I AM NOT A BOT Episode 8: “WannaCry”

Alpha. I don’t know how to end this.

Another quote sounds like a 1/3 idea. Like you AI’ed me this morning, dad, If you do not change direction, you may end up where you are heading.

How about one more quiz question?

This cryptoworm was the biggest ransomware attack in history. It spread within days to more than 250,000 systems in 150 countries, including Russia, Ukraine, India, and Taiwan. Nissan Motors, FedEx, China National Petroleum, Renault SA, Deutsche Bahn, Hitachi, Sberbank of Russia, Yancheng police department in China, and the Russian Interior Ministry were all victims.

I pause my video recording. I think of hitting delete, but I stop myself from that extreme.

I look at your diary one last time.  I try to picture your younger self. I fail. My head is filled with more recent memories of you.

Three years ago, a cholecystectomy.

Six months later, mild cognitive impairment (MCI).

That Thanksgiving, with all of us visiting AZ for the first time. You didn’t cook. You couldn’t cook and you loved to cook.

That Monday, after we all left, Mom lost you at the mall.

Six months later, you crashed your car during a rare rainstorm in the desert. It turned out it wasn’t the rain. You passed out before you hit the highway divide.

You survived the crash. At least you did until –

-- I close my eyes to hold the tears. It works. I hit the red button.

Dad, I learned something recently that you would like. It is the Japanese learning principle of Kaizen, or the idea of continuous self-improvement. Essential to Kaizen’s success is a long-term commitment to consistent, incremental improvements that accumulate over a lifetime to create the highest quality of good.

I think of stopping the recording again like I’ve done all morning. But I stop myself from stopping myself.

I’m recording this time of my life just like you recorded your same time so many years ago. I was hoping you would be able to see it … to hear it … to know that I have changed directions. That I finally changed directions. 

The thing is I don’t know if I can make it in this new world, dad. I’ve talked to alumni of this program three, six months ahead. So many of them are back doing what they were doing before taking this class. Back to being real estate agents, sales … bartenders.

There seems to be no such thing as entry-level Cybersecurity jobs. Every zero day opportunity I’ve come across requires multiple years of experience. How that makes sense is one of the biggest unknown unknowns. 

I pause. I touch my laptop. I grab a pen. I poke myself in my forearm. Lightly, I think.

Is this real, dad? Is any of this real? I don’t know. Sometimes, I don’t know.

Oh, I forgot to mention, dad. There was this guy, Marcus Hutchins. A kid really. He stopped that high stakes attack I mentioned earlier. He found a kill switch hidden in the code. All he needed to do was register a web domain and he stopped all the bad. He stopped all the – 

-- I wanted to do that for you, dad. I wanted to find the kill switch and end all your suffering. But I couldn’t. I wanted to, but I …

… I want to do this for you, dad. I want to be a better person. I want to take a road less traveled. I wanted to pursue a dream like you did when you were my age. I want this for you, dad. I want to …

I want to cry, dad. I wannacry. I do. And I do. And I do.

And that’s how I know this is real. I think. I laugh. And I cry. I do all of those three things. Just like you’ve always taught me. That’s how I know I am alive. That’s how I know my love for you will endure. That’s how I know I will endure.

Omega.

I AM NOT A BOT Episode 5: “Alpha Omega”

The first thing my father wrote in his journal was about the Beatles song, “Ticket to Ride”.

Just told our Director of Nursing, Nancy, the truth about her favorite Beatles song. She thought that song was about what Paul and John encountered on a hitchhiking trip to Ryde, a town on the northeastern coast of the Isle of Wight.

I had to pervert her pollyannic pov with the fact that a “Ticket to Ride” is actually about hookers in Hamburg who needed to get health clearance documents from the government, which John dubbed “tickets”, in order to perform their “rides”.

I LOL’ed the first time I read this. I’m LOL’ing now upon my tenth. That’s because I do the same kind of music origin corrections all the time. Just last night at the bar, I told this backward-cap wearing Hobokenite that the Beastie Boy’s “Fight for Your Right to Party” is a parody song that actually makes fun of backward cap wearing frat boys who ironically love to throttle this song.

I probably should’ve held that reveal until after he paid his bill given his $1 FU very much of a tip.

My teacher disrupts yet another perfectly good distraction session with his review of Lockheed Martin's Cyber Kill Chain Model.

“Phase 1 is Reconnaissance.”

He goes on to talk about harvesting login credentials, email addresses, user IDs, physical locations, software applications, and operating system details, all of which may be useful in phishing or spoofing attacks.

I continue on with my own recon assignment. My mission to understand my father better via a review of his journal that he wrote when he was my age. On the surface, our situations could not be more different. He with a wife, two kids, and two careers. Me being 0 for each one of those at bats.

Between the lines, on the other hand, we could not be more alike.

Take basketball and the NBA for example. When I was a kid, my first hoops hero was Patrick Ewing of the ‘90s NY Knicks. Michael Jordan, his Airness, was my decade long disdain.

It seems my father’s had an equally tortuous love affair with Julius Irving. Now I don’t know if he liked that player because of his medical connect nickname, “Dr. J”, or simply because of his high flying act. Either way, despite his transcendence, Dr. J was also denied a ‘chip year after year by Celtic legends and Laker magic.

Though if I had a chance to sit with my dad and talk to him again like when we did so often when I was kid, I wouldn’t be asking him about musical origin stories or sports fanaticism. No. I would want to hear about those three weeks during the brutal winter of ’82 that he mentioned in his journal. That time when he and a few of his fellow 3rd shifters briefly turned to cocaine as a means to keep up with their exhausting work schedules.

Or I’d talk to him about his work boondoggle to Vegas in ’83, his first physician’s convention that just so happened to coincide with the inaugural AEE expo at the LV Convention Center. At the least, I would want to know more about the event flyer he hid in his journal with the double entendre notation, “thanks for coming”, written in lipstick red.

I stare down his book and all its one-sided conversations. I picture a few more hopeful quotes for the future he put in there.

“Just one small positive thought in the morning can change your whole day.”

That’s a tough one for me to follow these days, dad. Not with everything that’s going on. Not with you …

“Love your family, work super hard, live your passion.”

That’s an easy one to picture you saying. At the same time, I’m left wondering if you had a passion beyond helping others as a doctor? One beyond loving and caring for your family?

With all your star-crossed soliloquies here, it was clear your right brain was as charged as your left. Maybe you were writing this journal as an artistic outlet, a fulfillment of a dream you were never able to pursue.

I guess I will never know.

“Phase 2 of the Kill Chain is Weaponization. Where an attacker creates some kind of remote access malware that can exploit a known vulnerability.”

Your vulnerability was your overextension. The two jobs you needed to take on to take care of us. I don’t blame you for dabbling into coca. I did for a time because I struggled with a few double shifts. You double shifted most of your adult life. You worked for 16-18 hours a day, for almost two decades to support your family.

“The 3rd Phase is the Delivery or the launch where the attacker sends email attachments or a malicious link. In Phase 4, Exploitation, the malicious code is executed within the victim’s system.”

Your virus knew of your constant state of exhaustion. Knew it could nick away at your consciousness, your right brain, your left. To your credit, you held it at bay for decades, refusing to give in to it until your family was completely safe.

Eventually … inevitably you stroked out. Just as you were finally able to rest. Just a few years after you retired. Just a few months after you built your dream home in Arizona.

“Phase 5: Installation. This is a turning point in the attack lifecycle, as the threat actor has entered the system and can now assume control. Phase 6 is Command and Control where the attacker moves laterally throughout the network.”

Now your days … your final days … are to be spent bedridden. Mom is by your side, as always, dad, but she is struggling. She is refusing to accept the help you need. That she needs as well.

There is hope though. Help is on the way. Your daughter is coming to help. You knew that would happen. As is your older son if you can believe that. Both are coming to give mom relief and to convince her to accept the hospice care that is being offered.

I will be coming there too, as soon as I finish this course. You can wait til then, right dad? Right?

“The final phase, Phase 7: Actions on Objective. In this stage, the attacker takes steps to carry out their intended goals.”

You have to hang on, dad. We know we can’t stop what’s ailing you. But we can … we will … just not yet, dad. Hang on a little longer, ok?

I turn the video share off on Zoom. I then look longingly at my dad’s journal.

These pages. These entries. I am so happy I’ve found them. To find this little more of you. I know you can’t, but still I want to try to talk to you about them when I get there. So you hang on now.

I want to know why you stopped writing in this journal. Or any journal. And why you left this one book behind. Although I think I know.

On May 31, 1983, you wrote with the utmost joy that your beloved Dr. J did finally win a championship. After years taking care of a whole league with his years of iconic memory making on the court and years of admirable ambassadorship off the court, Dr. J finally achieved his ultimate goal.

On June 2, 1983, you talked about a day on the horizon, a day coming soon when you could retire from the police force, your second job.

On that day, you wrote, “It is never too late to be what you might have been.”

But if I recall correctly, you didn’t retire from your second job until much later. Not until the 1990s.. It’s one of my first memories I have of you, dad. Your retirement ceremony. I remember mom being so happy.

Still, I wonder. Did you ever get to spend more quality time with mom? Did you get to follow your passion? Your dream? Whatever you were talking about in ’83?

After a long pause in between entries, on September 6, 1983, you wrote your final entry. You wrote that mom revealed to you that she was pregnant with me. You said you couldn’t believe it at first, then followed with how excited you were. That you wanted to call me Julius -- or Julia if I were to be a girl.

Mom obviously won that name game battle. But, dad, you are going to win the war. If I ever have a kid, you can be damn sure Julius will be your grandchild’s name.

You just gotta … just hold on for me, dad. I can’t wait to tell you about your future grandson, Julius. Or Julia if a granddaughter.

You just … please, dad. It’s almost over.

Alpha. Omega.

I AM NOT A BOT Episode. 3: “The Birthday Paradox”

I smirk at the Brute Farce Attack online headline while waiting for my teacher to let me into today’s Zoom class,

DIVERSE CYBERSECURITY PANEL HOSTS FIVE DIFFERENT KINDS OF WHITE MEN, AND ONE PAIR OF RAINBOW SOCKS.

Seconds later, popups of true diversity appear on my screen, including various shades of African, Asian, and Latin American.

This Cybersecurity program I’m in is designed to give minorities access to advanced tech training – education being the ultimate hack into the good ol’ boy network.

The face of my father pops up in the Zoom box of my mind. Today’s version is a lot younger than usual.

When he came to America in the late 1960s, my father struggled as a medical resident, mainly because he was earning just $150 a month. To support my mom and my older sister and my older brother, he had to take a second job.

His American counterparts, on the other hand, made $1500 a month. No second jobs needed. Probably got their rainbow socks for free.

“The Birthday Paradox,” my teacher opens with, “is a study of probabilities. Sometimes an event is more likely to occur than we believe it to be.”

Our cohort started with 22 students. Four abandoned ship after the first two weeks. What is the occurrence probability of such a drop off? High, I think to myself.

“In this case, if you survey a random group of just 23 people, there is a 50–50 chance that two of them will have the same birthday.”

We try it. No luck. None of our birthdays match. Maybe because we are down to 19 Zoom boxes.

“Ok. Now everyone think of a family member. A brother. A sister. One of your parents. One of their birthdays will likely match one from --”

-- Edamame chimes in. ZaeZae’s birthday matches his wife’s.

I type into the Zoom chat that NotSoShi’s birthday is July 1st. My father’s birthday.

“The occurrence probability of a birthday match moves close to 100% if you expand the room to 100 people,” my teacher says. “From 50/50 to almost 100 with a simple expansion.”

Various heads nod in their Zoom boxes.

“There is a high probability of a match because there are a finite number of options. There are only 366 possible birthday dates, which makes it easier to find someone just like you.”

“There is no one in the world like me,” ZaeZae touts on Discord.

“And this all relates to Password Cracking how?” my teacher asks.

An awkward silence follows.

“Think of what we learned yesterday about hashing. Remember why we hash, the importance of encryption.”

Try as I might, I can’t help but mentally detach from class, as I tend to do.

I do hear something about hashing algorithms.

I do hear something about taking an input of any length and producing an output of a fixed length.

I do hear something about the birthday attack and the creation of hash collisions.

I do smile as I see that ZaeZae has typed, “Uh … huh?” into the Zoom chat.

I focus on the “huh?”, which transports me to my parents and their “huh?”

I am transported back to me. Baby me that is, wrapped in swaddling clothes. That's because I was a “huh?” A mistake. An oops. My sister is 12 years older than me. My brother 10.

I look at a baby me and cry to myself, I been done trying to find that someone in the world like me.

I smile again when I look at my head. I smile at the fact that all babies are given the same rainbow colored beenie to warm their heads at birth. A lazy attempt to connect us all.

My mind’s eye clicks on to the rainbow socks crew from this morning’s Brute Farce Attack meme. I start to think that the biggest problem in the Cybersecurity industry is related to the Birthday Paradox we are studying. The biggest problem is that you have the same finite set of good ol’ boys’ minds trying to solve an infinite number of problems in the Infosec universe. And to no one’s surprise, these limited minds are failing.

Alpha. Omega.

Cybersecurity breaches have cost American companies billions of dollars over the last few years. According to the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN), nearly $600 million was paid out by US victims of Ransomware in the first half of 2021 alone.

Black Hats, as of course they are labeled, have tapped into Uber databases and have snuck into Los Angeles’s public school district. Just the other day, there was the Southwest holiday travel debacle caused by malware. Today, that was elevated into a nation-wide shutdown of air traffic control across all airlines.

A new McKinsey research study alarms that Cyberattacks have caused $2 trillion dollars of damage in 2022.

The same finite, exclusive set of “white hats” are losing to a rainbow of adversaries who are constantly trying to think up new ways to digitally attack us with each sun is shining and each birds are chirping.

Or … are these white hats covertly trying to cash in on the $2 trillion market opportunity that is cybersecurity technology and cybersecurity service?

“I don’t know, “ ZaeZae answers out loud to another of our teacher’s questions.

There are an infinite number of questions in this ever morphing industry. The good news, however, is that there really is just one answer to them all. One solution. One way to combat all the hacks and all the bad actors we have discussed over the past few weeks.

And if you think about it, there is just one way to address all of the ‘huhs?” and all the accidental collisions and all of the purposeful paradoxes this country has hashed out on the regular.

One answer. One understanding. And that answer, that understanding is that DIVERSITY MATTERS.