Chris Domas is a cybersecurity researcher working on what has become a new warfront, “cyberspace.” In this compelling talk, he shows how researchers use pattern recognition and reverse engineering (and some all-nighters) to understand a piece of binary code whose purpose and contents they don’t know. Below is his TED talk. Translated by Chryssa Rapessi and edited by Nikolao Benia.
0:11 That's a lot of ones and zeros. That's what we call binary information. That's how computers. That's how they store information. That's how computers think. That's how computers do everything that computers do. I'm a cybersecurity researcher, which means I sit with this information and I try to make sense of it, to understand what all the ones and zeros mean. Unfortunately for me, we're not just talking about the ones and zeros that I have here on the screen. We're not just talking about a few pages of ones and zeros. We're talking about billions and billions of ones and zeros, more than anyone could possibly comprehend.
0:48 Now, as exciting as this sounds, when I first started in cybersecurity -- (Laughter) -- when I first started, I wasn't sure that aces and zeros was what I wanted to do for the rest of my life, because in my mind, cybersecurity was about protecting my grandmother's computer from viruses, making sure that Myspace pages didn't get hacked, and maybe, maybe on my greatest day, protecting someone's credit card information from being stolen. Those are important things, but I didn't want to spend my life that way.
1:18 But after 30 minutes of work as a contract defense, I soon discovered that the idea I had about cybersecurity was somewhat wrong. In practice, regarding national security, protecting my grandmother's computer from viruses was very low on their priority list. Because cybersecurity is much larger than those things. Cybersecurity is an integral part of all our lives, because computers are an integral part of all our lives, even if you don't have a computer. Computers control everything in your car, from GPS to airbags. They control your phone. That's” this you can call 100 and someone will answer. They control the entire infrastructure of our country. That's why you have electricity, heating, clean water, food. Computers control our military equipment, everything from missile silos, satellites to nuclear defense networks. All this is possible because of computers, and therefore because of cyberspace, and when something goes wrong, cyberspace can make all that impossible.
2:20 But that's where I come in. A large part of my job is to protect all of this, to make it work, but sometimes, my job is to break some of it, because cybersecurity is not only about defense, it also involves offense. We are entering an era where we talk about cyber weapons. In reality, the capability for a cyber attack is so great that cyberspace is considered the new battlefield. War. It's not necessarily something bad. On one hand, it means we have a new front where we must defend ourselves, but on the other hand, we have a new method of attack, a new way to stop the bad guys from doing bad things.
2:58 Let's consider an example that is completely theoretical. Suppose a terrorist wants to blow up a building, and wants to do it again and again in the future. He doesn't want to be inside the building when it explodes. He will use a mobile phone as a remote detonator. In the past, the only way to stop the terrorist was with hail of bullets and pursuit with cars, but that is no longer necessarily true. Now we can stop him by pressing a button 1,000 kilometers away, because whether he knew it or not, as soon as he used his phone, he entered the realm of cyberspace. A well-crafted cyber attack can get into his phone, disable the overvoltage protection in its battery, dramatically overload the circuit, cause the battery to overheat and explode. We will no longer have a phone, nor a detonator, perhaps not even a terrorist, all by pressing a button. a thousand kilometers away.
3:51 How does this happen? Everything returns to the aces and zeros. Binary information makes your phone work, and if used correctly, it can make your phone explode. When you look at cyberspace from this perspective, spending your life looking at binary information begins to seem somewhat exciting.
4:10 But here's the trap: It's difficult, very difficult, and why. Think about everything you have on your phone. You have the photos you've taken. You have the music you listen to. You have the list of your contacts, your email and 500 apps you have never used in your whole life, and behind all that is the software, the code that controls your phone, and somewhere, buried in the code, there is a small piece that controls your battery, and that's what I actually want, but all that, just some ones and zeros, is all mixed up. In cyberspace, we say it's like looking for a needle in needles, because everything, more or less, looks alike. I'm looking for a key piece, but it just ties in with everything else.
4:57 Let's get out of this theoretical scenario where we make a terrorist's phone explode and let's look at something that happened to me. A little bit, whatever I do, my work starts with a lot of binary information and I always look for a key piece to do something specific. In this case, I was looking for a very advanced piece of high‑technology code that I knew I could hack, but it was buried somewhere among billions of ones and zeros. Unfortunately for me, I didn't know exactly what I was looking for. I didn't know exactly what it looked like, which makes the search very difficult. When I have to do this, what I do is look at various pieces of this binary information, try to decode each piece, and see if it's what I'm looking for. After a while, I thought I had found the piece I was looking for. I thought maybe it was that. It seemed right to me, but I wasn't sure. I didn't understand what those ones and zeros represented. So I spent a lot of time trying to clarify it, but I didn't have much luck, and eventually I decided I would finish it, I would come over a weekend, and I wouldn't leave until I discovered what it represents. And I did that. I came on a Saturday morning, and after about 10 hours, I had somehow all the pieces of the puzzle. I just didn't know how they connected. I didn't know the significance of the ones and zeros. At 15 hours, I started to have a better picture of what was there, but I had a suspicion that what I was looking at had nothing to do with what I was searching for. At 20 hours, the pieces started to connect very slowly – (Laughter) – and I was fairly sure I was walking the wrong path at that moment, but I wouldn't give up. After 30 hours in the lab, I found exactly what I was looking at, and I was right, it wasn't what I was looking for. I spent 30 hours connecting the ones and zeros that made the picture of a cat. (Laughter) I wasted 30 hours of my life looking for ” this kitten that had nothing to do with what I was trying to achieve.
6:56 I was frustrated, I was exhausted. After 30 hours in the lab, I was probably bored. But, instead of just going home and giving up, I took a step back and wondered, what went wrong here? How could I make such a stupid mistake? I'm pretty good at this. It's my job. So what happened? I thought that when you see the information at this level, it's easy to get lost in what you're doing. It's easy to miss the forest for the trees. It's easy to go down the wrong rabbit hole and waste incredible time doing something wrong. But I had this obsession. We were looking at the data in a completely wrong way from day one. That's how computers think, ones and zeros. People don't think that way, but we try to adapt our minds to think more like computers so we can understand this information. Instead of trying to fit our minds to the problem, we should make the problem fit our minds, because our brain has huge analytical capabilities for large amounts of information, just not like that. And if we could unlock the ability just by translating it into the right kind of information? With that in mind, I ran from my underground lab at work to my underground lab at home, which seem more or less the same. The main difference is that at work I'm surrounded by cyber materials, and cyberspace seems to have been the problem here. At home I'm surrounded by anything else I've ever learned. So I looked at all the books I could find, all the ideas I encountered, to see how we can translate a problem from one field into something completely different?
8:27 The biggest question was, what do we want to translate it into? What do our brains do completely naturally that we could exploit? My answer was vision. We have a huge capability to analyze visual information. We can combine color gradations, depth cues, various such signals into a coherent picture of the world around us. It's incredible. If we find a way to translate these binary patterns into visual signals, we could unlock the power of our mind to process these things. So I started looking at binary information and wondered, what do I do when I first encounter something like this? The first thing I want to do, the first question I want to answer, is, what is this? I don't care what it does, how it works. What I want to know is, what is this? And I can find it by looking at pieces, successive pieces of binary information, and I look at the relationships between those pieces. When I gather enough information for ” these sequences, I start getting an idea of what exactly this information should be. Let's return to the topic of the terrorist's phone explosion. The text in English looks like this at a binary level. So your contacts list should appear like this if I examined it. It's very difficult to analyze at this level, but if we extract those binary chunks we are trying to find, and instead ” of this translate them into a visual representation, translate those relationships, what would we get? This is how the English text appears from a visual extraction perspective. Suddenly, it shows us the same information that was in the ones and zeros but in a completely different way that we can understand instantly. We see all the patterns here immediately. It takes me seconds to spot the patterns here, but hours, days to spot them in ones and zeros. Anyone can learn in minutes what the patterns represent here, but it takes years of experience in cyberspace to learn what the same patterns represent in ones and zeros. This piece was triggered by lowercase letters followed by lowercase letters within a contacts list. These are uppercase with uppercase, uppercase with lowercase, lowercase with uppercase. This is caused by spaces. This by carriage return character. We can pass every detail of the binary information in seconds, as opposed to weeks, months, at this level. This is how an image from your mobile phone looks. But this is how it looks in a visual extraction. This is how your music looks, but the visual extraction. The most important thing for me is how the code looks on your mobile phone. That's what I'm looking for in the end, but that's the visual extraction. If I don't find it, I can't make the phone explode. I can spend weeks trying to find it among ones and zeros, but it takes me seconds to spot such a visual extraction.
11:11 One of the most remarkable pieces ” all this is that it gives us a completely new way to understand new information, things we have not seen before. So I know how English looks at a binary level, and I know how its visual extraction looks, but I have never seen Russian binary in my life. It would take me weeks just to understand what I was looking at in the raw ones and zeros, but because our brains instantly distinguish and recognize these subtle patterns within these visual extractions, we can subconsciously apply them to new situations. So Russian looks like this in a visual extraction. Because I know how a language looks, I can recognize other languages even if they are unfamiliar to me. This is how a photograph looks, and this is how a clipart looks. This is how the code looks on your phone, and this is how the code looks on your computer. Our brains distinguish these patterns in ways we could not by looking at raw ones and zeros. But we have only scratched the surface of what we can do with this approach. We have just begun unlocking the capabilities of our mind for processing visual information. If we take the same concepts and translate them into three dimensions, we will find entirely new ways to understand information. In seconds, we can distinguish every pattern here. We can see crosses related to code, cubes that have to do with text. We can even distinguish the smallest visual objects. Things that would take weeks, months to find in ones and zeros appear instantly in some kind of visual extraction and as we continue and feed it more information, we find that we are able to process billions of ones and zeros within seconds simply by using the innate ability of our brain to analyze patterns.
12:52 So it's nice and helpful, but all it tells me is what I'm looking at. Now, based on visual patterns I can find the code on the phone. But that isn't enough to blow up the battery. Then I have to find the code that controls the battery, but we return to the needle problem in the pins. The code looks like any other code in this system.
13:13 So maybe I won't find the code that controls the battery. but many things are similar to this. You have the code that controls your screen, your buttons, your microphone, and even if I don't find the code for the battery I bet I can find one of those. The next step in the binary analysis process is to look at pieces of information that are similar to each other. It is really difficult to do at a binary level, but if we translate these similarities into a visual extraction, I won't even need to look at the raw data. I only have to wait for the image to light up to see when I will be in similar pieces. I follow these threads of similarity like a path with breadcrumbs to find exactly what I'm looking for.
13:52 At this point in the process, I have identified the code that controls your battery, but it is not enough to blow up a phone. The final piece of the puzzle is to understand how this code controls your battery. For that, I need to recognize the subtle and detailed relationships within the binary information, something very difficult when you look at ones and zeros. But if we translate this information into a physical representation, we can crawl and let our visual cortex work. It can find all the detailed patterns, all the important pieces, for us. It can find exactly how the code pieces work to control the battery. All of this can be done in hours, whereas the same process in the past would have taken months.
14:38 Everything is fine and nice in a theoretical case of the terrorist's phone exploding. I wanted to find out if this would actually work in the job I do daily. I was playing with the same concepts as some data I had looked at earlier, and again, I was trying to find a very detailed, specific piece of code within a huge chunk of binary information. So I looked at it at this level, thinking I was looking at the right thing, only to see that it doesn't have the connectivity I would expect for the code I was searching for. In reality, I'm not even that sure what it is, but when I went one level back and looked at the similarities in the code I saw that it has no similarities with any code that exists out there. It can't be code. In fact, from this perspective, I could say that this wasn't code. It's a kind of image. And from here, I can see, it's not just an image, it's a photograph. Now that I know it's a photograph, I have dozens of other binary translation techniques to visualize and understand this information, so within a few seconds we can take this information, run it through dozens of other visual translation techniques to discover exactly what we are looking at. I saw – (Laughter) – it was that damned cat again. All of this is possible because we managed to find a way to translate a very difficult problem into something our brains do very naturally.
16:02 What does this mean then? For the kittens, it means they are no longer hiding in aces and zeros. For me, it means I will not have any more lost weekends. For cyberspace, it means we have a radical new way to tackle the most incredible problems. It means we have a new weapon in the evolving theater of cyberwar, but for all of us, it means that cyber engineers now have the ability to be the first responders in emergency situations. When seconds count, we have unlocked the means to stop the bad guys.
16:33 Thank you.
Source: secnews.gr
