Forward Pass: Blackhat

The setup

Jeffrey Starr at NeoPrime introduced me to Michael Mann. Jeff’s own claim to fame, as Mann put it, was the Kazakhstan highly-enriched-uranium recovery, Project Sapphire, that earned a presidential commendation. Mann was deep in research for what was then the Untitled Michael Mann Project, which became Blackhat. In it, Hemsworth’s “Hathaway,” a convicted hacker and MIT scholarship kid who’d done time, is furloughed to hunt a threat actor. The actor has used Hathaway’s own old injector code to hit the Chicago Board of Trade in a soy-futures play and, as prelude, to melt down a nuclear plant via its PLCs, Stuxnet-style.

On March 29, 2013 I flew to LA and sat down with Mann for a long working session. The production arranged the travel and cc’d the itinerary to Legendary Pictures. He laid out the skeletal bare bones of the story and asked me, point by point, whether it held up and how a real operator would actually do it. The next day, 3/30, Maggie Chieffo at Forward Pass sent over the script to read. The typed transcript of our conversation arrived 4/9/2013, from FPI’s B. Forester.

My role

Reality-check and fixer for the film’s hacking. Mann’s constraint, in his own words, was dramatic economy. A story moves through time like music, so if something takes three steps he can’t tell it in seventeen. My job was to keep the tradecraft honest inside that constraint: tell him what was wrong, and offer the most cinematic version a real practitioner wouldn’t laugh at. I described my usual work as the “Ocean’s 11 / Brad Pitt” role. Given an objective, I assemble and wrangle the right red-team talent, often difficult talent, and design how the job gets done.

What I did / advised on

A lot of the session was me translating real tradecraft into things the camera could show:

The Chicago Board of Trade hack. Mann’s draft had an air-gapped CBOT, which he already suspected was wrong, since it has to touch the net to trade. I reframed it around value-added network providers and the market-maker terminals. Then I pitched a physical man-in-the-middle the audience could literally see: a PWNIE Express implant that looks like a power strip or surge protector. It costs ~$800 and ships to anyone. A janitor plugs it in between a terminal and the network, and it “calls home” over cellular or a covert channel. That became a real beat. Hathaway walks the perimeter of the room and spots the thing nobody should have plugged in.
Command-and-control and attribution. We covered how a careful actor anonymizes, never calling home directly and hopping through compromised drops instead. We covered port-knocking servers that look dead until hit with the right sequence. And we covered how the protagonists could still trace the actor through the film’s fictional bulletproof host, “Intrashield”, via firewall rule sets, NAT/address translation, and logged keys, chasing a “magic key” or passphrase back to one client’s server among hundreds.
ICS / Stuxnet realism for the PLC meltdown, and a gut-check on the fictional NSA data-recovery tool, “Black Widow”, and the key-logger plot device. My honest note was that real keyloggers aren’t as clean as the script wanted.
The deception world. I walked him through MILDEC, military deception: breadcrumbs that lure an adversary into a fully virtualized, fraudulent environment to expose their intent and TTPs. It’s the same thesis behind the ZanttZ/Shadow Networks work.

I also gave him a lot of character texture he was clearly mining: the archetype of the hacker who treats the computer system as the real world and the body as a thing to maintain; the “jack in,” “hack the Gibson,” “pwned/w00t/root” vernacular; and how I personally think. That meant blanking out into “brain space,” filling dry-erase walls, building a system layer by layer, and “shifting the focal plane” like a camera lens. Mann loved that one.

The ongoing engagement, 2013 to 2017

What began as one session became a years-long relationship with Mann and Forward Pass:

On-set / post-production. The deal included my going to LA to appear in a scene in Blackhat, though the production cut the scene before shooting. I did go back to LA and got to sit in the hallowed halls of Studio #1/#2 on the Warner Bros. lot to watch Michael Mann do sound editing live. It was a remarkable thing to witness. A behind-the-scenes producer, Laura Davis, was documenting the project in 2013. They also asked me to sit for a DVD-extras interview, and I passed.
Time with John Nelson. I spent a lot of time with Mann’s VFX lead, John Nelson, the two-time Academy Award-winning visual-effects supervisor of Gladiator and Blade Runner 2049. We worked on how I visualize hacking a computer, trying to get the on-screen representation right. In the end they just used a third-party video for it. Such is film. John and I stayed friendly for years.
A second project. On a ~2015 LA trip Mann and I discussed a different hacker movie he was developing.
“Digital bodyguard”: securing Forward Pass. Through 2015 to 2016 the work shifted to personal and company security for Mann and Forward Pass, Inc. That covered a “server room vision,” documents on safe day-to-day access and protected research access, and standing up proper IT support. For that, I brought in a managed service provider on a support proposal. FPI staff were my close day-to-day contacts, and I corresponded with Michael directly. The specifics of the security guidance stay private. I was still checking in with FPI in 2017.

Net result

Several of the ideas map onto what actually ended up on screen in the 2015 Blackhat, most recognizably the physical-implant/man-in-the-middle beat and the ICS/PLC meltdown. I also met Chris Hemsworth along the way. More than a credit, it became a genuine multi-year relationship: advising the film, then protecting the director’s company. It’s one of the most distinctive things in my career.

The story

A working session where Michael Mann interrogated me on cyber tradecraft for an hour, and I got to be the practitioner who makes the fiction honest. Then came years in his orbit: the WB lot, sound editing, John Nelson, a scene written for me and then cut, and eventually Mann trusting me with his company’s security. The through-line to the rest of my career is all over it: Lane Davis and the early-’90s hacker scene, Andre Gironda and the Cisco-vuln fame, NeoPrime and Jeffrey Starr, MILDEC and deception at ZanttZ, the PWNIE-style physical implants and HP, and the systems-architect way of thinking.

Key people

Michael Mann, director. He ran the session, and brought Paul on for years of advisement and then company security.
John Nelson, Mann’s VFX lead and a 2× Oscar-winning visual-effects supervisor, for Gladiator and Blade Runner 2049. He spent real time with Paul on visualizing hacking, and they stayed friendly for years.
Jeffrey Starr made the NeoPrime introduction to Mann.
Chris Hemsworth, the lead, “Hathaway”. Paul met him.
Forward Pass, Inc. staff, the people Paul worked with on the script, the transcript, and the 2016 security work.
Laura Davis, behind-the-scenes producer on the project in 2013.
Andre Gironda and Lane Davis, referenced as part of Paul’s hacker-world bona fides. See the Origins and ZanttZ entries.

Technologies / methods, as discussed

Physical network implants, the PWNIE Express-style power-strip man-in-the-middle; covert C2 call-home over SSH, cellular, or innocuous protocols; port-knocking C2 servers; firewall rule sets, NAT, and log and key tracing for attribution; Stuxnet-class ICS/SCADA PLC manipulation; MILDEC deception environments; value-added-network paths into an exchange. Later, for Forward Pass, endpoint and company security and safe-access practices, kept private.