Steve Bassi talks to BlockTempo TV about PolySwarm’s threat detection marketplace, a VirusTotal alternative that provides intelligence on malicious files and URLs. Bassi talk here about how PolySwarm can help curb cybercrime, plus his thoughts on the WannaCry attack and what blockchain projects need to be successful in 2019 and beyond.
Video transcription:
What was the original intention of PolySwarm?
My name is Steve Bassi I’ve been involved in software security since I was a teenager. I personally got interested in blockchain in about 2010. I read the original Bitcoin white paper and was really interested that someone built a distributed system for money with nothing more than a than a private key you could control funds; that was very interesting to me. My team and I are basically a bunch of hackers, so we’ve always liked sort of cool technical solutions to broader problems like money, antivirus and things like that. We were interested in this idea of decentralized money and decentralized ecosystems and how we could improve antivirus by creating a decentralized environment for security experts to compete against each other and detecting new viruses as they came out; that’s that’s sort of the origin of PolySwarm.
Why was the WannaCry attack such a big deal?
WannaCry was interesting, right. This idea that if you’re a bad guy you can create software that holds people’s computers hostage and make them give you money to release your data. That was a new paradigm and I think we saw it at scale with WannaCry. We really saw it affecting a lot of people; hospitals, little old ladies. The interesting thing about PolySwarm is we provide the same incentive but for the good guys. For the defenders. So the idea is instead of being the bad guy and locking somebody’s files up and ransoming, we encourage the good guys to detect things like WannaCry. And if they’re faster at detecting new viruses like WannaCry or new threats like any of the state-sponsored stuff out there, they can actually get paid thousands of times for the same detection. So they really just take the knowledge that’s in here and they produce software that detects these new viruses and essentially they can earn passive revenue. And this is the first time that anybody’s tried to do this in the antivirus world. So we’re really incentivizing people to stop being the bad guy and start being the good guy.
So in reality there’s no there’s no one way [a cyber attack] happens to every organization. It’s a combination of factors. Some organizations, like some hospitals in the UK, were just a victim of bad computer security practices. So they don’t update their Windows machines, they didn’t install antivirus software in the first place, you know people who open attachments without virus scanning them.
A decentralized threat intelligence marketplace?
So PolySwarm would help with some of those [above mentioned] things. We would help detect new things like WannaCry faster than maybe a single vendor would. A single vendor is like the traditional antivirus company is that you might install on your machine. The advantage of PolySwarm is we bring the wisdom of the crowd like essentially to the antivirus problems. So if anybody in PolySwarms ecosystem can detect a new threat they can actually help protect users. but in reality if someone’s got poor, bad computer security practices you know there’s there’s a variety of factors that go into that and it’s really about just upping the awareness and using better tools to detect new threats. I think those are the two things.
Why blockchain?
So a lot of credit needs to be given to the early systems like Bitcoin and the later systems in Ethereum. This idea that you can with blockchain with smart contracts specifically and with all these incentives you can essentially program new marketplaces so in our case we really wanted to leverage smart contracts small incentives to redo how antivirus is done, and really reward security experts who produce smaller antivirus engines that detect new threats really incentives them at a file level at a small microtransaction level to do better protecting users and two things about blockchain excited us one the ability to give small rewards to these antivirus engines and two the ability to record the performance of each engine on on a medium like a blockchain that even we as polyswarm where we developed the software to make this possible we can’t change that history because that history is essentially immutably recorded in a blockchain that we don’t fully control. So even if some antivirus company said we want to pay you PolySwarm a million dollars to change our history to show you know to to say that we’ve done better historically than we really have done we can’t do that so you don’t have to trust us PolySwarm to keep a record of somebody’s performance. You can trust the technology the blockchain itself the decentralized participants to keep an accurate record of how people were really doing in our ecosystem. Thats what really excites us about it.
Turn hackers into defenders? How?
One of the things we think will happen when we release PolySwarm, [UPDATE: PolySwarm was released 2019] is it provides a different economic Avenue to people who are currently scamming people or attacking people with malware right so you’ve got this guy in Ukraine or in Latvia or wherever right and sometimes the only way he can make a living is by creating ransomware and sending it out into the world so he gets payed for his creation, right. Because his alternatives aren’t that good. Maybe he doesn’t have very good job prospects locally or he can’t find technical employment but he’s got a very technical skill set. We think PolySwarm will help turn people like this into from attackers to defenders, right. Where instead of scamming users, or creating ransomware or attempting to hold peoples files hostage they’ll actually create software that will look for these types of attacks and help protect users instead of instead of actually exploiting them.
In your perspective what kind of blockchain project will succeed?
I think the projects that are going to be successful leveraging blockchain as a tool are the ones that take an old problem we’ve had; at the core of our problem is how do we get incentives into hands of defenders wherever they are, and how do we get those incentives, the small incentives, to them routinely without some middlemen right with like a bank or whatever. But the successful projects I think are the ones that take an old problem like how do I get small amounts of money to some guy over there without a middleman. And they sort of take that problem space and reframe it. For example how do I pay people in the third world efficiently. How do I create micro loans to help people out of poverty, right. If they can use blockchain to sort of rethink these problems and create a new solution that wasn’t possible through like the traditional banking infrastructure, or wasn’t possible because local governments are corrupt and there was no way to sort of remove that middlemen. I think those are the projects that are going to succeed personally — the ones that use a tool to solve an existing problem.
Try the PolySwarm marketplace for yourself, free at the Community level, here.