Mikko Hyppönen, a luminary in the realm of cybersecurity, reflects on his illustrious career during this insightful dialogue. With over three decades of experience, he articulates the evolution of his professional journey, transitioning from programming to the intricate domain of malware analysis. He recounts his initial encounter with malware, specifically the Omega virus, which ignited his passion for reverse engineering and paved the way for his enduring contributions to security. Moreover, Hyppönen unveils his recent shift toward drone defense technology, indicating a profound commitment to addressing contemporary challenges in military applications. As he prepares to leave the cybersecurity landscape, he expresses gratitude for the community that has supported him throughout his tenure, underscoring the importance of collaboration in making the digital world a safer environment.

In this special edition episode of the Security by Default podcast, Mikko discusses his extensive career in cybersecurity, his transition to a new role in drone defense, and the innovative Museum of Malware that showcases the intersection of art and cybersecurity. He reflects on his journey, memorable experiences, and the importance of storytelling in engaging audiences

Takeaways

• Mikko's alternative career choice was journalism.
• He started in programming and transitioned to cybersecurity.
• Keynote speaking at Black Hat involves storytelling.
• Experience reduces anxiety in public speaking.
• The Omega virus was Mikko's first memorable malware.
• The Museum of Malware archives the history of cyber threats.
• The museum features art inspired by malware and cyberattacks.
• Mikko is transitioning to a drone defense company.
• He sees parallels between cybersecurity and drone defense.
• Mikko expresses gratitude for his 34 years in the cybersecurity industry.

Resources:

https://www.withsecure.com/en/experiences/museum-of-malware-art

Miko, welcome to the short round fire of the Security By Default podcast.

It's a pleasure to have you back.

We've chatted many times over the years.

You've been doing black hat for many years.

How many times is this black hat for you?

20.

I'm guessing somewhere there a lot of, lot of conferences.

So I have a question.

When you're starting off in your career at a very young age, what actually, what was your alternative career option?

What were you.

If you weren't.

If you didn't get into cybersecurity, what would you be doing today?

I'd be a journalist.

I actually wanted to be a journalist.

I did a bit of like a radio journalist work when I was 18, 19.

I remember interviewing James Brown when he was visiting, towing a gig, things like that.

Also telling that I actually cut and pasted that interview, like literally cut it.

The tape that I recorded it on and I used tape to, you know, put it back together.

That's the way we did it.

I never got into the university that taught journalism, so then I took the alternative path, which was, well, computers.

It was very similar.

When you think about journalism, it's a lot of research, but did you choose cybersecurity or security at the time, because it wasn't called cyber, or did cybersecurity choose you?

What was it?

I was a programmer.

I studied on 8 bit computers, which taught me to do really low level programming on very restrictive devices.

And then later when I was hired to do programming professionally, well, the same company was also doing security and they realized that I could reverse engineer stuff, so they started giving me malware.

Mikko, can you reverse engineer this?

Can you decode and figure out what it's trying to do?

And I could.

That's what I started doing 20, 30, 35 or so, and I'm still doing it today.

That's impressive.

That's such a.

Very few people have such a long career.

Because in this industry, in this economy, careers change very often, almost like every five to 10 years.

So that's impressive.

You've done hundreds and hundreds of keynotes of the years and conference talks.

What's different about giving a talk and a keynote here at Blackout?

Blackout isn't actually that different from giving a keynote anywhere else except the audience, of course.

The keynote is huge.

12,000 People.

That's a lot of people for anybody.

But it's also a very knowledgeable, very technical audience.

So you really must not underestimate the technical level of the audience.

But in the end, what people really want to hear is stories they want to hear about what other people have done, what they've learned, and that's universal.

And that applies here at Black Hat as well.

Absolutely.

Fantastic.

I mean, I also.

I do a lot of talks over the years, and even before talks, I have a lot of my own personal preparations and rituals and kind of things that I do to get ready for it.

Do you still get anxiety?

Do you get, like, you know, some, you know, pressure?

Do you get scared?

Do you have any rituals?

How do you prepare for giving keynotes such as what you give here?

I have no tips to give there except to do a lot of talks.

I don't have rituals.

I don't get nervous because I've done my hundred thousand hours of talking.

How many hours?

You want to count?

I don't know.

I've done this for 20 years.

And of course, then it becomes something which, you know, regardless of the situation, that you'll be able to handle it regardless of the audience, regardless of the stage, regardless of the technical things.

Even if there is a breakdown and you lose your slides, you know, it's going to be okay.

And.

And I do think that this also matters to the audience.

When you have a really experienced speaker walking on stage, it's somehow obvious.

The audience will immediately know that he's.

He's gonna do it, it's gonna be fine, regardless of everything else.

Absolutely.

So practice makes perfect.

It's about, you know, repeating and practicing and just getting into it becomes almost.

Like a habit, and you become confident, and that's.

That's really.

It's obvious to the audience that this guy knows what he's doing when he's confident.

So a quick question.

What's your most memorable piece of malware?

What's the one that sticks?

Years?

Because you've.

You've researched many.

You've reverse engineered probably hundreds, if not thousands of pieces of malware.

What's the one that kind of always sticks in your mind?

There's many different options.

I could go with the obvious ones, like Stuxnet.

We could speak about Isla View, the largest email worm outbreak in history, which we were the first ones to find.

But I will start.

Or, I mean, I will.

I will choose the one that started it all for me, which is Omega, the very first malware I was ever assigned, reverse engineer.

I spent three or four days decoding it because I had no experience whatsoever.

In fact, I didn't even have a computer I could use to run the malware on because computers were expensive and we couldn't afford to spare a computer just for infecting it.

So I printed out the code, went through the code with pen and paper, had a interrupt reference list and an ASCII chart.

And I decoded it successfully, figured out how it replicated, how it activated on Friday the 13th, every time overriding all the files in the computer and then displaying a symbol.

And I was looking at the ASCII chart to decode that it's the Omega symbol.

And maybe a month later, I got a computer I could actually infect on purpose.

And I ran the malware, I changed the date, and it indeed was the Omega symbol.

And it was also the first virus I ever named, the Omega virus, which you can still find online if you Google for it.

And that started a tradition with our company, which is that after you work with the company for 10 years, you get an Omega watch.

And I've been carrying my seamaster omega for 24 years now.

And I know what you're thinking.

I should have named the virus Ferrari.

So that leads me into one of the things that just recently launched, I think it was last year, was the Museum of Malawar Art.

Tell us a little bit about it.

Can people find it online?

Can they go visit it?

What's the way to get to go experience the museum?

I've been part of several really cool projects while working with this company.

But one of the coolest projects I ever did with Data Fellows or F Secure or witsecure is this museum project, which we started already three years ago, originally with the idea of archiving the history of malware and virus attacks and all that.

It expanded from just a museum into an art museum.

And this is a physical museum you can visit in Helsinki, Finland.

If you go to museumofmalware Art, you'll find the webpage and you can book a visit and come take a look at the things we have on display, where we have the history of malware, old viruses on display, but then completely new modern art, commissioned especially for the museum from international artists, where all the art pieces are inspired by malware or by cyber attacks.

And we have sculptures, paintings, AI art, interactive art, graffiti, textile art.

It's pretty amazing.

And it's a permanent museum I'm really proud about.

Absolutely.

Make sure that the audience who's listening in will actually get easy, easy links to be able to find out more about museum and also how to visit when actually doing a visit to Helsinki, Finland.

Sure.

So you've made a major announcement recently about a change in your career.

And direction.

Can you tell us about what's.

What's next?

What's your next passion and hobby?

What are you going to do in the future?

As we are recording this, I'm on my final days working at Widsecure.

So after 34 years, I resign and I will starting in a new industry.

I'm joining a drone defense company called Sensor Fusion, building hardware products to locate and fight aerial drones and other kinds of drones as well.

And this is mostly used for military use nowadays, as we know.

The war in Ukraine has shown to us how the face of war has changed thanks to different kinds of drones.

And this is something I feel has more meaning right now than any other field of research.

And that's what I'll be doing in the future.

And I think there's a lot of similarities between cyber defense and drone defense.

And I'll be bringing what I've learned over these decades from cyber into drone.

There's definitely a lot of overlap for sure.

So for you, will this be your last blackout or are you going to come back?

It's going to be my last Black Hat.

Who knows?

For now it's the last one.

I won't be completely leaving cyber, but I will no longer be working in cyber security industry.

Final.

You know, Migo, thank you for being everything you've done over the years in the industry and making the world a safer place.

And now I'm really excited about you're continuing to continue to do that in another area with drones where it's really, you know, that's accelerating, I think, faster than anything else.

And it's changing a lot of the kind of the defence and the country's sovereignty as well.

So thank you for everything you've done.

Any final words of wisdom, any final notes you want to leave with the audience?

I want to repeat what I told the keynote audience here at Black Hat in my final words from the stage, which was thanking people for their work and thanking people for giving me a home.

Giving me a home for 34 years.

Thank you.