Goa 2018:- Keynote by Haroon Meer

### Overview In his keynote address at Nullcon Goa 2018, Haroon Meer (founder of Thinkst and creator of Thinkst Canary) reflects on his career across offensive security, defensive engineering, and product development. Drawing heavily on Richard Hamming’s classic essay and talk *You and Your Research*, as well as observations from Dan Geer and Brian Snow, Meer delivers advice directed at both young and experienced security professionals. He challenges the cybersecurity community to stop chasing passive distractions and instead tackle significant, enduring problems, urging practitioners—particularly offensive researchers—to embrace blue-team defense and product development.

### Key Topics - **Distractions in InfoSec and Passive Learning:** The security industry is easily distracted by constant novelty and conference culture, which can turn into passive entertainment ("potato chips for your mind") rather than active learning and substantive problem-solving. Meer notes that aiming simply to be a conference speaker is an empty pursuit. - **The Current Stagnation of Defense:** Despite millions spent, typical enterprise defense remains fragile. Meer references two heuristics: lateral movement in many organizations remains as easy as it was in 2003, and most organizations are only zero to one 0-days away from catastrophe. - **Shifting from Red Team to Blue Team:** Breaking into networks has become relatively routine, and offensive techniques like social engineering are often overly easy rather than challenging. In contrast, defensive problems (such as local admin passwords or two-factor authentication) offer massive research opportunities and commercial potential (e.g., Duo Security). - **Avoiding Utopian Thinking:** Defenders frequently let perfection undermine practical effectiveness. Meer cites EMET bypasses and the historical demise of the Linux honeypot tool Sebek (killed because researchers proved it could be detected via kernel syscall timing in a lab, despite attackers in the wild never performing such checks). Blue teams should "embrace the hack" and solve real-world organizational challenges rather than rejecting imperfect tools. - **Hamming's Lessons on First-Class Research:** Success in groundbreaking work is rarely just luck. Key factors include independent thoughts, the courage to chase them, deep drive, and emotional commitment. Knowledge compounds like interest, meaning sustained extra effort leads to dramatically outsized productivity.

### Technical Details - **Sebek and Honeypots:** Meer highlights Sebek, an early 2000s Honeynet Project rootkit-like tool designed to capture keystrokes and traffic from compromised boxes. Academic/lab demonstrations showed Sebek could be detected via precise syscall timing, leading defenders to shelve a tool that was otherwise effective against real-world adversaries who do not perform syscall timing. - **Defensive Tooling and Pragmatism:** Mentioning Microsoft's Enhanced Mitigation Experience Toolkit (EMET), Meer illustrates that even if reverse engineers can bypass an exploit mitigation tool, deploying it still protects enterprises against common threats. - **Compounding Work and Metasploit:** Meer uses HD Moore's creation of Metasploit as an example of restructuring ad-hoc work (copy-pasting shellcode and one-off exploits) into an open platform that others can build upon. - **Thinkst Canary:** During the Q&A, Meer explains that Canary focuses on alerting organizations to compromises with minimal effort and low false positives, addressing the organizational challenge of adoption rather than merely writing technical code.

### Takeaways - **Dedicate Time to Great Thoughts:** Regularly schedule time to ask yourself: "What are the important problems in your field, and why aren't you working on them?" - **Embrace Constraints and Put in the Work:** First-class research requires intense dedication and emotional investment rather than relying on talent, luck, or ideal working conditions. - **Focus on Usable Solutions:** Tackle enterprise organizational barriers directly rather than blaming users or abandoning tools over minor edge cases. High-value opportunities exist in building resilient, usable defensive products.