Cris Thomas

Cris Thomas (also known as Space Rogue) is an American cybersecurity researcher, white hat hacker, and award winning best selling author. A founding member and researcher at the high-profile hacker security think tank L0pht Heavy Industries, Thomas was one of seven L0pht members who testified before the U.S. Senate Committee on Governmental Affairs (1998) on the topic of government and homeland computer security, specifically warning of internet vulnerabilities and claiming that the group could "take down the internet within 30 minutes".

Subsequently, Thomas pursued a career in Cyber Security Research while also embracing a public advocacy role as a cyber security subject-matter expert (SME) and pundit. Granting interviews and contributing articles, Space Rogue's advocacy has served to educate and advise corporations, government, and the Public about security concerns and relative risk in the areas of election integrity, cyber terrorism, technology, the anticipation of new risks associated with society's adoption of the Internet of things, and balancing perspective (risk vs. hype).

Career

Cyber Security

A founding member of the hacker think tank L0pht Heavy Industries, Thomas was the first of L0pht's members to leave following the merger of L0pht with @Stake in 2000, and the last to reveal his true name. Thomas was one of seven L0pht members who testified before the U.S. Senate Committee on Governmental Affairs (1999). Testifying under his internet handle, Space Rogue, the testimony of Thomas and other L0pht members served to inform the government of current and future internet vulnerabilities to which federal and public channels were susceptible. The testimony marked the first time that persons not under federal witness protection were permitted to testify under assumed names.

While at the L0pht Thomas created The Whacked Mac Archives and The Hacker News Network. In addition he released at least one security advisories detailing a flaw in FWB's Hard Disk Toolkit.

Thomas continued a career in Cyber Security Research at @Stake, Guardent, Trustwave (Spiderlabs), Tenable, and IBM (X-Force Red). Selected to serve as a panelist during a 2016 Atlantic Council cyber risk discussion series, and a webinar speaker for the National Science Foundation's WATCH series, Thomas has embraced a public advocacy role as a cyber security subject-matter expert (SME) and pundit, granting interviews and contributing articles to educate the public about security concerns and relative risk. Topics include election integrity, cyber terrorism, technology, password security, the anticipation of new risks associated with society's adoption of the Internet of things, and balancing perspective (risk vs. hype).

In response to a 2016 United States Government Accountability Office report revealing the nation's nuclear weapons were under the control of computers that relied on outdated 8" floppy disks, Thomas argued that the older computers, data storage systems, programming languages, and lack of internet connectivity would make it more difficult for hackers to access the systems, effectively reducing the vulnerability of the weapon control systems to hacking.

Following cyber security mega-breaches at Target, Home Depot, and the U.S. Office of Personnel Management, Thomas advocated for proactive implementation of basic security measures as the most effective means to thwart similar mega-threats. Bluntly stating that the gap between knowledge and implementation leaves companies and individuals at unnecessary risk, Thomas’ recommendation focused on simple measures that have been known for one to two decades, but which organizations have not implemented universally. Thomas had identified retail cyber security breaches, including that at FAO Schwarz, as early as 1999.

In 2017, at the Defcon hacker conference Thomas assisted with escorting Rep. Will Hurd (R) and Rep. Jim Langevin (D) around the conference area through the various villages.

At Defcon 27 in 2019 Thomas appeared on a panel with Rep. Langevin (D-RI), Rep. Lieu (D-CA), and former Rep. Jane Harman entitled "Hacking Congress: The Enemy of My Enemy Is My Friend." During the panel Thomas was quoted as saying “It’s up to us as a community to engage with those people…to educate them”, "But Congress doesn't work that way; it doesn't work at the 'speed of hack'. If you're going to engage with it, you need to recognize this is an incremental journey” and “it takes 20 years to go from hackers in Congress to Congress at DEF CON”.

The Whacked Mac Archives

The Whacked Mac Archives was an FTP download site managed by Thomas with the world's largest collection of Apple Macintosh hacking tools. The total size of all the tools on the site was 20MB. A CD copy of the contents of the FTP site was advertised for sale in 2600: The Hacker Quarterly.

Hacker News Network

Serving as Editor-in-Chief, Thomas founded and managed L0pht's online newsletter and website, known as the Hacker News Network (or simply Hacker News or HNN). Originally created to rapidly share discoveries about computer security, Hacker News also became a forum for users to post security alerts as vulnerabilities were identified. The publication grew, eventually supporting paid advertising and an audience that included technology journalists and companies with an interest in cybersecurity. The website can be seen in several background shots of the video "Solar Sunrise: Dawn of a New Threat" produced by the National Counterintelligence Center in 1999.

After L0pht's merger with @Stake in 2000, the Responsible disclosure-focused Hacker News Network was replaced with Security News Network.

Hacker News Network, after a decade offline, set for a launch on Jan. 11, 2010, with video reports about security, the last videos were published in 2011. Hacker News Network in 2018 redirects to spacerogue.net

CyberSquirrel1 (CS1)

In 2013, Thomas created the project CyberSquirrel1 as a satirical demonstration of the relative risk of Cyberwarfare attacks on critical infrastructure elements such as the North American electrical grid. Started as a Twitter feed, the CyberSquirrel1 project expanded to include a full website and CyberSquirrel Tracking Map; as the dataset grew, Attrition.org's Brian Martin (alias “Jared E. Richo” a/k/a Jericho) joined the project in 2014. CyberSquirrel1's results disrupted public perception regarding the prevalence of nation-based hacking cyberwarfare attacks, concluding that damage due to cyberwarfare (for example, Stuxnet) was "tiny compared to the cyber-threat caused by animals", referring to electrical disruptions caused by squirrels.

An archive containing the full data set and supporting material of the project was uploaded to the Internet Archive under the Creative Commons license on January 19, 2021.

Election Security

As the 2015-2016 alleged Russian interference in the 2016 United States elections unfolded, public and media interest in hacking and hackers increased. Leading up to the 2016 election, Thomas was interviewed for mainstream media productions, including CNBC's On the Money. After the release of the Joint Analysis Report, Thomas called for expanded detail on Indicators of Compromise in Federal Joint Analysis Reports, indicating that increased transparency and IP address reporting were instrumental for enhancing security.

Prior to the 2018 election Thomas continued his advocacy speaking with CBS News and other outlets about securing our elections and the vulnerability of voting machines.

Books

In February 2023 Thomas released his first book, Space Rogue: How the Hackers Known as L0pht Changed the World. Written as a personal memoir, the book detailed his childhood growing up in Maine, how he discovered the online world of BBS’s and met the other members of the hacker collective L0pht Heavy Industries. The book covers how the L0pht released security vulnerability information, created L0phtcrack, gained media recognition, and testified in front of Congress in 1998. The book also covers the L0pht’s transition to the security consultancy @Stake, and how the L0pht’s impact still ripples throughout the information security industry today.

The book spent several weeks in the Amazon top 10 in the Computer & Technology Biographies category and briefly hit number 1. The book was a finalist in the 2023 International Book Awards. and a winner of the 2023 National Indie Excellence Awards (NIEA).

References

External links

• Cybersquirrel1 website & event tracking map
• Space Rogue (Cris Thomas) personal website

1. Cris Cyborg
2. Cris Collinsworth
3. Squirrel
4. Cris Carter
5. List of hackers
6. Electrical disruptions caused by squirrels
7. Penetration test
8. L0pht
9. @stake
10. Thomas Capano
11. Cri du chat syndrome
12. Chris Thomas
13. Next (2007 film)
14. CRIS experiment
15. Rozonda Thomas
16. Cris Crotz
17. Cris Dishman
18. Banshee
19. Chris Rock
20. Ruth's Chris Steak House