Speaker:

You found the backup wrap up your go-to podcast for all things

Speaker:

backup recovery and cyber recovery.

Speaker:

In this episode, we take a look at reconnaissance in

Speaker:

Cybersecurity by examining Mr. Robot season one, episode two.

Speaker:

Persona and I break down how threat actors conduct reconnaissance

Speaker:

before launching major attacks.

Speaker:

Just like F Society did against Evil Corp. In the show, we explore the

Speaker:

human intelligence aspects, you know, like figuring out who's dumb enough to

Speaker:

take a random CD from some guy on the street and put it in their computer.

Speaker:

We also discuss why your backup systems are prime targets for recon.

Speaker:

Modern attackers can spend months mapping your infrastructure, identifying your

Speaker:

weaknesses, and planning their approach.

Speaker:

This episode will, I think, open your eyes to just how thorough

Speaker:

those recon operations can be.

Speaker:

By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. Backup,

Speaker:

and I've been passionate about backup and recovery for over 30 years, ever since.

Speaker:

I had to tell my boss that we had no backups of the production

Speaker:

database that we had just lost.

Speaker:

I don't want that to happen to you, and that's why I do this.

Speaker:

On this podcast, we turn unappreciated admins into Cyber Recovery Heroes.

Speaker:

This is the backup wrap up.

Speaker:

Welcome to the show.

Speaker:

Hi, I am w Curtis Preston, AKA, Mr. Backup.

Speaker:

And I have with me a guy that just doesn't seem to get stressed out like I do.

Speaker:

Prasanna Malaiyandi.

Speaker:

How's it going, Prasanna.

Speaker:

I'm good, Curtis.

Speaker:

How do you stay?

Speaker:

So like even keel, like you're just like, I'm just like, ah.

Speaker:

And you're just like, you're good, man.

Speaker:

yeah, you just.

Speaker:

I honestly, I don't think I used to be like this.

Speaker:

Is it?

Speaker:

Is it, is it weed?

Speaker:

What?

Speaker:

No, no.

Speaker:

Like up or even after that, like through high school and college.

Speaker:

I even like the beginning part of my career, I don't think I

Speaker:

was like even keeled like this.

Speaker:

I, for the most part I was, but I used to get stressed and

Speaker:

then I don't know what changed.

Speaker:

Something clicked and

Speaker:

Hmm.

Speaker:

I am like, okay.

Speaker:

Hmm.

Speaker:

I know a

Speaker:

You're like, um,

Speaker:

who are like, how are you so calm all the time?

Speaker:

It'd be like in the middle of a fire drill.

Speaker:

I'm like, uh, it's okay.

Speaker:

yeah, I need, I need you in my fire drills.

Speaker:

Um, I feel like I'm in the middle of like three or four fire drills, like right now.

Speaker:

Like you saw, I got three phone calls we're trying to do, we're trying

Speaker:

to do this episode and I got like three phone calls, which reminds

Speaker:

me, I'm gonna put, I'm gonna put my phone on, you know, focus right.

Speaker:

Um, there.

Speaker:

Okay.

Speaker:

Um, so.

Speaker:

Curtis, just take a deep breath.

Speaker:

Shall we turn this into like a meditation?

Speaker:

Yeah.

Speaker:

Anyway, but uh, speaking of focusing on stuff, uh, we are continuing our

Speaker:

series of lessons learned from Mr.

Speaker:

Robot, which is a great show.

Speaker:

Spoiler alert, by the way.

Speaker:

Uh, we're gonna be talking about stuff in this episode,

Speaker:

uh, and all of these episodes.

Speaker:

If you haven't watched it, if you haven't watched episode, season one,

Speaker:

episode two of Mr. Robot, go watch it now before you listen to the podcast.

Speaker:

When you and I watched this episode, we, we weren't quite sure what we

Speaker:

were gonna pull outta this episode.

Speaker:

And, um.

Speaker:

There, there's a couple of things.

Speaker:

This is a very foundational episode.

Speaker:

You know, we sort of learn who Mr. Robot is.

Speaker:

We learn, um, that, that, um, and, and Elliot is given the, the

Speaker:

opportunity to participate in this hack that they want to take down.

Speaker:

Uh, evil Corp, which I love.

Speaker:

I love that.

Speaker:

It's called Evil Corp. And uh, and it uses essentially Enron's logo.

Speaker:

Completely unmodified, which is onic, you know, to say the least.

Speaker:

And then, um, you know, he's given the opportunity to participate in this thing.

Speaker:

And then they basically said, look, if you walk away, you walk away.

Speaker:

And, um, you know, and, and he does, he actually walks away.

Speaker:

Um, he, he will obviously end up coming back.

Speaker:

Otherwise this would be a very short series.

Speaker:

But, um.

Speaker:

end.

Speaker:

The The end.

Speaker:

Yeah.

Speaker:

But what we're gonna focus on is this concept of reconnaissance and network

Speaker:

mapping, because what you see is that clearly they have been doing that because

Speaker:

they know some things about Evil Corp

Speaker:

that they wouldn't know otherwise.

Speaker:

And so maybe just to provide a bit more context, because I'm sure people are

Speaker:

not watching it as recently as we have.

Speaker:

So in this episode, kind of as a recap, right?

Speaker:

What ends up happening is he goes and he visits the bunker with where F Society is.

Speaker:

Right.

Speaker:

Um, in addition, this is where Mr. Robot tells him, Hey, we want you

Speaker:

to, and we will discuss more in details about the network mapping.

Speaker:

We want you to take out their backup facility where, if you don't remember,

Speaker:

it was called Steel Mountain.

Speaker:

Steel Mountain, not to be confused with any other company by a similar name.

Speaker:

Yes.

Speaker:

And it just, and that's where they have their backups as well as there just

Speaker:

happens to be a gas plant next to it.

Speaker:

We will talk about that

Speaker:

Right.

Speaker:

bit.

Speaker:

Um, in addition, in this episode, this is also where you meet the drug dealer, uh,

Speaker:

Yeah.

Speaker:

right where, uh.

Speaker:

Elliot's neighbor Shayla gets the drugs that she then sells to Elliot.

Speaker:

Uh, so Fernando Vera was the guy's name.

Speaker:

Um, let's see what else happened in this episode.

Speaker:

This is also the episode where, um, I don't know if people remember it, but um.

Speaker:

Angela And Ollie, right?

Speaker:

Her boyfriend.

Speaker:

Yeah.

Speaker:

kind of standing out on the street and there is a guy who's trying to sell CDs.

Speaker:

Yeah.

Speaker:

like, oh, sell my CD or Buy my cd.

Speaker:

All I need is like 20 tweets saying

Speaker:

Yeah.

Speaker:

it or whatever else.

Speaker:

Yeah.

Speaker:

Yeah.

Speaker:

And they gave, and they gave him a cd, which turns out to be, uh, something very

Speaker:

much not a CD or not a, not a music cd.

Speaker:

Yeah,

Speaker:

Yeah,

Speaker:

in this episode too, right, they talk about how Ollie

Speaker:

puts it in the laptop at home,

Speaker:

yeah,

Speaker:

And the guy is able to sort of take over it, installs some malware.

Speaker:

He's

Speaker:

yeah,

Speaker:

at the webcam right

Speaker:

yeah.

Speaker:

Yeah.

Speaker:

all the rest of that,

Speaker:

And that was, that was where the very, the very last moment of that episode is

Speaker:

when he's seeing the webcam and he can see the girl, uh, he can see Angela basically

Speaker:

like going to take, I think take a shower.

Speaker:

And he's like, we're in.

Speaker:

The last line in the episode is we're in and

Speaker:

And

Speaker:

"we're

Speaker:

in", was actually written in Chinese.

Speaker:

Oh, okay.

Speaker:

Okay.

Speaker:

I guess I missed that part.

Speaker:

Yeah.

Speaker:

Um, the, and so any crucial, any hack, any major hack, which is going to

Speaker:

include, like, this is, this is, you know, this hack that they want to do of.

Speaker:

Evil Corp I is, is definitely, I would, I would call this like a, an EPT an or an

Speaker:

a PT, an adv advanced persistent threat.

Speaker:

Right?

Speaker:

You know, they've got, they're going to be doing this over a long run, a

Speaker:

long period of time, and they have a goal in mind and they, and they

Speaker:

are willing to be patient to, um, to do the things that they need to do.

Speaker:

To, to move forward.

Speaker:

And I, I, I think that it, it gives us an opportunity to discuss this

Speaker:

concept of reconnaissance, um, and, and network mapping, which is what

Speaker:

we're, what we're talking about.

Speaker:

Their goal, right?

Speaker:

With this entire thing, right?

Speaker:

What are they looking to accomplish with Evil Corp, right?

Speaker:

Evil Corp basically has all the credit records of everyone in the country.

Speaker:

Right,

Speaker:

as you start to see Angela's in heavy debt with student loans, right?

Speaker:

There are other people who, uh, Shayla, the Elliot's neighbor is also in debt,

Speaker:

and so it's basically they're like, we can basically attack the company,

Speaker:

destroy everything, and do basically a giant reset on everyone's rec financial

Speaker:

right.

Speaker:

Right.

Speaker:

and

Speaker:

Yeah.

Speaker:

So that's, that's their end goal, right?

Speaker:

Um, basically, you know, deleting and, and, and they know that if they delete

Speaker:

the, the primary copy, they know that, uh, they have, um, a copy, you know, in

Speaker:

their backups stored in Steel Mountain.

Speaker:

Yeah.

Speaker:

and so they know therefore, and by the way, why.

Speaker:

And I guess, how do they know that?

Speaker:

And the answer, the, the answer to that question is, the answer to this

Speaker:

or the to is the title of this episode.

Speaker:

Because they went in and they did reconnaissance and they figured out, and,

Speaker:

and again, this is something that we, we've said on multiple episodes that.

Speaker:

It's going to be one of the primary goals of once, once the initial, um,

Speaker:

access has been granted to the threat actor, their next step is going to be

Speaker:

figure out what can we get rid of that, you know, that basically how can we stop

Speaker:

whatever it is that would then stop us?

Speaker:

In other words,

Speaker:

they're gonna try to take out the backups.

Speaker:

Right.

Speaker:

And you know, and, and, and yeah.

Speaker:

This is a podcast dedicated to backups, but.

Speaker:

And so maybe, you know, to hammer everything looks like a nail.

Speaker:

Trust me.

Speaker:

Talk to any, you know, go listen to the Red Team Epi episode where he

Speaker:

basically said, he said two things.

Speaker:

One is he loved backups because they were so great at helping him to do

Speaker:

network mapping and figure things out.

Speaker:

And, uh, and he loved the system, the fact that they run

Speaker:

his system and all that stuff.

Speaker:

Uh, and then the other is, yes, you're gonna try to take that out.

Speaker:

And unfortunately, many of the designs that we have today are

Speaker:

using entirely disc based backups.

Speaker:

Dis and cloud, uh, and if you're, depending on how you set that up, they

Speaker:

can easily map all of that stuff, figure that stuff out, and then delete it.

Speaker:

Right.

Speaker:

And what we have in this episode is we do see that this company is at least storing

Speaker:

some offsite backups in Steel Mountain.

Speaker:

And um, in this case it happens to be tape backups.

Speaker:

It doesn't have to be tape backups, right.

Speaker:

But yeah.

Speaker:

which, which

Speaker:

Go ahead.

Speaker:

basically a third party vendor, right?

Speaker:

It's

Speaker:

It's a third party be Yeah, yeah.

Speaker:

A-K-A-K-A Iron Mountain.

Speaker:

Right, right.

Speaker:

Iron Mountain or something like that.

Speaker:

Right.

Speaker:

And, um, the, um, I, I think it's funny that, like, did they, did they

Speaker:

reach out to Iron Mountain, see if they wanted to be branded in the episode?

Speaker:

Probably not.

Speaker:

Yeah.

Speaker:

No.

Speaker:

but it just, it just, it's funny, like anybody in the industry is like,

Speaker:

oh yeah, they mean Iron Mountain.

Speaker:

Right.

Speaker:

Um, but.

Speaker:

There's a couple of things here.

Speaker:

One is first just understanding this concept of reconnaissance, right?

Speaker:

Um, what are the kinds of things, do you think that a, a threat actor,

Speaker:

once they've gained an initial access, what are the kinds of things that

Speaker:

they're going to try to figure out?

Speaker:

Well, they're gonna figure out well for them, right?

Speaker:

They wanna figure out what's the most valuable data in the company,

Speaker:

Right.

Speaker:

right?

Speaker:

That's one thing.

Speaker:

And then where all is that data sitting?

Speaker:

Mm-hmm.

Speaker:

then where are those things that can be used to recover from any sort of attack?

Speaker:

Because remember we talked about with ransomware, right?

Speaker:

It's not just a matter of encrypting your data, deleting your backups.

Speaker:

A lot of these people will also exfiltrate your data,

Speaker:

Right,

Speaker:

For double extortion.

Speaker:

right.

Speaker:

now forced to pay in order to prevent incriminating evidence or bad things

Speaker:

about your company from being published.

Speaker:

Yeah.

Speaker:

And, and, and if I, and I, I agree everything that you said, I will

Speaker:

preface, uh, I will add to your list at the beginning of your list.

Speaker:

Um, basically human based reconnaissance because we see that happening with Angela

Speaker:

and Ollie and I would wager Toti bet.

Speaker:

Well, not wager.

Speaker:

I, I think if we go back to, to the first episode that, um, which oddly

Speaker:

enough is numbered episode zero because.

Speaker:

clarify.

Speaker:

Yeah.

Speaker:

So for people who are watching the show and then trying to map it to

Speaker:

what we're talking about, the show technically starts with Episode Zero.

Speaker:

Yeah.

Speaker:

1.0 and 1.1.

Speaker:

This is episode 1.1, AKA, episode two in, in binary fashion.

Speaker:

Right.

Speaker:

We're starting at zero.

Speaker:

Um, which again, I think it's kind of cool, right?

Speaker:

But, um, and also confusing for certain things, right?

Speaker:

Uh, but basically what we see is clearly in the case of what happened with Elliot.

Speaker:

Which is our main protagonist here.

Speaker:

What happened with Elliot is clearly they did reconnaissance against Elliot.

Speaker:

Clearly, they figured out what he was up to, which, and they

Speaker:

figured out his proclivities.

Speaker:

Right.

Speaker:

They figured out.

Speaker:

I, I think they find, I think they felt that they had found someone

Speaker:

that they could, exploit is a strong word, but they could use, right.

Speaker:

And, and this, and you see this on the previous episode, right?

Speaker:

Where

Speaker:

Yeah.

Speaker:

sitting at the computer terminal in the data center and he's like,

Speaker:

I should go delete this directory.

Speaker:

And it's at the prompt where it's like, yes or no.

Speaker:

And

Speaker:

Yeah,

Speaker:

should do it.

Speaker:

And his finger's hovering over

Speaker:

yeah, yeah.

Speaker:

like, and, and because there was a text file that said, leave me here.

Speaker:

Right.

Speaker:

he's like, it was intended for me.

Speaker:

So I think, like

Speaker:

Yeah.

Speaker:

Curtis, the only way they could have done that is if they had done some sort

Speaker:

of human, uh, read on him to be like, yes, this is the sort of thing that he

Speaker:

is struggling with and let us use him.

Speaker:

Yeah.

Speaker:

Also known as human, right?

Speaker:

Human intelligence and yeah.

Speaker:

So they figured out, and, and, and what we also know about Elliot is he has a

Speaker:

problem, you know, in addition to being antisocial and anti, anti, anti, anti,

Speaker:

uh, he is also got a drug problem, right?

Speaker:

So we're seeing it.

Speaker:

And then, and that's something that.

Speaker:

That again, you know, like, um, I dunno if you've ever heard this, um, the only

Speaker:

two people that actually know you are your hairdresser and your and your CPA, right?

Speaker:

Yep.

Speaker:

Like right.

Speaker:

They know, they know your real, real hair color and your CPA knows where

Speaker:

you're actually spending your money.

Speaker:

Yeah.

Speaker:

And so if someone.

Speaker:

Had done reconnaissance against him.

Speaker:

And, and you know, you think about it, there are the, the, they

Speaker:

targeted him because of his access.

Speaker:

Yep.

Speaker:

He worked at allsafe, which is this, this cybersecurity firm.

Speaker:

So they're like, who can we get that has access into the company?

Speaker:

We're gonna find somebody.

Speaker:

And they probably did a bunch of reconnaissance against all safe, um.

Speaker:

employees and to

Speaker:

And the employees, and they watch 'em and they see what they do

Speaker:

and they see Elliot like going out there buying drugs and stuff.

Speaker:

I mean, if, if they're, this is a big operation and they're gonna

Speaker:

do stuff like that, um, to, to, to do the reconnaissance, to figure

Speaker:

out, um, you know, what's going on.

Speaker:

which was very interesting because you know, Elliot was super careful

Speaker:

Yeah.

Speaker:

a seed right where he hacks.

Speaker:

Terrell, right, who is sort of the person who wants to become

Speaker:

CTO of the of Evil Corps, right?

Speaker:

And he realizes, oh, it's too easy.

Speaker:

And there's a scene where he's literally taking apart his computer.

Speaker:

He's drilling the hard drives,

Speaker:

Yeah.

Speaker:

out

Speaker:

Yeah,

Speaker:

cards and throwing it into the microwave and zapping them.

Speaker:

yeah.

Speaker:

with all being so careful,

Speaker:

Yeah.

Speaker:

Maybe he didn't think about the human intelligence piece.

Speaker:

Yeah.

Speaker:

Yeah.

Speaker:

Um, and, uh, Tyrell, he is, he is a, he is a twisted little fellow himself.

Speaker:

Right.

Speaker:

Um, but, um, 'cause we have the, in this episode we have the scene

Speaker:

of him paying money to go beat the crap outta some homeless dude.

Speaker:

I, I do not know what that, I mean, clearly that's a, you know, it's a. It's

Speaker:

like that's gonna come into play later.

Speaker:

But, but this is the thing, like, like when you have a company, you have

Speaker:

all sorts of people that work for you that have all sorts of weaknesses.

Speaker:

Yep.

Speaker:

They might be financial weaknesses, they might be drug weaknesses,

Speaker:

they might be people, weaknesses.

Speaker:

And if someone, if some entity.

Speaker:

Wants to take your company down, they're, they're going to go through the trouble of

Speaker:

doing this kind of recon, reconnaissance of figuring out who works at your

Speaker:

company to see who they, who's gonna be dumb enough to take a CD off the street

Speaker:

Yep.

Speaker:

then put it into a network computer.

Speaker:

Um,

Speaker:

Do

Speaker:

yeah.

Speaker:

it drives me bonkers because remember back in the day, people would

Speaker:

just leave, like USB sticks around

Speaker:

Yeah.

Speaker:

would pick it up and put it in their machines,

Speaker:

Yes.

Speaker:

would be like, please do not do this.

Speaker:

That is bad.

Speaker:

And then they had to start locking down all the USBs

Speaker:

Yeah.

Speaker:

Uh, another thing, um, is that, well, you, you can buy, like if you buy USB,

Speaker:

like used thumb drives off of eBay or used hard drives, you will get data

Speaker:

on those, on those drives, right?

Speaker:

Um, and uh, again, I, I know I've told this story before, but I love this story.

Speaker:

I'm gonna go back to.

Speaker:

Several years ago when Symantec bought Veritas.

Speaker:

And, um, it was the first, uh, that, and it had a, uh, Veritas vision was

Speaker:

the name of the, of their conference, which it used to be called Vera Con.

Speaker:

But then when they went to international, apparently Raan and

Speaker:

French sounds like very stupid.

Speaker:

No.

Speaker:

and so they changed it to Veritas Vision and then Seman, and then it was

Speaker:

Semantic Vision and it was the first.

Speaker:

Uh, conference after the Semantic rebranding.

Speaker:

And I, I remember two things.

Speaker:

One is they didn't really do anything with NetBackup.

Speaker:

They did literally, and because I remember blogging, I think you

Speaker:

can find a blog on my website 'cause it's been around a while.

Speaker:

You can find a blog on my website that says that the

Speaker:

Semantic apparently spent a year.

Speaker:

Painting everything yellow and black.

Speaker:

That's, that's what I remember saying.

Speaker:

But then it was the trade show and, um, they passed out a thumb

Speaker:

drive, uh, for everyone to that, you know, it was the conference

Speaker:

materials and the thumb drive that.

Speaker:

At the Semantic Conference had had malware on it and um, and so like, it

Speaker:

was like the next day and they were like, Hey, uh, have you got that?

Speaker:

Some don't, don't put it in anything.

Speaker:

It's a, it's kind a thing, which I mean, I mean that's just like.

Speaker:

Ironic.

Speaker:

Yeah.

Speaker:

Ironic to the max, right?

Speaker:

Um, the fact that a, you know, an antivirus company essentially would

Speaker:

distribute a virus or whatever, whatever it was, I dunno if it

Speaker:

was a virus, but it was malware.

Speaker:

Yeah.

Speaker:

Um, at their own conference.

Speaker:

Yeah.

Speaker:

So, I think the one interesting thing about this episode as well,

Speaker:

right, so we talked about the human intelligence piece, right?

Speaker:

Yeah.

Speaker:

kind of understanding who's where.

Speaker:

The other thing was in the episode they talked about, okay, all of their

Speaker:

data is on their primary data center.

Speaker:

Mm-hmm.

Speaker:

Um, and they're like, yeah, we can go delete it.

Speaker:

But being a financial company, guess what it has?

Speaker:

They have paper records, right?

Speaker:

Right,

Speaker:

records still

Speaker:

right.

Speaker:

is actually what is in Steel Mountain.

Speaker:

Oh, is that what's in steel mount?

Speaker:

Is the paper records?

Speaker:

Okay.

Speaker:

I missed that part.

Speaker:

And by the way, something I learned.

Speaker:

I think I've said this in pre stuff, but something I learned is that if

Speaker:

you see a truck that's branded and it says Iron Mountain, it's not like

Speaker:

you did mention it

Speaker:

Yeah.

Speaker:

Level one stuff, right?

Speaker:

It, it's like, I think it might be a,

Speaker:

Shredding.

Speaker:

only be a tape, a paper destruction, right?

Speaker:

It's definitely not tapes.

Speaker:

Uh, but I do remember many years ago, I don't know if it was Iron Mountain,

Speaker:

but it was a, it was an offsite vaulting company and the offsite vault guy.

Speaker:

He was driving his van.

Speaker:

He was a man in a van,

Speaker:

Yeah.

Speaker:

stopped at Starbucks to get some stuff and he came back out and his van was gone.

Speaker:

Oh no, that's not good.

Speaker:

Yeah, it's like go from A to B. Do

Speaker:

Yeah,

Speaker:

Do not.

Speaker:

yeah, yeah.

Speaker:

Um, so yeah, so, so Go ahead.

Speaker:

Go ahead.

Speaker:

Oh

Speaker:

ahead.

Speaker:

yeah, so Steel Mountain.

Speaker:

So they were like, yeah.

Speaker:

And to find that out, right.

Speaker:

They probably had to look at email records and pos and figure out like,

Speaker:

when are records going out the door to this other place, and who's it

Speaker:

going to and what's their schedule?

Speaker:

And oh, you know what it was, is they

Speaker:

I'll just interrupt there.

Speaker:

Just interrupt there.

Speaker:

And the, the amazing thing about things like pos and things like that

Speaker:

is they're like just PDFs and they're generally stored in plain text.

Speaker:

No one thinks about.

Speaker:

Securing that data from outside access.

Speaker:

Go ahead.

Speaker:

Oh, the other thing is they did also mention in the episode they're like,

Speaker:

where most of the s and p 500 stores their or archives, their data, and

Speaker:

that's what they said, steel Mountain.

Speaker:

Yeah.

Speaker:

guess who one of those is?

Speaker:

Is Evil Corp.

Speaker:

Right, right.

Speaker:

And

Speaker:

It's, yeah.

Speaker:

that's where they're like, it is this one facility that we need to attack.

Speaker:

Yeah.

Speaker:

And, I'm willing to go on a limb and say that there is nowhere where Iron Mountain

Speaker:

has a facility next door to a gas.

Speaker:

Uh.

Speaker:

I was, I was, I was going to say, I was like, what is a likelihood that a company.

Speaker:

That is, that is known for, that would put it like right next to a gas plant.

Speaker:

Yeah.

Speaker:

And you know, my, my previous employer I got sent to, um, I got sent to a facility,

Speaker:

a, a secure tape storage facility for a household name financial organization.

Speaker:

And it's in the middle of a giant field right,

Speaker:

Mm-hmm.

Speaker:

berms around it.

Speaker:

Right.

Speaker:

Um, and to get there with a car, you have to go through

Speaker:

three levels of security, right?

Speaker:

There's this, there's a giant like metal barricade that, that, that, that's down.

Speaker:

You talk through a squawk box that lets you, through that barricade, through

Speaker:

the steel reinforced fence, right?

Speaker:

Then you go through there, then you park.

Speaker:

In a parking lot.

Speaker:

Then you go inside and you talk to the person who then determines, you know,

Speaker:

and then, and then, and then you go through another barric, another of the,

Speaker:

you know, crossing guard barricades to go inside a building where they then go

Speaker:

around with one of those like scanning things to scan your car and they're

Speaker:

putting stuff underneath, like I think, I think Iron Mountain would have something

Speaker:

simple, I guess is what I'm saying.

Speaker:

Yeah.

Speaker:

It's like Fort Knox, right?

Speaker:

You don't like

Speaker:

Yeah.

Speaker:

is in the middle of nowhere.

Speaker:

Yeah, exactly.

Speaker:

Exactly.

Speaker:

Um, so yeah, so we talked about that, that basically they would do this, they

Speaker:

would go through all of this effort to do reconnaissance and what we see,

Speaker:

I think at the very end there is we see the beginning of a more digital.

Speaker:

Method of reconnaissance, right?

Speaker:

So now we've got access to the computer and we're, and they're gonna do, I

Speaker:

think a couple of things there because obviously they have webcam access.

Speaker:

So they're gonna be able to listen in on conversations, they're

Speaker:

gonna be able to hear things.

Speaker:

And this is Angela, who is part of allsafe.

Speaker:

And so, and he's also part of allsafe, right?

Speaker:

Ali

Speaker:

Um, and so they're gonna have conversations that, you know,

Speaker:

it'd be great to listen in on.

Speaker:

And so they're, they're gonna be able to do again, um, you know, human-based

Speaker:

intelligence and they're gonna, they're gonna learn all sorts of stuff.

Speaker:

'cause these, these two people, they're,

Speaker:

Yeah.

Speaker:

they're very connected and they're gonna be in their, what they think is a

Speaker:

very safe place discussing, uh, stuff.

Speaker:

Um, but again, just, just going back to,

Speaker:

you know, proper.

Speaker:

Uh, stuff, right?

Speaker:

You, you don't, you don't do that, right?

Speaker:

You don't, you don't, uh, just take a CD off a guy or a thumb drive off

Speaker:

a guy or a thumb drive that you find on the ground, and, uh, and then, uh,

Speaker:

yeah, and then put it in your system.

Speaker:

also please, when you're at an airport and you see those USB

Speaker:

charging ports at an airport, do

Speaker:

Yeah.

Speaker:

in your phone to those.

Speaker:

Well, I will say.

Speaker:

So I'll, I'll, I'll push back on that a little bit.

Speaker:

I, I, I can't argue with it too much, but what I will say is at least a

Speaker:

decent modern phone will say, Hey, you just plugged into this device.

Speaker:

Do you want to trust it?

Speaker:

And I would say, make sure you say no.

Speaker:

Okay,

Speaker:

I mean, best practices don't do it.

Speaker:

Right.

Speaker:

Actually, best practice would be bring a plug.

Speaker:

Yeah.

Speaker:

Right, right.

Speaker:

But yeah.

Speaker:

Yeah.

Speaker:

That, that's best practice, you know, good, better, best.

Speaker:

Right.

Speaker:

Yeah.

Speaker:

even Department of Homeland Security also recommends not

Speaker:

Yeah.

Speaker:

Again, I can't, I can't disagree with you.

Speaker:

I'm just saying if you're, if you're, if you're desperate, if you're gonna,

Speaker:

yeah,

Speaker:

but again, that's what they want.

Speaker:

They want you to be desperate.

Speaker:

Um, and also whatever you do, don't just trust a random cable.

Speaker:

'cause I did watch a presentation on a cable that looked like

Speaker:

just a regular normal cable.

Speaker:

And it, and it, you know, it took over a phone.

Speaker:

Yeah.

Speaker:

Um, and what was that last thing you said?

Speaker:

What was it?

Speaker:

Oh, also on airplanes?

Speaker:

Oh, yeah, yeah, yeah, yeah.

Speaker:

Airplane.

Speaker:

Yeah, because those are definitely, yeah.

Speaker:

Yeah.

Speaker:

Yeah.

Speaker:

Um, so yeah, so basically, again, best practice is not to trust random guy.

Speaker:

Yeah,

Speaker:

Um,

Speaker:

I think the other thing is also be careful what you post online some of these things,

Speaker:

which maybe should not be out there

Speaker:

yeah.

Speaker:

It's something, it's something that, um.

Speaker:

I think our, our generation you are in My generation aren't, no, actually

Speaker:

aren't, aren't you a millennial?

Speaker:

What are you

Speaker:

I'm technically a millennial.

Speaker:

Uh, you're an elder millennial.

Speaker:

Just like I'm an elder.

Speaker:

I'm an elder Gen Xer.

Speaker:

Um, yeah.

Speaker:

So both of our generations I think, understand that a little bit better

Speaker:

than the current generations.

Speaker:

The two, the two, um, where literally they just, they just, you know,

Speaker:

they post, they, they got up.

Speaker:

I, you know, I,

Speaker:

Yeah.

Speaker:

to the bathroom, here's what I had for breakfast, you know,

Speaker:

Well, I

Speaker:

you know what I mean?

Speaker:

had like posted a video of like, they had joined a company and like were

Speaker:

posting like their security stuff, like just a walkthrough of the building and

Speaker:

the security things and it's like, uh,

Speaker:

Yeah, it's no bueno.

Speaker:

No bueno.

Speaker:

Um, so, um, and again, I'll, I'll use this as an opportunity again that

Speaker:

because the backup system is such a target, it needs to be segregated, right?

Speaker:

It needs to be on a separate network.

Speaker:

It needs to be on a separate authentication and authorization system.

Speaker:

, It's gonna be on a separate Entra domain, formerly known as Active Directory.

Speaker:

And, you know, my, my Prasannal is that you would use like local passwords and a

Speaker:

password manager, um, that you wouldn't use a, a network based, um, you know.

Speaker:

System and, and lots of, and lots of MFA and, you know, um, and, you

Speaker:

know, UB keys and like by, you know, incorporate biometrics if you can.

Speaker:

Right.

Speaker:

Um, and, and just have that as separate as you can and, and, and

Speaker:

it sounds like a pain to do it.

Speaker:

And it is a pain the first time, but then when it's like, it's like,

Speaker:

okay, when I'm doing backups, I just need to be on this other system and.

Speaker:

The pain I went through recently, you know, after being chided from with Mike

Speaker:

when he was on here and he was talking about, you know, don't do your financial,

Speaker:

uh, transactions and anything that really matters from a security perspective.

Speaker:

At the same time as you have other browser tabs open in the same browser.

Speaker:

And, and I, I never really thought about that.

Speaker:

And so I went through the trouble of getting a different browser, right.

Speaker:

Um, and, uh, I had to get a browser that was supported by my

Speaker:

password manager, uh, which I had like two or three to choose from.

Speaker:

And then I also added a. Basically enforcement thing, so that if

Speaker:

I forget that, and trust me, I do all day long, I forget it.

Speaker:

Right.

Speaker:

Um, I go to open up, you know, my, my bank on, uh, my usual browser

Speaker:

and, uh, it, it basically says, you know, site prohibited, right?

Speaker:

Yeah,

Speaker:

Um, so it, it was a pain when I first first started doing it, but you

Speaker:

know, there are ways to do it that.

Speaker:

you don't just wipe your computer every hour

Speaker:

I, I do not, I do not wipe my computer every hour.

Speaker:

Um, and um, yeah, and I'll also say that, you know, his drilling of

Speaker:

the thing, you know, for what it's worth, the drilling of the thing.

Speaker:

I mean, it's helpful, but it's not, it doesn't, dam

Speaker:

doesn't destroy the hard drive.

Speaker:

Um, I, I think I like the idea of the, of the microwaving of the chips.

Speaker:

I think that's probably an effective way of getting, you know, because

Speaker:

that's the things that modern devices.

Speaker:

Have all these like chips in them.

Speaker:

What were you gonna say?

Speaker:

he didn't have a giant magnet gals.

Speaker:

The hard

Speaker:

The hard drive.

Speaker:

Those are really expensive.

Speaker:

I mean, really expensive.

Speaker:

Yeah.

Speaker:

A, a ba a magnet big enough to dals a modern hard drive is

Speaker:

actually, uh, quite expensive.

Speaker:

See,

Speaker:

Um,

Speaker:

he would've had something around like his doorframe.

Speaker:

So

Speaker:

it would've to be.

Speaker:

Yeah, that would have to be even, even more, uh, you know, uh, powerful.

Speaker:

But, but the, but the thing that a lot of people do forget about are all the chips.

Speaker:

The chips are in the tapes or in the hard drives or in all

Speaker:

stuff, you know, all that stuff.

Speaker:

The sim cards, sim card, I think sim cards is what he was, uh, destroying.

Speaker:

Yep.

Speaker:

Uh, but again, going back to the, the point of this episode, if someone,

Speaker:

if some entity is going to try to take out your company, they're

Speaker:

going to go through the effort.

Speaker:

That, uh, of, of what we're describing.

Speaker:

Right.

Speaker:

Um, so

Speaker:

is it hopeless then to try to protect against it?

Speaker:

well no, well, no hope Hopeless is a hopeless, is a strong term.

Speaker:

I, I would say in some sense, well, it, it's not hopeless in that like

Speaker:

there is no point in doing it.

Speaker:

Yeah.

Speaker:

It is hopeless in that, oh, well I did it, I did all the things that.

Speaker:

I was told to do, and so therefore I'm good that you know, you, you, you, you

Speaker:

need to understand that you are most likely going to be compromised at some

Speaker:

point, and you therefore need to be, uh, prepared to be able to, to deal with it.

Speaker:

is it that or is it also you should estimate the risk look at your risk

Speaker:

profile for these different activities?

Speaker:

Yeah.

Speaker:

Well, well that's kind of what I mean is like, you know, you, you

Speaker:

need to prepare, you need to do what you can to limit the blast radius.

Speaker:

Do what you can to limit, um, exfiltration and to detect of

Speaker:

exfiltration when it's happening.

Speaker:

Yeah.

Speaker:

and, uh, yeah.

Speaker:

way to understand how all this works,

Speaker:

What's that?

Speaker:

do tabletop exercises.

Speaker:

Yes, tabletop exercises here.

Speaker:

I thought you were gonna, uh, say buy a copy of my upcoming book, but

Speaker:

Oh, that too.

Speaker:

yeah, so, uh, all right, I think we're good.

Speaker:

Um, uh, go watch episode three and, um, and we'll be ready to talk about that

Speaker:

Or episode point or

Speaker:

1.2. It's so,

Speaker:

Yeah.

Speaker:

1.0. Yep.

Speaker:

Yeah.

Speaker:

I live on the second.

Speaker:

Yeah,

Speaker:

that example.

Speaker:

yeah.

Speaker:

Yeah.

Speaker:

It's very disconcerting if you're used to the, it's the

Speaker:

first floor, so it's floor one.

Speaker:

I, I, I, I don't get that.

Speaker:

You know, European

Speaker:

note,

Speaker:

All right.

Speaker:

the

Speaker:

Like,

Speaker:

and

Speaker:

yeah.

Speaker:

podcast episode.

Speaker:

Yeah.

Speaker:

Uh, thanks for helping me out.

Speaker:

Prasanna.

Speaker:

No, this was fun.

Speaker:

I, I do enjoy rewatching the show 'cause I haven't seen it since it came out.

Speaker:

So,

Speaker:

Yeah.

Speaker:

Uh,

Speaker:

back

Speaker:

well it's, it's either that or K-Pop demon hunters.

Speaker:

So my niece wanted me to watch that.

Speaker:

I have not watched it yet, but it's on the list.

Speaker:

Li Lily, my granddaughter has watched it and she told me all about it

Speaker:

and I'm like, okay, well, I'm good.

Speaker:

I think I'm good.

Speaker:

Anyway, um, anyway, thanks for listening folks, and uh, you

Speaker:

know, you're, why we do this.

Speaker:

That is a wrap

Speaker:

. The backup wrap up is written, recorded, and produced by me w Curtis Preston.

Speaker:

If you need backup or Dr. Consulting content generation or expert witness

Speaker:

work, check out backup central.com.

Speaker:

You can also find links from my O'Reilly Books on the same website.

Speaker:

Remember, this is an independent podcast and any opinions that

Speaker:

you hear are those of the speaker and not necessarily an employer.

Speaker:

Thanks for listening.