Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/2/2008
08:55 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Halvar Flake: Reverse-Engineered

Security expert Thomas Dullien chats about Vikings, VCs, guinea pigs, and his flap with US Customs

Halvar Flake started out as a Viking.

That’s how he got his hacker handle: As a teenager, Flake’s friends called him Halvar, after a burly cartoon character from the village of Flake in a children's television cartoon. (See the large, red-bearded viking on the left.)

“The chief of a Viking village on the television show was a big Viking called Halvar,” recalls Flake, aka Thomas Dullien, CEO and head of research for German security firm Zynamics (formerly Sabre Security). “I was short, fat, had long hair, and was drinking a lot of beer, so people called me ‘Halvar.’”

Figure 1:

The blond and trim 6’2” Flake in no way resembles the cartoon Viking Halvar these days. Flake, 27, has been a fixture at Black Hat meetings as an instructor since he and a friend from Sri Lanka first did briefings there in Amsterdam in 2000 so they could meet up (inexpensively ) with one another in person. “We couldn’t afford the flight tickets [between Sri Lanka], so we decided to present at the same conference,” Flake says. “So I submitted a talk to Black Hat, and was flown to the conference.”

Flake’s first Black Hat talk was on reverse-engineering to find bugs, and he’s been doing training sessions at Black Hat on reverse-engineering techniques ever since. He stands out (both physically and virtually) at Black Hat and within the security community for his pioneering work over the past decade in reverse-engineering code for vulnerabilities and to dissect malware.

Even so, Flake tries to keep a low profile in the hacker community, avoiding the politics of some “bogus” attention-getting debates he says have no real resolution anyway. But Flake did get accidentally get caught up some big-time politics last summer on his way to Black Hat USA in Las Vegas, where he was scheduled to conduct his training session. (See Researcher Barred From US.)

Flake was detained for several hours by U.S. Customs , and ultimately denied entry in to the U.S. due to some confusion over his visa and independent work status for Black Hat. He was questioned following the discovery of his presentation in his travel materials. Flake since has obtained a business visa for subsequent visits to the U.S.

“You have no rights, because your immediate status is not actually in the country... When you are detained there, you have no rights to call your lawyer,” he says. “Knowing you have no rights and you are at [the] whim of [the] guy over the counter is not pleasant.”

Ironically, Flake had originally planned to become a lawyer, not a security researcher. The day he was signing up for his university classes, he switched over to mathematics at the last minute. “When you apply for law school in Germany, a central agency determines where you go and study. In my case, they wanted to send me somewhere I didn’t want to go. I was standing in line with my college application in hand” and chose mathematics instead, so he’d have more flexibility, he says. He also studied computer science.

He’s currently finishing up his master’s degree and will begin his PhD thesis later this year -- all while running his company, Zynamics, which is primarily funded with research prize money he won for his company’s malware-classification technology. That €100,000 has helped keep him free of venture capital funding, which he sees as too restrictive.

“Reverse engineering is still a niche market. Any VC is going to want to drag us out of that niche and into some hip and trendy market... I am quite happy where I am now,” he says. “Not that I would refuse money if it was offered without a few strings."

Zynamics sells Flake’s reverse-engineering tools and is making a profit now, he says, although he has used up all of his prize money. (See 10 Hot Security Startups.)

Meanwhile, Flake says the learning curve for hacking is getting steeper, and the number of new researchers coming on the scene seems to be dwindling a bit. “I see fewer youngsters coming up,” he says. “The entire field is maturing.”

Many of his contemporaries, for example, started with hacking, foregoing college altogether. But Flake says that model is shifting, as universities begin catching up with security programs. “I think you’re going to now need to study for a year or two or three before getting up to speed,” given the maturity of the market, he says.

And Flake doesn’t lose much sleep over the malware and other things he sees in his daily reverse-engineering work. “In the end, I think I’m way more scared of global warming or erosion... than of anything in security. Security isn’t half as important as most of us think it is.”

Personality Bytes

  • First security memory: "When I was eight, I asked my brother how to crack copy protection because he knew [how to] at the time... but I didn’t do any security until 1999, when I realized you can do reverse-engineering for finding security issues instead of bypassing copy protections."

  • First hack: "No comment."

  • After hours: "Whenever I have a chance to go anywhere, I go skim-boarding. That’s once a year when I get near a beach. And I enjoy reading math -- I’m crazy like that.”

  • Fear factor: "I have a fear of getting old and slow, I guess. From 1999 and onwards, I have been worried that I would be too old and too slow for the security game.”

  • Just added to his iPod: "I have horrible taste in music, as people will attest. I recently added a bunch of horrible German rap, Argentinean tango music, and a CD of Bach’s cello pieces.”

  • Comfort food: "Oatmeal.”

  • Hangout: "Goldkante. It’s a nonprofit club/bar run by the regulars."

  • Dog or cat? "Two guinea pigs. I was allowed to name only one of the guinea pigs (the other one was named by my better half). My [guinea pig] is called Jenny. She has a black patch of fur over one eye, and there's a figure in the Threepenny Opera that is called ‘Pirate Jenny.’"

  • Wheels: "Volkswagen Caddy. It’s a terribly uncool car.”

  • Next career: “I wouldn’t mind teaching. If someone starts a university and they need a network research chair for offensive computer security... Sign me up.”

  • What Flake would most like to be known for:"I'd like to be known for having understood something, and then explaining it well to others."

    Have a comment on this story? Please click "Discuss" at the bottom of this page. If you'd like to contact Dark Reading's editors directly, send us a message.

    Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    7 Tips for Infosec Pros Considering A Lateral Career Move
    Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
    For Mismanaged SOCs, The Price Is Not Right
    Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment:   It's a PEN test of our cloud security.
    Current Issue
    IT 2020: A Look Ahead
    Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
    Flash Poll
    How Enterprises are Attacking the Cybersecurity Problem
    How Enterprises are Attacking the Cybersecurity Problem
    Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2020-5226
    PUBLISHED: 2020-01-24
    Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp 1.18.0, a new SimpleSAML\Utils\EMail class was introduced to handle sending emails, implemented as a wrapp...
    CVE-2019-1517
    PUBLISHED: 2020-01-24
    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
    CVE-2019-1518
    PUBLISHED: 2020-01-24
    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
    CVE-2019-1519
    PUBLISHED: 2020-01-24
    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
    CVE-2019-1520
    PUBLISHED: 2020-01-24
    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.