Learn the rules: The hacker mindset

STANDARD INTRODUCTION: This is the Microsoft Research Podcast, where Microsoft researchers—driving advancement through fundamental science and technology research—explore the who, how, and what’s next in computing and AI.

[MUSIC ENDS] 

WEISHUNG LIU: Hi, and welcome. My name is Weishung Liu, and I’m a principal technical program manager here at Microsoft Research. And today, I’m joined by Mike Walker, who is a research manager here in MSR, or Microsoft Research, where he leads projects at the intersection of AI, cybersecurity, and large distributed systems. 

Before Microsoft, Mike led DARPA’s Cyber Grand Challenge, the pioneering program that demonstrated autonomous AI systems capable of finding and patching software vulnerabilities. And CGC actually just celebrated its 10th anniversary this year in 2026. 

Mike’s work spans groundbreaking efforts that include cloud native memory analysis, automated malware analysis, and next-generation cyber defense technologies. 

Mike, thanks for joining me. 

MIKE WALKER: Good to be here, Wei. 

LIU: All right, so, Mike, we have known each other for a couple of years now. And I’ve heard, like, bits and pieces of your story over time as we’ve gotten to talk. But before I really knew who you were, sort of, as a person, I, kind of, knew you as, like, “Mike Walker, the hacker guy that’s working over there,” which I’m sure you love. And I know you love that, when I call you “The Hacker.” 

But you’ve worked on so many things that I’ve never really thought about before. Like, new words have entered my vocabulary as a result of knowing you and working with you, like threat intelligence, nation states, and I think there are a couple other ones that I think would have never been in my lexicon had I not known you. 

So I’m hoping we can spend this time to also have the audience get to know you, as well. So we’re going to start at the beginning then. And the beginning is, I believe, Mike, you grew up in Ohio. 

WALKER: Columbus, Ohio. 

LIU: Columbus, Ohio. What kind of a kid were you in Columbus, Ohio? 

WALKER: I think I was a kid who spent a lot of time in the woods. [LAUGHTER] I was a skateboard kid. I was a basketball kid. But I think mostly I was a kid who read books and lived in a world of their own imagination. 

LIU: Were you on a farm in Columbus, Ohio, or were you in, like, or is this more suburban, rural, urban? 

WALKER: It was halves and halves. I spent my … most of the year in Columbus, Ohio, and then every summer, I would go out to the town of Tappahannock on the Rappahannock River in Virginia. And I lived completely on the farm. 

LIU: So what was the lifestyle in what you were doing different between, like, Columbus, Ohio, and the farm? 

WALKER: So, like, some things that I was doing in Columbus, Ohio, is that my father, who was sort of half scientist, half venture capitalist, would bring me home industrial equipment and say, “See what you can make out of this,” and drop it in my room. [LAUGHTER] Really dangerous stuff. And he would always give me safety warnings, right, like, “This is a helium neon laser.” You know, “This is … this tube is made out of glass. Don’t break it.” And then, “This is a really, really high-voltage power supply driving it, and it can arc and kill you,” right. And I knew what that meant. [LAUGHTER] And then he would leave me with it. And what can you make out of this, right. 

So I would do stuff like, like try to replicate the Michelson-Morley experiment, you know, because I had the, had the table and the mirrors and I could do that. And then also I spent a lot of time with the Apple II, which was this just incredible machine from some other universe that I had never gone to. I later found out that was, you know, hackerspace and, and information technology culture, but it came from nowhere and there was nobody I could talk to about it. And so I spent a lot of time trying to hook the Apple II up to stuff in my life and, and try to control it with that thing. 

LIU: OK, so you brought up some hacker stuff, so I have to ask. There was farm stuff. There was, you know, “dad brought home interesting tools and equipment.” How did all of that get you interested in cybersecurity? 

WALKER: I think I was always in cybersecurity. I just didn’t know. 

LIU: Explain. 

WALKER: You know, there’s this idea that you live two lives: the one before you find out your purpose and the one after you find it. This was, sort of, life before purpose, where I didn’t know why I was so interested in how these things worked. 

So, you know, I ran a bulletin board system. Before the internet, this was how computers communicated with each other. Dial-up modems, not even backbone linked. Each, each BBS—bulletin board system—[LAUGHTER] was, was a universe unto itself, you know, architected by its creator. And so there were all these little universes you could dial into. And then at some point, all these things I’d been doing my whole life, sort of, got connected to a career. 

When you say, you know, somebody could, right, somebody could listen to every single badge swipe event on the network, on campus, and then replicate them and badge themselves into any building they wanted because this is all in a broadcast LAN [local area network] and somebody should change that, there was a time when if you said things like that, the people you told it to would just be like, “Well, don’t do that,” [LAUGHTER] right? And then … 

LIU: Did you listen to them? 

WALKER: No. [LAUGHTER] I was young. 

Um, and then at some point, the world started getting serious about imposing rules onto networked computers, and they started hiring people who are interested in that. And that’s … suddenly it was a career, right. I was like, “Oh, I was always here, but now it has a name.” 

LIU: So I have to ask then, like, you brought up the notion of rules. I feel like cybersecurity and rules has a relationship there. How much of a rule follower were you growing up versus how much do you think you are a rule follower now, and was there a difference or have you always been some version of “rule following”? 

WALKER: Well, you have to understand the rules if you want to be able to do what you want. 

LIU: Yes. 

WALKER: So I have a definite fascination with the rules, [LAUGHTER] but the thing you have to understand about the rules is that rules are a social construct. And I think that a lot of … in the computer security field, when, when people hear the word “security” and they think about the rules that the security system is imposing on them, every time a security system asks something of users, then you’re asking for their trust. And that trust is a precious commodity. And so when you squander user trust, then the security regime falls down. So I think it’s really important to understand the social context of rules instead of just having instant adjudication. 

LIU: OK. I’m going to have to ask you then about a game that we played recently called No Vehicles in the Park (opens in new tab). 

WALKER: No Vehicles in the Park is … it’s a game about content moderation is one way to look at it. I think it’s a fascinating thought experiment. But it just takes the thesis that rules are simple and challenges it with putting the player in the position of judge. And so the name of the exercise is the name of the rule, which is no vehicles in the park. 

And then it asks you some very simple commonsense questions about, is this a violation of the rule no vehicles in the park? Like if the International Space Station overflies the park, is that a vehicle in the park, and is it against the rules? 

LIU: Mike, do you think the ISS flying over the park is a violation of the rules? 

WALKER: No. [LAUGHTER] But it’s important that we have a resilient way to adjudicate things that, that bridges social norms. 

LIU: OK. How much did you agree with the population, by the way, of No Vehicles in the Park? 

WALKER: I’ve rarely ever broken 50%. Yeah. 

LIU: I got like 90 … 

WALKER: I play often. 

LIU: I think I got 96% on my first try, so I think I … does that mean I’m kind of like a lemming that, like, just understands the social construct of rules? 

WALKER: I think it means you, you channel the zeitgeist. 

LIU: Mm, OK, I’ve been assimilated. 

WALKER: Right … 

LIU: That’s what it feels like. 

All right. So let’s talk about something that I love, which is you had a short segment in 60 Minutes (opens in new tab) where you had a conversation with Lesley Stahl, and she described you as “one of the world’s top hackers,” at least at the time in which she interviewed you. And so now I have to know, how did you find hacker cultures? What was the extent of your involvement and, you know, how did you really get into it? 

WALKER: It, sort of, happened all at once, and I can tell the beginning of the story, and then I can tell you the day that the story stops. 

So the beginning of the story is that I was working at a, at a startup building telecommunications technologies on Sept. 11, 2001, and I was living in Maryland, outside of Washington, D.C., but my wife was in Washington, D.C., on that day, and, um, and then all the phones stopped working. My workplace was overflown by an F-16, and, and after that, in the nation’s capital, there was this sudden talent search for people who understood computer security or people who’d always been there but didn’t know what it was called. And that talent search found me. 

LIU: What, uh, what were the qualifications, like, that you had that, you know, matched with their list of talent that they were looking for? 

WALKER: I wish I knew. 

LIU: World’s top hacker? 

WALKER: I think, I think that that label was placed on me much later. 

LIU: [LAUGHS] All right, fine. 

WALKER: I think that I became part of a series of cultures after that day, and one of them was the, the group of people who play in DEF CON Capture the Flag, which is a hacking contest in Las Vegas. And when you start getting involved in trying to get, get better at something in a way where you can compete at a national or international level, especially in sort of a coffeehouse environment where everyone else is trying to get better, too, it sort of propels you upward very quickly. 

LIU: OK, let’s, let’s go back later to talk about Capture the Flag, because I think it’s related to the, sort of, next arc of your life, which was your time as a project manager—program manager—at the Defense Advanced Research Projects Agency, also known as DARPA, which is also why Lesley had been interviewing you at the time. It was associated with your affiliation at DARPA, and you were there for about four years. 

How did you, how did you go from, you know, let’s say call, call to action from the nation’s capital looking for people with your specific set of skills to being at DARPA as a PM. 

WALKER: So we should, we should be clear, we’ve just, sort of, skipped over 11 years of Mike trying to get better at hacking. 

LIU: [LAUGHS] You were world’s top—look, I just believe world’s top hacker, one of the world’s top hackers. 

WALKER: Well, I think, uh, I think my, my friends, colleagues, and teammates from the time, if they were here to, to hear that accusation being made, would give me endless grief about it. 

Certainly, there was a, there was, sort of, a golden age of Capture the Flag, and I got to be part of it and see some of the people. I got to see the game change over time. But it was a competition, so … and it was very reflective of a skill set that was of national interest. I think at the same time, the think tank RAND had published an opinion piece called Hackers Wanted (opens in new tab), right, which, sort of, described the immense need for more people who could think that way at a high level. 

And DARPA, specifically Norm Whitaker and Dan Kaufman, who were leading I2O [Information Innovation Office] … 

LIU: DARPA Dan! 

WALKER: DARPA Dan … looked at the game of hackers, right, and if you could think of that as soccer, their immediate question was, what about robot soccer? You know, could we make automated systems that could play this game? And so they encountered myself and some colleagues giving a talk about, sort of, the, the interleaving of Capture the Flag as, you know, hacking contests and talent development. And they said, you know, could you do talent development for computers the same way, right? Could machines play Capture the Flag? And that, that was the beginning of the conversation about building the world’s first all-machine hacking tournament. 

LIU: OK, so now, now maybe let’s go back and explain what DEF CON Capture the Flag was, or CTF, because I think a lot of us who are again not in the space, you say, “Capture the Flag,” and I’m thinking, like, summer camp. And, you know, each … there are two teams, and there’s kids who hide flags, and then you try to run around and find the flag, you find the defenders and whatnot. So what was the DEF CON version of this? 

WALKER: It’s changed over time. That’s the thing about this game that I should lead with is that Capture the Flag is different with every generation, and at least in my opinion, I think it’s gotten better with every generation, right. Each hacking group that’s picked up the lessons of the past and the game has made it better, but it is, sort of, based around that playground idea, right. My team has some flags. Your team has some flags. We’re going to try to take each other’s flags. Whoever takes the most wins, right. It is that simple. 

Now there are more than two teams, somewhere between eight and 16, and each team is trying to take flags from every other team. They’re trying to protect their own flags. But, of course, the flags are made of data, right, … 

LIU: Mm-hm. 

WALKER: … or control over a networked system. And the way that you protect your own data and control of your own network system is network defense, right, and computer defense. And the way that you take flags from other, other teams is you hack into their servers and you take their flags and you do it without getting caught. And then what makes this game, sort of, unique is that all the software that you’re protecting is written just for that game. It will never be used again. It’s boutique. It was written by the organizers, kept in secret, revealed to the teams the minute they sit down. They’ve got new software they’ve never seen before. They don’t know what it does, and they’re in a race to understand it, and they’re racing everybody else. Because if you can understand it, then you can protect it, and if you can understand it, you can hack it. 

LIU: OK. So let’s get into this thing called DARPA’s Cyber Grand Challenge, or CGC, which just celebrated its 10th anniversary. And so from what I understand, CTF—humans playing soccer. CGC … robots playing soccer? Is that probably a good way to, to … 

WALKER: That’s exactly it. 

LIU: OK, so now explain to me a little bit further, like, what was CGC, what was your role, and then more importantly, did it feel historic at the time or just, kind of, impossible and you somehow figured out with a large group of folks at DARPA, “This is how we’re going to solve this impossible thing”? 

WALKER: Well, there’s, there’s two ways to answer that. There’s the, the day before it worked and the day after it worked, right. [LAUGHTER] There were actually three and a half years before it worked. So if you’d ask me, I think, in any of that three and a half years, I would have said let’s wait and see. 

LIU: So, so what was it, though, like—by the way, I think you can watch the first CGC online (opens in new tab). Like, there’s a whole recording of the event. 

WALKER: There is a recording of the event, which we had sports casted live with announcers, and, and so you can watch it as it happened, and it was, it was a capture the flag, right—protect data, steal data—that was run entirely by autonomous systems behind an air gap, so if they failed, there was no person even to turn them off and turn them back on again. 

LIU: So how did … so if I think about how you just described Capture the Flag with DEF CON, but there were, like, people on the floor coding, I’m assuming, though, you’re saying CGC did not have that. So were there teams that had, like, pre-created something? 

WALKER: Yes. They had spent many years of their life actually building these autonomous systems, and you can’t really preflight an autonomous system whose purpose is to fight. You can preflight an autonomous system whose purpose is to maybe go for a drive, right. You can take it for a drive. But if you’re going to fight other systems, you have to, like, build another one, right. And we did give them some exposure to a, sort of, scripted opponent. 

The DARPA infrastructure team built a scripted opponent and attempted to give teams some pre-exposure. But that first confrontation between adversarial hacking machines, there wasn’t really a great way to prepare for it. And so the teams were in this really tough position of watching the systems play—win or lose—in a way where they couldn’t do anything but watch. 

LIU: So, you know, I want you to think back on that time, as well, because, like, now when we’re talking about AI, it seems a little bit more commonplace, right? We’re like, oh, you know, we have GPT, we have Claude, we have a lot of other models, as well. So, like, how historic was that? Because I think it can’t be understated how vastly different, sort of, autonomous or artificial intelligence capabilities were like 10 years ago versus now. 

WALKER: It was, it was a different universe of capability, and Cyber Grand Challenge had a role in the development of the technology stacks that we’re seeing today, but it was an expert systems contest. There was, there was no—at that time, we would have called it machine learning—but there’s no, no real involvement, critical involvement, in machine learning. 

But there was this fusion of tooling where you had, sort of, an autonomous set of tools that could perform a lot of these tasks as far as conventional compute could push the state of the practice at the time. I think if we look back from the perspective of today, which is, which is still a perspective that’s difficult to keep up with and difficult to appreciate how, how radically different the intelligence displayed by today’s models is from what we had in 2013, 2016, we’re still seeing the technology stacks that we would have called “expert systems” in 2016 being used as what we call a harness today. 

So if … just to talk about another DARPA project, AIxCC [AI Cyber Challenge] (opens in new tab), which happened a few years ago, some of the people from Team Atlanta, which won that competition (opens in new tab), are building a harness called MDASH, which is, I think we could call it a cyber reasoning system that is powered by models and used to do these sorts of tasks autonomously. 

LIU: You were interviewed by The New York Times in 2016 about CGC (opens in new tab), and you said that making networked technology safer was a “challenge for civilization.” And, you know, what do you think about that? Has civilization made progress on, you know, resolving that challenge? And what are some tangible takeaways that you think, you know, from 10 years ago till now, think through sort of how, how we’re making things safer for civilization? 

WALKER: I’d say that’s as true now as it was then, maybe more so. And I think our dependence on networked systems for every piece of civilization has only increased. I think it’s difficult to buy a car or to participate in a utility grid that isn’t networked, right. 

How we’re doing? I think that we’re seeing a great disruption of the status quo right now. I think that we reached a pretty steady-state equilibrium, where our, our security in our networked civilization was, sort of, dictated by offensive scarcity. There was a known cost for high-end computer network attack, and that cost equation has been completely upended by the capabilities of models. 

LIU: So in thinking about, sort of, capabilities of models then, some terms that, that I’ve heard used are things when we’re testing models, for example, is––we call it––red teaming. But then I also hear that there’s something called blue teaming. And then, of course, if you’ve taken primary colors or understood kindergarten primary colors, if you put red and blue together, you get purple teaming. Can you explain to the audience a little bit about those differences? 

WALKER: Yeah. Red team and blue team is sort of an artificial separation between being an attacker and being a defender, and it’s also, sort of, an oversimplification and an abnegation of capability, right. Attackers attack; defenders defend. But if you, if you take that simplification away and you look at what’s going on under the hood, you’ll see that the difference between offense and defense most of the time is, sort of, who’s in control or who’s driving. 

If you were to give a name to a program that encrypted every file in your computer and then unlocked it when you needed it, that is either a cryptography utility or it’s ransomware depending on who holds the key. If you were to give a name to a program that, that allows you to log in to your computer remotely and control it, maybe your home automation setup, that is either malware or remote administration utility [LAUGHTER] depending on who holds the key, right? Who holds the key. 

So there’s, there’s this, sort of, blurring of offense and defense where computer security capabilities at their most atomic basic level aren’t offensive or defensive. They’re dual use. And so the idea of red teaming and blue teaming is sort of this idea that we can impose single use onto dual-use capabilities, and purple team is the acknowledgment that that’s not true, right. 

Attackers, as soon as they break into a network, they have an intrusion that they need to defend. You’ll hear all these terms like moving laterally, which just means breaking into more computers, or exfiltration, which means taking data. But the whole time they’re doing that, they’re trying not to get caught, right. So they are defending their attack, right. 

LIU: Mm. 

WALKER: And at the same time, when defenders are doing things like log analysis or really any—or traffic analysis—their tools themselves can be broken into, right. They have a duty to defend their own tooling, and they also need to, in order to prevent attackers, they need to be able to find vulnerabilities, find weaknesses, and then grade weaknesses in their own software. And the way that you find vulnerabilities is vulnerability research, and you grade weaknesses by writing exploits or at least proof of vulnerability, and that’s offense, right. So purple team is just this idea that attack and defense are the same skill set. They’re the same tooling. They’re blended. And it’s really a contest to control the logic of memory of networked computers run all the time. 

LIU: All right. So, so I’m going to ask you a little bit about the team that you manage then. It’s called New Security Ventures. And would you classify the type of work that you and your team do as being red, blue, or purple? Or are we going to introduce a different coloring from the rainbow? 

WALKER: I think that we do highly offense-aware defensive tool development. So we build defensive tools, but we build them knowing that they are a target. 

LIU: What’s one example of a project that your team has been working on? 

WALKER: We have a project we call Project Freta. It’s named after the birthplace of Marie Curie (opens in new tab), the pioneer of battlefield imaging (opens in new tab). [LAUGHTER] And the idea is, is that … well, first I actually need to introduce tampering. We think of ourselves as the solution to tampering, but, but first, what’s tampering, right? 

LIU: What’s tampering?

WALKER: What problem are we solving?

So let’s say that my job is to break into a store undiscovered, right? It’s mission impossible, right? I’m going to break in, take the Doritos, not get caught, right. 

 LIU: Wait. Hold on. What flavor of Doritos? 

 WALKER: I don’t know. 

 LIU: What?! 

WALKER: I don’t actually eat them. I’m sorry. 

LIU: OK, fine. 

WALKER: But that’s, you know, it’s mission impossible. I have to take them. 

LIU: Fine. You got to go get Doritos. 

WALKER: I have to not show up on the video. 

LIU: Yeah. 

WALKER: I can compute this path of not being observed by the video camera. It’s really hard, right. Maybe I do some, some kung fu, some gymnastics. I slide into the laser wire, I grab it, and I get out. But there is another way to break in and not get caught, which is to walk in, right, wave at the camera, cut the feed on the camera, take it down, and replace it with a fake video camera that just plays good video, like there’s nobody in the, in the store, and then go in and change the tape and leave. That’s tampering, right? 

LIU: OK. 

WALKER: And it sounds actually less complicated, right, than trying to simply not be observed. And if you look in the computer security world at tampering, tampering is often the easier way to accomplish the objective of an attacker, which is to break in and not get caught and defend their intrusion, right. They’re doing defense while they’re doing offense. And so Project Freta is an attempt to solve that at cloud scale, to make it so that when defenders acquire defensive signals, right, telemetry signals about what’s happening in computers, they don’t do it with software that can be removed or tampered with. They do it by acquiring signals from cloud hardware. And so we’re a whole-system memory analysis environment built from the ground up for looking at memory that’s acquired from cloud hardware. 

LIU: So, OK, so you just revealed, for example, how Project Freta works and how it protects or is trying to defend against something like tamper. But then, you know, I’m kind of curious, though. You just revealed how it works. So, you know, you’re kind of telling the attackers what you’re doing and how you’re defending. How does that work if you’re like, “This is how I’m defending, like, this is how I’m defending my castle. Here you go”? 

WALKER: Well, you can reveal a technology or you can reveal its deployment. And I’ve revealed a technology, and I haven’t said anything about its deployment. 

LIU: OK, so there’s a, there’s a difference, and there’s layers that you’ve described so that, you know, even though you’ve revealed something, you haven’t revealed the full extent. 

WALKER: Well, you’re, you’re bringing up a really interesting part of the game theory of, of adversarial computer network attack-computer network defense, which is that attackers condition their behavior based on their perception of what the defense is doing. And so that gets into these, these strange effects of, is the best way to protect a network to say that you have something or to actually have it or to have a mismatch between what you say you have and what you have. 

LIU: So you’re like bluffing in poker. 

WALKER: There’s a reason this game is played in Vegas. [LAUGHTER] 

LIU: OK, OK. So we’ve had, we’ve had some, like, more serious, like, topics for a while. And I want to get into something that maybe a lot of folks who maybe even know you don’t know about you, which is you love—I think I’m going to use … I think I can say love—cycling. 

WALKER: That’s true. 

LIU: How did you get into cycling? 

WALKER: I got into cycling in, sort of, the way that I’ve gotten into a lot of things in my life, which is I got into it through what I thought at the time was, was a disaster. I blew out my knee playing basketball, which was one of my first great loves, right. And I went through surgical repair. And afterwards, the surgeon told me you can’t do the stuff with this knee that you used to do. 

I said, “Well, what can I do?” You know, I hadn’t even thought to ask this question before surgery. You know, I’m sitting there trying to, like, rehabilitate the knee. And he said, “Well, you could try swimming or you could try riding a bike.” 

I didn’t really know anything about either one. You know, I used to ride a bike to get around. And then a friend of mine in college introduced me to mountain biking, which is sort of this idea that you could take a bicycle, which is a very stable system—you know, you go out and you ride it down the sidewalk; it works great—and ride it over, you know, just horrible, you know, really steep, rough terrain that no one should ever try to ride a bike on. 

LIU: OK. And you did this recently at a 100-mile endurance race called High Cascades. 

WALKER: High Cascades 100 (opens in new tab). 

LIU: And what was it like to prep for that? Because I feel like you’ve been, you’ve been working on some very important things on the professional side. And then you also had this big 100-mile endurance race that you were prepping for on the personal side. How did that go? 

WALKER: There are very few things in life where you have a fixed date and time where you have to show up and deal with uncertainty, and ultra-endurance racing is one of those. Um, there’s, there’s the parts that you can prepare for and the parts you can’t, right. You can’t prepare for the smoke forecast or the weather. You can just have a range of options. 

But then, you know, as far as the conditioning, I do spend a lot of time on the indoor trainer. I just wake up really early. I have, I have a whole structured plan. I think I start...