Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Space Rogue on L0pht Heavy Industries, 90s infosec lessons and “gray hat” hacking
Guest:
Space Rogue
Published:
Updated:
Duration:
38 min
Episode summary
Hacker Cris Thomas – better known by his old bulletin board system handle Space Rogue – has witnessed the infosec community grow from a hodgepodge network of hacking collectives to a multibillion dollar industry.
Space Rogue was a member of the L0pht Heavy Industries hacker group that made its name poking holes in premier products from burgeoning tech giants like Microsoft and Oracle. Now Global Lead of Policy and Special Initiatives at IBM, he is also author of a new memoir recounting his experiences from the “magical hacker scene” of the 1990s,SpaceRogue: How the Hackers Known As L0pht Changed the World.
In the latest episode of WE’RE IN!, Space Rogue shares his side of the story from L0pht’s influential May 1998 testimony before Congress, in which the hackers warned of glaring security vulnerabilities that remain relevant to this day.
Tune in to hear more from Space Rogue on:
Tales from early meetings of the famous hacker quarterly 2600
The value of college versus certifications for anyone seeking to launch an infosec career
The fragility of the modern internet
Listen to the episode
S2 E7 · Space Rogue on L0pht Heavy Industries, 90s infosec lessons and “gray hat” hackingWE'RE IN! Podcast · 38 min
Key takeaways
Disclosure began with unfixed bugs The L0pht started publishing vulnerabilities after vendors would not fix issues members found at work, feeling a moral obligation to warn others running the same software.
The same problems persist 25 years on Topics from the 1998 testimony, including weak passwords, network configuration, GPS weaknesses, and BGP, still come up today, which Space Rogue sees as a twenty-five-year government lag.
Entry-level jobs are competitive IBM X-Force Red gets well over a thousand resumes for about 10 intern slots. The worker shortage mostly applies to mid-level and senior roles.
Stand out with extracurricular work Competitions like CPTC, CCDC, and CyberPatriot, bug bounties, capture the flags, BSides volunteering, and home labs set a resume apart from others with the same degree or certification.
Online sources disappear Researching the book through search, Space Rogue found many articles and publications from the era completely gone, and he lost his old L0pht email when he was fired from @stake.
Topics covered
Cyber in the Boardroom
Pentesting
Thought Leadership
Notable quotes
…we have a moral obligation now to tell other people about these problems because other people are running the same software…
So we ended up with four or five different ways to do what we claimed to do with just one. We're like, Wow, this is all bubblegum and baling twine. It really, really is fragile.
We were there 25 ago, and we're still seeing a lot of the same problems today. So there's a twenty five year lag there at least.
It's both amazing how much stuff is still there and how much stuff is gone, just completely gone.
Questions this episode answers
Where does the name Space Rogue come from?
He picked it for a bulletin board that required a new handle, free associating from cyberspace after seeing Katie Hafner's book Cyberpunk. He only later found a game called Space Rogue, so the name did not come from the game. Read this section
What did the L0pht tell Congress in 1998?
They discussed network configuration, weak passwords, GPS weaknesses, and cascading vulnerabilities. The famous sound bite was Mudge saying any one of them could take down the internet in thirty minutes, based on a BGP vulnerability that was already patched. Read this section
How can I break into the cybersecurity industry?
Space Rogue recommends getting a degree if you can and certifications if you cannot, but stresses adding extras such as competitions, bug bounties, CTFs, volunteering, and home lab work to stand out. Read this section
Did the L0pht coin the term gray hat?
No. Space Rogue said the term is sometimes attributed to the L0pht and they used it a lot, but someone else created it. Read this section
Why did the L0pht start the Hacker News Network?
The L0pht did not want banner ads on its own site, so Space Rogue created a separate news site with ads, built from news links he had been emailing to members. It eventually paid the electric bill. Read this section
About the guest
Space Rogue, whose given name is Cris Thomas, was a member of the L0pht Heavy Industries hacker collective and one of the L0pht members who testified before the US Senate in May 1998. He founded the Hacker News Network and has worked at companies including @stake, Tenable, Trustwave, and IBM, where the feed describes him as Global Lead of Policy and Special Initiatives at the time of recording. He is the author of the memoir Space Rogue: How the Hackers Known As L0pht Changed the World.
in. And welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm Blake Sobczak, and I am so excited to be joined today by Chris Thomas, better known as Space Rogue. No. He's not a Guardians of the Galaxy movie star, but he is famous in hacker circles for being a founding member of the L0pht Heavy Industries hacking collective in the early nineteen nineties. That's L0pht with a zero. Chalk it up to hacker speak. Members of L0pht were invited to testify before congress in 1998. The group left a major mark on the cybersecurity industry and on technology titans ranging from Microsoft to IBM. I won't spoil the full story because Space Rogue has it all written out for us. He's the author of the newly released book, How the Hackers Known as L0pht Changed the World. Before we jump into some riveting hacker history, here's a quick word from our sponsor, Synack.
Attackers scan your systems daily. You just don't get the report. Synack's security testing platform stands out by drawing on a trusted network of global security researchers. From web apps to headless APIs, our platform helps you find and fix gaps in your security posture. Learn more at synack.com. That's synack.com.
Thank you so much for joining us on the program Space Rogue. Really appreciate having you here, and I wanted to jump right into it. First question I'm sure is top of mind for many of our listeners. What's in a name? Where does the name Space Rogue come from?
If I had known I would be using Space Rogue for thirty plus years, I probably would have chosen something a little different. It has some interesting parts to it. I was just looking for a new name, a new handle to log into a bulletin board system, a dial up system. And on this particular system, it requested that you use a handle that you have not used before. The idea being that nobody would bring the luggage or the baggage that they carry with their old handles to this new bulletin board and nobody would know who anybody else was. A good idea in theory doesn't work out that well in practice because once you read people's typing you tend to figure out who's who pretty quickly. Anyway, I needed a new handle and so I was like trying to figure something out and free associating with names and stuff that were in my room or general vicinity at the time, and one of the books that I was reading was Katie Hafner's Cyberpunk.
Not a book I recommend, but I was like, Oh, maybe that's a good name. I was like, Oh, wait, cyber's a bad word. Unlike today where everything is cyber back then cyber was a very bad word, but I started free associating with that and I hit on cyberspace and I was like, Oh, space. Yeah. Oh, space rogue. And so I kind of picked that and went with it. And it wasn't until years later when I'm at the local corner or computer store digging through the discount software bin when I find the game Space Rogue, and I'm like, this is not good. But even by that point, I had already developed a persona around that handle and it wasn't really conducive to changing. So I stuck with it and kept it. And it was fine because nobody remembered the game. It was totally irrelevant. Nobody played it. It was a one hit wonder, so to speak, until Steam comes along and puts it on Steam, and then everybody's playing it.
I did buy the version that I found at the computer store on the corner, but I don't do Steam, so I don't have the version on Steam. And I think the version I bought was for Apple II, and I didn't even own an Apple two at the time. I don't think I've ever actually played the game. But I have it somewhere on my shelf somewhere here.
Well, mentioned actually in recounting that story, notion of a BBS and in your book, How the Hackers Known as L0pht Changed the World, you talk a lot about some of the early BBS files and having this sort of aura or mystique of forbidden knowledge. I guess for those of us who had to Google what BBS was, what can you share about hacking's early days and what that is?
Yeah, I mean, everything was bullet board systems, right? You would use your phone and a modem and a personal computer and the computer would connect to the modem and connect that on the phone lines. You dial a number and it would connect to another modem, which would connect to another computer on the other end. It was one computer to one computer. And so you would interact with that software on the other computer and you would read messages left by other people and you would post your own messages and people would write files or text files or T files and try to share knowledge that way through these files. Of course, the source was always questionable. You didn't know where it came from or who wrote it. And it was on various different topics, whatever anybody felt like writing about that day. And and, it was forbidden knowledge because a lot of times the bulletin boards would have secret sections or hidden areas that only certain people were allowed into. And you're like, oh, I wonder if this board has one of those.
I wonder if I'm cool enough to get into that area or elite enough as the as the term we used. And then when you found some of this information, especially technical information for me, it wasn't like you could go to the library and look this up because it it... The libraries didn't have this stuff. And so this was really the only source of that information. So for me it was really forbidden knowledge, very special wizard type stuff that you would find, and you can only find it on bullet board systems.
I would just download tons of stuff. I still have some of those files on my hard drive, information on all kinds of different things. And some... A lot of times, the stuff was boring, uninteresting, totally written by crack pots who who had no knowledge of what they were really writing about or poorly written to the point where it was unreadable. But every now and then, you would find a nugget, right? One piece that you could really sink your teeth into was like, oh my goodness, this is really, really interesting. Wow. And it would be eye opening and mind blowing and you'd try to dig deeper. And like you mentioned, there was no Google, there was no AltaVista. Mean, there was no internet really that was accessible to regular people. At that point, the internet did exist, but it was mostly academics and defense contractors. And it wasn't even until a few years later that commercial entities started to get access to the internet.
That's really interesting. And I know there were some early meetings hosted, I guess, by the hacker magazine 2600 named after the long distance telephone signaling frequency of 2,600 Hertz. And, you know, the the BBS, that whole system reminds me of the early connection between your phone line and your access to this wider knowledge base. I guess, what were those meetings like with the the early 2600 crew?
Well, in Boston, physical meetings really started with a board called The Works, run by Jason Scott, who now works for the Internet Archive. And he wasn't the first CISO of The Works. It's just he was there when I was there, so I associate him with that. And so The Works had these things called gatherings on an ad hoc semi regular basis. And Works gatherings eventually morphed into 2,600 meetings. And 2,600, as you mentioned, the 2600 magazine, and their name is pulled from that frequency they used in the telephone switching system. And so 2,600 meetings were a chance to actually meet the people that you were interacting with on bulletin board systems, and you would meet them in person. And it was all kind of very surreal. Like you've read everything this person's written and you sort of think you know them, but you've never really met them. Nowadays we take this sort of thing for granted because this is a lot of interaction we have with people online with Facebook and Twitter, Instagram, other social media, where we sort of interact with people who we've never met and we feel like we know them.
But in the mid-90s, early 90s, this was new thing and everybody was kind of a little hesitant to sort of release or reveal a lot of personal information about each other. And so we'd often still use the handles even when we're talking to each other face to face and in person. And in Boston, we would meet in Harvard Square and then eventually it moved to the Prudential Center after they opened the new Prudential Center in Boston, and they had a big food court there. And so in the summertime, we'd be out on the patio, and then in the wintertime, we'd go inside where it was warm and sort of huddle in one corner of this big, huge monstrous food court.
So tell me a little bit more about the development of L0pht. It was really fascinating to read about how it developed around that physical space. You mentioned these meetups and how hardware hacking was such an important component of the group's growth. And I'm wondering, how how would you describe that dynamism and the early development of this of this now legendary, of course, hacking collective?
It was really, I think, Brian Oblivion who sort of grabbed everybody together. Brian and count zero were living in South Boston, and their apartments were full of computers. And there was a old warehouse building right around the corner, and it was easy to sort of rent a space in this warehouse building that had been turned into a loft, sort of artists lofts, right? So there's other people painting and sculptors and woodworkers and whatnot in the building. And so this space came available and they're like, you know what, we'll rent this space. We'll just put all our computer stuff in there. And so Brian sort of grabs everybody else to sort of join them, myself, Weld Pond, Kingpin. And he only, Brian pretty much only picked people who he had called to his BBS and that he had met in person. So it was rather specific criteria to sort of get invited, if you will.
Granted, you also had to be able to afford your part of the rent, because we split everything to pay the rent and the electric and the phone bill. At the beginning, it was really just a storage space, right? We want a place to put all this stuff, all these computers that we've collected over the years. And then once we had all the stuff in the physical space, we started plugging it in and networking it. We're like, you know, maybe we should play some Doom or something. And so we played games and eventually the Internet was starting to grow at the same time. We're like, well, we want a network connection. We need a network connection. Let's get a dial up modem and we'll make a connection. And we're like, well, now we have an Internet connection, let's put up a website. And so l0pht.com became one of the first 10,000 websites on the internet. And it was different from almost every other website out there because every other website was a university or a research center or a government contractor. There weren't a lot of other entities that weren't those on the internet.
Well, I think in the early days, we were all just kind of doing our own thing. I started to put together something called the Whack Mac archives, which had a collection of Mac hacking software. Brian was working on porting his bulletin board, his T files, his text files from his old bulletin board system onto the l0pht.com website. Kingpin was busy tinkering with different hardware pieces. Count zero was doing his thing. White Knight and Gogo thirteen were doing their things. Weld comes in and he's messing around. Everybody's doing their own thing. And it wasn't until, know, probably a year or two after we're sort of there, and we're already getting media attention when we realized... Or I wouldn't say we realized, it wasn't like a conscious decision. We started posting things to our website, security vulnerabilities, things that we had found at our job that we were trying to get fixed. And for whatever reason, the companies we were dealing with wouldn't fix them.
And so we're like, all right, well we have a moral obligation now to tell other people about these problems because other people are running the same software, has the same vulnerabilities for them, they need to be aware so that they can protect themselves. And so we would publish these vulnerabilities on our website, and that's sort of when the whole security thing sort of starts taking off for us, and people start getting more and more attention through publishing of these vulnerabilities. And then it sort of snowballs from there.
Right. And I know, I mean, it's still controversial, right? I mean, in those days, was just starting out of publishing vulnerabilities, how to navigate this notion of radical transparency of trying to get things fixed. You know, you might come at it from a well meaning perspective, but then turn around and get hit by threats or lawsuits or whatnot. Now, I noticed that renowned cyber anthropologist, Biella Coleman, actually helped with some aspects of this book and reviewing it, it sounds like. But one thing that I found really interesting about some of her analyses of how cybersecurity cybersecurity shifted from this sort of underground, again, radical transparency, sharing this information, I'll call it Gray Hat, I know people call it different things, model into this hugely profitable industry that's still booming to this day. And you were really on the front lines of that transition. So I guess, what was like that shift? Is there a moment that sticks out where it was like, okay, we're onto something really big here that's more than even just our bulletin board systems?
Yeah, so first to comment, I mean, Biella Coleman did some excellent research in that area. And I think I was one of her many, many sources there. And she helped proofread the book and added some insight to the book as well. So that was very much thanks to Bella for assisting there. And as you mentioned, we were on the forefront of this whole disclosure debate, right? We weren't really sure. There was no responsible disclosure. There was no full disclosure. There was no, there was just you do what you do. We didn't have a name. And shortly after we started releasing things and that debate started to come about, a person named Rain Forest Puppy released the first vulnerability disclosure policy that the industry started to notice. And then responsible disclosure came about, and we realized, well, if there's responsible disclosure, is everything else irresponsible?
And we didn't like that. I say we in a very large Reckless disclosure. Yeah, reckless disclosure. People came up with coordinated disclosure, which was a little bit better term, but it kind of meant the same thing. And you mentioned the term Gray Hat, which is a term that is sometimes attributed to the L0pht of coining, but we didn't coin it. We did use it a lot. We definitely found ourselves in that sort of middle area, but it's not a term that was attributed directly to us. Someone else actually created the term. And now I'm rambling and I forgot the original question.
I think you answered it well in the sense that this is really about creating something out of nothing when it comes to vulnerability disclosure, right? And it sounds like the way you were doing it was just to do it and just here they are then figure out what happens next, which is, hey, that's one way to handle it.
when we later on, many years later, when we finally get the venture capital from @stake, we were very concerned that we would get labeled as like sellouts or something. And we did. We had a lot of large voices in the community kind of saying, oh, L0pht sold out. They took the money and this is the end of that, which, well, it was the end of that, but that wasn't really the case. It was interesting to see that dichotomy happen where there were a lot of security people in the industry trying to get a piece of that venture capital pie in the early 2000s, late 199s, and some people who resisted and other people who welcomed that. Definitely an interesting period in history.
Yeah, there are parallels. There's a lot of companies. I mean, I actually give a talk sometimes to some of the interns at IBM and X Force about the history of the information security industry. I have a slide in that talk that's basically a NASCAR shot. If you ever built slide decks, you're familiar with a NASCAR slide with logos all over it. And it's basically every security company I could find that was founded in 1999 or early two thousand. It was 18 companies, right? All within that one year period, almost none of which anybody remembers today. And it's similar today. Like there's a ton of startups out there pitching security products or services or new ways of doing things. And a lot of them, you're never going to hear about again. And a lot of them will get bought and a lot of them will flame out and crash and burn. And that's, I think, just the nature of the startup economy, the startup ecosystem. And so in that case, looking at it that way, there's definitely a lot of similarities.
You mentioned briefing some IBM interns, you know, you've worked at various companies, Tenable, Trustwave. What would your career tips be for any of our listeners who may be trying to break into this industry?
That's interesting because the industry when I started is completely different than it is today. So today you can go to a very reputable, well known school and get a degree in cyber. You could barely get a computer degree in the mid nineties. Security degrees definitely did not exist at all, let alone a cyber degree. I mean, they used to be called Infosec degrees and now they're cyber. Everybody wants a cyber degree. But tips and tricks for somebody that's coming up and trying to break into the industry. I know this is still a big argument against or for and against college versus certifications. I try to recommend both. If you can go to college, go to college. Why? Because it's going to make your life a lot easier. There are ways to do it cheaply and inexpensively if you can't afford a high level school, but try to get a degree.
If you can't, then yeah, go get the certs. Regardless of which avenue you pick, the big key thing is trying to get a large number of things to put on the resume. Don't just go get a degree and think, Oh, I'm going get a job. And listen to all the hype about the shortage of workers. That only applies, that shortage of workers really only applies to mid level and senior people. There are a ton of entry level people. For example, we have 10 slots for our IBM X Force Red Intern slip every year. It varies one or two, either way, depending on budget and whatnot, but we have roughly about 10. We get well over a thousand resumes for those 10 slots. Wow. That gives you a one in a 100 chance of getting selected. You've really got to stand out on your resume to get noticed. And the way to do that is by having additional extracurricular things on your resume.
Things like competitions, say, CPTC, CCDC, Cyber Patriot, things like bug bounties, things like capture the flags, volunteering. If volunteer at a BSides conference, put that on your resume. If you have a home lab where you're putting stuff together in your home lab for security, put that on your resume. All those little things are things that when we look at resumes, stand out to us and we're like, okay, we know this person's going to the school and they're getting that degree. They're the same as everybody else. What else do they have that sets them apart? And it's pretty much the same as in any industry, right? You want to be a little bit different. And if you're going the cert route, same thing. Get the certs, add in more stuff other than just the certification. If you volunteer at your local church and help them set up their Wi Fi and implement WPA, put that on a resume. There's no limit to what you can put on, and the more you put on, the easier chance or better chance you're going to have of landing that position.
Well, I did wanna talk about that because you devote a section of the book to this, you know, to L0pht members, really groundbreaking congressional testimony back in 1998. It's become quite a well known little facet of hacker history. And I shouldn't even say little because it obviously did have quite an impact. And I'm wondering for listeners unfamiliar with that episode, if you can kinda walk through the impact that that moment had and what it was like being there to testify on something that the world didn't really understand just yet.
Yeah, it was really... It was interesting. I mean, we got approached to to testify and how that came about is up for debate. But the... Senator Thompson's office reached out to us and said, Hey, we're releasing some reports. We want to get somebody in to generate some press around these reports, and we think he'd be a perfect point for that. And so we're like, Yeah, that sounds like a good idea. We'll come down, but we have to do it under our handles. We're not ready to reveal the given names yet. So for some reason they agreed to that. I don't know why or how that came about, but they agreed to let us testify under our handles. So we go down to DC and we didn't tell anybody we were going to go down beforehand, because we didn't really know what to expect or what was gonna happen. A lot of people think we were the first hackers to testify in front of Congress, and that's actually not true. Emmanuel Goldstein of 2,600 magazine was first, before him, Susan Thunder, if you know her at all, she was there.
But Emmanuel Goldstein didn't have a very good time. He was basically labeled a criminal in front of, you know, while he's sitting there trying to testify. And and so we didn't know what to expect. We like once you get in the room, like, they can say anything they want, and there's not much you can do about it. So we didn't tell anybody before we went down, and we figured we'd wait until after. And we're like, if it goes good, we'll we'll say something. And if it doesn't go good, then we'll just keep quiet and pretend it didn't happen. Thankfully, it went well, and the senators were very appreciative and very friendly and asked a lot of great pointed questions. The video of the testimony is up on YouTube, so if you're still interested, you can watch it. It's interesting, And I still get these comments now. It's interesting how many of the topics that came up twenty five years ago, it's the twenty five year anniversary of this May. How many of those topics are still relevant and still an issue today?
The impact that that had, I think is what the other part of your question was, was I don't think I realized how important it was then or how important it has been over time. And I definitely didn't think I was going be talking about it twenty five years later or write a book about it.
Network configuration, weak passwords, weaknesses in GPS, for example. I remember Senator Glenn was very concerned about that as a pilot. And so we talked a lot about that. We talked about cascading vulnerabilities that can travel from one to the other. I mean, that was the big, the thirty second sound bite that came out of the testimony was Mudge announcing that any one of us could take down the Internet in thirty minutes. It was a vulnerability in BGP, Border Gateway Protocol, which had already been patched by the time of our testimony. But the fact that even now, probably about once a year, we have this major issue with BGP still. And so it's just interesting that you still have to see the same issues come up over and over again.
Interesting story. After the testimony, people would come up to us and they'd be like, Hey, so this take down the Internet thing in thirty minutes. Were you guys talking about this thing where you do XYZ and this other thing? We're like, No, that's not what we were talking about at all. But that would work. So we ended up with four or five different ways to do what we claimed to do with just one. We're like, Wow, this is all bubblegum and baling twine. It really, really is fragile.
Well, remember the Log4j vulnerability. One of my favorite headlines to emerge from that was just, the internet is on fire. And it does feel like we periodically get these big moments that just shake everybody to their core and really rattle something that we've just as a society grown so dependent upon. But so I guess thinking about covering events that happened a fairly long time ago, when you're so vividly describing specific scenes in the book, I guess, how did you do that? Did you get like, did you use sort of the shared memory of the L0pht collective or, you know, where did you tap into those memories?
So a couple of things. I did not actually consult any other L0pht members when I was writing the book for a couple of reasons. One, I wrote it as a memoir, so it was my memory of the events. And so I didn't want to pollute my memory with other people's memories. And two, I wasn't sure how everybody else would feel about me writing a book. And I wasn't sure if that was going to be a positive response or not. And so since I wasn't clear, I'd be like, you know what, I'm not going to poke the bear, I'm just going to do it. And then we'll see if they can be upset about it later. So I went ahead and wrote the book that way. I think the big thing was that I did not have access to my old mail spool. So when I was fired from @stake, by the time I got home from the office that day, my l0pht.com mail was gone. I didn't have access to it. It was a rude awakening because I didn't think that, you know, I sort of understood.
When you leave a job, they kill your email. But l0pht.com was separate from @stake.com. And so I was thinking I would still... But no. As soon as I got home, boom. Everything was shut off. And I've never been able to get that mail back. So when I was writing the book, I wasn't even able to refer to my old mail. And basically I only had whatever files I had left over in Google. So most of the footnotes in the book, like all a 100 of them are all me trying desperately to find stuff via Google. And it's amazing. It's both amazing how much stuff is still there and how much stuff is gone, just completely gone. And like, I remember this article, I know it existed. I'm allowed to look for it. It's gotta be here somewhere and it's gone. Like it just does not exist. The publication's gone. The person who bought the, the company that bought the publication is gone. I remember I was trying to find, I wanted to use a picture from the cover of an EE Times magazine and I could not find anybody who still had that picture on file anywhere.
I contacted the photographer, I got ahold of him, but he's like, yeah, I don't own the copyright. They bought the picture. I can't give you permission. So was a great picture of all of us on the cover of EE Times that I think would have been great in the book, and I I couldn't get the rights to it, so I couldn't use it, which also is why the cover is the way it is. There's a very famous picture of the seven of us testifying in congress, a picture that we often refer to as the loft supper. The loft in the middle, the long hair.
And it's got all seven of us across the big. Oh, So I was gonna... I really wanted to use that picture on the cover. I went to the the the online site that has it and I found it, that they wanted $1,500 to put it on the cover of the book. I'm like, I don't even know if I'm going sell that many copies. I can't afford $1,500 for one picture. And so I'm telling my book designer this, and I'm like, you know, this is my idea for the cover, but I can't use the picture. So dunno I what else you can come up with. Well, I can just take the picture and make it a line drawing. I'm like, okay. And I actually think it works much better than the actual photo. So that's why the cover is the way it is.
Hey, you know what? Make do with what you got, work around it, figure it out. And now you got a great cover. Now, it's interesting you mentioned digging up old articles. You've described the press as kind of this double edged sword in the book. And I could certainly relate to that having come from a journalism background myself. Recounted some negative moments, obviously with MTV in particular, kind of doing maybe what some would classify as a hit piece to some extent, or at least a nonsense piece. I'd just be curious as a former cyber editor and reporter myself, and you're working on on our readme.security cybersecurity publication here at Synack. What's your experience been like building out this hacker news network, which are the voice of reason as you describe it in the hacking community in the early two thousands? What was that like?
Hacker News Network came about because l0pht.com was getting a ton of traffic. It was one of the early first websites on the internet, getting tons and tons of traffic. And we're looking around the internet, we're seeing a lot people getting rich off banner ads. And we're like, geez, it'd be really great to get some of that money to pay our electric bill, put a banner ad up on l0pht.com. Would be awesome. And but we're also like, well, you know, then we're we're beholden to the advertising behemoth. Right? We don't want that to influence our voice or or be beholden to that in any way. So we didn't put any ads up on l0pht.com. And so I'm sitting here racking my brain trying to figure out, well, how can we still get a piece of this little pie? And I'm like, well, why don't we just create a different website and we'll put ads on that? And so I had been collecting news links anyway and sharing them via email to anybody in the loft. And I went to one of our loft meetings one week and we had meetings every week and I'm like, hey, here's an idea.
I'm gonna create a new website. I'm going to put this email that I'm sending you guys up on the website every day and we'll get tons of hits and we'll make tons of money. And they all kind of laugh at me. I mean, they didn't actually laugh, but I could tell they were like, Yeah. Right. Space Rogue has got another crazy idea. And I'm like, know, domain name's only $15 or whatever it was. Was like, it's probably 35 at the time. So we'll spend $35. We'll make Space Rogue happy, he can go play on his his website. So we did that, and I started posting the news up every day. And it took a while. It took like a year, year and a half, but it started to get really popular to the point where it was actually paying the electric bill from the banner ads and the T shirt sales. I would just... Every day I would I would gather news sources, write a little blurb, put a headline on it, write up the HTML by hand and post it every morning, trying to get it out by 9AM in the morning. So I'm getting up early in the morning, driving to the loft, researching the news for three hours, and then writing the HTML and posting it.
So it did that for a couple of years until @stake bought it, until we became part of @stake. And @stake didn't really know what to do with HNN. They're like, this is not part of our core business. We don't really know what to do with it. And so I'm writing up I wrote up a business plan for HNN. I'm like, with a little bit of investment or a real webmaster, we can make this much money in a year, blah, blah, they're like, well, that's not... That's small potatoes. I'm like, do mean it's small potatoes? It's a it's a it's a lot of money. And like, yeah, but we want millions of not thousands. I'm like, whatever, hundreds of thousands pays my salary. Like, what the hell? You know, after I got fired, they kind of shut down HNN rather quickly because it was just sucking resources and they didn't see the vision. And so several years later, Tan from the loft, he calls me up and he's like, Dude. And I'm like, Dude. And he's, We need to do HNN again. And I'm like, No, we don't. Yeah, yeah, yeah.
YouTube was starting to be big, but YouTube had a ten minute limit, for anybody who remembers early YouTube. And I was producing a twenty minute show. I don't know how Tan convinced me to do this, but I borrowed a video camera from work, filmed a pilot episode, I'm like, yeah, this is... Yeah, yeah, this should bring back some memories. Let let me get into this. So we did the video, but I couldn't host it on YouTube because of their ten minute limit. So we're over on a hoster called Blip TV. And after two years of that, I was just, I was putting forty hours, fifty hours a week into making this video, which anybody who's done a podcast before, especially a scripted one, knows how much work that sort of thing is. And I'm still trying to do a forty hour a week job on top of that. And I'm just like burnt out. I can't do it anymore. So I'm just like, alright, this has got to end. And so it was rather abrupt ending, boom, over. And I think like three months later, YouTube lists their 10 limit. If I just held on for a few more minutes, I would have been able to ride that YouTube wave and have a million subscribers now and have a play button on the wall.
Hey, it's not too late. It's not too late to get on the YouTube train. All you gotta do is have somebody to make some really catchy thumbnails with like your eyes big and your expressions exaggerated. Yeah, exactly. With like three cool tips from Space Rogue.
That's right. That's right. Actually, yeah, maybe we can work with that. We're talking, we're onto something. So, but looking ahead for a minute, aside from YouTube plans, which now I'm glad that we're holding you to that. I know you're still on the cutting edge of cyber trends and analysis over at IBM. One quote from the book really caught my eye as being a little alarming, which is that quote, Hackers no longer explore networks and computer systems from parents' basements, if they ever did. Now it is often about purposeful destruction at the bequest of governments. That purposeful destruction line certainly jolted me awake. What do you see as the biggest threats facing us today?
The Internet has become a major tool in international relations, both pro and con. And, you know, you only have to look at the current conflict in Ukraine to see that on both sides. I think Ukraine just announced a measure or an effort to legalize their civilian cyber hacker army in the last few days. And and Russia, of course, has been attacking their critical infrastructure for years, taking out the power in Ukraine and and launching other critical crippling attacks. We look at Saudi Aramco attack. We look at the the Sony attack. These are all a government sponsored event taking place on the internet to further the goals of international relations, whatever those relations tend to be. And so, I don't know if I would classify all of that as a threat to the internet. It's become a tool used for those purposes, just like other tools.
But it's definitely a far cry from where we started twenty five years ago or thirty years ago or earlier, where we were upset that somebody was putting an ad for a green card on a Usenet posting. And and to look at that and and the the furor that happened over that versus what's happening on the Internet today is definitely a major difference between the two.
I'd be curious to hear your thoughts on some of the Biden administration's actions recently, especially, you know, hearkening back to your early congressional testimony and whatnot, you know, from the Cybersecurity and Infrastructure Security Agency to the new National Cybersecurity Strategy. Where do you see us going from a policy perspective?
But they're doing, actually seem to be resonating with small business and big business and even individuals and getting the message out and being able to communicate that message appropriately so that people are actually paying attention and listening and not sounding tone deaf or out of touch or totally not with it as most government cyber messages tend to be or have been in the past. So CISA is really, I think, taking a step forward there and advancing Biden administration's agenda in regards to cyber. Now speaking of which, the Biden administration has recently released some new cyber guidelines, which I haven't really delved into a lot yet. But what I've heard so far, I'd like. It definitely seems to be some steps in the right direction, and hopefully it will continue to be so. I know the government has tended to lag behind when it comes to cyber.
I mean, it's... We were there 25 ago, and we're still seeing a lot of the same problems today. So there's a twenty five year lag there at least. Right? And we've had a couple of administrations over that time frame just kinda punt the ball down the road and be like, yeah. Well, you know, we'll let somebody else deal with it. Well, now it's down the road, and I... I'm glad to see Biden doing something. And from what I've seen so far, most of it seems to be in the positive direction and help furthering security as a whole.
That's great. Well, really appreciate you coming on the show. The book is really interesting. Definitely some fascinating windows into some of the early interactions there. So finally, wanted to ask you something we ask all of our guests here on WE'RE IN, which is what's something we wouldn't know about you, Space Rogue, just by looking at your LinkedIn profile?
Well, there's not a whole lot on my LinkedIn profile. I will say that it's still, if you're just looking at my LinkedIn profile, you might not know my real name. My given name is not on there, which I'm kind of curious how long it's going to stay up because there's supposedly this effort at LinkedIn underway. Maybe I shouldn't say anything to get rid of fake profiles. My profile's real. It's just under Space Rogue. It's not under my given name, Chris Thomas.
But, yeah, there isn't actually a whole lot on my LinkedIn profile. You might not know, like there's some early jobs like I used to work at Burger King, you wouldn't have that. That's not on there. I used to work the drive through at Burger King late at night.
Well, no nowhere to go to get a get a Whopper. Well, thanks again Space Rogue for joining us. This was a really great conversation. Definitely encourage our listeners to check out the book, How the Hackers, known as L0pht, changed the world. And that's L0pht, L zero P H T, by the way, not just any L0pht. So thanks again, and hope the book tour goes well.
Heard it here first. All right, thanks so much. If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little Infosec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
