127: Maddie

Key takeaways

The history of software engineering highlights the importance of disciplined software development practices after the Mariner 1 disaster.
Maddie Stone’s transitions from studying multifaceted disciplines to executing critical roles in security demonstrate the diverse pathways into cybersecurity.
Understanding and mitigating zero-day vulnerabilities is essential for defending against cyber threats, requiring ongoing vigilance and research.
Malware can disguise itself convincingly, making user education about digital security paramount.
The cybersecurity field operates as an arms race, with continuous efforts to outsmart and undermine malicious actors.

Summary

The Dawn of Software Engineering

The episode begins with a fascinating exploration of the history of software engineering, tracing back to the 1950s when NASA was pioneering space travel. Jack Ricider describes how the lack of software engineers at that time led to catastrophic events, such as the destruction of the Mariner 1 spacecraft due to a simple coding error—a missing dash in the algorithm. This incident highlighted the need for software engineering as a discipline, catalyzing the formalization of software engineering practices that we recognize today.

Meet Maddie Stone

Maddie Stone, a security researcher for Google’s Project Zero, shares her journey into the cybersecurity field. With a background in computer science and even Russian language studies, Maddie’s path took her from reverse engineering firmware and hardware at the Applied Physics Lab at Johns Hopkins to leading a team tackling Android malware at Google, specifically through reverse engineering malicious apps to protect users. Her affinity for low-level programming languages like assembly sheds light on her deep understanding of the inner workings of computer systems.

Battling Zero-Day Vulnerabilities

The essence of Maddie's work revolves around identifying zero-day vulnerabilities—critical bugs in software that are actively exploited by attackers. The discussion covers how her team at Project Zero not only detects these vulnerabilities but also develops strategies to mitigate them, working to close the gap between public knowledge of vulnerabilities and the secret techniques used by attackers. Maddie explains how public awareness can shift the tide against cyber threats.

The Realities of Malware Analysis

Maddie delves into her experiences analyzing malware, giving an insight into the types of threats she encounters. The episode shares exciting stories of malware like JinMaster that prey on unsuspecting users by disguising themselves as legitimate applications. She illustrates the meticulous process of reverse engineering malware to understand its behavior and protect users from attacks, as well as the ethical dilemmas involved when tackling nation-state threats.

The Cybersecurity Arms Race

The dialogue transitions to the broader implications of nation-state cyberattacks, emphasizing the ongoing arms race in cybersecurity. Maddie discusses how attackers seek to find, exploit, and weaponize vulnerabilities, while defenders like herself work tirelessly to patch those vulnerabilities and expose the attackers' methods. There's a philosophical undertone regarding the ethics of cybersecurity, with Maddie highlighting how her work aims to protect vulnerable populations and ensure a safer digital landscape.

Show notes

Maddie Stone is a security researcher for Google’s Project Zero. In this episode we hear what it’s like battling zero day vulnerabilities.