Closing keynote: Cybersecurity 2035: where will we be in 10 years' time?

Cybersecurity 2035: Where Will We Be in 10 Years' Time?

Speakers: Paul Ducklin, Independent cybersecurity expert

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=MPOiT5IptMM

Overview

In his closing keynote at Virus Bulletin, veteran cybersecurity expert Paul Ducklin delivered a thought-provoking address titled "Cybersecurity 2035: where will we be in 10 years' time?" Far from offering a typical roadmap of future threats or technological advancements, Ducklin instead challenged the audience to look inward and backward, arguing that the future of cybersecurity hinges less on novel technology and more on fundamental shifts in industry culture, cooperation, and a sober understanding of perennial challenges. Using metaphors ranging from the Rosetta Stone to the Halting Problem, he underscored the persistent nature of cybersecurity issues and the often-misguided assumptions that plague the industry.

Ducklin, now an independent expert, drew upon decades of experience to highlight recurring patterns of behavior, both good and bad, that have shaped the cybersecurity landscape. His central thesis posited that many "new" threats are merely old problems repackaged, and that the industry frequently neglects crucial lessons from its own history. The talk served as a powerful call to action for greater collaboration, intellectual humility, and a renewed focus on foundational principles over hype-driven solutions, particularly in the face of burgeoning AI-first narratives and excessive data collection.

The talk's significance lies in its refusal to engage in speculative threat predictions, a practice Ducklin openly criticized as largely unhelpful. Instead, it provided a robust framework for assessing the industry's trajectory, emphasizing human factors, ethical considerations, and the critical role of community in building a more resilient digital future. By dissecting historical incidents, Ducklin illustrated how collective action and responsible stewardship are far more impactful than technological silver bullets, advocating for a return to common sense and cooperative spirit.

Background

▶ Watch: Rosetta Stone metaphor for cybersecurity assumptions (0:00)

Ducklin's talk began by setting a unique contextual stage, using the Rosetta Stone as a metaphor for the pervasive issue of making incorrect initial assumptions in complex problem-solving, a pitfall he frequently observes in malware analysis and broader cybersecurity challenges. He highlighted how the Rosetta Stone, initially presumed to be an easy decode due to known languages and iconic hieroglyphs, turned out to be far more complex, with languages misidentified and scripts misunderstood – a parallel to the common experience of security professionals.

The core problem, as Ducklin articulated, is not a lack of technological innovation but a persistent failure to learn from the past and foster genuine cooperation. He recounted the genesis of the IICAR test file, a seemingly simple string of ASCII characters designed to be detected by antivirus software. This file emerged from a chaotic era (the late 1980s/early 1990s) where antivirus vendors actively sabotaged competitors by supplying customers with live malware that only their product detected, leading to widespread confusion and active infections. The IICAR file was a direct response by a group of passionate techies, working collaboratively and outside the influence of sales and marketing departments, to create a neutral, standardized test — a testament to what collective action can achieve.

Ducklin further contextualized the industry's challenges by invoking Alan Turing's Halting Problem, a foundational concept in computer science from 1936. This theoretical impossibility of writing a program that can definitively predict the behavior (e.g., termination, maliciousness) of all other programs serves as a fundamental limit on perfect malware detection. This academic principle, Ducklin argued, is often forgotten or ignored by marketing departments pushing "be-all and end-all" security solutions, creating unrealistic expectations and perpetuating a cycle of disappointment. His historical perspective, encapsulated by George Santayana's truism, "Those who cannot remember the past are condemned to repeat it," formed the bedrock of his argument for a more reflective and community-driven approach to cybersecurity.

Key Findings

▶ Watch: Alan Turing's Halting Problem and perfect antivirus (18:00)

Ducklin's address unveiled several critical findings regarding the trajectory of cybersecurity, positing that its future is deeply intertwined with its past and present cultural practices:

1. The Persistence of Problems: Many "new" cybersecurity threats are merely re-iterations of old problems, driven by human factors rather than purely novel technical exploits. The industry frequently succumbs to historical amnesia, leading to repeated mistakes and re-discovery of known challenges.
2. The Illusion of Perfect Detection: Alan Turing's Halting Problem fundamentally demonstrates the theoretical impossibility of creating a perfect, all-encompassing malware detection system. This scientific reality is often overlooked in marketing hype, leading to unrealistic expectations for security products and an endless "cat and mouse" game.
3. The Power of Cooperation vs. Competition: While competition is natural, genuine industry cooperation among technical experts (as exemplified by the IICAR test file's origin) leads to better outcomes for everyone. Conversely, selfish or adversarial industry practices (like early AV vendor competition or the Sony Rootkit debacle) actively harm collective security.
4. The Cultural Dimension of Supply Chain Security: Critical open-source infrastructure often relies on under-supported maintainers. The XZ Utils backdoor highlighted a systemic failure of the broader IT community to adequately invest in and support the foundational projects it heavily leverages, creating vulnerabilities that state-sponsored actors can exploit.
5. Data Overload and AI Hype: The indiscriminate collection of vast "data lakes" and an over-reliance on "AI-native" solutions are often counterproductive. Ducklin argued that more data does not automatically equate to better security and can, in fact, create more opportunities for adversaries. He cautioned against abdicating human judgment and interaction to machines, which cannot solve theoretically impossible problems.
6. Ethical Responsibility and Transparency: Companies and individuals within the cybersecurity space have an ethical responsibility to be honest about capabilities and limitations, avoid misleading marketing, and prioritize collective security over short-term competitive advantage. The Sony Rootkit incident served as a stark reminder of how industry players can actively undermine user security for commercial gain.

Technical Deep Dive

▶ Watch: Santayana's truism: Learn from cybersecurity history (22:20)

Ducklin's talk, while primarily cultural, wove in several historical technical examples to illustrate his points about the enduring nature of cybersecurity challenges and the importance of human decisions.

IICAR Test File: A Beacon of Cooperation

The IICAR test file (EICAR, European Institute for Computer Antivirus Research) is a standardized string of ASCII characters designed to be detected by antivirus software as if it were a virus, without actually being malicious. Ducklin, who wrote the explanatory blurb for its creation, detailed the technical intricacies involved in crafting this seemingly simple string ( X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* ).

Creating a pure ASCII string that could execute as shellcode on Intel 16-bit systems (DOS .COM files) was challenging. It required careful opcode selection, avoiding instructions like MOV with problematic encodings or backward jumps that used negative numbers exceeding 7Fh. The code had to be self-patching in memory, a technique often used by viruses, but complicated by the lack of virtual memory or memory protection in DOS. Execution involved navigating CPU prefetch queues, which had varying lengths across different processors, requiring precise byte placement to ensure correct execution. The IICAR file's technical cleverness, however, was secondary to its cultural significance: it demonstrated how competing techies could collaborate to solve a systemic problem of inconsistent and dangerous malware testing.

The Halting Problem: Limits of Detection

Ducklin delved into Alan Turing's Halting Problem, a fundamental concept in computability theory. This problem asks whether it's possible to write a general algorithm that, given any arbitrary program and its input, can determine whether that program will eventually halt (finish executing) or run forever. Turing proved this to be theoretically impossible.

Ducklin applied this directly to malware detection: can we write a program that can perfectly classify all other programs as either "malicious" or "not malicious"? Informally, the proof involves a self-referential paradox:

1. Assume such a perfect "is_malicious" function exists.
2. Construct a new program that takes itself as input to "is_malicious."
3. If "is_malicious" says the program is safe, the new program executes a malicious action.
4. If "is_malicious" says the program is malicious, the new program executes a safe action (e.g., prints "Hey, be cool, dudes." and exits).

This construction creates a logical contradiction: the "is_malicious" function can never correctly classify this self-referential program, thus proving that no such perfect classifier can exist. This theoretical limitation underscores why cybersecurity will always be a cat-and-mouse game, making claims of "100% detection" inherently false.

AIDS Information Trojan (PC Cyborg, 1989): The First Ransomware

The AIDS Information Trojan, also known as PC Cyborg, is widely considered the first instance of ransomware. Delivered via floppy diskettes to a mailing list of AIDS researchers, it encrypted filenames on the user's hard drive after a certain number of reboots. The ransom demand was $189 or $378 US, to be sent to a PO box in Panama.

Technically, the malware was not sophisticated. It used a fixed key for encryption, meaning recovery tools quickly emerged. Its method of "recruiting affiliates" was particularly notable: users could insert a blank floppy disk, which the Trojan would format and write a version of the software to, along with the user's "tag," effectively incentivizing the victim to spread the malware further to regain their own data. Ducklin pointed out that the perpetrator, Dr. Joseph V. Pop, pioneered tactics still seen today: avoiding infection in his home country (US) to evade law enforcement and framing the attack as a "licensing agreement" for "proactive penetration testing."

Sony Rootkit (2005): Industry Self-Sabotage

The Sony BMG copy protection rootkit was a notorious incident where music CDs installed a hidden rootkit on Windows computers without user consent. The purpose was Digital Rights Management (DRM). Ducklin stated he analyzed the rootkit and believed it was copied almost byte-for-byte from a proof-of-concept rootkit published in Phrack magazine.

The rootkit operated by patching the operating system kernel, specifically by intercepting system calls related to file and registry access. It would hide any file or registry key whose name started with $sys$. This gave malware writers a "free" rootkit: they could simply prefix their malicious files and registry entries with $sys$ to make them invisible to many security tools. This incident showcased the industry turning on its customers, reducing security for the sake of copy protection, and inadvertently providing powerful tools to adversaries. The infamous quote from a Sony executive, "Most people I think don't even know what a rootkit is. So why should they care about it?" encapsulated the arrogant disregard for user security.

XZ Utils Backdoor (2024): Neglected Open Source

The XZ Utils backdoor (CVE-2024-3094) was a sophisticated supply chain attack targeting the liblzma compression library, part of the XZ Utils package. The attacker, known as "Jia Tan," spent two years gaining trust in the open-source project. The backdoor was designed to eventually compromise the OpenSSH (sshd) daemon on Linux distributions using systemd to manage SSH, specifically targeting Debian-based systems that used liblzma for compressing systemd's log files.

The attack leveraged a complex mechanism: malicious code was injected into the build process, not the source code itself. During the SSH handshake, specially crafted data (disguised as a fake cryptographic key) would trigger the backdoor, allowing remote code execution. Ducklin emphasized that the technical sophistication was secondary to the cultural failure: a critical piece of infrastructure, widely used for compressing Linux distros, was maintained by a single, under-resourced individual. The lack of community investment and support made the project vulnerable to a long-term, insidious takeover, putting virtually all Linux users at risk.

Demo / Proof of Concept

▶ Watch: Sony Rootkit scandal: Industry's self-inflicted wound (38:00)

Paul Ducklin's talk did not feature live coding demonstrations or interactive proofs of concept in the traditional sense. Instead, he presented historical artifacts and visual evidence to illustrate his points. He displayed the string of the IICAR test file and discussed its technical constraints. For the AIDS Information Trojan, he showed images of the original floppy diskette, the physical envelope with a UK stamp, and crucially, the minuscule, legalistic text of the "license agreement" that accompanied the malware, detailing its mandatory leasing terms and threatening "program mechanisms" for non-compliance. While he verbally walked through the Trojan's file-scrambling behavior and the fixed decryption key, the focus was on the historical context and the cultural audacity of its creator, rather than a live execution. He also provided code snippets (e.g., a simple kernel patch for the Sony Rootkit) on slides to highlight technical details, but these were for illustrative purposes within the narrative.

Defensive Implications

▶ Watch: Critiquing 'data lakes' and over-reliance on AI (46:00)

Paul Ducklin's talk offered profound defensive implications, steering away from specific tool recommendations and instead focusing on fundamental shifts in mindset and industry practice:

• Foster True Cooperation: Defenders must actively promote and participate in community contribution and information sharing, mirroring the collaborative spirit behind the IICAR test file. This means moving beyond competitive silos to share threat intelligence, research, and best practices.
• Embrace Humility and Realism: Acknowledge the theoretical limits of perfect detection, as demonstrated by the Halting Problem. This requires realistic expectations for security products and a shift from an "assume breach" mentality (as an excuse for failure) to a commitment to robust prevention efforts. CISOs, he argued, should be striving to prevent breaches, not merely assume them.
• Support Open-Source Infrastructure: The XZ Utils backdoor exposed a critical vulnerability in the reliance on underfunded and under-supported open-source projects. Organizations must actively invest in and contribute back to the foundational open-source components they depend on, either financially or through developer contributions, to prevent future supply chain compromises.
• Question Data Hoarding: Re-evaluate the strategy of collecting "data lakes" of every conceivable piece of information. Ducklin warned that "less is more" and "more is often too much," suggesting that excessive data collection creates a larger attack surface and can inadvertently benefit adversaries. Focus on collecting relevant, actionable data.
• Resist AI Hype: Be skeptical of "AI-native" and "AI-first" marketing. While AI has its place, it cannot solve problems that are theoretically impossible for machines (e.g., perfect malware detection). Human expertise, critical thinking, and collaboration remain indispensable.
• Prioritize Clarity and Honesty: Use plain language to explain complex security concepts, avoiding jargon and misleading marketing. Transparency with users and stakeholders about capabilities and limitations builds trust and improves collective understanding.
• Learn from History: Actively study past incidents like the AIDS Information Trojan, Sony Rootkit, and XZ Utils. Understanding the cultural, ethical, and technical missteps of the past is crucial to avoiding their repetition in the future. As Santayana warned, "Those who cannot remember the past are condemned to repeat it."
• Standardize and Professionalize: Adopt clear, unambiguous standards for logging (e.g., RFC 3339 for dates, using Zulu time) and data visualization (e.g., equal-area map projections instead of Mercator). These seemingly minor details contribute to better communication and analysis.

Key Takeaways

• Cybersecurity challenges are fundamentally human and cultural, often repeating historical patterns rather than being purely new technical problems.
• Perfect, 100% malware detection is theoretically impossible due to the principles of Alan Turing's Halting Problem, underscoring the need for layered defenses and realistic expectations.
• Genuine industry cooperation and community contribution among technical experts are vital for collective security, as exemplified by the IICAR test file.
• The industry must actively support and invest in critical open-source projects to prevent supply chain vulnerabilities, as highlighted by the XZ Utils backdoor.
• Beware of excessive "data lakes" and over-reliance on "AI-native" solutions; "less is more" and human judgment remain crucial.
• Learning from historical incidents like the AIDS Information Trojan and the Sony Rootkit is essential to avoid repeating past mistakes and ethical failures.

About the Speaker(s)

Paul Ducklin is an independent cybersecurity expert with a long and distinguished career in the industry. Having previously worked for large cybersecurity firms, he now operates independently, offering his expertise for hire. Ducklin is known for his deep historical knowledge of cybersecurity, his candid and often humorous critiques of industry practices, and his strong advocacy for community collaboration and ethical conduct. He is notably credited with writing the explanatory blurb for the IICAR test file. His perspective as an "old-timer" provides a unique and valuable lens through which to examine current and future cybersecurity challenges.