McClure: Hacking Exposed

Security researcher-turned-executive Stuart McClure on surviving a plane crash, witnessing the Morris worm firsthand -- and hacking a college buddys password

As the United Airlines flight on which Stuart McClure was traveling with his mother and little brother began nosediving toward the Pacific Ocean after a midair explosion, a passenger sitting next to the-then college sophomore McClure said to him, Its been really good knowing you, as they covered their heads in preparation for a crash.
McClure, now 44, recalls the plane suddenly returning to a horizontal position, seeing lights on the horizon, and, then, surviving a shockingly near-perfect landing on the ground in Hawaii. A known design flaw in the Boeing 747s door-latching mechanism that the airline hadnt yet fixed had blown open the cargo door at 25,000 feet, causing the explosion and fire in two of the planes engines that ripped a massive hole in the business-class section of the aircraft and killed nine people.
United Airlines had known about it, and it was a month or two from the deadline to repair it, and they hadnt done it yet, McClure says.
Even more chilling for McClure was that he and his family had nearly moved to seats in the section where the accident had occurred, but ultimately decided to stay put. He says his brush with death has a lot to do with his incessant drive to figure out security holes and get them fixed. I cant sleep until I figure something out. I started to realize that [the crash] was a big part of it, he says, and wanted to ensure that no one would become the victim of a mistake.
McClure -- who co-authored the widely recognized and read Hacking Exposed: Network Security Secrets and Solutions book with Joel Scambray and George Kurtz, and later co-founded Foundstone, a security consulting and products company that McAfee acquired in 2004 -- a year-and-a-half ago started up security services and product firm Cylance, which, among other things, focuses on embedded systems and critical infrastructure security. Cylance researchers have pinpointed vulnerabilities in medical equipment and building automation systems, for example -- systems that have physical security ramifications as well.
Its all been leading to developing these next-generation technologies to detect good and bad algorithmically, says McClure, who is CEO and president of Cylance. We take all that is known and the experience in how they work, the techniques, and holes in defense, and then try to find the math algorithm of what is good or bad.
Stuart McClure
McClures first hack came a few years after surviving the airplane accident. He was a TA in a secure programming class at the University of Colorado in Boulder. A buddy of mine was a systems administrator for a Solaris box, and he was bragging that his Solaris box was never hit by the Morris worm ... I was no hacker [then], but was a pretty darn good programmer, he says. I knew the ins and outs of Unix, so I said, OK, are you challenging me then?
It was throwdown time. I didnt sleep for 36 hours and was able to reverse-engineer the encryption algorithm for the password on his system, McClure recalls. So I got a brute-force tool to break his password and gave him a folded-up piece of paper with his root password, apple1, as unglamorous as it was. You should have seen his face go ashen white.
McClure, who had previously done some low-level reverse-engineering of the Morris worm when it hit other servers at the university in 1988, says that password crack gave him the hacking bug. He went on to write virus detection tools early in his IT career and later co-founded Foundstone. McClure served as enterprise vice president and global CTO and general manager of the management business unit at McAfee, part of Intel, after the Foundstone acquisition.
But the red McAfee brand shield wont carry the McAfee name anymore: Intel CEO Brian Krzanich yesterday at the Computer Electronics Show announced that Intel is dropping the McAfee name and rebranding McAfee products as Intel Security products. What does former McAfee exec McClure think of the move?
McClure says he wasnt really all that surprised. The reason Intel bought McAfee, honestly, was to extend Intel into security. Its natural to have a name change, he says. And Im sure some of John McAfees activities have helped spur that along a bit, he says of the infamous McAfee founder who, in the past year, fled Belize to avoid questioning by police about a murder of one of his neighbors, as well as posted a bizarre video on YouTube criticizing his former company.
Meanwhile, McClures legacy at Foundstone includes building a product he describes as akin to an early Metasploit or Core Impact. It was [built] way ahead of Core and Metasploit. But the market just wasnt ready for it at the time. They didnt understand a vulnerability or how to exploit it, he says. We would release it a couple of years later as Vulnerability Manager.
Those were the days when white-hat researchers kept their bug finds to themselves for the most part, he says. You would keep it a few weeks so you could impress your customers when you did a pen test. Eventually, youd roll it out to Microsoft, and it would patch it a year or so later, he says.
McClures view of the traditional reactive approach to security reflects his mission to fix problems before someone or something gets hurt. He says the security industry today needs to stop waiting to see an attack before coming up with a detection mechanism: The AV industry and all signature-based technologies are flawed, he says.
PERSONALITY BYTES
Worst day ever at work:
When I was forced to lay off a team of people, despite having crushed our numbers for the quarter and year.
What McClures co-workers dont know about him:
I enjoy studying immunology -- bacteria, viruses, cancer cells, fungi, parasites, prions, etc. -- and how the bodys defenses work.
Favorite team:
Denver Broncos -- especially this year.
Favorite hangout:
My house, since I travel a lot.
In his music player right now:
Mostly R&B/pop and dance. Some explicit tracks, but dont tell anyone.
McClures security must-haves:
Encryption (PGP), two-factor authentication on everything possible, and a desktop firewall.
McClures security must-not-haves:
USB sticks, Click here to win your prize emails, antivirus (but I am not typical).
Comfort food:
Right now an Immunizer drink at Juice-it-up.
Ride:
Audi, but about to move into a hybrid.
For fun:
Long bike rides, 50 to 75 miles.
Guilty pleasure:
Real Housewives-- OC and Beverly Hills mostly-- and Vanderpump Rules. Only because they make my life look calm.
Actor who would play him in a film:
Tom Cruise
Next career:
Immunologist
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
McClure: Hacking Exposed