mojibake
loading…

Ivan Medvedev Interview

14 min read

So Who Is Ivan???

So a bit ago I snagged my first few CVEs. (WOO). While I was working on that I came across 2 fun rabbit holes. 1 of which being OSINT and BGP to track down what data center a server is in.

But the other was this: Regarding this oft reused example of encryption in C#/.NET’s crypto library.

Where did this example come from? I had initially thought the question started and ended with that Stack Overflow response.

I was going to publish this project under the name Ivan The Terribly Encrypted- but the friend who gave me the lead that led to this project advised I ask Ivan himself. It hadn’t occurred to me that I could find THE Ivan Medvedev. I had sort of assumed maybe it was a reference to Ivan Medvedev, Russian politician and energy economist or was someone off answer on Stack Overflow anonymous and lost to time. So I looked! To outline the search:

In order of discovery:

Wait a second… He works at Google in Washington? All this time working on this project and we’re practically neighbors??

So I draft a message:

Subject: { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 }

Hey there, are you the Ivan Medvedev who wrote this post?

If so I’d love to chat! I went to school for cybersecurity and I am bagging some of my first CVE’s and following a thread has led me to about 8 open source projects all containing some variation of this function. I’ve also since learned it shows up in a number of malware.

…

Please let me know if you’d like to chat or get coffee sometime!

In full honesty I never expected to hear back, but not an hour later I receive a response-

Eli - I don’t mind a chat over coffee, though not sure how much I can tell you about this 23 y/o code that isn’t already written in the links you sent :)

The line goes quiet for 2 weeks and just when I thought it was off, while at one of my partners houses, I get the message that It’s on!

And within a week I’m sitting in a coffee shop east of Seattle far earlier than my unemployed (RIP) self is used to- overwhelmingly nervous -

My partner reminds me over text that he’s just a person. I see him bike up.

Oh he biked here

I say.

How very Tech Worker of him

She replies.

He grabs Coffee and a pistachio cake from the café and comes to join me.

He even offers me some of the cake, and my awkward-ass misunderstands the question and declines accidentally. Then, realizing he heard me decline, and then in spite of actually wanting some, I decide it’s LESS awkward to stick to my original answer. (I’m nailing this already, can’t you tell?)

We then move outside to not bother the other patrons. This proved to be ill-advised on my part because the leaf blowers were out in full force. After perhaps 10 minutes we retreat back inside, where naturally, because I’m god’s favorite, my recording app crashes when trying to save the last hour of the interview!

What follows is the salvaged Interview - first transcription then reconstruction based on Ivan’s willingness to follow up after the fact and fill in some of the blanks from what I remembered.

…

So, thank you again for meeting with me. I guess given why we’re here to begin with, how do you feel about the notoriety of the code snippet, and when did you realize that it had made such an impact, and who told you? How did you first find out?

First of all, going on record, my views don’t represent the views of my employer.

Absolutely.

Yes. Well, it’s been quite an interesting thing. So I first learned about challenges associated with it a few years ago when somebody, and I think it happened a few times, actually. Some security researchers reached out to me and said, hey, we’re investigating this ransomware thing for the large organization and your name popped up in the code do you know anything about it? - No, I swear I have nothing to do with it. And then they talked, and it’s sort of, they said it’s in this encryption code that they used for ransomware.

That was Samsam in 2018, right?

I honestly don’t remember because there’s been a couple of those.

Oh, so this has happened more than once that they’ve reached out to you?

This happened more than once, yeah. Not necessarily in the ransomware context. But security researchers come to me and saying something in the wild is using this, you know “bits with your name in it”, After the first time I kind of knew about it. So yeah! That was kind of interesting- I mean I try to help them when I could, I mean obviously.

Sort of going into the technical details, if that ransomware was still using CBC and the IV is known, which is what the bytes are, it makes cracking it easier. So maybe it made it easier for the security researchers to help their customers. Hopefully, I don’t know; they didn’t share which, and they shouldn’t have, but yeah it was kind of fascinating.

After that I saw a couple of blog posts and articles where it was mentioned, some critical. I think you sent something, someone actually took the time to understand what was going on. But at first I was like maybe I screwed up and published some insecure code, and then I reread my post and I was like no it’s …

no it’s 100% on them

Yeah it’s kind of correct!

You said at the very bottom you’re like you should change these

You know, granted it was written at the beginning of my career when I was young and eager. This is 20 years later, and I was like well I was probably stupid when I was younger and wrote it and then I went and reread it and I was like no I mostly stand behind this even now. I mean of course now we probably wouldn’t use CBC anyway.

So yeah that was interesting, but it got me thinking about the interesting ways things like this spread around. Things like APT actors, for example: if I’m a nation state or something like that wouldn’t it be interesting for me to publish a bunch of seemingly helpful crypto or other security open source and then when people implement it or just blindly copy it without understanding. Wouldn’t it make it easier for me to infiltrate our systems later on?

yeah! I’ve wondered about that sometimes I’ll be researching something and I’ll look into something and it’ll seem either incomplete or not quite right, and one of my thoughts is oh is this intentionally incorrect did someone. Like is this someone back-dooring just the general pool or public knowledge of information in a way, yeah that’s interesting

Another thing is one of the reasons that my name is in the IV to begin with. I guess one of my hopes was if it’s clearly not random it’ll make people think that, hey, why are not random bytes here? Maybe I should replace it with something. Yeah, so that clearly didn’t work.

No not at all. One thing that I noticed, and I actually think it’s kind of cute of people to do this. Every iteration I’ve seen where it shows up in different places they leave the IV the same but they’ll change the password. But that doesn’t change the problem that it’s written down. I think it’s kind of funny.

So you said you wrote it at the beginning of your career. If the blog post was in 2003 what was going on in your life? What stage of your career were you at? I noticed it was posted the day after Christmas too. I think it’s kind of funny, yeah, the 26th.

Yeah so I was working for Microsoft at the time. I was on the team that built those crypto and other libraries for.NET. .NET as a product or platform was pretty young at the time and we wanted to be an option. Part of that effort was advocating publishing samples, advertising and, so people were encouraged to talk about the product present conferences write samples, write blog posts. So that’s what I did, so in a way this was a sample that showed how to use some of the crypto libraries that my team built.

So you were the part of the team that wrote some of the crypto library for that? That is cool. Okay. So is that largely what you went to school for, is cryptography?

Not really, no. I went to school for essentially computer science. My diploma says what’s the equivalent of, and I say that because it was from a different country, what’s essentially equivalent of Master’s in math. I did a bunch of computer science courses, so the classes I got are basically what started in computer science. I consider it computer science, but for me it’s like math.

Okay, cool! So coming largely from math, it was just a shared interest between the two things?

Yeah, and it just so happened that my career, when I started and while I was still in school, was all security and some crypto related. So my very first job was building network encryption for large government customers, implementing a country‑specific encryption algorithm. Some Windows drivers that I built for, I think it was in Windows NT 4 at the time, to encrypt network traffic. And that first job kind of spiked my interest in crypto, and I’ve been curious about it since then. Even now, my job, one of the projects I work on, has tokenization/encryption capability.

Yeah. Which folds into the privacy element of things in your role.

Right. Yeah. Well, encryption is built for both security and privacy, so the difference between security and privacy is a fascinating topic.

…

After technical issues ate the rest of the recording I sat in the cafe for a good 30 minutes searching through memory to see if anything resembling the recording was retained.

Apparently: The obsidian plugin I was using to record turns the recording into a base64 string at some point (WHY??), and after nearly an hour of recording generated a string too big for the application to handle, and it just eats it.

After accepting it was gone, I jot down everything I can remember and rush home.

I follow up with Ivan and he’s kind enough to respond in text to some of the questions I could recall!

…

Do you get recognized? Do you feel like that name recognition has helped your career?

This is a fairly niche thing and more of a fun peculiar anecdote that very few people really care about. I work with a bunch of security people and a few cryptographers and I don’t think any of them are aware of it; when I tell the story it usually ends up with a chuckle and people forget about it in a few minutes.

Given that it was written in 2003 when you wrote it, What has changed since then? Specifically in regards to what we do and don’t consider to be secure code.

(Here we touched briefly on Q-day, I asked what if anything Google was doing about it, and he indicated that he couldn’t tell me, which only left me more interested.)

Lots has changed both in cryptography (e.g. CBC mode is rarely used), key generation and management, infrastructure around it, new threats (e.g. post quantum, etc.).

I’ve heard of some of what was discussed above, one thing that I think might be related, and you’re free to correct me, is the potential web3 development using some of the same technology behind NFTs, is that some of what you mean?

Not really following blockchain related tech that much; it’s an interesting idea with limited practical use. Maybe one day, but for now it feels more like a hammer looking for a nail.

So then do you think AI will have a similar trajectory? Where once the hype dies off it will similarly be the butt of a joke?

(Here there was insightful conversation about the 2 divergent paths where either we have something resembling post scarcity, or more consolidated power)

Lot of things are in flight and are difficult to predict. When sufficient computation power is applied over sufficient data, new unexpected properties sometimes emerge. It could stay an awesome autocomplete (and that’s very useful and powerful with the combination of agents/MCP) or turn into something very different (AGI). The jury is still out but rapid progress is being made. The society will need to decide on how it wants to order itself as a reaction to the new AI capabilities.

To that end, how do you feel about the future of user privacy in an age of improved indexing and sentiment analysis through AI, and the eventual breaking of encryption? professionally? personally? We touched on how identities are open secrets now, how there’s interesting challenges in legislation and policy regarding how that data for training AI is handled. We touched on how while you feel like you don’t have anything to hide because you’re not fighting an oppressive regime, you still see the value in their privacy (really felt like this was a valuable takeaway)

Not too worried about the future. There will always be novel security/privacy issues, and people passionate about solving them. There are post-quantum resistant algorithms and approaches already. We will likely see more AI assisted and AI driven offense and defense in security (already there are companies that sell AI security solutions, with good results; AI shows up well in some capture-the-flag competitions).

Before we wrap, I know myself among other people for example Microsoft expats, are looking for jobs and AI is definitely changing that landscape. Are there any niche corners of cybersecurity and privacy that you feel get passed over or not as much attention as maybe they should?

There are probably a few less explored areas, including multimodal AI threats (text, images, audio, video, VR and mixes thereof). Things like prompt injections and other attacks on AI, e.g. recently read a paper on reconstructing training data from embeddings + black box access to vector generator. A big area will be unlocking the use of large amounts of data for data science/AI/ML while protecting security and privacy (e.g. in medical research).

Any final thoughts?

There is job security in security – the space will morph but not ever go away.

…

After this- I felt the need to apologize almost. This was such an exciting project to me and to nearly lose the whole interview had me feeling so deflated.

His terminally chill response:

Do not worry about me, I enjoyed the conversation, the coffee was tasty and it was a good opportunity for me to go on a bike ride (I came by bike).

And for the record: He did think “Ivan the Terribly Encrypted was funny.”

Graph View