DarkReading: Superhero Loki Lurks Like a Zero-Day Threat

Matt Shea Chief Strategy Officer

Matt is Chief Strategy Officer for MixMode AI. With over 20 years’ experience in the technology space, Matt has concepted, architected and developed groundbreaking solutions that blend equal parts of technology, product and business.

Recently, MixMode’s Head of Federal, Matt Shea, wrote an article for DarkReading titled, “Superhero Loki Lurks Like a Zero-Day Threat.”

The following is an excerpt from that article.

Superhero Loki Lurks Like a Zero-Day Threat

The Marvel creation may just be the perfect example of a zero-day attack with no signature.

Loki on Disney+ is a fun new show that pulls back the curtain on the new multiverse aspect of the Marvel Cinematic Universe (MCU), with infinite timelines where almost anything that could happen has happened somewhere. It gives fans the “What if?” of many comic book conversations over the years: What if this character got away with the infinity stones? What if that event never happened, or the bad guys won? You get the picture.

All this timeline chaos apparently doesn’t sit well with the newly introduced Time Variance Authority (TVA), which is empowered to remove all the characters behaving differently than the desired, sacred timeline. Let’s call this timeline the baseline of outcomes that are supposed to happen in the eyes of the TVA. Anyone not falling in line with that is considered a “variant” that shall be removed, or “pruned” from the timeline.

We learn early that the Loki we have seen since the first Thor movie is just one of countless possible versions of him out there. Due to the events in Avengers: Endgame, he finds himself taking a path divergent from what we were originally shown. This deviation leads to him being branded a variant and captured by the TVA.

What does this have to do with cybersecurity? Well, Loki might just be the perfect example of a zero-day attack or attacks with no signature.

No Rules

The TVA is tasked with monitoring the sacred timeline and is alerted when branches start to crop up due to variant behavior. They only have a few minutes to break out their TemPad to open a Timedoor and swoop in to save the day before permanent damage is done.

A more perfect analogy of the overworked security operations center team might not exist.

Just like the SOC analyst, the TVA has to find these threats and remove them as quickly as possible. Let’s say you are tasked with being this TVA agent and are told you need to search all the timelines (an almost infinite number of them) and find all the Loki variants to have them removed.

Being a good analyst, you decide you are going to write a query or set of rules to find them. You start out with a general description of the Loki we have seen for years. Tall guy, long hair, looks like the actor Tom Hiddleston. You then run that query and get a number of hits.