cases and not push certain other cases.
And so as the government you kind of have to
think through all that.
So we decided not to.
And there were civil suits and it actually
resolved things for Napster and I remember thinking
that was good.
But then
I think it was DEFCON 9
there was a
case
so there was a speaker. This is the
whole agenda of DEFCON 9 by the way.
That's every speaker
for the whole event.
And you can't obviously see it
obviously you can't see it from where you are and I can't
either but I'm pretty sure the bottom left
was a guy
named Dmitry Skylarov speaking about
he was an employee of
a Russian company called Elcomsoft
and they had put out some software
that would break
the encryption on the
Adobe eBook reader.
So it was kind of like Napster 2.0
unfolding
and Adobe was really
pushing hard with my office
to prosecute
a case.
And so they
Dmitry Skylarov came from Russia
he spoke at DEFCON
and if you could look really close
I took a screenshot from
Wikipedia of
noticeable
incidents at DEFCON.
The second one was
when Dmitry came off the stage
from talking about
the Adobe eBook reader
encryption breaking tool
he was arrested by the FBI.
And he
was taken into custody.
And it was a mess.
And a lot of people protested.
The picture on the right
is people from
the security community
protesting against the prosecution
of Dmitry.
And that was at the San Francisco
Federal Building.
So let me back up.
So how did the Dmitry story end?
Everybody realized pretty quickly
that Dmitry
he wasn't intending to
do anything particularly I guess.
His company might have been trying to
monetize the situation.
But the charges were dropped against Dmitry
and they went forward against the company.
I was involved in the case
early on
and then I left
the U.S. Attorney's Office
and I went to go work at eBay so I didn't actually
I was there during the time when the charges against Dmitry
were dropped. I was part of the prosecution team.
And then after I left
the case went forward against the company.
And I think the government lost.
So to me
that was
another chance for me
to think about the research
versus company
versus government triangle.
And I was on the side of the government
and we were
arresting a researcher.
And
at the time I thought that was the right thing to do.
But then I went into the private sector
and I remember almost like a month
after I got to eBay we got this email
and it was from somebody that said
we found a security vulnerability
I will tell you if you pay me.
And I remember I personally had
this like angry reaction to this person.
Like
why do they want to get paid?
I'm fighting inside this company to get them to do
the right thing and protect our users and we need to do
everything we can because that's my job.
And then there's someone on the outside
who could help me and they wouldn't give it to me.
And that was like my
next perspective from a company on
security researchers.
But then I
really got to start learning
more about that different perspective.
This was an article written by
Bruce Schneier in
2001 just a couple of months after
Dimitri's case
while it was still pending.
And there was this big fight between Microsoft
and the research community
because Microsoft had gotten mad
because researchers were publishing
vulnerabilities
and I started really thinking
about it from different perspectives.
Move forward a few years I got to PayPal.
I switched from the eBay side to the PayPal side.
And I helped Andy
Steingruble who's now the CISO of
Pinterest
with the publication of what we did at PayPal
in 2007.
And it got praised I think
by a lot of people in the research community
because we published one of the first responsible
disclosure policies.
This was an article by
Jeremiah Grossman praising it.
And so this was the language that we
published at PayPal in 2007
because we'd gone from that experience
where we were angry at
researchers for wanting money
to completely flipping.
And we said
if you follow our guidelines
we won't refer you to the government
and we won't
bring an action
against you.
And
almost immediately after that
companies started publishing those more
and then researchers started
pushing even harder and saying
you shouldn't just not prosecute us
you should actually
pay us.
And there was the No More Free Bugs campaign
that Dino and a bunch of people did.
So a couple years later
I had moved over to Facebook
I was the CISO at Facebook
and I worked with Alex Rice
who's now the CTO of HackerOne
and we published our own version
of what I had helped write at
PayPal. So we published
the Facebook version in December 2010
and we said basically
the same thing. We won't bring lawsuit
or ask law enforcement to investigate
you if you contact us.
We actually came to
here at DEF CON
we launched our bug bounty program
at Facebook in 2011.
That was a heavy lift for us back then
because we weren't the
mega corporation that it is now.
But we announced and launched
the program here. It got a lot of
good publicity and we paid out for a lot of bugs.
But
the relationship with security researchers from inside
the perspective of the company
wasn't actually that
amazing when we first rolled out the bounty program.
This was an interesting
story about a month after I think.
So we now said we're open for business
we'll pay you for vulnerabilities
This
young man in
the Palestinian territories
at the time
found a vulnerability
on Facebook where he could
post on somebody else's wall
and he tried to report it to my team
but he couldn't figure out how to do it
and there was this whole glitch in communication
because we weren't good at communicating
and he wasn't good at communicating
and we were all trying to figure this thing out
so he got irritated and he went on Mark Zuckerberg's
Facebook page and he
using a
picture of Snowden
posted on Mark's page.
So
first sorry for
this is the first slide. First sorry for violating your
privacy.
And so I
had this dilemma of
we had language in our responsible disclosure
and bug bounty program saying we won't
go after researchers and we will
pay you. And so
we actually talked about this inside the company
and we're like is this an unauthorized
access? Is it illegal what he did?
We decided we're not going to
refer this to anybody.
I mean it was CNN sent a reporter
to interview him in person
and so the case got a
lot of attention and I got a lot
of blowback because I said well we can't
pay you for your research.
The security community actually came
together and created a fund
and a bunch of people from the research community
contributed the fund and so he ended up getting
a lot more money than he would have
if we had just paid him
the bounty.
But you know there are a lot of like these
and I could give you probably a thousand
examples like this. This is just one
that I could talk about because it was
so public.
Another one that was kind of
public was
there was this
researcher Reginaldo from
Brazil and he found an RCE
in Facebook
and
not too long before that one of the leaders
on my team had been quoted as saying
our bug bounty program is so awesome
it's doing great
and someone asked what's the max bounty you'll
pay and he said
we would pay a million dollars for the right
bounty if you found something
that was that
significant and harmful
and this researcher he thought
about it and he's like I've got RCE
on Facebook which is basically
for those who don't know
it's just like straight access.
So he had found something big
but he reported it to us
and we worked with him. We did pay him
I think our largest bounty at the time
I think it was 33,500
but
we also hired him and
he moved from Brazil to work
on my team
and kind of be on the other side of the bug bounty
program and that went really
great. I think he stayed at Facebook
for six years.
I left Facebook in
March of 2015
after seven years there building out
the team and I went to Uber
and within
I think a month of me getting to Uber
we published a responsible disclosure policy
saying the same things
and I worked with
a couple of members of our team to put that out
and we said
we won't take legal or administrative action
against people who report vulnerabilities
and so on just kind of like similar to what
we'd said before
and
one of the cool things
that I appreciated that time was
further down on that page there's a
name Rob Fletcher. We were acknowledging
Rob and Rob was actually one of the people
who was helping push out this policy with me
he had been an outside researcher who
had contacted Uber before I got there
reporting a vulnerability and the team had hired
him even before I got there
and Rob ended up ultimately running
the product security team at Uber
and is a very successful
security engineer.
We
right after that I mentioned publicly
I think this one
was on Quora that we had a
private HackerOne bug bounty program
so we launched so this is literally
within a very short period of time after
I got to Uber and then
you know
a lot of companies launch a private program
now and they never take it public
and there's a big debate whether you keep your bug bounty program
private or public
we decided we wanted to take it public
but we had to sit in private
for a while to fix all the things that
researchers reported to us
because I'll tell you when you launch a bounty program
you really do find things
that you wouldn't find otherwise
from a company standpoint bug bounty programs
are amazing
as a security leader I'd have this huge budget
and I would pay pen testing companies
a set amount of money
up front and then they would
find three vulnerabilities every time
and so it was like no matter how much I paid
them I was going to get the same kind of report
that I would have to look really hard to find a little
bit of important stuff
with researchers you don't have to pay them a dime
until they find something important
and so like from a company
standpoint I really believe
that we
like and I used to say this I would say
it's negligence to not have a bug bounty program
like you have to
have that opportunity for people
to do the work
so we launched our public program
and within a very short time
after that
this came to my personal email
and my Uber email
hey Joe I found a major vulnerability in Uber
I was able to dump Uber database
and many other things
I did what I always do
I've gotten versions of this email hundreds of times
I forwarded it
to our bug bounty
triage team
and Rob Fletcher the same researcher
who had gotten a job at the company
I just put this slide in to remind me
that everything I'm going to talk about now is stuff that
was covered publicly in the trial
so like I was saying at the beginning
I'm only going to talk about the case from what's public
so Rob sent an email back
really quickly
after I'd gotten that email
forwarded it to them and Rob said
hey my name is Rob I work in product security
here at Uber
I understand
you have a vulnerability you want to disclose
our preferred method
is use our public bug bounty program
at HackerOne
but if you'd like to use email
to exchange details let's go
and so
that's kind of the start of the case
during the trial
there was a whole bunch of debate
and testimony and argument about
the interaction with these
researchers slash hackers
I never know what to call them because back at the time
we thought of them as researchers
and now everybody
thinks of them as felons
so there was this whole question
of whether they were
this was a slide from the trial
getting a bunch of quotes from people who
testified
and it was a bunch of people from my team
saying mostly what happened
in this case in terms of our interaction
it was quite typical
we had a lot
of debate internally often
about you know back then
so you have to remember 2016
is a long time ago now in internet
time and especially in bug bounty
program time we had very
generic rules back then companies now
have very long rules of what you can and can't
poke at
and so
like Colin Green
said during his testimony there's no supreme
court of bug bounty rules we just look at each
case and try and figure it out back then
and Rob said our guidelines
were flexible and another
member of the team Matt said
in his testimony look if
in these situations we actually
went and referred someone to law
enforcement can you imagine
how the research community would react and then
our program would tank
...
so
we
and actually the
new CEO of Uber when he testified he said
it was the right thing to do to pay them
we
during the investigation I don't want to spend too much time
on the investigation because I don't have
that much time and this is focused more
on the researcher side we documented
everything on the team we had a large
number of people involved
this is I think 25 members of my team
worked on the investigation we pulled in
the communications team they
communicated all the way up to their exec level
we pulled in legal
they communicated with their
manager who ran the privacy team for legal
so they were all kind of in the loop working
through what we did on the case
we had a data breach response policy we had
a data breach response plan we
had a breach incident response playbook
we had all the documentation you would hope
to have we had specifically the names
of who in legal we were supposed to escalate
things to we did those things
legal was responsible for deciding
what gets disclosed
according to policy to whom
and legal the lawyer
testified said
they gave the advice to my team it's not a
reportable data breach situation
if three things one
you're confident
the hackers no longer have the data two confident
the data was not disseminated further and three
you can get the hackers to sign an NDA
so that was the advice from legal at the time
and then I want to
jump back to my sentencing hearing because this was
again the only time I like the judge
really gave his opinions on the case was at the
sentencing and
so a big focus during the case
from if you go back to those articles I
showed you that came out in 2017
they all said we gave them an NDA
to shut them up
and the judge said
the NDA
argument the government makes
doesn't fly
this wasn't a cover up it was part of the
ability to solve the problem
in my view in the way that the evidence came in
I was so happy like I said earlier
when the judge said that because it validated
how hard my team worked and what they did on the
investigation
because on my teams
we always had a culture of attribution
in our investigations we always wanted to know
who we were dealing with on the other side
I would love to someday give a talk just on
the concept of attribution
because like security leaders
very much disagree on
philosophically whether
people inside the company should care
who they're to know
who they're dealing with on the other side
we always wanted to know
because we would refer a lot of cases
to law enforcement
but we also sometimes didn't
there was a great example on the wall we had at Facebook
that was mentioned in an article
where
like an 11 year old kid
had done something really stupid
and we were like what are we going to do with this case
so we wrote a letter to his mother
and it was
and asked her to have him apologize
and he did
and we were like that's a good resolution for that case
but you know we also
we also
you know and it's a weird situation
it goes back to the people in the private sector
having a lot of discretion about what to do
and actually being the only ones
who have visibility into what's really happening
in a lot of these situations
like
that culture of attribution
and this could be a whole other talk too
around attribution
I left Facebook in the spring of
2015
and of course in 2016
there was a lot
of stuff happening at Facebook
around the 2016 presidential election
and suggestions of this concept of misinformation
that security team
put out a really detailed
write up publicly
about what had happened
from the Facebook perspective
and chose to be transparent
I think there were a lot of other platforms
that had just as much misinformation on them
but they didn't put out the reports
and so I think Facebook actually
got a lot more heat
so jumping back forward
to our case
my team did an amazing job on figuring out
who these guys were on the other side
it turns out it was two young men
one 19 and 20
the main person responsible
from my team's determination
was a kid named Brandon
who lived in Florida
and he basically
I don't want to talk about his personal life
because I don't know him
but my team got to know him really well
and really came to like him as a person
but they also really appreciated his skills
because it took a lot of effort
to track him down
and this would be an amazing talk also
but the thing that the team did
that was really great
was
you know when you have a situation
where you're trying to get attribution
what we typically do is
trigger a lot of back and forth
and then sooner or later they make a mistake
and expose something
and it could be financial
it could be IP
it could be lots of different things
and so I had to apologize
because I had said to my team
it's not enough to get an NDA signed by someone
we don't know their real name
and
so my team did the attribution work
and the way that they
exposed themselves
was when we sent the NDA
through DocuSign
they kind of
it's not so easy to use your
VPNs and TORs and stuff
in those situations
and so an IP leaked to us
some other stuff that we found on blockchain
and pretty soon
we knew where they were
and then
so we knew it was Brandon
who was the main kid behind this
this was an email from a member of my team
hey Brandon
and there were like three or four things
well first off the email was sent to Brandon's
actual real email address
which is not what he had been communicating with us
and
he said
I wish I could see it
because it's really good
so anyway
in this email
Matt said
a few different things
one of which was like
I really want to meet you and talk to you about attribution
and obfuscation
and how you work this all out
and we invited him out
to come do a talk to our whole team
at Uber
in that email
we also said in the email
one of our team is
in town to interview you
and check to make sure you've deleted the data
and
because we had figured out where in Florida he lived
and we sent
a member of our team
who was a long time
CIA interrogator
we sent him
and we met with Brandon
and he put together
a very long personality profile
and analysis of Brandon
and said basically this is a 19 year old kid
maybe he was 20 at the time
this is a 20 year old kid
who you know
he's afraid
he doesn't leave his house much
he
really likes this hacking stuff
and computer stuff
he's just gotten involved in it recently
he's trying to figure it all out
and
so we had
a couple members of my team interact with him
one had a lot of interaction with Brandon
and
we even tried to get him a job at a security company
so I think about this case
like I've given you some facts
think about it from the researcher perspective not mine
you know there's the version on the left
Uber paid 20 year old hacker
who lives with his mom to cover up massive data breaches
kind of like
one version
Nicole Pearlroth
who was a reporter at the New York Times
an excellent cyber security reporter
she did a detailed review
and published something with Mike Isaac
who had been
the main reporter for the New York Times covering Uber
and they actually
somehow got access to a bunch of the emails
between Brandon and my team
and kind of looked at it from a different perspective
and
but that didn't happen until
a few months later
and of course like the stories that come out the first week
are the ones that get read more than the ones that come up
a few weeks later
so now I'm going to
jump forward
to the trial again
and
the government presented its case
my team presented its case
I didn't testify
the jury was instructed
about a violation of
1030 which is
18 U.S.C. 1030
is kind of one of the core
anti-intrusion laws
in federal law in the United States
and one of the
fundamental thing is
did you access a computer without authorization
and so
it went to the jury
and the jury
was debating for a few days whether I was guilty
or innocent
and they sent out these two notes to the judge
the jury is allowed to send notes out to the judge
and in this case
the jury asked
could Uber give authorization
after the access
because that's the advice
if you remember the advice that the lawyer
testified he gave was we could
authorize it after the fact
I think he used some Latin phrase
nunc pro tunc during the trial
but the idea was
if somebody trespasses
in your yard and then you say
okay you're welcome
here there was no trespassing
sign but you're
and I didn't personally invite you yet
but you came in
and then I can authorize you after the fact
I've never researched the law
on that specifically but that was the advice
that I think that bounty companies
and a lot of programs have always had
because if you think about the first time a researcher
finds a vulnerability in a company
they probably haven't signed up for the bug bounty
program they probably haven't clicked through
any of those terms that could be
presented as quote unquote authorization
like that's how the companies try
and say that they gave authorization as you publish
these policies
the decision during the case
was the jury just
has to go back and read
the statute which says
a felony starts
at the time of the unauthorized access
or a felony is committed then
so the jury came back with
a guilty verdict for me
but this isn't what I'm showing you
I'm showing you a different
judgment in a criminal case
this is a judgment of
United States versus Brandon
the researcher
he
now also is convicted of a
felony as of
June of this year
so there
are lots of other different
situations I don't think I have time
to go into them but
these two researchers slash hackers
slash felons had
actually
gone and accessed other companies
in the same way and found their
vulnerabilities and contacted them as well
one of them
linked in
just
called it a breach
called in the FBI the FBI was not able to
find them
like my team was
we were actually in touch with the team at
StubHub because I think
the person on the StubHub team used to work
for me back when I was at PayPal
and they were dealing with a similar situation
they confirmed
to us that
they resolved
their situation as well
and so
from the outside it looks like they
they reached out to a bunch of companies
one company declared a
breach one paid them and
tried to explain bug body programs to them
and
others just kind of did different things
but did the
researchers slash hackers slash felons
take the data of those other companies and dump it
or monetize it
no they just deleted it actually in those cases
too because I think they were
trying to help the companies that's the way I thought about
it at the time and that's what like I'd love to
learn more about what actually happened at these other companies
so
to kind of wrap it up I think we
really need to
look at cases like
this from the perspective of the researcher and I
feel like it's hurt things a lot
from everything I've heard so
we need to get more proactive in
communication about
the realities and expectations
between the public researchers
and companies I remember
when this case blew up my
dad called me
that day in 2017
and he's like
nobody understands bug body programs
and my dad's like I think he was like
76 at the time
I was like yeah dad I know
we
we need to get better
at having like consistent shorter
policies
so that and we need to make sure like
I still don't know what the right answer
for guidance for people is on
that unauthorized access question
so like
I was talking to somebody and they said
I should put a slide into this presentation listing
20 different scenarios and ask whether
it's an authorized or unauthorized
access if it's an employee inside
the company who accidentally stumbles
on an exposed database and then
the employee goes into it is that an unauthorized
access that it's now a felony
if it's a pen
tester and they go outside
the boundaries of the contract and they find
something is that an unauthorized access
that needs to be reported if a bug bounty
person does it like
where you draw these lines
is not as clear as it should be
and I haven't seen any
I mean I don't know I don't get
cc'd on notifications to the government about
exposure but
I do often hear about them and talk to the security
leaders beforehand and they don't
feel like they have clarity on these issues
I hope that the department
of justice continues to invest in
dedicated
lawyers who understand
cyber security and that they get
all over the country and that they
that they're involved in all these cases
you know there's that one really good thing that DOJ has
is a policy that anytime
a security researcher is
to be prosecuted
by one of the districts out in the country
they're supposed to run it by the computer crime section
in Washington DC so I think that's
a good thing and I'd like to see more
stuff like that
um
the thing that bothered my team
the most was a lot of people
telling them if they'd just
done the right thing
like none of this would have happened that's not the
that's too simplistic a perspective on
these complicated dynamics
um
I want companies to be able to launch
these programs I want researchers
I want somebody to get that million dollar bounty
and so we need
to create an environment where companies
are comfortable launching these programs
more than ever
and I want to make sure we educate
young people on the right ways
to do these things
um
I wish Roots still existed as part of
DEFCON cause my daughters got to go to that
growing up and they learned a lot about
this stuff and we need to have programs
like that like when we talk about cyber education
for kids in schools and stuff like that
it should actually be teaching them about
bug bounty programs and how they could go make money
while they're in high school
cause then they'd really learn
cause they'd be motivated
so anyway
I think um
that's basically
um the stuff that I've been
thinking about we need to
really harmonize our program policies
we need to engage people we need to talk about this stuff
we need to kind of change so that my dad
doesn't have to say again
people don't understand
um so
why am I doing this talk why am I taking
risk standing up here and talking about this stuff
it's because um
I think this stuff is really important
and I think we should be looking at it from
the researcher perspective as well as everybody else
um
I since I'm on stage I want to use this opportunity
to pitch
my non-profit work for one second
uh I'm the CEO of a non-profit
I go to Ukraine and help
I originally tried to
volunteer to do cyber security work there
because when I was the CSO of Cloudflare
last year we did a lot of work to help
and so I really enjoyed that and when I left
Cloudflare at the end of last year I wanted
to stay involved turns out that
our non-profit we focused more on medical
equipment and then we started a new program in
January that I initiated
we get companies to donate their used
laptops and I bring them over
these two pictures on the right
were me delivering laptops
to kids in the Bucha region
north of Kyiv that had been
devastated in the initial days of the
invasion I was in Ukraine
last month and so these pictures
are from there on the left side was on the 4th of July
we were with some troops who just got back
from Bakhmut and we were doing
medical training on
how to use
tourniquets the right way it's the most important
thing they need to know medically
and so we were there and
if you work in a company
go find out what you do with your
used laptops and send me
a note every
laptop that I've brought to Ukraine
has become has come to
my organization because of somebody in the security
community worked to
get the people inside their company
and I can't tell you how
happy you can make a 13
year old who's doing remote
schooling on their parents
phone feel when you show
up and give them a MacBook Pro
it was like that the girl on the bottom
right and her mom we had to wait 20 minutes
to take this picture so that they could stop crying
it's like
what we take for granted you know they're
trying to live a normal life in a war zone
kids can't just like hide in a
bunker for years they need to actually
you know they had to go through COVID
there too and do remote schooling and now they're
still in remote schooling half the kids
in the country are in remote schooling and half of those
kids don't have a laptop so
the other reason I'm doing this is
because I told the judge in my
case I wrote a letter to him before my sentencing
and I said if you don't send me to prison
I will stand up and I will
talk about the things we need to do
better and I think this
is one of those things that we need to do better
so I told him I would
put my name on the list for every conference
and go and talk and
the government the prosecutors
were asking that I get 15 months
and the judge said
no thankfully
so I'm here to give this talk
but I have to live up to my commitment
to the judge that I will talk about
these things right now so thank you
for your time