1 00:00:00,354 --> 00:00:01,644 W. Curtis Preston (2): Are you curious about the world 2 00:00:01,644 --> 00:00:03,354 of offensive cybersecurity? 3 00:00:03,684 --> 00:00:07,734 We recorded this episode last year with Duane LifeLock, the CTO and red 4 00:00:07,734 --> 00:00:09,444 team leader at Pollstar security. 5 00:00:09,864 --> 00:00:13,314 It was one of the most popular and enlightening episodes from last year. 6 00:00:13,494 --> 00:00:14,844 So I'm playing it again. 7 00:00:15,174 --> 00:00:20,004 I could listen to his stories all day, make sure to pay close attention for when 8 00:00:20,004 --> 00:00:25,014 we start talking about backup systems and their role in a cyber attack, he confirmed 9 00:00:25,014 --> 00:00:27,474 my worst fears and then gave me new ones. 10 00:00:28,014 --> 00:00:30,414 I think you're going to really enjoy this episode. 11 00:00:30,444 --> 00:00:36,234 You'll learn a lot and I hope you'll enjoy listening to his stories as much as I do. 12 00:00:37,194 --> 00:00:42,204 By the way, if this is your first time listening I'm w Curtis Preston, AKA Mr. 13 00:00:42,204 --> 00:00:42,714 Backup. 14 00:00:43,074 --> 00:00:46,914 And I've been passionate about backup and recovery for over 30 years. 15 00:00:47,244 --> 00:00:51,894 Ever since I had to tell my boss that we had no backups of the giant 16 00:00:51,894 --> 00:00:53,664 database that we had just lost. 17 00:00:54,084 --> 00:00:55,734 I don't want that to happen to you. 18 00:00:55,734 --> 00:00:57,084 And that's why I do this. 19 00:00:57,444 --> 00:01:02,424 On this podcast, we turn unappreciated backup admins into cyber recovery heroes. 20 00:01:02,724 --> 00:01:04,914 This is the backup wrap up. 21 00:01:17,877 --> 00:01:18,867 Welcome to the show. 22 00:01:19,843 --> 00:01:22,273 W. Curtis Preston (2): I'm your host, w Curtis Preston, a k a, Mr. 23 00:01:22,273 --> 00:01:22,783 Backup. 24 00:01:23,143 --> 00:01:27,893 And I have with me my Google Sheet consultant Prasanna Malaiyandi. 25 00:01:27,913 --> 00:01:28,423 How's it going? 26 00:01:28,423 --> 00:01:28,873 Prasanna? 27 00:01:29,338 --> 00:01:30,238 Prasanna Malaiyandi: I am good, Curtis. 28 00:01:30,243 --> 00:01:33,928 I have years and years of experience with Google Sheets, 29 00:01:34,003 --> 00:01:34,633 W. Curtis Preston (2): Yeah. 30 00:01:34,633 --> 00:01:37,843 So, so we've been, we've been going through this, uh, you know, as of 31 00:01:37,843 --> 00:01:43,933 my recent purchase, two weeks now, as of as of yesterday, I now have my 32 00:01:43,993 --> 00:01:45,883 proud owner of a Tesla model three. 33 00:01:46,438 --> 00:01:49,168 Base model, 270 miles of range. 34 00:01:49,478 --> 00:01:54,098 You have all these plans to choose from that offer different costs for 35 00:01:54,098 --> 00:01:55,748 different times of the day, right? 36 00:01:55,748 --> 00:01:57,368 I could potentially save a lot of money. 37 00:01:57,548 --> 00:02:00,758 I could potentially cost myself a lot of money, so I created this 38 00:02:00,758 --> 00:02:05,468 gigantic spreadsheet and Prasanna's been helping me through it. 39 00:02:05,558 --> 00:02:08,078 What do you think, how, how do you think we are on the how 40 00:02:08,353 --> 00:02:08,643 Prasanna Malaiyandi: Yeah. 41 00:02:08,753 --> 00:02:11,453 No, I think, I think your spreadsheet makes sense. 42 00:02:11,813 --> 00:02:16,523 Um, I think it's not too, I'm actually surprised that no one has built 43 00:02:16,528 --> 00:02:18,353 an online calculator to do this, 44 00:02:19,814 --> 00:02:23,174 W. Curtis Preston (2): It turns out, in my case, the break even point was 45 00:02:23,174 --> 00:02:29,204 if I'm going to charge at least 80 kilowatt hours per week in my Tesla, 46 00:02:29,204 --> 00:02:31,664 then it makes sense to switch over, which 47 00:02:31,774 --> 00:02:34,709 Prasanna Malaiyandi: 250, or it's like 350 miles, right? 48 00:02:35,024 --> 00:02:36,944 W. Curtis Preston (2): Yeah, which is not gonna be a problem 49 00:02:36,944 --> 00:02:38,324 based on my driving patterns. 50 00:02:38,924 --> 00:02:42,194 There's a $16 a month thing to be on that plan. 51 00:02:42,734 --> 00:02:43,694 Um, and I, 52 00:02:43,784 --> 00:02:45,854 Prasanna Malaiyandi: but why do they charge you $16 a month? 53 00:02:45,854 --> 00:02:47,054 That's just highway robbery. 54 00:02:47,114 --> 00:02:47,594 You know 55 00:02:48,074 --> 00:02:50,264 it, it's not like anything really changes. 56 00:02:50,264 --> 00:02:52,394 You're still paying the transmission fees. 57 00:02:52,704 --> 00:02:54,434 W. Curtis Preston (2): it's called a utility. 58 00:02:54,434 --> 00:02:56,504 It's called a monopoly. 59 00:02:57,884 --> 00:03:02,264 You can't just go get electricity somewhere else, right? 60 00:03:02,374 --> 00:03:06,484 Uh, anyway, our guest, uh, I'm sure has gotta be antsy at this point. 61 00:03:06,904 --> 00:03:08,794 He, uh, let's bring him on. 62 00:03:09,124 --> 00:03:13,444 guest today has specialized in offensive cybersecurity for over 20 years. 63 00:03:13,654 --> 00:03:17,764 He's the C T O and red team leader at Pulsar Security, which offers a 64 00:03:17,764 --> 00:03:22,834 comprehensive package of services designed to bring maximum security benefits at 65 00:03:22,834 --> 00:03:25,384 minimal cost without sacrificing quality. 66 00:03:25,714 --> 00:03:28,984 He's also a host of the Security this week podcast. 67 00:03:29,344 --> 00:03:31,714 Welcome to the pod, Dwayne Laflotte. 68 00:03:32,884 --> 00:03:33,634 Duane Laflotte: Yeah, great. 69 00:03:33,694 --> 00:03:34,324 Great to be here. 70 00:03:34,324 --> 00:03:36,334 Thank you so much for, uh, for the invite. 71 00:03:36,424 --> 00:03:39,094 Um, and I was, I was itching at that electricity talk. 72 00:03:39,094 --> 00:03:42,029 All I'm saying is how did they read how much electricity you use? 73 00:03:43,169 --> 00:03:44,549 They use that smart meter outside, 74 00:03:44,594 --> 00:03:44,864 W. Curtis Preston (2): yeah. 75 00:03:44,864 --> 00:03:45,194 The smart 76 00:03:45,419 --> 00:03:48,569 Duane Laflotte: And they drive by and they pick up a 900 megahertz 77 00:03:48,569 --> 00:03:50,129 signal or a 2.4 gigahertz 78 00:03:50,134 --> 00:03:50,669 signal from 79 00:03:50,674 --> 00:03:50,819 that 80 00:03:51,044 --> 00:03:52,504 W. Curtis Preston (2): the, I like the way you're, I. 81 00:03:53,339 --> 00:03:57,239 Duane Laflotte: if you were to, if you were to saturate that band, uh, you 82 00:03:57,299 --> 00:03:59,609 probably would be using no electricity. 83 00:04:00,104 --> 00:04:05,144 Just throwing that out there and this is what my job is. 84 00:04:05,144 --> 00:04:08,384 How do we break, how do we break these things where they 85 00:04:08,384 --> 00:04:11,414 Prasanna Malaiyandi: so unfortunately Dwayne for me, so we have a smart 86 00:04:11,414 --> 00:04:15,914 meter too, but what our city has done is they've put basically wifi 87 00:04:15,944 --> 00:04:18,374 access points all throughout the city. 88 00:04:19,394 --> 00:04:22,964 And so you get free wifi anywhere in Santa Clara, which is great, but at 89 00:04:22,964 --> 00:04:26,084 the same time, they don't have to drive by anymore, and it just automatically 90 00:04:26,084 --> 00:04:28,754 connects to those and downloads the data. 91 00:04:29,294 --> 00:04:31,964 Duane Laflotte: the other thing that's interesting is your smart meter, 92 00:04:31,964 --> 00:04:35,534 it probably has a Mac address to connect into that particular thing. 93 00:04:35,534 --> 00:04:40,554 So if you d off your own smart meter, it will never connect to the wifi. 94 00:04:42,284 --> 00:04:42,874 Which means, 95 00:04:43,574 --> 00:04:44,474 W. Curtis Preston (2): You would of course not 96 00:04:44,474 --> 00:04:46,154 suggest doing such things, but 97 00:04:46,214 --> 00:04:46,814 Duane Laflotte: No, of course 98 00:04:47,114 --> 00:04:48,794 W. Curtis Preston (2): you're saying theoretically speaking, 99 00:04:49,034 --> 00:04:53,054 Duane Laflotte: Theoretically, from a networking red team standpoint, 100 00:04:53,054 --> 00:04:54,374 it might be what I would do. 101 00:04:54,794 --> 00:04:55,154 Um, 102 00:04:57,234 --> 00:04:59,354 W. Curtis Preston (2): if per chance you were doing a, a 103 00:04:59,354 --> 00:05:01,904 pen test for SDG and e or um, 104 00:05:01,964 --> 00:05:02,744 Duane Laflotte: Yes. 105 00:05:03,314 --> 00:05:07,184 W. Curtis Preston (2): So, Dwayne, for those that I, I think most people probably 106 00:05:07,184 --> 00:05:10,424 know about Red team and Blue Team, but why don't you tell us what a red team 107 00:05:10,499 --> 00:05:11,879 Prasanna Malaiyandi: Isn't there a purple team? 108 00:05:12,269 --> 00:05:13,019 Duane Laflotte: There is, yeah. 109 00:05:13,019 --> 00:05:14,669 Purple's, purple's kind of the new thing. 110 00:05:14,729 --> 00:05:18,089 Um, it used to be they would just pit the teams against each other. 111 00:05:18,094 --> 00:05:20,579 So Blue team is defense, right? 112 00:05:20,579 --> 00:05:24,269 It's the guys who really like reading through logs and looking for bad guys. 113 00:05:24,749 --> 00:05:29,249 Um, the, the red team, we are, uh, we are the offensive team, so we 114 00:05:29,249 --> 00:05:30,959 like pretending to be the bad guys. 115 00:05:31,079 --> 00:05:34,709 Um, and thinking all of the, well, how could I get my smart meter 116 00:05:34,714 --> 00:05:36,509 off of the electric grid thoughts? 117 00:05:37,019 --> 00:05:40,709 Um, and then putting those in action, um, and, and, and attacking an organization. 118 00:05:41,339 --> 00:05:44,729 And that involves everything from, um, you know, 'cause a lot of people 119 00:05:44,729 --> 00:05:49,199 throw around terms like pen testing or vulnerability scanning or red teaming. 120 00:05:49,199 --> 00:05:50,669 And those are three very different things. 121 00:05:50,699 --> 00:05:51,929 From the red teaming side. 122 00:05:51,929 --> 00:05:53,909 It's holistically looking at the company. 123 00:05:54,209 --> 00:05:58,859 So it's everything from the employees, um, to what sites they view, uh, you 124 00:05:58,864 --> 00:06:03,239 know, from the company to, uh, who are your partners as a company that we could 125 00:06:03,239 --> 00:06:08,789 use to maybe leverage to get into the organization, um, to, uh, we've had teams. 126 00:06:08,819 --> 00:06:12,059 Uh, the reason I talk about jamming sensors and whatnot, we 127 00:06:12,059 --> 00:06:14,969 actually do have teams that will physically break into organizations. 128 00:06:15,359 --> 00:06:19,019 Um, and I can tell you that all the motion sensors on most alarms are 900 megahertz. 129 00:06:19,019 --> 00:06:21,149 And I can saturate that, walk through a building with that 130 00:06:21,149 --> 00:06:22,109 emotion sensor going off. 131 00:06:22,109 --> 00:06:26,159 So there's like all sorts of really cool things that we as a 132 00:06:26,159 --> 00:06:28,139 red team will be trained to do. 133 00:06:28,139 --> 00:06:30,059 It looks very much like thievery. 134 00:06:30,179 --> 00:06:32,129 Um, but we're the good guys, I promise. 135 00:06:32,134 --> 00:06:33,029 So that's, that's our job. 136 00:06:33,034 --> 00:06:34,409 And purple is the mix, right? 137 00:06:34,409 --> 00:06:37,679 It's people who know a little bit of that offensive and a little bit of defensive, 138 00:06:38,009 --> 00:06:39,749 um, just to be better on both sides. 139 00:06:40,484 --> 00:06:43,754 W. Curtis Preston (2): So would another term for that be ethical hacking? 140 00:06:44,984 --> 00:06:45,554 Duane Laflotte: Yes. 141 00:06:45,644 --> 00:06:46,004 Yeah. 142 00:06:46,004 --> 00:06:50,114 Ethical hacking, um, is definitely another term people use for that. 143 00:06:50,114 --> 00:06:52,754 They, people have moved away from ethical hacking. 144 00:06:53,294 --> 00:06:57,134 Um, a little bit more to more focused terms. 145 00:06:57,139 --> 00:06:59,534 'cause cybersecurity's so big at this point. 146 00:06:59,744 --> 00:07:03,614 Um, it used to be like if you were in cyber, you kind of did the same thing. 147 00:07:03,614 --> 00:07:06,044 You looked a little bit at, you know, offensive, you did a little bit of 148 00:07:06,044 --> 00:07:07,244 coding, you did a little bit of whatever. 149 00:07:07,994 --> 00:07:11,384 Um, and, and that ethical hacker is really that generalist. 150 00:07:11,474 --> 00:07:15,164 Um, then you move into like, the really focused sides of 151 00:07:15,194 --> 00:07:16,874 even offensive cybersecurity. 152 00:07:17,084 --> 00:07:20,834 Like if we just talk about offensive, um, I have people on 153 00:07:20,834 --> 00:07:22,784 my team who are reverse engineers. 154 00:07:23,024 --> 00:07:27,794 So what they will do is tear apart a system, take, um, there's one company 155 00:07:27,794 --> 00:07:31,844 we broke into the company through a tv, um, that, that was sitting in their 156 00:07:31,844 --> 00:07:33,254 lobby that was connected, the wifi. 157 00:07:33,674 --> 00:07:34,664 So how did we do that? 158 00:07:34,994 --> 00:07:38,444 We literally bought one of the TVs, tore it apart. 159 00:07:38,954 --> 00:07:44,354 Um, attached a, a bus pirate and a J tabulator to the, the, the system 160 00:07:44,354 --> 00:07:48,224 ripped the firmware off the chips and read through the firmware and 161 00:07:48,224 --> 00:07:51,374 found an exploit and then used that to, to break into the tv. 162 00:07:52,184 --> 00:07:54,794 Um, that's a specialty in and of itself. 163 00:07:55,064 --> 00:07:59,744 Then you have, you know, your, your web developers who are really good offensive, 164 00:07:59,774 --> 00:08:03,734 you know, web certified experts who know how to tear apart things like angular 165 00:08:03,734 --> 00:08:07,934 and.net and understand how all that works, but wouldn't necessarily be your reverse 166 00:08:07,934 --> 00:08:12,194 engineers and wouldn't necessarily be your network guys who are offensive network 167 00:08:12,199 --> 00:08:15,644 who understand, you know, spanning trees and how I can manipulate a network and 168 00:08:15,644 --> 00:08:20,504 how M D N S works and like how to break all that, who are entirely different 169 00:08:20,504 --> 00:08:24,824 from the guys who are cloud, like how to manipulate, pulling universal keys from 170 00:08:24,824 --> 00:08:29,414 the cloud and how to get the cloud to, how to get two clouds to attack each other. 171 00:08:29,444 --> 00:08:30,614 'cause they're never gonna block each other. 172 00:08:30,614 --> 00:08:32,054 Like, that's all tactics as well. 173 00:08:32,059 --> 00:08:35,594 So it's definitely like been been specialized since the 174 00:08:35,594 --> 00:08:37,064 ethical hacking term came out. 175 00:08:38,639 --> 00:08:42,659 Prasanna Malaiyandi: That is like my, sorry, my mind is just like blown just 176 00:08:42,659 --> 00:08:43,859 hearing what you just talked about. 177 00:08:43,859 --> 00:08:46,169 'cause that covers such a broad spectrum. 178 00:08:46,829 --> 00:08:47,189 Right? 179 00:08:47,189 --> 00:08:48,329 And I. 180 00:08:48,434 --> 00:08:53,114 I wonder when people think about defending themselves from hackers, right? 181 00:08:53,114 --> 00:08:54,764 Are they sort of pigeonholing themselves? 182 00:08:54,794 --> 00:08:57,674 Because I know Curtis, we've always talked about, okay, make sure you prevent 183 00:08:57,679 --> 00:09:03,044 lateral movement, make sure that you have multi-factor authentication, right? 184 00:09:03,434 --> 00:09:04,574 All the rest of these things. 185 00:09:04,574 --> 00:09:07,574 But there's, like you were saying, Dwayne, there's other ways, like through 186 00:09:07,574 --> 00:09:09,644 partners, through like that tv, right? 187 00:09:09,644 --> 00:09:12,794 You didn't even think about that as an IT person maybe, and you're 188 00:09:12,794 --> 00:09:14,204 like, ah, it's just a tv, whatever. 189 00:09:15,059 --> 00:09:17,849 W. Curtis Preston (2): Of course, I, I would tell, tell me, Dwayne, 190 00:09:17,849 --> 00:09:21,269 tell me, tell me, tell me I'm wrong and it is totally okay. 191 00:09:21,269 --> 00:09:22,649 'cause this is not my bag. 192 00:09:23,219 --> 00:09:27,569 The, the, the problem, the, the, the, uh, mistake that that company 193 00:09:27,569 --> 00:09:32,939 made was that this smart tv, this network-based TV was on the same 194 00:09:32,939 --> 00:09:36,059 network that the rest of every, that the rest of their corporation was on. 195 00:09:36,674 --> 00:09:37,184 Duane Laflotte: Yes. 196 00:09:37,274 --> 00:09:37,514 Yeah. 197 00:09:37,514 --> 00:09:41,924 So part of it, absolutely, this particular customer, it was on the same network. 198 00:09:41,954 --> 00:09:46,124 Um, but what we have seen before is a guest network, right? 199 00:09:46,334 --> 00:09:48,824 Um, isolated no devices. 200 00:09:48,824 --> 00:09:53,114 And then we'll see people connected to the guest network who are also connected to 201 00:09:53,114 --> 00:09:55,004 the executive or to the internal network. 202 00:09:55,004 --> 00:09:58,274 And the reason they do that is because in the lobby, they 203 00:09:58,274 --> 00:09:59,654 don't get the corporate network. 204 00:09:59,714 --> 00:10:02,264 So they're like, oh, well the guest network's here, so I'll connect to it. 205 00:10:02,564 --> 00:10:06,644 So what's really nice is once they connect to it, like when they leave the building, 206 00:10:06,704 --> 00:10:08,744 we can emulate the guest network. 207 00:10:09,014 --> 00:10:10,424 They'll connect to us. 208 00:10:10,454 --> 00:10:13,874 We'll drop a piece of, uh, malware or, or a captor portal or 209 00:10:13,874 --> 00:10:15,404 whatnot on their, on their device. 210 00:10:15,524 --> 00:10:18,224 When they walk it back into the building, that portal will then 211 00:10:18,224 --> 00:10:20,894 beacon out to us, and now we have access to the corporate network. 212 00:10:20,894 --> 00:10:24,824 So, you know, we, we definitely see, even though you isolate it, you can't 213 00:10:24,824 --> 00:10:27,794 pull the humans out of the system unfortunately, for the most part. 214 00:10:28,064 --> 00:10:29,594 W. Curtis Preston (2): If we could just get rid of all those 215 00:10:29,594 --> 00:10:31,304 damn users, the, our computer 216 00:10:31,634 --> 00:10:31,984 Duane Laflotte: right. 217 00:10:32,474 --> 00:10:33,314 W. Curtis Preston (2): would be a lot. 218 00:10:34,184 --> 00:10:34,604 Duane Laflotte: Yeah. 219 00:10:34,994 --> 00:10:36,074 W. Curtis Preston (2): A lot safer. 220 00:10:36,134 --> 00:10:37,034 Absolutely. 221 00:10:37,934 --> 00:10:39,754 Um, yeah. 222 00:10:40,469 --> 00:10:41,399 Goodness gracious. 223 00:10:41,459 --> 00:10:41,669 Yeah. 224 00:10:41,669 --> 00:10:45,089 I, when I talk to somebody like you, I've, I've had, I've had a handful 225 00:10:45,089 --> 00:10:48,989 of conversations with, you know, folks on the offensive side, uh, 226 00:10:49,019 --> 00:10:52,709 throughout my career, and I always walk away just super depressed. 227 00:10:52,919 --> 00:10:57,899 I'm just like, like, why even try, you know, um, 228 00:10:58,169 --> 00:10:58,289 you 229 00:10:58,409 --> 00:11:00,389 Prasanna Malaiyandi: did you have that story, Curtis, about the guy 230 00:11:00,389 --> 00:11:03,329 who, with the various uniforms who would break into buildings? 231 00:11:04,049 --> 00:11:04,679 W. Curtis Preston (2): oh yeah. 232 00:11:04,684 --> 00:11:05,189 I mean, yeah. 233 00:11:05,189 --> 00:11:09,539 So I, I, I know a guy that does physical, uh, pen testing, right? 234 00:11:09,899 --> 00:11:15,569 Um, and his job is, is to physically get into a place that he's not 235 00:11:15,569 --> 00:11:20,099 allowed to be, take a selfie and, you know, G T F O, right? 236 00:11:20,549 --> 00:11:26,039 And, um, and he just, uh, and uh, he just told me, he's like, I have 237 00:11:26,039 --> 00:11:31,229 never, never not been able to get into where I was supposed to get into. 238 00:11:31,709 --> 00:11:32,039 Right. 239 00:11:32,039 --> 00:11:36,059 It, it's all about social engineering and, and sometimes it's about, 240 00:11:36,119 --> 00:11:38,924 uh, But, uh, card scanning, right? 241 00:11:38,954 --> 00:11:42,334 Um, you know, scanning somebody's, uh, R F I D badges, right? 242 00:11:42,784 --> 00:11:47,884 Um, I heard, I heard a talk, um, you know, it was, uh, Kevin Mitnick once 243 00:11:47,884 --> 00:11:54,334 talking about, you know, the scanning badges in a bathroom, which just, it 244 00:11:54,334 --> 00:11:57,964 was just wrong, but it was, it was just like, it's just so easy, right? 245 00:11:57,964 --> 00:12:00,094 Because you're just a little weird, a little weird. 246 00:12:00,424 --> 00:12:05,644 When I think back, the only like red team type stuff that I've seen 247 00:12:05,644 --> 00:12:11,134 depicted, uh, a lot or like an entire movie based around it was sneakers. 248 00:12:11,674 --> 00:12:13,414 Um, do you remember that movie? 249 00:12:13,534 --> 00:12:15,094 Duane Laflotte: Oh, like a fantastic movie. 250 00:12:15,184 --> 00:12:15,724 Sneakers. 251 00:12:15,844 --> 00:12:16,114 Yeah, 252 00:12:16,354 --> 00:12:20,644 and what's what's funny about that is that's not far off. 253 00:12:20,644 --> 00:12:25,624 So, you know, looking from my red team's ex, like as the red team leader, I'm 254 00:12:25,624 --> 00:12:27,604 playing Robert Redford's job, right? 255 00:12:27,604 --> 00:12:30,904 So I'm going through an understanding like, okay, cool, we got this 256 00:12:30,904 --> 00:12:32,764 target, how do we attack it? 257 00:12:32,764 --> 00:12:37,504 And, and I have my specialists, I have my mother who, who understands, you 258 00:12:37,504 --> 00:12:42,004 know, sensors and, and understands, you know, uh, different wavelengths 259 00:12:42,004 --> 00:12:43,624 and signals and that sort of stuff. 260 00:12:43,624 --> 00:12:47,404 And I, you know, I have my, uh, you know, my, my face guy who's good at 261 00:12:47,404 --> 00:12:48,724 talking to people and that sort of thing. 262 00:12:48,724 --> 00:12:49,654 So I'm planning this out. 263 00:12:49,654 --> 00:12:51,124 I'm like, okay, here's how we're gonna attack, here's how 264 00:12:51,129 --> 00:12:52,084 we're gonna do whatever we do. 265 00:12:52,354 --> 00:12:56,194 But looking at sneakers from, from my perspective, my job, you go, okay, cool. 266 00:12:56,194 --> 00:12:58,564 Well, they got access to the temperature control system. 267 00:12:58,594 --> 00:12:59,764 Is that even possible? 268 00:13:00,064 --> 00:13:05,704 Um, and, and sure enough about, uh, about a month ago we were pen testing a bank. 269 00:13:05,914 --> 00:13:07,894 Um, I, I like to call it the bank job. 270 00:13:07,894 --> 00:13:09,064 We were doing the bank job. 271 00:13:09,154 --> 00:13:13,504 Um, and, and as we were, as you were doing the bank job, this is, uh, 272 00:13:13,504 --> 00:13:15,094 it's about a month ago, so it was. 273 00:13:15,709 --> 00:13:18,679 In May, early May cold up here, cold-ish at night. 274 00:13:19,249 --> 00:13:22,309 Um, we did sure enough, get access to the HVAC system. 275 00:13:22,549 --> 00:13:24,859 Um, and, and what could we have done with it? 276 00:13:24,859 --> 00:13:26,719 We were like, okay, we could shut it off. 277 00:13:26,839 --> 00:13:29,599 Um, and it gets cold enough at night where maybe pipes freeze 278 00:13:29,599 --> 00:13:30,649 and burst and that sort of stuff. 279 00:13:30,649 --> 00:13:33,379 We could crank it up, I guess, but then, you know, I started 280 00:13:33,379 --> 00:13:34,189 thinking about sneakers. 281 00:13:34,194 --> 00:13:35,059 I was like, oh my gosh. 282 00:13:35,089 --> 00:13:38,569 So if they're using infrared and we could crank it up, we could get in the bill. 283 00:13:38,569 --> 00:13:41,509 But yeah, so it's, you know, it's entirely as you go back and look at 284 00:13:41,514 --> 00:13:45,199 that movie, um, it was impressive how much stuff they got Right. 285 00:13:45,229 --> 00:13:48,279 From a, you know, what you might do as a red teamer is very cool. 286 00:13:48,494 --> 00:13:48,784 Prasanna Malaiyandi: Yeah, 287 00:13:49,459 --> 00:13:50,939 W. Curtis Preston (2): Have you Prasanna, have you seen this movie? 288 00:13:52,444 --> 00:13:52,954 Prasanna Malaiyandi: I'm trying. 289 00:13:52,954 --> 00:13:54,394 I don't think I have. 290 00:13:55,029 --> 00:13:57,189 W. Curtis Preston (2): I think they get a lot of stuff, interestingly. 291 00:13:57,219 --> 00:13:57,699 Right. 292 00:13:58,149 --> 00:14:02,139 Um, I mean, just the, just the whole thing of like the scene where Robert 293 00:14:02,139 --> 00:14:05,919 Redford's got a bunch of packages, he's got balloons and he's like, can you, 294 00:14:05,979 --> 00:14:07,839 can you just buzz me through, you know? 295 00:14:08,019 --> 00:14:12,519 Um, and, uh, so what you're telling me, Dwayne, is you, you 296 00:14:12,519 --> 00:14:16,689 play the role of the devastatingly handsome disarming guy who disarms 297 00:14:16,689 --> 00:14:19,719 Duane Laflotte: that's what I like to, yeah, that's, I mean, I wouldn't, I wasn't 298 00:14:19,719 --> 00:14:21,309 gonna put that label on it, but thank you. 299 00:14:21,459 --> 00:14:22,029 Yes. 300 00:14:22,179 --> 00:14:27,009 Um, but you know, honestly, it's a great movie to watch. 301 00:14:27,009 --> 00:14:31,119 I love watching these movies 'cause they like, they're part of the, it's 302 00:14:31,119 --> 00:14:36,009 the passion of cybersecurity and hacking that I got in the nineties, right? 303 00:14:36,009 --> 00:14:39,339 And I watched Hackers and I watched sneakers and I watched war games 304 00:14:39,339 --> 00:14:43,509 and, and it was that, that awe of how could you tear a system apart? 305 00:14:43,509 --> 00:14:46,779 How could you make it do things that it was never even designed to do? 306 00:14:47,139 --> 00:14:49,629 Um, and, and bend it to your will as a red teamer. 307 00:14:49,629 --> 00:14:52,599 And, and that's what these movies and these shows do for me, is they 308 00:14:52,599 --> 00:14:54,999 bring that, that awe back, right? 309 00:14:55,029 --> 00:14:58,329 Um, even though some of it might not technically be true, it doesn't matter. 310 00:14:58,709 --> 00:15:03,239 Prasanna Malaiyandi: So given that you do offensive security, right, red teaming, 311 00:15:04,559 --> 00:15:06,299 and I know we'll talk more about that. 312 00:15:06,629 --> 00:15:10,769 I guess the question is, in your personal life, doesn't it freak you out a bit? 313 00:15:10,769 --> 00:15:14,339 Like what do you do to protect yourself against some of those things? 314 00:15:14,339 --> 00:15:17,339 You know, like the fact that you're surrounded by this all 315 00:15:17,339 --> 00:15:18,659 the time, trying to break things. 316 00:15:18,659 --> 00:15:21,569 Does that sort of translate into your personal life where you're like, 317 00:15:21,574 --> 00:15:24,929 okay, RFIDs can be hacked, so I'm gonna get one of those wallets that 318 00:15:24,929 --> 00:15:27,959 block RFIDs all the time, right? 319 00:15:28,409 --> 00:15:29,249 Wifi network. 320 00:15:29,249 --> 00:15:32,069 I'm just gonna keep everything unplugged all the time. 321 00:15:32,069 --> 00:15:33,539 Like nothing comes on my network. 322 00:15:33,684 --> 00:15:35,159 Duane Laflotte: Yeah, it's a great question. 323 00:15:35,159 --> 00:15:39,779 And I also have, um, I have probably three of the, uh, um, I. 324 00:15:40,319 --> 00:15:42,929 Worst end users from a cybersecurity standpoint. 325 00:15:42,929 --> 00:15:43,499 You could imagine. 326 00:15:43,499 --> 00:15:48,149 I have three children and they're they'll, they, like, you can never 327 00:15:48,149 --> 00:15:51,569 tell them what to visit or not visit or click on or not click on. 328 00:15:51,574 --> 00:15:52,739 It's just, it is what it is. 329 00:15:52,744 --> 00:15:55,649 So, um, so it's interesting, it's twofold. 330 00:15:55,679 --> 00:15:59,729 One, yes, there are certain things I take into account in my daily life that 331 00:15:59,729 --> 00:16:00,839 I notice a lot of people don't like. 332 00:16:00,839 --> 00:16:06,299 I use a password manager all the time for all my passwords because, you know, using 333 00:16:06,299 --> 00:16:09,809 the spreadsheet, if the spreadsheet gets compromised in some ways somebody gets it. 334 00:16:09,809 --> 00:16:12,929 I'd rather have a company who focuses on managing passwords and 335 00:16:12,929 --> 00:16:14,189 sometimes they do it wrong, right? 336 00:16:14,194 --> 00:16:17,669 Like KeyPass, but more often than not they're gonna get it right. 337 00:16:17,669 --> 00:16:19,439 So there are little things like that where I get paranoid and 338 00:16:19,439 --> 00:16:20,669 I go, yes, I wanna do that. 339 00:16:20,669 --> 00:16:22,229 I turn on two f a for everything. 340 00:16:22,229 --> 00:16:26,339 I have all of my accountant credit locked through the three different, uh, you know, 341 00:16:26,519 --> 00:16:30,179 providers, your credit, Equifax and all those guys, uh, Experian and whoever else. 342 00:16:30,569 --> 00:16:33,719 So there are certain things I do because I'm a cybersecurity professional 343 00:16:33,719 --> 00:16:37,049 and I can see, you know, we have access to all the deep dark web. 344 00:16:37,799 --> 00:16:40,799 Information on all the people, and I'm like, oh my God, I can see all this info. 345 00:16:41,339 --> 00:16:46,229 But from another standpoint, I worry less because I know how hard 346 00:16:46,229 --> 00:16:48,599 it is to break into a smart device. 347 00:16:48,809 --> 00:16:53,099 Like I know how hard it is to reverse engineer a chip and 348 00:16:53,104 --> 00:16:54,569 figure out a way to break into it. 349 00:16:55,019 --> 00:16:57,629 So from that standpoint, if I just, yeah, you know what? 350 00:16:57,629 --> 00:16:59,339 I'm gonna set a strong password on my wifi. 351 00:16:59,369 --> 00:17:03,389 Like I, we have a crack cluster at the office, um, that has, at 352 00:17:03,394 --> 00:17:07,499 this point, I think it has 40 or 50, um, 30, 90 GPUs in it. 353 00:17:08,039 --> 00:17:09,659 So, and talk about electricity. 354 00:17:09,659 --> 00:17:09,719 Woo. 355 00:17:10,829 --> 00:17:11,399 Um, 356 00:17:13,764 --> 00:17:16,934 W. Curtis Preston (2): you might consider moving that to Prasanna's neighborhood. 357 00:17:17,249 --> 00:17:18,449 Duane Laflotte: I might have to think. 358 00:17:18,454 --> 00:17:23,279 I'm gonna have to, um, so we can guess about we, if we grab a, a 359 00:17:23,399 --> 00:17:25,109 crack, a hash from a password. 360 00:17:25,109 --> 00:17:25,799 So just a little bit. 361 00:17:25,889 --> 00:17:29,759 If your users aren't breaking into wireless networks all the time, um, I. 362 00:17:30,209 --> 00:17:33,809 Uh, if, if I go up to a wireless network, I can see all of the clients 363 00:17:33,809 --> 00:17:36,479 that are connected 'cause it's all over 2.4 gigahertz wireless. 364 00:17:36,479 --> 00:17:37,949 Everybody can see those signals. 365 00:17:37,949 --> 00:17:41,909 They're open, um, but they're encrypted between the client and the access point. 366 00:17:41,909 --> 00:17:45,269 But I can tell the client to get off the access point. 367 00:17:45,269 --> 00:17:47,579 I can d off it, I can say, Hey, I'm the access point. 368 00:17:47,579 --> 00:17:50,939 Get off the, get off the, the access point just for a couple minutes 369 00:17:50,999 --> 00:17:52,589 and it'll de off that client. 370 00:17:52,589 --> 00:17:55,679 And then the client, when they reconnect, we'll see a handshake, right? 371 00:17:55,709 --> 00:17:57,509 And that handshake's an encrypted password. 372 00:17:57,659 --> 00:18:00,059 But we can take that and then we can try and crack it. 373 00:18:00,899 --> 00:18:03,719 So I can then take that handshake, take seconds to get, I can pull 374 00:18:03,719 --> 00:18:06,569 it on my offline cracker and, and our offline cracking device. 375 00:18:06,569 --> 00:18:09,659 Can guess 3 billion passwords a second. 376 00:18:10,664 --> 00:18:11,114 Prasanna Malaiyandi: Wow. 377 00:18:11,349 --> 00:18:11,569 W. Curtis Preston (2): Wow. 378 00:18:12,419 --> 00:18:14,849 Duane Laflotte: So you say, you say to yourself, well, okay, shoot, my 379 00:18:14,849 --> 00:18:16,439 wireless is probably not secure. 380 00:18:16,799 --> 00:18:19,919 Um, but if you start looking at the math of it, you say, listen, if it's, 381 00:18:20,159 --> 00:18:25,124 if your password for your wireless is in any list of passwords ever, Right. 382 00:18:25,154 --> 00:18:27,614 Um, so if you go to have I been p.com right? 383 00:18:27,674 --> 00:18:30,614 And you type in your wireless password and click check and it's in the list. 384 00:18:30,614 --> 00:18:34,184 Yeah, they can get it in seconds, but let's say it doesn't show up on that, 385 00:18:34,334 --> 00:18:39,314 that in any list now it's a mathematics, uh, problem to, to brute forcing. 386 00:18:39,614 --> 00:18:42,014 So let's say minimum password's, eight characters. 387 00:18:42,044 --> 00:18:44,954 And I can do that in, uh, let's say a day. 388 00:18:45,524 --> 00:18:46,724 And that's actually quicker than that. 389 00:18:46,724 --> 00:18:48,644 It's about an hour for me to do an eight character. 390 00:18:48,644 --> 00:18:51,134 All uppers, lowers, numbers, whatever. 391 00:18:51,944 --> 00:18:58,784 If you put nine characters on that, and, and let's say we don't do, um, all uppers, 392 00:18:58,784 --> 00:19:00,014 we don't do all special characters. 393 00:19:00,014 --> 00:19:00,944 We don't do all numbers. 394 00:19:00,944 --> 00:19:03,824 That's still 26 times an hour. 395 00:19:03,824 --> 00:19:06,074 So we're looking at a day now. 396 00:19:06,074 --> 00:19:08,354 We do an, we do a 10 character password. 397 00:19:08,354 --> 00:19:10,094 It's 26 days. 398 00:19:10,574 --> 00:19:12,164 We do an 11 character password. 399 00:19:12,284 --> 00:19:14,804 Right now we're ending up at 26 months. 400 00:19:14,804 --> 00:19:16,694 We're at two years for us to break that, and that was just 401 00:19:16,694 --> 00:19:17,864 all lowercase characters. 402 00:19:18,254 --> 00:19:22,964 So the longer that password is, as long as it's not in a list, I personally 403 00:19:22,964 --> 00:19:24,734 know how hard it would be to crack. 404 00:19:24,734 --> 00:19:27,164 So I'm like, ah, we gotta have 15 character password. 405 00:19:27,164 --> 00:19:28,394 It's reasonably good. 406 00:19:28,394 --> 00:19:29,414 Some uppers and lowers. 407 00:19:29,414 --> 00:19:30,254 Nobody's gonna crack it. 408 00:19:30,254 --> 00:19:31,154 It's just not gonna happen. 409 00:19:31,844 --> 00:19:35,534 Um, so it's a great question because a lot of people are like, you know, oh my gosh. 410 00:19:35,539 --> 00:19:39,554 And for me, I calm down on certain things, but other things I do reasonable stuff. 411 00:19:39,614 --> 00:19:44,144 My family, however, like my wife, like, she will give valid 412 00:19:44,144 --> 00:19:45,524 emails from family members. 413 00:19:45,529 --> 00:19:46,784 She's like, I'm not clicking on that. 414 00:19:46,844 --> 00:19:49,244 No, I know, I hear all the dark stories. 415 00:19:49,244 --> 00:19:50,804 I'm not, I'm not clicking on anything. 416 00:19:51,074 --> 00:19:53,654 Like, if she gets a phone call from someone, she's like, Nope. 417 00:19:53,654 --> 00:19:55,424 And I'm like, I, I think that was our bank. 418 00:19:55,424 --> 00:19:56,724 She's like, Uhuh, I'm not. 419 00:19:56,804 --> 00:19:58,034 I'm so, yeah. 420 00:19:58,034 --> 00:19:59,504 I think my family takes the brunt 421 00:19:59,639 --> 00:20:00,089 W. Curtis Preston (2): You know, my 422 00:20:00,089 --> 00:20:03,959 f my favorite thing, and it used to, it was a different bank that I'm at right 423 00:20:03,959 --> 00:20:09,269 now, but they, they would call for, basically it was a fraud alert, right? 424 00:20:09,274 --> 00:20:11,789 That, that I would have a, I would have a potentially fraudulent 425 00:20:11,789 --> 00:20:15,749 charge and then they would call me, they call me from Rando number. 426 00:20:15,779 --> 00:20:16,229 Right. 427 00:20:16,499 --> 00:20:19,829 Um, and even if it said different number, I wouldn't believe it. 428 00:20:19,829 --> 00:20:23,279 But they call me and they're like, this is a b, C bank. 429 00:20:23,699 --> 00:20:26,579 Um, we'd like to talk to you about a potentially fraudulent charge. 430 00:20:27,059 --> 00:20:29,039 Please authenticate yourself. 431 00:20:29,429 --> 00:20:33,269 And they want me to like, they want me like, you called me, right? 432 00:20:33,299 --> 00:20:35,459 You want, and they're like, this is the process. 433 00:20:35,459 --> 00:20:40,109 Like, you want me to give you, like, they wanted like, like my social or 434 00:20:40,109 --> 00:20:45,239 something for me to authenticate my, like, you called me like you don't, like, 435 00:20:45,239 --> 00:20:47,549 you don't understand how stupid this is. 436 00:20:47,549 --> 00:20:48,599 Like, I was so angry. 437 00:20:48,599 --> 00:20:51,689 I was like, I like, I'm glad you called me for a fraud alert. 438 00:20:52,169 --> 00:20:54,779 But I'll tell you what, I'll call you, right? 439 00:20:54,779 --> 00:20:59,069 I will call the, the known number for the bank, and then I will authenticate myself. 440 00:20:59,069 --> 00:21:04,739 I'm not giving my social to some rando who just showed up on a phone number. 441 00:21:04,739 --> 00:21:06,599 Like, what, what are you thinking? 442 00:21:07,004 --> 00:21:08,654 Duane Laflotte: And I think what the, the worst part of that. 443 00:21:09,389 --> 00:21:13,889 Um, you, like, you are savvy in the security world, so you're like, 444 00:21:13,889 --> 00:21:15,509 okay, this, this doesn't feel right. 445 00:21:15,899 --> 00:21:19,379 But I think the worst part is the bank is training their normal, you know, 446 00:21:19,769 --> 00:21:20,399 W. Curtis Preston (2): right, 447 00:21:20,429 --> 00:21:22,409 Duane Laflotte: that this is the normal process, right? 448 00:21:22,414 --> 00:21:23,309 We're gonna call you. 449 00:21:23,309 --> 00:21:26,279 So when they get a call from a spammer, they're like, oh, well this is the normal 450 00:21:26,289 --> 00:21:27,179 W. Curtis Preston (2): Yeah, exactly. 451 00:21:27,329 --> 00:21:28,799 Duane Laflotte: Just like they used to train if you click 452 00:21:28,804 --> 00:21:30,179 on links and emails, right? 453 00:21:30,359 --> 00:21:33,509 W. Curtis Preston (2): Just like, uh, years ago when I worked at, uh, at a 454 00:21:33,514 --> 00:21:37,619 bank, we would, uh, train, they all, everybody got regular cybersecurity 455 00:21:37,619 --> 00:21:40,769 training and it, and one of the things that we told 'em was, no one 456 00:21:40,774 --> 00:21:45,929 in it will ever, ever, ever call you and ask you for your password, ever. 457 00:21:46,364 --> 00:21:46,904 Right. 458 00:21:47,354 --> 00:21:51,824 And then the next day after training, someone from IT would call them 459 00:21:51,824 --> 00:21:53,264 and ask them for their password. 460 00:21:53,564 --> 00:21:55,844 And it worked like 20% of the 461 00:21:55,979 --> 00:21:56,279 Duane Laflotte: yeah. 462 00:21:56,284 --> 00:21:58,379 And they'd always give it, they're like, oh, they're from it. 463 00:21:58,589 --> 00:21:59,129 Of course. 464 00:21:59,159 --> 00:21:59,369 Yeah. 465 00:21:59,479 --> 00:22:00,164 W. Curtis Preston (2): from it. 466 00:22:00,164 --> 00:22:02,234 We're like, oh, you're 467 00:22:02,354 --> 00:22:06,044 Prasanna Malaiyandi: what could you do though to train users, though? 468 00:22:06,044 --> 00:22:08,924 I think that's like the hardest challenge, right? 469 00:22:09,134 --> 00:22:10,244 Or one of the biggest challenges, 470 00:22:10,364 --> 00:22:13,274 Duane Laflotte: So I, I think it is, and I think it's not, I think we, I 471 00:22:13,274 --> 00:22:17,864 think in some ways we've been trained as people to stop listening to that voice 472 00:22:17,864 --> 00:22:19,334 in your head that says, this is weird. 473 00:22:19,634 --> 00:22:23,504 Um, so I like to think of humans as almost like networks. 474 00:22:23,534 --> 00:22:26,444 'cause I understand networks, uh, and they kind of make sense. 475 00:22:26,594 --> 00:22:29,534 So imagine you are a, you're a network and you have this, this 476 00:22:29,534 --> 00:22:31,214 intrusion detection in your head. 477 00:22:31,964 --> 00:22:34,634 And there are certain times we've gone through, we've all gone through this 478 00:22:34,634 --> 00:22:37,634 where we're on the phone, somebody asks us a question, we, we answer 479 00:22:37,634 --> 00:22:39,194 it, then they ask another question. 480 00:22:39,199 --> 00:22:41,204 We go, wait, this is weird. 481 00:22:41,294 --> 00:22:44,294 Like, I've never been asked this question over the phone before. 482 00:22:44,294 --> 00:22:45,884 Nobody's ever asked me for my social. 483 00:22:45,884 --> 00:22:49,694 Nobody's asked me what the last four digits on my credit card like, No, no, 484 00:22:49,844 --> 00:22:52,814 but then we go, oh, well this, you know, I wanna be nice, I wanna be polite. 485 00:22:52,814 --> 00:22:53,714 I'm not gonna, right. 486 00:22:53,714 --> 00:22:57,794 So we get to that, that where we just disregard all the alarms we, 487 00:22:57,794 --> 00:23:00,164 we have in our head because we're like, well, I'm on with this person 488 00:23:00,169 --> 00:23:01,604 and they must be well-meaning. 489 00:23:01,994 --> 00:23:04,964 Um, and I think we need to get back to you listening to those voices in your head. 490 00:23:04,994 --> 00:23:05,864 There's, you know what? 491 00:23:05,864 --> 00:23:07,514 This doesn't feel right then. 492 00:23:07,514 --> 00:23:08,774 It probably isn't. 493 00:23:08,924 --> 00:23:13,694 Um, if it's not something you normally do, if it calls you up every day and 494 00:23:13,694 --> 00:23:16,184 asks for your password, you know, great. 495 00:23:16,244 --> 00:23:16,994 I, I get it. 496 00:23:17,024 --> 00:23:17,174 Yeah. 497 00:23:17,174 --> 00:23:20,714 You give them the password and no harm, no, no, uh, fault on yours. 498 00:23:21,014 --> 00:23:25,004 But if they've never called you up and then they call you up, like, that's weird. 499 00:23:25,004 --> 00:23:26,444 Even if really is it? 500 00:23:26,744 --> 00:23:28,664 So, you know, I wouldn't, yeah. 501 00:23:28,814 --> 00:23:32,114 I think you need to, I need, that's how I like to train users is like, really 502 00:23:32,114 --> 00:23:33,224 listen to that voice in your head. 503 00:23:33,224 --> 00:23:36,614 If it's something you've never done before, um, don't start now. 504 00:23:36,854 --> 00:23:37,244 Right. 505 00:23:37,304 --> 00:23:38,594 Find other ways to verify. 506 00:23:39,314 --> 00:23:41,054 Prasanna Malaiyandi: But then how do you train them? 507 00:23:41,174 --> 00:23:43,124 Taking that and the flip side of that, right. 508 00:23:43,124 --> 00:23:45,344 How do you train them to start doing things then? 509 00:23:45,344 --> 00:23:47,564 Because if they've never done it before, then how do you start to 510 00:23:47,564 --> 00:23:48,495 build that voice in their head? 511 00:23:49,109 --> 00:23:50,909 Duane Laflotte: Yeah, so that's a good question too. 512 00:23:50,939 --> 00:23:54,029 Um, what I typically do then is say, listen, when that voice goes off in 513 00:23:54,029 --> 00:23:57,119 your head, um, and, and you're like, this is odd, this isn't the right thing. 514 00:23:57,419 --> 00:23:59,849 What you need to do is start thinking about alternate paths, 515 00:23:59,909 --> 00:24:01,949 alternate uh, communication paths. 516 00:24:01,949 --> 00:24:06,239 So, like Curtis had said, when the bank called him, he said, this is weird. 517 00:24:06,539 --> 00:24:06,929 I'm out. 518 00:24:07,469 --> 00:24:09,989 What I'm gonna do though is I'm gonna look on the back of my credit card. 519 00:24:10,229 --> 00:24:12,629 I'm gonna find that number that's on the back of my credit card 520 00:24:12,629 --> 00:24:13,979 and I'm gonna call you back. 521 00:24:14,339 --> 00:24:17,279 Now would that be fail safe a hundred percent of the time? 522 00:24:17,399 --> 00:24:19,799 Uh, listen, if you're getting attacked by a nation state, they 523 00:24:19,799 --> 00:24:22,289 would've tapped into the phones and it wouldn't have mattered, right? 524 00:24:22,499 --> 00:24:25,769 So we gotta assume a nation state's not coming after each of us. 525 00:24:25,799 --> 00:24:28,319 'cause at that point, we're kind of in trouble anyways. 526 00:24:28,739 --> 00:24:32,429 Um, but if it was a random spammer yeah, you verified via an alter channel. 527 00:24:32,429 --> 00:24:35,219 So that's typically what I'll do is say, listen, if something's weird, 528 00:24:35,549 --> 00:24:36,899 get outta that particular thing. 529 00:24:36,904 --> 00:24:39,569 Whether it's an email, whether it's text messages, um, whether 530 00:24:39,569 --> 00:24:40,619 it's, you know, a phone call. 531 00:24:40,619 --> 00:24:44,369 Just get outta that and find an alternate way to communicate. 532 00:24:45,059 --> 00:24:45,179 Prasanna Malaiyandi: Hmm. 533 00:24:45,434 --> 00:24:48,104 Duane Laflotte: Now I say alternate way and I stress that because 534 00:24:48,104 --> 00:24:52,484 we, we had a customer, um, that unfortunately lost, uh, hundreds of 535 00:24:52,484 --> 00:24:54,644 thousands of dollars in a a scam. 536 00:24:55,544 --> 00:25:00,914 And, um, their boss sent them an email saying, Hey, we need to change our a C H. 537 00:25:00,974 --> 00:25:02,174 That should have been red flag. 538 00:25:02,174 --> 00:25:05,624 How often do you change your a c h for bank to bank transfers 539 00:25:05,624 --> 00:25:07,274 for a particular vendor? 540 00:25:08,054 --> 00:25:12,404 Um, and we said, and they, and that person then said, listen, I verified, 541 00:25:12,494 --> 00:25:13,544 I did what you told me to do. 542 00:25:13,549 --> 00:25:16,574 I verified to make sure that this was right. 543 00:25:16,874 --> 00:25:17,804 And we said, okay, cool. 544 00:25:18,044 --> 00:25:19,784 What alternate channel did you use? 545 00:25:19,904 --> 00:25:23,414 And, and we said, they said, well, I sent an email to my boss asking, you 546 00:25:23,414 --> 00:25:25,394 know, if this was a real transaction. 547 00:25:25,399 --> 00:25:29,414 We're like, but didn't your boss communicate over email? 548 00:25:29,504 --> 00:25:30,164 And they were like, yeah. 549 00:25:30,169 --> 00:25:33,464 And we're like, that's not an alternate path that you used the same path. 550 00:25:33,854 --> 00:25:36,884 So what had happened is the hacker actually, and 'cause a lot of us would 551 00:25:36,884 --> 00:25:41,084 notice that like fake Gmail account saying, it's your boss, this particular 552 00:25:41,084 --> 00:25:42,944 boss, their email got compromised. 553 00:25:43,289 --> 00:25:45,179 So they were in their inbox. 554 00:25:45,179 --> 00:25:48,539 So it's like, no, there's nothing you, you like different path. 555 00:25:48,539 --> 00:25:51,539 Call them, talk to them face to face, especially when we're 556 00:25:51,539 --> 00:25:53,009 starting to talk with big money. 557 00:25:53,159 --> 00:25:53,459 Right. 558 00:25:54,404 --> 00:25:54,884 W. Curtis Preston (2): Yeah, 559 00:25:54,959 --> 00:25:55,769 Duane Laflotte: would be my suggestion. 560 00:25:56,534 --> 00:25:56,684 W. Curtis Preston (2): yeah. 561 00:25:56,684 --> 00:26:00,824 I've seen the, I've seen and heard of that, um, and I've seen it and heard of 562 00:26:00,824 --> 00:26:06,224 it where, where basically they have hacked the entire email system and the, and then 563 00:26:06,224 --> 00:26:09,374 customers are using email as their M f A. 564 00:26:09,764 --> 00:26:10,274 Right? 565 00:26:10,364 --> 00:26:14,834 And so they, they, they, you know, basically, and they use that to basically 566 00:26:14,834 --> 00:26:16,454 at that point, they've taken over, right? 567 00:26:16,454 --> 00:26:17,534 They can do whatever they want. 568 00:26:17,534 --> 00:26:21,434 They can reset passwords, they can then authenticate that with 569 00:26:21,434 --> 00:26:26,084 the m ffa, uh, which is why email and, and SMSs suck as MFAs. 570 00:26:26,444 --> 00:26:30,794 Um, and you know, and speaking of, speaking of which, you know, uh, we, you 571 00:26:30,794 --> 00:26:35,294 know, recently in the last few years, right, you know, I've been pushing 572 00:26:35,294 --> 00:26:39,434 more of m f A on, on myself as well, which includes pushing it on my wife. 573 00:26:39,674 --> 00:26:42,464 And there's a lot of things that she doesn't do very often. 574 00:26:42,809 --> 00:26:46,349 And then she'll, I, I remember a couple of weeks ago where she went to go 575 00:26:46,439 --> 00:26:48,749 log onto something and she got angry. 576 00:26:48,754 --> 00:26:50,129 She says, oh crap. 577 00:26:50,129 --> 00:26:50,669 Like, that's right. 578 00:26:50,669 --> 00:26:52,109 I gotta go get that thing right. 579 00:26:52,109 --> 00:26:54,809 I gotta go get the M FFA thing to get the thing to put in the thing. 580 00:26:54,929 --> 00:26:58,079 And I remember getting angry at that moment going, yeah, who cares 581 00:26:58,084 --> 00:27:02,549 about having So having security, like, I'm sorry that you gotta spend 582 00:27:02,549 --> 00:27:06,209 an extra 30 seconds to protect all the money we have in that account. 583 00:27:06,539 --> 00:27:07,529 Uh, anyway, 584 00:27:07,859 --> 00:27:07,949 I 585 00:27:08,159 --> 00:27:08,969 Prasanna Malaiyandi: I remember that. 586 00:27:08,974 --> 00:27:10,529 I actually remember that conversation, 587 00:27:10,529 --> 00:27:11,009 Curtis. 588 00:27:11,849 --> 00:27:14,519 W. Curtis Preston (2): Um, so let me, let me ask you this, Dwayne. 589 00:27:14,519 --> 00:27:16,679 So, you know, I, so I like the password manager. 590 00:27:16,679 --> 00:27:18,270 We're, we're a big fan of those here. 591 00:27:19,179 --> 00:27:22,269 We've also covered like the big LastPass hack and it just, like, 592 00:27:22,269 --> 00:27:25,899 it sounded bad, it got worse and it just, it just never got better. 593 00:27:26,199 --> 00:27:32,109 Um, and so it's, so no, no one password manager is, is perfect. 594 00:27:32,349 --> 00:27:35,469 Uh, and if, if something becomes compromise, it's time to move. 595 00:27:35,589 --> 00:27:39,039 But that doesn't mean the concept of password managers is wrong and 596 00:27:39,039 --> 00:27:40,329 tell me something that's better. 597 00:27:40,479 --> 00:27:41,469 That's what I want to know. 598 00:27:41,799 --> 00:27:42,189 Right. 599 00:27:42,249 --> 00:27:45,909 Um, because, you know, you talk about password length, I've just been over 600 00:27:45,909 --> 00:27:49,329 it because I have a ridiculous number of passwords in my password manager. 601 00:27:49,839 --> 00:27:55,689 Um, the, um, I, I just, I keep setting 'em to like 20, like 20 602 00:27:55,689 --> 00:27:57,159 has been my, has been my number. 603 00:27:57,159 --> 00:27:57,489 Right. 604 00:27:57,819 --> 00:28:00,819 And, um, by the way, while you were talking about it earlier, 605 00:28:00,819 --> 00:28:01,869 I counted the number of. 606 00:28:02,364 --> 00:28:03,864 Characters of my wifi password. 607 00:28:03,864 --> 00:28:05,664 It's is 18, so I felt I 608 00:28:05,889 --> 00:28:06,219 Duane Laflotte: I'll see. 609 00:28:06,219 --> 00:28:06,639 You're good. 610 00:28:06,759 --> 00:28:07,179 You're good? 611 00:28:07,179 --> 00:28:07,509 Yeah. 612 00:28:08,214 --> 00:28:10,524 W. Curtis Preston (2): Um, and it, and it, and it's not, it's not, and I've been 613 00:28:10,529 --> 00:28:15,654 pod um, I am definitely, I've definitely had some accounts that got, um, that 614 00:28:15,654 --> 00:28:17,604 got hacked or whatever, but who hasn't? 615 00:28:18,114 --> 00:28:26,484 Um, so besides password manager and M f A, uh, and, uh, and, um, pa um, sorry, patch 616 00:28:26,484 --> 00:28:33,264 management, what would you think are, are the next sort of best bang for the buck? 617 00:28:33,264 --> 00:28:36,504 That, and, and, and again, let's just, let's just do context. 618 00:28:36,714 --> 00:28:41,184 What are audience is typically really worried about is the ransomware 619 00:28:41,184 --> 00:28:46,524 hacks and Exfil and exfiltration, um, of, of that data, which what we're 620 00:28:46,529 --> 00:28:52,014 hearing is that exfiltration is now step one of a coordinated attack. 621 00:28:52,044 --> 00:28:52,524 Right. 622 00:28:53,124 --> 00:28:56,964 Um, so that's why we talk a lot about lateral movement, right? 623 00:28:56,964 --> 00:28:58,824 Trying to limit, limit lateral movement. 624 00:28:59,244 --> 00:29:01,524 Uh, what would you say are the next. 625 00:29:01,854 --> 00:29:05,454 Few things that would stop a guy like you, 626 00:29:05,904 --> 00:29:08,214 Duane Laflotte: Yeah, that's a great question. 627 00:29:08,214 --> 00:29:11,784 So here I'm gonna, I'll, I'll spill some of the secrets, um, from 628 00:29:11,784 --> 00:29:14,004 our, from our red team tactics. 629 00:29:14,184 --> 00:29:20,184 Um, and, and sadly I'd say all of these are going to deal distill down to policy. 630 00:29:20,694 --> 00:29:21,174 That's it. 631 00:29:21,384 --> 00:29:24,474 It's gonna be, here are the policies you should be following 632 00:29:24,479 --> 00:29:25,794 to make yourself more secure. 633 00:29:26,394 --> 00:29:30,444 Um, so xFi is always one of the big things, um, that, that a lot of 634 00:29:30,444 --> 00:29:32,694 our customers are concerned with as well, especially when we're doing 635 00:29:32,694 --> 00:29:36,294 banks, um, financial organizations, embassies, that sort of stuff. 636 00:29:36,294 --> 00:29:39,564 Anything we can ex fill is important and, and that's why there's this 637 00:29:39,569 --> 00:29:41,064 massive d l P market out there. 638 00:29:41,859 --> 00:29:44,829 Right looking for exfiltration of data. 639 00:29:44,829 --> 00:29:45,999 Did it go over email? 640 00:29:45,999 --> 00:29:48,399 Is somebody trying to upload a file to a website? 641 00:29:48,399 --> 00:29:49,539 Something along those lines. 642 00:29:49,569 --> 00:29:54,249 Um, I can tell you, uh, the red teamers as well as the, the hackers out there 643 00:29:54,249 --> 00:29:56,559 are not uploading data over Port 80. 644 00:29:56,559 --> 00:29:58,719 They're not uploading data over port 4, 4, 3. 645 00:29:59,079 --> 00:30:02,769 Um, they're not, you know, they're not using the standard channels because 646 00:30:02,769 --> 00:30:05,949 there are so many other ways for us to exfil data out of an organization. 647 00:30:06,099 --> 00:30:11,979 Um, so for example, um, the first thing we do when we break 648 00:30:11,979 --> 00:30:13,449 into a company, um, and we 649 00:30:13,574 --> 00:30:15,264 W. Curtis Preston (2): can I, can I, sorry to interrupt you, 650 00:30:15,264 --> 00:30:16,464 but can I ask you a question 651 00:30:16,899 --> 00:30:17,319 Duane Laflotte: sure, 652 00:30:17,364 --> 00:30:18,114 W. Curtis Preston (2): Why not? 653 00:30:18,444 --> 00:30:22,074 Because if they were uploading over that port, it would seem like 654 00:30:22,079 --> 00:30:23,814 it would be a lot easier to do. 655 00:30:24,189 --> 00:30:26,169 Duane Laflotte: it's absolutely a lot easier to do, but it's, 656 00:30:26,199 --> 00:30:27,819 it's a, it's too watched. 657 00:30:28,059 --> 00:30:30,669 Um, so everybody knows to watch all the web traffic. 658 00:30:31,119 --> 00:30:36,789 Um, so even, even if I were to break up what I'm exfil into small parts and 659 00:30:36,789 --> 00:30:41,244 then like turn it into hex and then try and post it to a website, A lot of 660 00:30:41,244 --> 00:30:44,124 your D L P solutions are looking at the reputation of the website I'm posting to. 661 00:30:44,154 --> 00:30:44,424 Right. 662 00:30:44,424 --> 00:30:47,544 And they're, they start doing that analytics of that communications chain. 663 00:30:47,604 --> 00:30:53,244 Um, and, and H T M L communications, h t p communications are very well understood. 664 00:30:53,694 --> 00:30:56,184 So it's easy for a corporate organization to go, well, we're 665 00:30:56,184 --> 00:30:58,344 not gonna allow anything out other than through this proxy. 666 00:30:58,344 --> 00:31:01,044 And we, we are going to then mount in the middle with a certificate 667 00:31:01,044 --> 00:31:02,424 so we can see all that traffic. 668 00:31:02,724 --> 00:31:07,464 So it's, it's risky for somebody who wants to break into a company and, and steal 669 00:31:07,464 --> 00:31:09,654 data, um, to, to go over those ports. 670 00:31:09,659 --> 00:31:10,584 They just won't anymore. 671 00:31:10,584 --> 00:31:11,574 It just doesn't make sense. 672 00:31:12,294 --> 00:31:17,094 And that is, it's super, it's, it's like, it's like we're, we're 673 00:31:17,094 --> 00:31:19,704 sitting out in a field, right? 674 00:31:19,764 --> 00:31:24,444 And, and port 80 is this steel door in the middle of the field. 675 00:31:24,449 --> 00:31:28,524 And, and we go, well, we could go through that steel door, um, or we 676 00:31:28,529 --> 00:31:30,774 could walk around the side of it. 677 00:31:31,569 --> 00:31:33,729 not use the steel door, right? 678 00:31:33,939 --> 00:31:38,229 So for us, we're like, it's just easier not to use the steel door, for example. 679 00:31:38,289 --> 00:31:41,619 I'm guessing at least your home networks, but probably your corporate 680 00:31:41,619 --> 00:31:44,619 networks, you don't block traffic out. 681 00:31:45,459 --> 00:31:46,359 Most people don't. 682 00:31:46,779 --> 00:31:48,519 They block traffic in, right? 683 00:31:48,549 --> 00:31:52,059 And then for d l P solutions, they look at web traffic, they look at, you 684 00:31:52,059 --> 00:31:56,559 know, um, maybe even, uh, they look at, you know, other ancillary traffic, 685 00:31:56,559 --> 00:31:59,949 but most of the time not, um, like web sockets and that sort of stuff. 686 00:31:59,949 --> 00:32:01,059 But most of the time they don't. 687 00:32:01,599 --> 00:32:03,939 So when we get into an organization, I mean, one of the first things 688 00:32:03,939 --> 00:32:08,649 we do, ha have you guys ever, um, you take a file, uh, I assume 689 00:32:08,709 --> 00:32:10,059 you've used Windows in the past. 690 00:32:10,239 --> 00:32:12,759 Um, we use Linux a lot, but take a file, right? 691 00:32:12,759 --> 00:32:16,569 Click on it, drag it to your desktop, and create a shortcut, right? 692 00:32:16,749 --> 00:32:17,289 Pretty simple. 693 00:32:17,289 --> 00:32:19,029 And then you double click on it and it opens up the shortcut. 694 00:32:19,449 --> 00:32:23,499 Well, what if that shortcut reached out to a file server, right? 695 00:32:23,964 --> 00:32:24,774 Well, you could do that. 696 00:32:24,774 --> 00:32:27,054 You could grab a file off a file server and create a shortcut. 697 00:32:27,054 --> 00:32:29,154 When you double click on it opens up the file on the file server. 698 00:32:29,454 --> 00:32:31,944 Well, what if that file server was on the internet? 699 00:32:33,564 --> 00:32:34,284 Can you do that? 700 00:32:34,434 --> 00:32:35,184 Well, you can. 701 00:32:35,274 --> 00:32:35,544 Yeah. 702 00:32:35,544 --> 00:32:36,984 4, 4, 5, which is Ss and B. 703 00:32:36,984 --> 00:32:39,444 Traffic does travel out over the internet. 704 00:32:39,644 --> 00:32:39,864 Prasanna Malaiyandi: Oh, 705 00:32:40,524 --> 00:32:42,684 Duane Laflotte: Most people don't ever do it. 706 00:32:43,374 --> 00:32:49,704 So it's easy for us to, what we do is we'll go to a w s, spin up a server turn 707 00:32:49,709 --> 00:32:51,864 on 4, 4, 5, and responder and a listener. 708 00:32:52,644 --> 00:32:56,094 Um, and then we drop this shortcut at the customer site. 709 00:32:56,664 --> 00:32:57,984 Um, and then we just wait. 710 00:32:58,374 --> 00:33:04,704 And what happens is everybody who browses that share doesn't even touch the file, 711 00:33:05,034 --> 00:33:11,034 but browses the share your file Explorer wants to put an icon on every file. 712 00:33:11,514 --> 00:33:15,294 So when it does, it touches that file and it goes to figure 713 00:33:15,294 --> 00:33:16,314 out what type of file it is. 714 00:33:16,319 --> 00:33:20,364 So it reaches out to us and gives us your hash, your handshake. 715 00:33:20,694 --> 00:33:23,334 For the network because it assumes it's connecting to. 716 00:33:23,784 --> 00:33:28,644 And, but who would stop SS m b traffic going out over the internet? 717 00:33:28,644 --> 00:33:28,914 Right? 718 00:33:28,914 --> 00:33:30,144 So this is one of the tactics we'll use. 719 00:33:30,144 --> 00:33:32,844 So then, you know, we were working with certain organizations where they're like, 720 00:33:32,844 --> 00:33:34,254 we have D L P, we have blah, blah blah. 721 00:33:34,254 --> 00:33:35,334 We have all this other good stuff. 722 00:33:35,334 --> 00:33:39,294 And, and literally all we had to do to x fill the data was map a windows, 723 00:33:39,294 --> 00:33:44,664 drive out to the internet and copy the data from one server to another 724 00:33:44,664 --> 00:33:46,104 and it just copied with Windows copy. 725 00:33:46,104 --> 00:33:49,374 And they're like, yeah, we didn't see 10 gig worth of data, customer 726 00:33:49,374 --> 00:33:52,224 data just go out over s and b 'cause nobody's watching it. 727 00:33:52,644 --> 00:33:55,854 Um, so the, so this is where I say a lot of it comes down to process. 728 00:33:55,884 --> 00:34:01,134 It's, you know, uh, least privileged process on traffic 729 00:34:01,134 --> 00:34:02,784 going out of the organization. 730 00:34:02,784 --> 00:34:05,514 If it's a not a port that you need, shut it down. 731 00:34:05,754 --> 00:34:08,364 Uh, 4, 4, 5 should never go out to the internet ever. 732 00:34:08,394 --> 00:34:09,834 There, there's no reason for it. 733 00:34:09,984 --> 00:34:10,524 Um, I. 734 00:34:11,064 --> 00:34:13,974 A lot of your home routers will actually block it by default. 735 00:34:13,974 --> 00:34:16,314 But corporate now, they're okay with it, which is just weird. 736 00:34:16,794 --> 00:34:19,284 Um, so I'd say part of that, part of that is process lease 737 00:34:19,284 --> 00:34:20,664 privileges on the way out. 738 00:34:20,664 --> 00:34:22,104 If you don't need a port, lock it down. 739 00:34:22,104 --> 00:34:25,044 That's gonna shut down a lot of the xFi tactics that we would use. 740 00:34:25,434 --> 00:34:29,604 Um, there are still some xFi tactics, tactics that we will use that 741 00:34:30,264 --> 00:34:31,734 would be hard for you to shut down. 742 00:34:32,184 --> 00:34:34,854 Um, there was one, I can't remember. 743 00:34:35,214 --> 00:34:39,084 Uh, there was one system, we had an administrator, we got access to this 744 00:34:39,084 --> 00:34:43,074 box and, um, he said, listen, I'll give you a jump station 'cause most, most of 745 00:34:43,074 --> 00:34:44,604 our engineers work on a jump station. 746 00:34:44,664 --> 00:34:46,404 And, and he gave us this jump station. 747 00:34:46,404 --> 00:34:49,494 And, you know, God bless him, he was, he, he really wanted to get the gold, 748 00:34:49,584 --> 00:34:52,254 the gold star on the, the, the pen test. 749 00:34:52,974 --> 00:34:55,074 And the drum station had access to nothing. 750 00:34:55,614 --> 00:34:58,164 Like, it didn't even have access to the internet. 751 00:34:58,464 --> 00:35:02,874 Like when we connected to it over remote desktop, this thing couldn't 752 00:35:02,874 --> 00:35:08,034 open files, couldn't, like, couldn't go anywhere, couldn't do anything. 753 00:35:08,124 --> 00:35:11,319 Um, And we're like, okay, what do people use this for, honestly? 754 00:35:11,319 --> 00:35:14,499 And he's like, ah, you know, they, we may have applications on there at some point. 755 00:35:14,559 --> 00:35:15,009 It's like, okay. 756 00:35:15,219 --> 00:35:19,749 So it was completely locked down and the way we were able to get our tools 757 00:35:19,899 --> 00:35:23,289 in and on that box was through d n s. 758 00:35:24,299 --> 00:35:25,659 Prasanna Malaiyandi: I was gonna ask about d n s. 759 00:35:25,659 --> 00:35:25,859 Yeah. 760 00:35:25,989 --> 00:35:26,469 Duane Laflotte: Yeah. 761 00:35:26,619 --> 00:35:28,989 Um, and listen, this thing couldn't communicate with the internet, 762 00:35:29,499 --> 00:35:30,879 but it's on a Windows domain. 763 00:35:31,299 --> 00:35:36,849 So we would then request through the domain controller to go out 764 00:35:36,849 --> 00:35:40,899 to our hacker.com website, and it couldn't pull down files. 765 00:35:40,899 --> 00:35:45,519 This is D N Ss, but you can request text records, which is the associated 766 00:35:45,519 --> 00:35:46,659 data with the d n s records. 767 00:35:46,659 --> 00:35:54,039 So we would encode like the first 64 bytes of a file in hex, pull that down. 768 00:35:54,039 --> 00:35:57,969 And once we had all the hex bits, we reassembled it into an executable. 769 00:35:58,329 --> 00:35:59,649 Um, at the local station. 770 00:35:59,859 --> 00:36:01,749 So, and, and it works both ways. 771 00:36:01,749 --> 00:36:03,459 You've got xFi and infill that way. 772 00:36:03,459 --> 00:36:06,279 So, uh, there are some that are really hard to block. 773 00:36:06,284 --> 00:36:09,249 You'd have to have very specialized tools watching, um, 774 00:36:09,249 --> 00:36:10,839 for those types of infill xFi. 775 00:36:10,899 --> 00:36:12,969 But I'd say just start with the basics. 776 00:36:13,029 --> 00:36:15,999 Shut down the ports that are going out that you don't absolutely need. 777 00:36:16,179 --> 00:36:17,829 And it gives you a lot less to look at. 778 00:36:17,859 --> 00:36:21,399 Like, did we have a hundred thousand d n s requests yesterday and now 779 00:36:21,399 --> 00:36:22,689 we have two and a half million? 780 00:36:23,259 --> 00:36:24,369 That's probably weird. 781 00:36:24,429 --> 00:36:25,749 We probably should look at that. 782 00:36:25,809 --> 00:36:26,109 Right. 783 00:36:26,169 --> 00:36:28,269 Um, it'll give you less of a, a surface of attack. 784 00:36:29,934 --> 00:36:30,014 W. Curtis Preston (2): Hmm. 785 00:36:30,754 --> 00:36:31,614 It is, it is. 786 00:36:31,824 --> 00:36:37,074 It was interesting because I, I had a conversation with a cyber person. 787 00:36:37,464 --> 00:36:43,734 Um, and he was crapping all over the idea of using D N Ss as an attack surface. 788 00:36:44,004 --> 00:36:47,214 Um, just like, it's like, it's just not, it's just nobody does that. 789 00:36:47,214 --> 00:36:48,534 And I'm like, okay. 790 00:36:49,284 --> 00:36:50,274 Um, 791 00:36:50,409 --> 00:36:52,059 Duane Laflotte: In a totally lockdown environment. 792 00:36:52,059 --> 00:36:53,289 I, I'll tell you, it's a pain in the butt. 793 00:36:53,469 --> 00:36:58,359 Um, because it's slow think, um, like if you guys ever used a, a 14 four modem back 794 00:36:58,359 --> 00:37:02,679 in the 1990, it's, it's like that where you're like, okay, d i r from our side. 795 00:37:02,679 --> 00:37:03,069 And it's like, 796 00:37:04,394 --> 00:37:04,684 Prasanna Malaiyandi: This 797 00:37:05,049 --> 00:37:07,149 Duane Laflotte: so from nostalgia standpoint it's pretty cool. 798 00:37:07,149 --> 00:37:11,439 But, um, so yeah, I get that it's not, it's not the best channel, 799 00:37:11,439 --> 00:37:13,719 but if it's the only one available, yeah, we'll absolutely use it. 800 00:37:14,694 --> 00:37:15,114 W. Curtis Preston (2): Right. 801 00:37:15,434 --> 00:37:15,714 Interesting. 802 00:37:16,494 --> 00:37:20,154 Um, man, I could talk, I could talk to you all day. 803 00:37:20,159 --> 00:37:20,304 It's 804 00:37:20,304 --> 00:37:24,204 both, it's both, very interesting and exciting and super depressing. 805 00:37:24,774 --> 00:37:30,714 Um, yeah, the, um, because you know, we, we had, we talked to somebody 806 00:37:30,714 --> 00:37:33,174 yesterday and basically their. 807 00:37:33,849 --> 00:37:34,479 Point. 808 00:37:34,529 --> 00:37:36,204 I would summarize it as this. 809 00:37:36,384 --> 00:37:39,624 Don't spend all your time trying to stop this stuff. 810 00:37:40,074 --> 00:37:43,824 Learn how to detect it when it's happening, and learn how to respond 811 00:37:43,914 --> 00:37:45,834 when it, when it has happened. 812 00:37:46,134 --> 00:37:46,554 Right. 813 00:37:46,794 --> 00:37:48,834 Learn how to watch for xFi. 814 00:37:48,924 --> 00:37:52,194 But in your case, you're, you're saying that some of this stuff is 815 00:37:52,194 --> 00:37:54,474 gonna be nearly impossible to detect. 816 00:37:54,864 --> 00:37:55,734 Look, you know, stop. 817 00:37:55,884 --> 00:37:59,274 I think what you're saying is stop the really obvious stuff, right? 818 00:37:59,334 --> 00:38:02,184 Uh, you can, you can do the, you can watch the port 80. 819 00:38:02,184 --> 00:38:02,544 Right? 820 00:38:02,544 --> 00:38:06,084 But you're saying that nobody's gonna, so, because I, I had heard that they're still 821 00:38:06,084 --> 00:38:10,764 using like these, um, and their names are escaping me, but like, these file sharing 822 00:38:10,764 --> 00:38:15,114 sites, um, like, like mega mega file 823 00:38:15,189 --> 00:38:16,899 Duane Laflotte: mega uploads and mega 824 00:38:16,899 --> 00:38:18,189 download and Yeah. 825 00:38:18,189 --> 00:38:18,759 Mega file. 826 00:38:18,959 --> 00:38:20,844 W. Curtis Preston (2): And wouldn't those go over port 80? 827 00:38:21,399 --> 00:38:21,639 Duane Laflotte: Yeah. 828 00:38:21,639 --> 00:38:25,419 And they do, and that's why most, most people aren't using those anymore. 829 00:38:25,419 --> 00:38:28,899 Like it used to be, um, what was it? 830 00:38:28,959 --> 00:38:31,389 Uh, pay bin and that sort of stuff. 831 00:38:31,389 --> 00:38:34,509 Like people were finding these sites where you could paste up a lot of data. 832 00:38:34,509 --> 00:38:37,539 And, and the problem is d l P solutions really have caught onto those. 833 00:38:37,959 --> 00:38:42,879 Uh, and I can tell you as a, so as a developer, uh, and as a, um, a guy 834 00:38:42,879 --> 00:38:46,599 who's trained in writing viruses that bypass any antivirus on the planet, 835 00:38:46,929 --> 00:38:51,639 it's really not that hard to open up any other port and start transferring data. 836 00:38:51,639 --> 00:38:53,349 'cause nobody's looking for it at that point. 837 00:38:53,349 --> 00:38:53,709 Right. 838 00:38:53,769 --> 00:38:58,989 Um, silly things like, um, say, okay, uh, S S H. 839 00:38:59,739 --> 00:38:59,949 Okay. 840 00:38:59,949 --> 00:39:03,699 So if every, if every you've ever, uh, you know, gone on a Linux box or whatever and 841 00:39:03,699 --> 00:39:08,319 you wanna connect to it remotely, use ss s h, which is a secure tunnel, um, well it's 842 00:39:08,319 --> 00:39:09,849 a secure tunnel 'cause it's encrypted. 843 00:39:09,999 --> 00:39:16,419 So if I just s ss h and s c p copy of file to a remote Linux box, 844 00:39:16,479 --> 00:39:18,249 that's an entirely encrypted channel. 845 00:39:18,429 --> 00:39:19,809 Nobody's gonna see what's in that. 846 00:39:20,079 --> 00:39:22,599 So why are you not blocking like port 22 out? 847 00:39:22,809 --> 00:39:23,169 Right? 848 00:39:23,259 --> 00:39:25,599 Oh, well, you know, one of our developers said they need to connect 849 00:39:25,599 --> 00:39:29,649 to some remote, uh, you know, Linux box in a w s like, okay, well there's 850 00:39:29,654 --> 00:39:31,119 better ways to do that, right? 851 00:39:31,419 --> 00:39:36,009 Um, so yeah, I you'll start to see a lot of, and, and you'll start to see a 852 00:39:36,009 --> 00:39:39,939 lot of these people using things like, um, you know, even like, so a lot of 853 00:39:39,939 --> 00:39:43,149 the Cobalt beacons, uh, cobalt Strike Beacons and that sort of stuff are, 854 00:39:43,154 --> 00:39:46,359 are starting to use different ports just so that they're not detectable. 855 00:39:46,389 --> 00:39:49,119 'cause everybody's looking for 80 and 4, 4 3, right? 856 00:39:49,284 --> 00:39:49,704 W. Curtis Preston (2): Mm-hmm. 857 00:39:49,709 --> 00:39:50,094 Mm-hmm. 858 00:39:50,469 --> 00:39:51,759 Duane Laflotte: and it's just easy to use something else. 859 00:39:52,464 --> 00:39:56,634 W. Curtis Preston (2): So my summary of what I heard all over that is 860 00:39:57,174 --> 00:40:02,785 blocking outgoing ports that, that you don't need right di disallow all. 861 00:40:03,624 --> 00:40:07,404 And allow the ones that you know you need, you'll break a couple 862 00:40:07,404 --> 00:40:09,654 of things, I'm guessing, right? 863 00:40:09,924 --> 00:40:12,534 You'll break a couple of things in the beginning, you'll fix those 864 00:40:12,534 --> 00:40:14,424 things and then you'll be better. 865 00:40:14,919 --> 00:40:17,319 Prasanna Malaiyandi: but but isn't that sort of supposed to be the way 866 00:40:17,319 --> 00:40:19,239 you approach network firewalls, right? 867 00:40:19,269 --> 00:40:23,620 It's always a deny all, and you add access for what you need. 868 00:40:25,209 --> 00:40:25,719 W. Curtis Preston (2): But I think, 869 00:40:25,719 --> 00:40:28,809 but I think Dwayne's making the very valid point that people haven't 870 00:40:28,809 --> 00:40:30,969 historically done that going out. 871 00:40:31,449 --> 00:40:31,959 Duane Laflotte: Yes. 872 00:40:32,019 --> 00:40:32,229 Yeah. 873 00:40:32,229 --> 00:40:35,289 And it's weird because like, um, and, and it's the same thing with windows, right? 874 00:40:35,289 --> 00:40:38,409 Windows in initially started with everything's open and 875 00:40:38,409 --> 00:40:39,429 you need to lock it down. 876 00:40:39,519 --> 00:40:43,539 And that's why they got the, the bad rep of being the unsecured operating system. 877 00:40:43,539 --> 00:40:45,459 And, and Linux started the entire opposite. 878 00:40:45,459 --> 00:40:47,709 There's nothing running on it unless you open it up. 879 00:40:48,189 --> 00:40:51,579 Um, networking has always been trust the inside and not the outside. 880 00:40:51,909 --> 00:40:52,209 Right. 881 00:40:52,209 --> 00:40:55,569 So we, we've been trained to, if they're on the inside, oh, they already have 882 00:40:55,569 --> 00:40:57,399 access to the juul, so to who cares? 883 00:40:57,399 --> 00:40:58,869 We don't need to worry about them going out. 884 00:40:58,869 --> 00:41:02,289 But, but the problem is, especially with ransomware and whatnot, the going out 885 00:41:02,289 --> 00:41:04,119 part is the important part at this point. 886 00:41:04,209 --> 00:41:06,219 Um, so yeah, you absolutely want it. 887 00:41:06,224 --> 00:41:10,689 And, and I like to think of it as a least privilege, uh, network stack, right? 888 00:41:10,689 --> 00:41:14,499 So exactly what you're talking about is what privileges do you 889 00:41:14,499 --> 00:41:18,069 need going out and let's say we manage a $22 billion organization. 890 00:41:18,069 --> 00:41:18,219 Yeah. 891 00:41:18,224 --> 00:41:20,769 You're not gonna set everything to deny out and then open it up. 892 00:41:21,069 --> 00:41:23,679 But what you could do is you probably have pretty sophisticated firewalls. 893 00:41:23,684 --> 00:41:26,649 You set them in monitoring mode, uh, and at the end of a month 894 00:41:26,649 --> 00:41:28,269 you see what ports are in use. 895 00:41:28,359 --> 00:41:31,749 Maybe you allow those and everything else gets blocked, right? 896 00:41:31,749 --> 00:41:34,839 So there are ways to do this without sort of breaking the organization. 897 00:41:35,169 --> 00:41:39,219 But I'll tell you the same thing applies to win like, um, corporate resources. 898 00:41:39,879 --> 00:41:46,119 We see far too often where we we're in an organization and it's like, oh, here's a 899 00:41:46,119 --> 00:41:49,209 public share that everybody has access to. 900 00:41:49,209 --> 00:41:53,289 And oh, by the way, it's got, uh, you know, we've seen things like, um, social 901 00:41:53,289 --> 00:41:57,819 security numbers, we've seen applications for mortgages, we've seen, uh, HR 902 00:41:57,819 --> 00:42:02,649 files, and we're like, why do we with no account have access to these things? 903 00:42:02,709 --> 00:42:04,779 And they're like, I don't know, people just put 'em in the public share. 904 00:42:04,779 --> 00:42:06,249 It's easy for anybody to access it. 905 00:42:06,279 --> 00:42:09,759 Um, so lease privilege needs to be used everywhere, but, 906 00:42:10,179 --> 00:42:10,839 um, including 907 00:42:10,934 --> 00:42:13,154 W. Curtis Preston (2): That's your policy thing that you were talking about, 908 00:42:13,194 --> 00:42:14,109 Duane Laflotte: Yes, exactly. 909 00:42:14,199 --> 00:42:14,489 Prasanna Malaiyandi: Yeah. 910 00:42:14,504 --> 00:42:15,614 W. Curtis Preston (2): concept of least privilege. 911 00:42:15,619 --> 00:42:15,884 Yeah. 912 00:42:16,334 --> 00:42:20,684 Um, that is a really good concept and policy that people should have everywhere. 913 00:42:21,174 --> 00:42:22,764 Let me, let me ask you this. 914 00:42:22,764 --> 00:42:29,784 So what, so a company comes to you and, and, you know, and 915 00:42:29,814 --> 00:42:32,304 they're like, hack us or whatever. 916 00:42:32,304 --> 00:42:36,444 I don't know exactly exactly what they say, but they, so what, what 917 00:42:36,444 --> 00:42:41,304 do they say and what do they get out of it right when they walk away 918 00:42:41,304 --> 00:42:48,804 from having, having been summarily beaten, um, and, and, and shamed. 919 00:42:49,194 --> 00:42:52,884 Um, what, what, what did they get out of it at that point? 920 00:42:53,409 --> 00:42:55,449 Duane Laflotte: Uh, that's a, that's another good question. 921 00:42:55,449 --> 00:42:59,769 So we do, um, the way we do red team engagement is a little bit different 922 00:42:59,859 --> 00:43:01,659 than most cybersecurity companies. 923 00:43:01,779 --> 00:43:05,709 Um, so the heart of our organization is very much a training company. 924 00:43:05,859 --> 00:43:09,249 Um, you know, I was a Microsoft certified trainer for decades. 925 00:43:09,309 --> 00:43:12,519 Um, my c e O was also a certified trainer for decades. 926 00:43:12,519 --> 00:43:14,709 We're all about teaching as much as we possibly can. 927 00:43:15,819 --> 00:43:17,439 So we bring that into our red team engagement. 928 00:43:17,439 --> 00:43:20,679 So the way it starts is t typically people do come to us and say, Hey 929 00:43:20,684 --> 00:43:23,859 listen, we're not really sure what our SEC cybersecurity posture is. 930 00:43:23,859 --> 00:43:24,999 Can you test it? 931 00:43:25,239 --> 00:43:25,539 Right? 932 00:43:25,599 --> 00:43:26,349 Can you hack us? 933 00:43:26,979 --> 00:43:28,809 Um, and we'll get some information from them. 934 00:43:28,809 --> 00:43:31,389 We'll obviously get the TS and CS sign that says you can't throw us in 935 00:43:31,389 --> 00:43:32,859 jail, and all that other good stuff. 936 00:43:33,069 --> 00:43:34,929 Um, 'cause we have had people come up to us. 937 00:43:35,199 --> 00:43:37,269 We had one guy come up to us, say, I'd like to engage you 938 00:43:37,274 --> 00:43:39,159 to, to, to hack into this bank. 939 00:43:39,474 --> 00:43:41,184 You know, I'm, I'm their IT manager. 940 00:43:41,184 --> 00:43:42,174 And we're like, okay, cool. 941 00:43:42,174 --> 00:43:45,144 But we don't see that you're their IT manager on LinkedIn. 942 00:43:45,324 --> 00:43:47,724 Um, or anything along those lines, you No, no, no, it's okay. 943 00:43:47,724 --> 00:43:48,144 It's fine. 944 00:43:48,444 --> 00:43:50,064 Um, but all things will go through me. 945 00:43:50,069 --> 00:43:53,274 So, and I was like, okay, so we can't talk to the bank and you want 946 00:43:53,279 --> 00:43:55,314 us to, no, we're not doing that. 947 00:43:55,464 --> 00:43:59,394 Um, so we talk to somebody at the bank, but for the most part they come to us, 948 00:43:59,394 --> 00:44:01,494 say, hack us, here's the resources. 949 00:44:01,584 --> 00:44:04,794 Um, you know, ideally they say, here's our IP addresses 950 00:44:04,794 --> 00:44:06,144 that are valid to hit go nuts. 951 00:44:06,534 --> 00:44:10,314 Um, sometimes they, they kind of tunnel us into, I only want you to 952 00:44:10,319 --> 00:44:13,104 focus on these systems, but they get kind of a better risk assessment 953 00:44:13,109 --> 00:44:14,664 if it's let us look at everything. 954 00:44:15,174 --> 00:44:19,764 And then what we typically do is, uh, we'll literally open up a, a zoom 955 00:44:19,764 --> 00:44:25,374 meeting, um, from nine in the morning till usually two in the morning, um, 956 00:44:25,374 --> 00:44:31,554 where their blue team can join and watch what we do and we'll talk 'em through it. 957 00:44:32,049 --> 00:44:34,239 But like, I know, and it's, it feels weird. 958 00:44:34,239 --> 00:44:36,819 It's like, Hey, I'm, I'm beating up your child, but let 959 00:44:36,819 --> 00:44:38,409 me explain how I'm doing it. 960 00:44:38,499 --> 00:44:40,749 Um, and they have to sit there and watch. 961 00:44:40,754 --> 00:44:42,249 I guess that makes it 962 00:44:42,454 --> 00:44:44,714 W. Curtis Preston (2): let me explain why your child is ugly. 963 00:44:45,939 --> 00:44:46,239 Duane Laflotte: right. 964 00:44:46,244 --> 00:44:46,689 Exactly. 965 00:44:46,689 --> 00:44:49,089 And we'll show you empirical proof. 966 00:44:49,119 --> 00:44:52,599 So, um, what's nice about that is far, you know, a, it 967 00:44:52,599 --> 00:44:53,799 gives, it's more collaborative. 968 00:44:53,799 --> 00:44:56,379 It's not like I'm delivering a report at the end, and the blue teamers are like, 969 00:44:56,409 --> 00:44:58,509 well, those red team guys suck, right? 970 00:44:58,539 --> 00:45:02,919 It's, it's, Hey, we wanna work with you, we want you to know these tactics and 971 00:45:02,919 --> 00:45:04,539 watch how we're moving around in network. 972 00:45:04,899 --> 00:45:09,579 Um, and, and b what we typically see from the blue team is they'll go, Hey guys, 973 00:45:09,609 --> 00:45:11,829 guys, you know that system over there? 974 00:45:11,829 --> 00:45:12,729 You haven't looked at it yet. 975 00:45:13,464 --> 00:45:15,174 Yeah, it's been causing us troubles. 976 00:45:15,264 --> 00:45:18,174 We wouldn't mind if you, you know, kind of tried to push 977 00:45:18,174 --> 00:45:20,304 that over a little bit, right? 978 00:45:20,574 --> 00:45:21,714 So we're like, all right, cool. 979 00:45:21,714 --> 00:45:22,674 We'll take a look at that system. 980 00:45:22,704 --> 00:45:27,324 So, um, so we, we use it as a training engagement, usually for like a week with 981 00:45:27,329 --> 00:45:31,434 their blue team and or red team if they have one, giving them other ways to think 982 00:45:31,464 --> 00:45:32,964 about the network and lock things down. 983 00:45:32,964 --> 00:45:36,324 And if we find something mission critical, we stop and we work with them to fix 984 00:45:36,324 --> 00:45:40,164 whatever it's, we find another hacking team in there, um, which we have, um, 985 00:45:40,169 --> 00:45:44,934 or we'll find, uh, yeah, we've, we've definitely found indicators of Compromise 986 00:45:44,939 --> 00:45:48,444 IOCs, um, for, for other teams in there. 987 00:45:48,444 --> 00:45:50,664 And that's an, that's an all engagement stop. 988 00:45:50,784 --> 00:45:51,414 And we call in 989 00:45:51,609 --> 00:45:53,949 W. Curtis Preston (2): And, and, and when you say other teams, you mean, 990 00:45:54,009 --> 00:45:55,599 you mean bad guys at that point? 991 00:45:55,794 --> 00:45:56,214 Duane Laflotte: Yeah. 992 00:45:56,364 --> 00:45:56,634 Yeah. 993 00:45:56,634 --> 00:45:59,454 And we'll, um, my team will go into forensics mode. 994 00:45:59,724 --> 00:46:02,724 We'll track 'em down and we'll be like, all right here, here's where they came in. 995 00:46:02,724 --> 00:46:03,444 Here's who they are. 996 00:46:03,444 --> 00:46:04,164 Here's right. 997 00:46:04,169 --> 00:46:06,624 If the, especially if the customer doesn't have a threat hunting team. 998 00:46:06,804 --> 00:46:08,904 Um, so that's typically what we do. 999 00:46:08,904 --> 00:46:10,914 And then, and then the report we deliver to them. 1000 00:46:11,409 --> 00:46:13,569 Is very actionable. 1001 00:46:13,569 --> 00:46:16,989 It's here was the issue we found, here's the risk, here's what could happen. 1002 00:46:17,499 --> 00:46:22,479 Here's how you fix it, and here's how you run the commands yourself 1003 00:46:22,509 --> 00:46:24,639 that we ran to exploit it. 1004 00:46:25,179 --> 00:46:28,929 So until these come back clean, there's no need to, you know, check 1005 00:46:28,934 --> 00:46:29,949 back in or anything like that. 1006 00:46:29,949 --> 00:46:30,849 Just go through. 1007 00:46:30,849 --> 00:46:35,709 So we want them to have all the tools, um, and, and we even tell customers 1008 00:46:35,709 --> 00:46:39,489 after being with us for a year or two, like, go find another security vendor. 1009 00:46:39,699 --> 00:46:41,139 Like, no, it behooves you. 1010 00:46:41,139 --> 00:46:45,219 Like we look at it one way and we, and we start to get tunnel vision when we 1011 00:46:45,219 --> 00:46:46,569 hit this network over and over again. 1012 00:46:46,569 --> 00:46:49,599 Go find somebody else who's gonna look at it in a different way, right? 1013 00:46:49,659 --> 00:46:51,819 Um, so that's, that's how we approach it. 1014 00:46:51,819 --> 00:46:54,549 So what they get from us is, you know, training a report that gives 1015 00:46:54,549 --> 00:46:57,399 them some actionable intel and how they can test their own network. 1016 00:46:57,759 --> 00:47:01,269 Um, and then advice that they can hopefully learn, uh, and we'll, 1017 00:47:01,299 --> 00:47:02,679 we'll adopt more customers. 1018 00:47:05,064 --> 00:47:05,304 W. Curtis Preston (2): Oh, 1019 00:47:05,814 --> 00:47:06,204 I like 1020 00:47:06,289 --> 00:47:06,449 Prasanna Malaiyandi: awesome. 1021 00:47:06,879 --> 00:47:07,169 Yeah. 1022 00:47:08,274 --> 00:47:09,174 W. Curtis Preston (2): Yeah, I like that a lot. 1023 00:47:09,174 --> 00:47:10,854 I, I'm curious to know 1024 00:47:12,954 --> 00:47:17,334 if you've ever had a situation where like you've got the blue team there 1025 00:47:17,604 --> 00:47:20,334 and they get like angry because, 1026 00:47:21,519 --> 00:47:21,669 Duane Laflotte: Oh 1027 00:47:21,684 --> 00:47:22,494 W. Curtis Preston (2): you know, it's 1028 00:47:22,769 --> 00:47:23,059 Prasanna Malaiyandi: Yeah. 1029 00:47:23,079 --> 00:47:24,899 Duane Laflotte: Oh yeah, yeah. 1030 00:47:25,209 --> 00:47:25,749 Okay. 1031 00:47:26,739 --> 00:47:31,299 Yeah, we've, we've, okay, so we've had situations where we've had, uh, 1032 00:47:31,329 --> 00:47:35,679 developers of applications on the line where we just tear the application apart 1033 00:47:35,739 --> 00:47:39,369 and, and they're, they're very much like, oh, man, like, and we tell them 1034 00:47:39,429 --> 00:47:41,799 that, like, they're like, what the f And I should have been better at this. 1035 00:47:41,799 --> 00:47:46,959 And I'm like, listen, like if you're not a, if I've been a developer, uh, 1036 00:47:46,959 --> 00:47:52,449 act since the early nineties, mid nineties and, and, and a cybersecurity 1037 00:47:52,454 --> 00:47:54,669 focus since, you know, 2000 so. 1038 00:47:54,904 --> 00:47:58,854 And, and there are a lot of these things I miss and I'm solely focused on cyber. 1039 00:47:58,854 --> 00:47:59,814 So don't beat yourself up. 1040 00:47:59,844 --> 00:48:00,804 This is what we do, right? 1041 00:48:00,804 --> 00:48:02,004 We specialize in these things. 1042 00:48:02,484 --> 00:48:05,874 Um, and I like that type of mentality 'cause that person wants to be better. 1043 00:48:06,294 --> 00:48:09,984 Um, I have had, we did have one blue teamer on a, uh, it was a 1044 00:48:09,989 --> 00:48:13,014 massive, uh, fortune 500 company. 1045 00:48:13,254 --> 00:48:18,714 Um, and he was the network security guy and he was on the call and, and every 1046 00:48:18,714 --> 00:48:24,594 time we run into a finding, we'd be like, oh, all of your, your switches actually 1047 00:48:24,594 --> 00:48:28,254 are doing, uh, T F T P automatically from an IP address that doesn't exist. 1048 00:48:28,254 --> 00:48:32,634 We just switched over to that IP address and that we can feed configurations to all 1049 00:48:32,634 --> 00:48:33,684 of your switches and that sort of stuff. 1050 00:48:34,554 --> 00:48:34,794 Anyway. 1051 00:48:34,794 --> 00:48:34,914 Go. 1052 00:48:34,974 --> 00:48:38,844 Well, you know, that's, uh, that always by design, um, that's the whole way. 1053 00:48:38,904 --> 00:48:41,334 Like, and we're like, oh, okay, that's cool. 1054 00:48:41,334 --> 00:48:44,394 We're just, you know, we're just saying this is, and, and every single time. 1055 00:48:45,039 --> 00:48:45,849 We would get this. 1056 00:48:45,849 --> 00:48:51,429 And, and we finally, we finally at one point went through and exploited it, um, 1057 00:48:51,429 --> 00:48:55,029 a particular switch config, and was able to pull down all the information on switch 1058 00:48:55,029 --> 00:48:57,729 config and decode this guy's password. 1059 00:48:58,089 --> 00:49:01,329 And we're like, oh, well, the way that we broke the entire network and became 1060 00:49:01,329 --> 00:49:06,429 domain admin is because this administrator here, here's his password on the switch. 1061 00:49:06,429 --> 00:49:09,609 And by the way, it's the same password on the domain. 1062 00:49:09,609 --> 00:49:12,669 And he's just like, I was like, yeah, yeah. 1063 00:49:12,669 --> 00:49:16,179 We try not to be adversarial, but occasionally we will get someone who, 1064 00:49:16,419 --> 00:49:19,779 uh, will, will invoke the ire of the red 1065 00:49:20,049 --> 00:49:23,319 W. Curtis Preston (2): Yeah, your, your goal is to bring them along with you, 1066 00:49:23,319 --> 00:49:25,449 like you said, for them to be educated. 1067 00:49:25,869 --> 00:49:29,949 But, uh, you know, a as a person who's been on the receiving end of that kind 1068 00:49:29,949 --> 00:49:32,949 of stuff, sometimes it's hard to, to 1069 00:49:33,159 --> 00:49:33,879 Duane Laflotte: Oh, absolutely. 1070 00:49:33,969 --> 00:49:34,659 W. Curtis Preston (2): it personal. 1071 00:49:34,719 --> 00:49:35,169 Right. 1072 00:49:36,009 --> 00:49:37,899 Um, yeah. 1073 00:49:37,904 --> 00:49:38,769 So, all right. 1074 00:49:38,774 --> 00:49:43,329 I, I, I, um, I have one final area and we've gone a little 1075 00:49:43,329 --> 00:49:44,619 longer than we typically go. 1076 00:49:45,744 --> 00:49:51,354 But I have one final area that I want to ask you about, and that is, so, you know, 1077 00:49:51,354 --> 00:49:54,054 at its heart our podcast is about backups. 1078 00:49:54,074 --> 00:49:54,494 Duane Laflotte: Mm-hmm. 1079 00:49:54,624 --> 00:49:57,414 W. Curtis Preston (2): What do you know about backup systems as an attack surface? 1080 00:49:57,744 --> 00:49:59,514 Duane Laflotte: so I have a very poignant example. 1081 00:49:59,784 --> 00:50:04,254 Um, we just recently, um, were doing a pen test two weeks ago, 1082 00:50:04,494 --> 00:50:07,794 uh, in an organization where we breached it over the backup system. 1083 00:50:08,034 --> 00:50:08,694 Um, and 1084 00:50:10,704 --> 00:50:10,824 I. 1085 00:50:11,019 --> 00:50:12,819 So they were all virtualized, of course. 1086 00:50:12,909 --> 00:50:17,049 Um, and they were backing up all of their VMs and we got access to the 1087 00:50:17,049 --> 00:50:20,139 backup manager because the password for the backup manager was weak. 1088 00:50:20,229 --> 00:50:21,939 Um, it was actually default passwords. 1089 00:50:22,389 --> 00:50:24,669 'cause people think to themselves, it's a backup manager, what do I care? 1090 00:50:24,669 --> 00:50:24,999 Right? 1091 00:50:24,999 --> 00:50:26,169 What are they gonna restore it? 1092 00:50:27,609 --> 00:50:28,629 And that's what we did. 1093 00:50:28,629 --> 00:50:34,779 We actually took the backup of the domain controller and pulled it over the internet 1094 00:50:34,779 --> 00:50:37,779 to us and restored it in my own lab. 1095 00:50:38,049 --> 00:50:41,949 And then were able to tear it apart, pull every single username and password. 1096 00:50:41,999 --> 00:50:47,189 So I would be careful that repository is just as sensitive as your primary network. 1097 00:50:47,189 --> 00:50:51,779 It's not only your path to recovering from disaster, but from an attacker. 1098 00:50:51,779 --> 00:50:55,079 I'm always looking for backup systems, um, and what I can pull out of 1099 00:50:55,084 --> 00:50:56,279 those systems, right? 1100 00:50:56,819 --> 00:50:58,679 So it's like pulling that data off. 1101 00:50:58,709 --> 00:51:01,739 Um, you know, uh, backup accounts should have strong 1102 00:51:01,739 --> 00:51:03,119 passwords and should be audited. 1103 00:51:03,119 --> 00:51:06,059 Backup systems should be audited for who's trying to log in, et cetera. 1104 00:51:06,269 --> 00:51:10,229 Um, backup service accounts that are running on boxes, we've seen far 1105 00:51:10,229 --> 00:51:12,029 too often just have weak passwords. 1106 00:51:12,059 --> 00:51:13,919 Um, and it's super easy for us to then compromise. 1107 00:51:13,924 --> 00:51:15,689 And the thing about backup, backup is awesome, actually. 1108 00:51:16,109 --> 00:51:20,849 Um, the, the backup service right on Windows gives you the ability to 1109 00:51:20,849 --> 00:51:24,149 read any file without being audited. 1110 00:51:25,034 --> 00:51:30,374 So, so you have all these auditing tools looking for users like reading files 1111 00:51:30,374 --> 00:51:32,144 and opening secure files and whatever. 1112 00:51:32,324 --> 00:51:34,844 But if you can request the se backup right? 1113 00:51:34,934 --> 00:51:38,354 You can touch anything and nobody ever sees it. 1114 00:51:38,594 --> 00:51:42,494 So from a, from a, from a surface of attack standpoint, like backups 1115 00:51:42,494 --> 00:51:44,174 are like a win button for us. 1116 00:51:44,174 --> 00:51:47,144 We're always looking for like, Hey, do they have a backup system? 1117 00:51:47,144 --> 00:51:49,454 Is there an account we can compromise that has se backup rights? 1118 00:51:49,484 --> 00:51:53,234 'cause if so, you know, money, we can go open any file we want and 1119 00:51:53,234 --> 00:51:54,494 nobody will know we were there. 1120 00:51:54,914 --> 00:51:59,534 So yeah, I, I would absolutely say, uh, surface of attack is large there. 1121 00:51:59,564 --> 00:52:01,814 Um, and you really need to go back to basics. 1122 00:52:01,814 --> 00:52:06,854 Make sure good passwords, strong auditing on backup systems and, and don't just 1123 00:52:06,854 --> 00:52:08,264 think it's your path for recovery. 1124 00:52:08,264 --> 00:52:09,764 It could also be an attack target. 1125 00:52:11,099 --> 00:52:11,819 Prasanna Malaiyandi: that's crazy. 1126 00:52:11,824 --> 00:52:13,979 I did not know that about the Windows role 1127 00:52:14,594 --> 00:52:15,314 Duane Laflotte: It's so cool. 1128 00:52:15,914 --> 00:52:17,324 So many cool things you could do. 1129 00:52:17,834 --> 00:52:20,864 Privilege escalation from ransomware can be done through backups. 1130 00:52:20,864 --> 00:52:22,394 I mean, there's so many cool things. 1131 00:52:23,969 --> 00:52:24,299 W. Curtis Preston (2): okay. 1132 00:52:24,299 --> 00:52:25,340 I was, I was, I was, 1133 00:52:26,299 --> 00:52:30,659 I was, I was excited and then I, and then I just, I just got really 1134 00:52:30,659 --> 00:52:32,129 depressed right at the end there. 1135 00:52:32,369 --> 00:52:34,919 I was like, God, it could be used for, yeah. 1136 00:52:34,919 --> 00:52:38,939 You know, the thing that we try to tell, like I've been trying to, I 1137 00:52:38,969 --> 00:52:42,689 I what this, this is gonna sound really weird, uh, especially given 1138 00:52:42,694 --> 00:52:46,499 that you joined that, you know, you crossover into cybersecurity in 2000. 1139 00:52:47,159 --> 00:52:50,969 What I think we're having at this point is a nine 11 moment. 1140 00:52:51,029 --> 00:52:52,799 And, and here's what I mean by that. 1141 00:52:53,279 --> 00:52:59,354 Up until nine 11, The thinking was, oh, well, just like, don't do 1142 00:52:59,354 --> 00:53:01,564 anything crazy with the hijackers. 1143 00:53:02,164 --> 00:53:06,274 Uh, okay, they can have access to the, the thing, but what are they gonna do? 1144 00:53:06,514 --> 00:53:06,784 Right? 1145 00:53:06,789 --> 00:53:09,454 They're gonna, they're gonna wanna land the plane, they're gonna wanna 1146 00:53:09,459 --> 00:53:12,514 hold everybody hostage so that they can release some prisoners. 1147 00:53:12,514 --> 00:53:19,264 And a pri, you know, no one had ever said, Hey, let's go train, you know, train 1148 00:53:19,264 --> 00:53:25,294 the hijackers on how to, how to land a, you know, a 7 47 so that they're gonna 1149 00:53:25,294 --> 00:53:28,804 use the, the plane as a bomb, right? 1150 00:53:29,104 --> 00:53:30,694 Um, as the weapon itself. 1151 00:53:31,034 --> 00:53:36,724 And, and what, that's what's happened with backup in the last, let's say five years. 1152 00:53:37,069 --> 00:53:42,709 Is that the ransomware folks are definitely, um, they're, they have 1153 00:53:42,709 --> 00:53:44,539 started seeing that two things. 1154 00:53:44,539 --> 00:53:48,199 One is that if they can take out the backup system, you're 1155 00:53:48,199 --> 00:53:49,519 more likely to pay the ransom. 1156 00:53:49,519 --> 00:53:54,409 And two, the backup system is, like you said, this massive attack surface that 1157 00:53:54,414 --> 00:53:56,059 that could be used for exfiltration. 1158 00:53:56,119 --> 00:53:56,539 I did 1159 00:53:56,674 --> 00:53:57,514 Prasanna Malaiyandi: pot of gold. 1160 00:53:57,979 --> 00:54:00,679 W. Curtis Preston (2): until you, until you mentioned I didn't think about it 1161 00:54:00,679 --> 00:54:04,999 being used for privilege escalation, uh, which makes it even more depressing. 1162 00:54:05,839 --> 00:54:10,699 Uh, and, and the, the thing is that so many times the backup system 1163 00:54:10,699 --> 00:54:13,339 is administered by the new guy. 1164 00:54:14,029 --> 00:54:14,419 Right. 1165 00:54:14,569 --> 00:54:14,809 It's, 1166 00:54:15,049 --> 00:54:15,739 Duane Laflotte: That was my first 1167 00:54:15,739 --> 00:54:15,859 W. Curtis Preston (2): the 1168 00:54:15,859 --> 00:54:16,939 first job I ever got. 1169 00:54:16,969 --> 00:54:17,839 Oh, it was your first job 1170 00:54:17,959 --> 00:54:18,169 Duane Laflotte: Yeah. 1171 00:54:18,169 --> 00:54:18,649 Mine too. 1172 00:54:18,829 --> 00:54:20,509 And, uh, and I'll date myself. 1173 00:54:20,509 --> 00:54:24,409 It was, it was these d l t tapes I was pulling out every day and then 1174 00:54:24,409 --> 00:54:26,059 putting in these new, these yeah. 1175 00:54:27,319 --> 00:54:27,979 W. Curtis Preston (2): Yeah. 1176 00:54:28,099 --> 00:54:29,779 Yeah, yeah. 1177 00:54:29,839 --> 00:54:30,529 Good times. 1178 00:54:30,589 --> 00:54:31,459 Good times. 1179 00:54:31,969 --> 00:54:35,029 Uh, well, well, dway, I, this has been fascinating. 1180 00:54:35,089 --> 00:54:37,579 Um, I don't know if I'm gonna be able to trim any of this 1181 00:54:37,579 --> 00:54:39,589 down to our usual show size. 1182 00:54:39,589 --> 00:54:44,389 So I hope that folks have enjoyed staying, uh, staying with us this amount of time. 1183 00:54:44,389 --> 00:54:46,159 I want to thank you so much for coming on 1184 00:54:47,089 --> 00:54:48,439 Duane Laflotte: It was my pleasure, honestly. 1185 00:54:48,444 --> 00:54:50,719 And this is, this was super easy, super comfortable. 1186 00:54:50,719 --> 00:54:53,179 Honestly, any guy, anytime you guys wanna talk cyber or 1187 00:54:53,179 --> 00:54:54,679 latest attacks, just hit me up. 1188 00:54:54,679 --> 00:54:55,399 I'd love to chat. 1189 00:54:55,669 --> 00:54:58,339 W. Curtis Preston (2): the time, right, Pana all the 1190 00:54:58,339 --> 00:54:58,819 time. 1191 00:54:58,819 --> 00:54:59,059 Don't we 1192 00:54:59,179 --> 00:55:00,619 Prasanna Malaiyandi: that's exactly what I was thinking. 1193 00:55:01,009 --> 00:55:01,429 Yeah. 1194 00:55:01,879 --> 00:55:06,139 I was like, just hearing the stories you talk about Dwayne, it's like fascinating. 1195 00:55:06,144 --> 00:55:09,859 It's like a world that like I've never really been exposed to and 1196 00:55:09,864 --> 00:55:11,209 just hearing the stories firsthand. 1197 00:55:11,214 --> 00:55:13,369 Like Curtis always talks about backup stories, which is great 'cause 1198 00:55:13,369 --> 00:55:15,679 I've never cut my teeth on backup. 1199 00:55:15,684 --> 00:55:18,679 But like hearing like the stories you or the experiences you have. 1200 00:55:18,679 --> 00:55:20,239 I think it's eye-opening. 1201 00:55:21,289 --> 00:55:22,009 Duane Laflotte: And horrifying. 1202 00:55:22,009 --> 00:55:24,589 And, and you notice me, I get giddy when things break. 1203 00:55:24,589 --> 00:55:26,089 Like the internet's on fire. 1204 00:55:26,089 --> 00:55:27,499 I'm the guy going, woo-hoo. 1205 00:55:27,499 --> 00:55:28,729 Like, let's see where this goes. 1206 00:55:29,239 --> 00:55:31,279 Which I know is a little sadistic. 1207 00:55:31,284 --> 00:55:31,699 I get it. 1208 00:55:31,699 --> 00:55:31,939 But, 1209 00:55:33,634 --> 00:55:34,204 W. Curtis Preston (2): Yeah. 1210 00:55:34,294 --> 00:55:39,484 Well, um, yeah, so thanks, uh, thanks again also to our listeners. 1211 00:55:39,784 --> 00:55:41,824 Uh, you know, we'd be nothing without you.