Here's What Cyber War With Russia Would Actually Look Like

Tracy Alloway (0:10)

Hello, and welcome to another episode of the Odd Lots Podcast. I'm Tracy Alloway.

Joe Weisenthal (0:15)

And I'm Joe Weisenthal.

Tracy Alloway (0:17)

So Joe, clearly a lot still going on with Russia's invasion of Ukraine, but one of the big talking points in the past couple of weeks has been this idea of a retaliatory response from Russia, not necessarily in the sense of traditional warfare, but in the form of cyber warfare.

Joe Weisenthal (0:39)

Right, so this has always been a source of concern going back for several years, long before the existing conflict.

What are Russia's cyber warfare capabilities? How weak is the rest of the world? How exposed is critical infrastructure and so forth? As of now, you know, I don't think this has been a huge aspect of the current conflict. Traditional violent warfare has sort of been the story, but it is always lurking out there as a risk.

Tracy Alloway (1:10)

Yeah, there have been some rumblings of potential attacks. I saw something in Der Spiegel this morning about possibly a hack of satellites that might have been impacting Ukraine. So there are sort of rumblings of this, you know, some accusations lurking in the background, but we haven't seen anything, let's say we haven't seen anything major yet. And I feel like cyber security risks, it's one of those things that you always see people mention as a sort of left-tail risk. You see lots of analyst notes about it, but no one really talks about it in concrete terms. It always seems to be just this vague threat lurking in the background.

Joe Weisenthal (1:51)

Yes, and I think it's in part because, as you exactly say, no one precisely knows what it would look like.

I mean, obviously companies are regularly getting hacked. We've seen an increase over the years in malware and ransomware, and companies losing data, companies having to pay to bring factories and infrastructure back online. Of course, I think it was late 2020 or maybe early last year, there was that pipeline on the central part of the United States. So these things recur, but I think it's very nebulous what that risk actually looks like.

Tracy Alloway (2:25)

So today, I'm very pleased to say we are going to try to get a firmer handle on what cyber warfare risk might actually look like. And we're going to do it maybe a little bit differently to what we normally do. But today on the show, we're going to be talking to a hacker about what it actually means to do cyber warfare, to hack into someone's systems, what the threat actually looks like, and what is possible from a technological perspective.

Joe Weisenthal (2:54)

I'm really looking forward to this. Sort of different from our normal path, but of something important to learn more about.

Tracy Alloway (3:00)

Yep. So we are going to be speaking with Matt Suiche. He is the founder of Comae, an incident response startup based in Dubai, which is where I met him. And I have to say, he's definitely an expert on all of this.

Matt, welcome to the show.

Matt Suiche (3:15)

Hi, Tracy.

Thanks for inviting me. Looking forward to talking with you about what cyber warfare might look like.

Tracy Alloway (3:24)

Yeah, so you have a bit of expertise in this. I mean, not just from the hacking perspective, but there are some Russian hackers who seem to be obsessed with you. Is that right?

Matt Suiche (3:33)

Yeah, so I assume you're referring to the group called the Shadow Brokers that mentioned me like a few years back.

Tracy Alloway (3:46)

Yeah, so just for background, Matt and I met when I was working in Abu Dhabi and Dubai, and this was back when Shadow Brokers had a major attack, and there was a lot of talk about them. And they allegedly were a Russian group of hackers, and they seem to really, I don't know, just focus on you, Matt.

Matt Suiche (4:09)

Yeah, so I guess like one of the main reasons for the focus at the time was mainly due to the fact that I was analyzing a lot of the documents that they were releasing. To date, that's one of the groups that released some of the most significant documents in cybersecurity, like partly as significant as the Snowden documents to give some context for the audience.

And as part of the release, they release operational notes and exploits that belong to the US government, particularly to the NSA, which is the main intelligence agency in the US where they were exposing US intelligence capabilities.

So those documents were released. I was part of the main people who were analyzing them. And like you said, they've been mentioning me a few times. So far, the main assumption is that that group is affiliated to the Russian government. And many times, I'm sure we're going to talk about it more in details. With cyber, it's very hard to know who is doing what. Sometimes it takes years to find enough evidence.