Corey Thuen is a hacker with a hacker mindset that is focused on the right way to do wrong things to get the right result.
Corey Thuen is the founder and CEO of Gravwell, a firm with a slight difference: it develops data analytics and vulnerability detection through a combined team of big data experts and hackers.
When interviewing a candidate for the hacker half of the team, he looks for people who have what he calls ‘the evil bit’. “Do they have that ‘evil streak’? Do they have that adversarial mindset that can look at a product and seek out ways to exploit it? If they don’t have that evil bit, I don’t think we can teach it.” He accepts that it may be possible for some people to develop one, but in his own experience, it’s either there or it’s not. Natural-born hacker is more a fact than a description; and it is tempting to describe Thuen as a natural-born hacker himself.
But does ‘evil’ indicate a lack of morality? “Who defines morality?” he replied. “Who defines what is good and what is bad? The old school hacking ethos, which still lingers, is that all information should be free”. Other folks consider that a bad viewpoint.
“I was recently working for the US government. We were evaluating the systems that go into power substations, part of the critical infrastructure. So, we were hacking these systems, but the goal was to improve security for everyone. We were using the evil streak for good. Hacking skills are a bit like guns. Neither are evil in themselves. They can be used for both good and bad purposes depending on the motives of the user.”
How old was he when he realized he’s a hacker? “I knew I was a hacker at a very young age; and from that moment onward, it was all I wanted to do. I had always been interested in computers and how they work, so when an uncle gave us an old Packard Bell while I was still in high school, the first thing I did was sit down and read the DOS manual from cover to cover.”
This interest was not hereditary. None of his family were technology-minded, and he had no resources beyond his own curiosity before the Packard Bell. But this led to video games – the archetypal introduction to hacking for many of today’s hackers. With access to a game’s save files and a hex editor, he started tinkering. “Where are the bytes that control how many lives I’ve got? Can I change them to give myself infinite lives?” And then he watched Hackers. “It was like, Oh my gosh! I want to do that. I want to fly around in cyberspace and hack the Gibson. All these guys are so cool!”
Despite his ‘messing around’, and despite the movie-inspired dream of hacking a Gibson, Thuen never did any immoral or harmful hacking. But he wasn’t squeaky clean. “Back then, it wasn’t crystal clear that we were doing anything wrong. We didn’t realize we could get into trouble. It was simply, ‘If I dial this number, I get into this system. What is it? I don’t know, so I’ll poke around a bit.” Thuen’s youthful hacking was curiosity rather than malicious intent.
“I would stand up these systems and mess with them, right? How does this vulnerability work? So, I’d set up a database on a website just to understand SQL injection – but I wouldn’t then go out looking for systems to exploit. I guess that was a line I just didn’t want to cross. I wasn’t much of a rule-breaker.”
After high school, he attended the University of North Dakota and gained a bachelor’s in computer science. He enjoyed the course but felt it was lacking a security program even though the tech elements were good. “North Dakota taught me how to do a bunch of things. Maybe the geography also helped. North Dakota is flatter than your table, so it’s pretty easy to run cables around. I was able to do cool dial-up stuff. So that was a contributing factor,” he added.
After that, he went to the University of Idaho to do his master’s in computer science. It was a scholarship for service (SFS) program run by the government. “Basically,” he explained, “you get a scholarship, but then you have to work for Uncle Sam for a few years after school so that Uncle Sam gets something back from the investment.”
When that time came, he looked at his options. Most of the government positions were on the East Coast. He, however, came from a small town with a population of around 7,000.
He attended a few East Coast interviews, but they didn’t appeal, and he concluded his options were the unpalatable East Coast or one of the Department of Energy institutions in different parts of the country – and one of them was (and is) in Idaho.
The Idaho National Laboratory (INL) is the Department of Energy’s leading center for nuclear energy research and development, and is also a globally recognized authority on protecting industrial control systems (ICS) and operational technology (OT). Technically owned by the Department of Energy, it was (and still is) managed by the private Battelle Energy Alliance (BEA).
“So, I ended up at INL, and I’m so glad I did. I worked with a great team, and it was there I first met my future co-founder of Gravwell [Kristopher Watts, now CTO]. That time was what really kicked the doors open for me messing around with how computers work.”
Corey worked at INL until 2013, at which time he left together with Kenneth Shaw and the two co-founded Southfork Security. This was where he first got into trouble following his initial “Hey, let’s hang a shingle moment” – something he had always wanted to do.
With Southfork, he explained, “I thought, ‘Maybe we can do some security testing. We’ve got a pretty good set of skills. Let’s take the idea to the private sector and see what we can do with it.’ I made some open source tools under Southfork Security, and that turned into a whole new saga.”
That saga was complex and messy, partly hinging on his early use of the term ’hack’ without implying bad intentions. Hack and hacking did not have the moral neutrality the terms have today, but he nevertheless described Southfork as “We hack things and make tools.” Hold that thought in the background. In the foreground, he and Shaw had worked together on an INL ICS cybersecurity tool called Sophia. The practice at INL was to develop software and then effectively roll it out to the private sector.
Now in the private sector, Southfork made a bid for Sophia during its commercialization process. That sounds reasonable since the two founders had been instrumental in its development within INL, but it soon became clear that the new firm was not going to win the bidding process.
“So, I basically started from scratch and made an open source tool [called Visdom] that sought to solve the same issues as the Sophia tool but would be open source.”
This is where it becomes messy. How different can a second attempt at solving the same problems be from the first attempt? BEA (for INL) decided it was no different and sued Thuen and Southfork Security for copyright infringement, trade secret misappropriation, and breach of employment agreements, alleging that Visdom was illegally derived from proprietary INL code.
The case never came to a public trial, but behind the scenes under judicial review it first looked likely that Thuen would lose, then appeared he might win, and ended with a voluntary surrender, probably because of lack of funds to proceed. It looked as if he would lose when BEA immediately achieved an aggressive ex parte temporary restraining order allowing forensic experts to image Thuen’s computer hard drives and temporarily block the release of the Visdom software code. It was argued that Thuen was a self-described (malicious) hacker (‘We hack things and make tools’) who might destroy evidence.
As the case progressed, it appears the judge had a change of heart. BEA’s initial call for an injunction was rejected, dissolving parts of the restraining order; and a request for summary judgment by BEA was rejected. The case was going nowhere fast, but BEA would outlast Southfork if only on the basis of funds. The two sides reached a private settlement before any important precedents could be decided by the court. Visdom was surrendered to BEA and Southfork effectively dissolved, largely because the court initially and wrongly stereotyped its founders as malicious hackers.
Following the wind-down of Southfork, Thuen moved to Digital Bond in 2014. As a senior researcher he focused on industrial control systems, IoT security, and vulnerability research. He left Digital Bond at the end of 2015 and moved to IOActive as a senior consultant. This was a natural fit for his mindset: IOActive is an offensive security company where members often describe themselves as pirates working on the right way to do wrong.
He left IOActive in 2017 and founded Gravwell, where, nearly ten years later, he remains CEO. At Gravwell he wrote a guest blog for IOActive in 2020 titled Hiding in the Noise. It provides insights into both his history and attitudes. “I spent a number of years at Idaho National Laboratory, Digital Bond, and IOActive. At these places, my job was to find 0-day vulnerabilities on the offensive side of things.”
For all of these companies he focused on ICS. The initial focus arose because that was INL’s focus, but he retained the interest because it was challenging and a bit different.
“You’re doing protocol reverse engineering, including some custom protocols that you must dissect and do low-level network binary type things. All that was super interesting. General IT systems have kind of coalesced around certain technologies – everything is web now, for example. So, ICS stuff is challenging and quite interesting. I got into vehicle research, which is closely related to ICS with all those embedded systems; and so that bit was kind of fascinating to me.”
He describes Gravwell as a data analytics platform for security logs, machine, and network data. “I believe that defense involves more than looking for how threat actor XYZ operates, it requires an understanding of the environment and maximizing the primary advantage that defense has – this is your turf and no one knows it like you do.”
Corey Thuen is a complex character. He has the hacker mindset but has never been tempted into any form of malicious hacking. He was a little bit naughty as a youngster, but never nasty – he has what he seeks when recruiting for Gravwell: “the evil bit”. But it is not ‘evil’ in the traditional sense. It is the ability to be naughty but never nasty in order to achieve a good intent.
This attitude also appears in what he describes as ‘spite’ (but again, not in the negative or nasty sense of ‘spiteful’). “The best way to get hackers to spend extra time and get good work out of them is to say, ‘This system is unhackable’, because then, yeah, okay, all right…” he explained.
“I think I have an overactive sense of justice and an overactive sense of spite. If I’m told this cannot be done when it absolutely can, then I’ll do it for spite. Just because you say something doesn’t mean it’s true.” Saying something is unhackable is a direct challenge to any hacker.
He also has an entrepreneurial side. He has founded two separate companies. The first, Southfork Security, failed somewhat controversially. The second, Gravwell, is now almost ten years old (compare that to the short time he spent working for other companies). This suggests a need to be the master of his own destiny. But it also introduces an apparent contradiction in his personality. Hackers break things. Entrepreneurs build things. Corey Thuen does both, but always with a bit of a twinkle, a sense of humor, and a liberal sprinkling of colloquialisms.
Related: Hacker Conversations: Vinnie Liu, Performer Turned Ringmaster
Related: Hacker Conversations: Marcus Hutchins and the Journey From the Gray Zone to Redemption
Related: Hacker Conversations: Tal Kollander’s Journey From Black Hat to Hack Blocker
Related: Hacker Conversations: Jesse McGraw (GhostExodus), From Blackhat Hacker to Redemption
