You found the backup wrap up your go-to podcast for all things
Speaker:backup recovery and cyber recovery.
Speaker:In this episode, we take a look at reconnaissance in
Speaker:Cybersecurity by examining Mr. Robot season one, episode two.
Speaker:Persona and I break down how threat actors conduct reconnaissance
Speaker:before launching major attacks.
Speaker:Just like F Society did against Evil Corp. In the show, we explore the
Speaker:human intelligence aspects, you know, like figuring out who's dumb enough to
Speaker:take a random CD from some guy on the street and put it in their computer.
Speaker:We also discuss why your backup systems are prime targets for recon.
Speaker:Modern attackers can spend months mapping your infrastructure, identifying your
Speaker:weaknesses, and planning their approach.
Speaker:This episode will, I think, open your eyes to just how thorough
Speaker:those recon operations can be.
Speaker:By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. Backup,
Speaker:and I've been passionate about backup and recovery for over 30 years, ever since.
Speaker:I had to tell my boss that we had no backups of the production
Speaker:database that we had just lost.
Speaker:I don't want that to happen to you, and that's why I do this.
Speaker:On this podcast, we turn unappreciated admins into Cyber Recovery Heroes.
Speaker:This is the backup wrap up.
Speaker:Welcome to the show.
Speaker:Hi, I am w Curtis Preston, AKA, Mr. Backup.
Speaker:And I have with me a guy that just doesn't seem to get stressed out like I do.
Speaker:Prasanna Malaiyandi.
Speaker:How's it going, Prasanna.
Speaker:I'm good, Curtis.
Speaker:How do you stay?
Speaker:So like even keel, like you're just like, I'm just like, ah.
Speaker:And you're just like, you're good, man.
Speaker:yeah, you just.
Speaker:I honestly, I don't think I used to be like this.
Speaker:Is it?
Speaker:Is it, is it weed?
Speaker:What?
Speaker:No, no.
Speaker:Like up or even after that, like through high school and college.
Speaker:I even like the beginning part of my career, I don't think I
Speaker:was like even keeled like this.
Speaker:I, for the most part I was, but I used to get stressed and
Speaker:then I don't know what changed.
Speaker:Something clicked and
Speaker:Hmm.
Speaker:I am like, okay.
Speaker:Hmm.
Speaker:I know a
Speaker:You're like, um,
Speaker:who are like, how are you so calm all the time?
Speaker:It'd be like in the middle of a fire drill.
Speaker:I'm like, uh, it's okay.
Speaker:yeah, I need, I need you in my fire drills.
Speaker:Um, I feel like I'm in the middle of like three or four fire drills, like right now.
Speaker:Like you saw, I got three phone calls we're trying to do, we're trying
Speaker:to do this episode and I got like three phone calls, which reminds
Speaker:me, I'm gonna put, I'm gonna put my phone on, you know, focus right.
Speaker:Um, there.
Speaker:Okay.
Speaker:Um, so.
Speaker:Curtis, just take a deep breath.
Speaker:Shall we turn this into like a meditation?
Speaker:Yeah.
Speaker:Anyway, but uh, speaking of focusing on stuff, uh, we are continuing our
Speaker:series of lessons learned from Mr.
Speaker:Robot, which is a great show.
Speaker:Spoiler alert, by the way.
Speaker:Uh, we're gonna be talking about stuff in this episode,
Speaker:uh, and all of these episodes.
Speaker:If you haven't watched it, if you haven't watched episode, season one,
Speaker:episode two of Mr. Robot, go watch it now before you listen to the podcast.
Speaker:When you and I watched this episode, we, we weren't quite sure what we
Speaker:were gonna pull outta this episode.
Speaker:And, um.
Speaker:There, there's a couple of things.
Speaker:This is a very foundational episode.
Speaker:You know, we sort of learn who Mr. Robot is.
Speaker:We learn, um, that, that, um, and, and Elliot is given the, the
Speaker:opportunity to participate in this hack that they want to take down.
Speaker:Uh, evil Corp, which I love.
Speaker:I love that.
Speaker:It's called Evil Corp. And uh, and it uses essentially Enron's logo.
Speaker:Completely unmodified, which is onic, you know, to say the least.
Speaker:And then, um, you know, he's given the opportunity to participate in this thing.
Speaker:And then they basically said, look, if you walk away, you walk away.
Speaker:And, um, you know, and, and he does, he actually walks away.
Speaker:Um, he, he will obviously end up coming back.
Speaker:Otherwise this would be a very short series.
Speaker:But, um.
Speaker:end.
Speaker:The The end.
Speaker:Yeah.
Speaker:But what we're gonna focus on is this concept of reconnaissance and network
Speaker:mapping, because what you see is that clearly they have been doing that because
Speaker:they know some things about Evil Corp
Speaker:that they wouldn't know otherwise.
Speaker:And so maybe just to provide a bit more context, because I'm sure people are
Speaker:not watching it as recently as we have.
Speaker:So in this episode, kind of as a recap, right?
Speaker:What ends up happening is he goes and he visits the bunker with where F Society is.
Speaker:Right.
Speaker:Um, in addition, this is where Mr. Robot tells him, Hey, we want you
Speaker:to, and we will discuss more in details about the network mapping.
Speaker:We want you to take out their backup facility where, if you don't remember,
Speaker:it was called Steel Mountain.
Speaker:Steel Mountain, not to be confused with any other company by a similar name.
Speaker:Yes.
Speaker:And it just, and that's where they have their backups as well as there just
Speaker:happens to be a gas plant next to it.
Speaker:We will talk about that
Speaker:Right.
Speaker:bit.
Speaker:Um, in addition, in this episode, this is also where you meet the drug dealer, uh,
Speaker:Yeah.
Speaker:right where, uh.
Speaker:Elliot's neighbor Shayla gets the drugs that she then sells to Elliot.
Speaker:Uh, so Fernando Vera was the guy's name.
Speaker:Um, let's see what else happened in this episode.
Speaker:This is also the episode where, um, I don't know if people remember it, but um.
Speaker:Angela And Ollie, right?
Speaker:Her boyfriend.
Speaker:Yeah.
Speaker:kind of standing out on the street and there is a guy who's trying to sell CDs.
Speaker:Yeah.
Speaker:like, oh, sell my CD or Buy my cd.
Speaker:All I need is like 20 tweets saying
Speaker:Yeah.
Speaker:it or whatever else.
Speaker:Yeah.
Speaker:Yeah.
Speaker:And they gave, and they gave him a cd, which turns out to be, uh, something very
Speaker:much not a CD or not a, not a music cd.
Speaker:Yeah,
Speaker:Yeah,
Speaker:in this episode too, right, they talk about how Ollie
Speaker:puts it in the laptop at home,
Speaker:yeah,
Speaker:And the guy is able to sort of take over it, installs some malware.
Speaker:He's
Speaker:yeah,
Speaker:at the webcam right
Speaker:yeah.
Speaker:Yeah.
Speaker:all the rest of that,
Speaker:And that was, that was where the very, the very last moment of that episode is
Speaker:when he's seeing the webcam and he can see the girl, uh, he can see Angela basically
Speaker:like going to take, I think take a shower.
Speaker:And he's like, we're in.
Speaker:The last line in the episode is we're in and
Speaker:And
Speaker:"we're
Speaker:in", was actually written in Chinese.
Speaker:Oh, okay.
Speaker:Okay.
Speaker:I guess I missed that part.
Speaker:Yeah.
Speaker:Um, the, and so any crucial, any hack, any major hack, which is going to
Speaker:include, like, this is, this is, you know, this hack that they want to do of.
Speaker:Evil Corp I is, is definitely, I would, I would call this like a, an EPT an or an
Speaker:a PT, an adv advanced persistent threat.
Speaker:Right?
Speaker:You know, they've got, they're going to be doing this over a long run, a
Speaker:long period of time, and they have a goal in mind and they, and they
Speaker:are willing to be patient to, um, to do the things that they need to do.
Speaker:To, to move forward.
Speaker:And I, I, I think that it, it gives us an opportunity to discuss this
Speaker:concept of reconnaissance, um, and, and network mapping, which is what
Speaker:we're, what we're talking about.
Speaker:Their goal, right?
Speaker:With this entire thing, right?
Speaker:What are they looking to accomplish with Evil Corp, right?
Speaker:Evil Corp basically has all the credit records of everyone in the country.
Speaker:Right,
Speaker:as you start to see Angela's in heavy debt with student loans, right?
Speaker:There are other people who, uh, Shayla, the Elliot's neighbor is also in debt,
Speaker:and so it's basically they're like, we can basically attack the company,
Speaker:destroy everything, and do basically a giant reset on everyone's rec financial
Speaker:right.
Speaker:Right.
Speaker:and
Speaker:Yeah.
Speaker:So that's, that's their end goal, right?
Speaker:Um, basically, you know, deleting and, and, and they know that if they delete
Speaker:the, the primary copy, they know that, uh, they have, um, a copy, you know, in
Speaker:their backups stored in Steel Mountain.
Speaker:Yeah.
Speaker:and so they know therefore, and by the way, why.
Speaker:And I guess, how do they know that?
Speaker:And the answer, the, the answer to that question is, the answer to this
Speaker:or the to is the title of this episode.
Speaker:Because they went in and they did reconnaissance and they figured out, and,
Speaker:and again, this is something that we, we've said on multiple episodes that.
Speaker:It's going to be one of the primary goals of once, once the initial, um,
Speaker:access has been granted to the threat actor, their next step is going to be
Speaker:figure out what can we get rid of that, you know, that basically how can we stop
Speaker:whatever it is that would then stop us?
Speaker:In other words,
Speaker:they're gonna try to take out the backups.
Speaker:Right.
Speaker:And you know, and, and, and yeah.
Speaker:This is a podcast dedicated to backups, but.
Speaker:And so maybe, you know, to hammer everything looks like a nail.
Speaker:Trust me.
Speaker:Talk to any, you know, go listen to the Red Team Epi episode where he
Speaker:basically said, he said two things.
Speaker:One is he loved backups because they were so great at helping him to do
Speaker:network mapping and figure things out.
Speaker:And, uh, and he loved the system, the fact that they run
Speaker:his system and all that stuff.
Speaker:Uh, and then the other is, yes, you're gonna try to take that out.
Speaker:And unfortunately, many of the designs that we have today are
Speaker:using entirely disc based backups.
Speaker:Dis and cloud, uh, and if you're, depending on how you set that up, they
Speaker:can easily map all of that stuff, figure that stuff out, and then delete it.
Speaker:Right.
Speaker:And what we have in this episode is we do see that this company is at least storing
Speaker:some offsite backups in Steel Mountain.
Speaker:And um, in this case it happens to be tape backups.
Speaker:It doesn't have to be tape backups, right.
Speaker:But yeah.
Speaker:which, which
Speaker:Go ahead.
Speaker:basically a third party vendor, right?
Speaker:It's
Speaker:It's a third party be Yeah, yeah.
Speaker:A-K-A-K-A Iron Mountain.
Speaker:Right, right.
Speaker:Iron Mountain or something like that.
Speaker:Right.
Speaker:And, um, the, um, I, I think it's funny that, like, did they, did they
Speaker:reach out to Iron Mountain, see if they wanted to be branded in the episode?
Speaker:Probably not.
Speaker:Yeah.
Speaker:No.
Speaker:but it just, it just, it's funny, like anybody in the industry is like,
Speaker:oh yeah, they mean Iron Mountain.
Speaker:Right.
Speaker:Um, but.
Speaker:There's a couple of things here.
Speaker:One is first just understanding this concept of reconnaissance, right?
Speaker:Um, what are the kinds of things, do you think that a, a threat actor,
Speaker:once they've gained an initial access, what are the kinds of things that
Speaker:they're going to try to figure out?
Speaker:Well, they're gonna figure out well for them, right?
Speaker:They wanna figure out what's the most valuable data in the company,
Speaker:Right.
Speaker:right?
Speaker:That's one thing.
Speaker:And then where all is that data sitting?
Speaker:Mm-hmm.
Speaker:then where are those things that can be used to recover from any sort of attack?
Speaker:Because remember we talked about with ransomware, right?
Speaker:It's not just a matter of encrypting your data, deleting your backups.
Speaker:A lot of these people will also exfiltrate your data,
Speaker:Right,
Speaker:For double extortion.
Speaker:right.
Speaker:now forced to pay in order to prevent incriminating evidence or bad things
Speaker:about your company from being published.
Speaker:Yeah.
Speaker:And, and, and if I, and I, I agree everything that you said, I will
Speaker:preface, uh, I will add to your list at the beginning of your list.
Speaker:Um, basically human based reconnaissance because we see that happening with Angela
Speaker:and Ollie and I would wager Toti bet.
Speaker:Well, not wager.
Speaker:I, I think if we go back to, to the first episode that, um, which oddly
Speaker:enough is numbered episode zero because.
Speaker:clarify.
Speaker:Yeah.
Speaker:So for people who are watching the show and then trying to map it to
Speaker:what we're talking about, the show technically starts with Episode Zero.
Speaker:Yeah.
Speaker:1.0 and 1.1.
Speaker:This is episode 1.1, AKA, episode two in, in binary fashion.
Speaker:Right.
Speaker:We're starting at zero.
Speaker:Um, which again, I think it's kind of cool, right?
Speaker:But, um, and also confusing for certain things, right?
Speaker:Uh, but basically what we see is clearly in the case of what happened with Elliot.
Speaker:Which is our main protagonist here.
Speaker:What happened with Elliot is clearly they did reconnaissance against Elliot.
Speaker:Clearly, they figured out what he was up to, which, and they
Speaker:figured out his proclivities.
Speaker:Right.
Speaker:They figured out.
Speaker:I, I think they find, I think they felt that they had found someone
Speaker:that they could, exploit is a strong word, but they could use, right.
Speaker:And, and this, and you see this on the previous episode, right?
Speaker:Where
Speaker:Yeah.
Speaker:sitting at the computer terminal in the data center and he's like,
Speaker:I should go delete this directory.
Speaker:And it's at the prompt where it's like, yes or no.
Speaker:And
Speaker:Yeah,
Speaker:should do it.
Speaker:And his finger's hovering over
Speaker:yeah, yeah.
Speaker:like, and, and because there was a text file that said, leave me here.
Speaker:Right.
Speaker:he's like, it was intended for me.
Speaker:So I think, like
Speaker:Yeah.
Speaker:Curtis, the only way they could have done that is if they had done some sort
Speaker:of human, uh, read on him to be like, yes, this is the sort of thing that he
Speaker:is struggling with and let us use him.
Speaker:Yeah.
Speaker:Also known as human, right?
Speaker:Human intelligence and yeah.
Speaker:So they figured out, and, and, and what we also know about Elliot is he has a
Speaker:problem, you know, in addition to being antisocial and anti, anti, anti, anti,
Speaker:uh, he is also got a drug problem, right?
Speaker:So we're seeing it.
Speaker:And then, and that's something that.
Speaker:That again, you know, like, um, I dunno if you've ever heard this, um, the only
Speaker:two people that actually know you are your hairdresser and your and your CPA, right?
Speaker:Yep.
Speaker:Like right.
Speaker:They know, they know your real, real hair color and your CPA knows where
Speaker:you're actually spending your money.
Speaker:Yeah.
Speaker:And so if someone.
Speaker:Had done reconnaissance against him.
Speaker:And, and you know, you think about it, there are the, the, they
Speaker:targeted him because of his access.
Speaker:Yep.
Speaker:He worked at allsafe, which is this, this cybersecurity firm.
Speaker:So they're like, who can we get that has access into the company?
Speaker:We're gonna find somebody.
Speaker:And they probably did a bunch of reconnaissance against all safe, um.
Speaker:employees and to
Speaker:And the employees, and they watch 'em and they see what they do
Speaker:and they see Elliot like going out there buying drugs and stuff.
Speaker:I mean, if, if they're, this is a big operation and they're gonna
Speaker:do stuff like that, um, to, to, to do the reconnaissance, to figure
Speaker:out, um, you know, what's going on.
Speaker:which was very interesting because you know, Elliot was super careful
Speaker:Yeah.
Speaker:a seed right where he hacks.
Speaker:Terrell, right, who is sort of the person who wants to become
Speaker:CTO of the of Evil Corps, right?
Speaker:And he realizes, oh, it's too easy.
Speaker:And there's a scene where he's literally taking apart his computer.
Speaker:He's drilling the hard drives,
Speaker:Yeah.
Speaker:out
Speaker:Yeah,
Speaker:cards and throwing it into the microwave and zapping them.
Speaker:yeah.
Speaker:with all being so careful,
Speaker:Yeah.
Speaker:Maybe he didn't think about the human intelligence piece.
Speaker:Yeah.
Speaker:Yeah.
Speaker:Um, and, uh, Tyrell, he is, he is a, he is a twisted little fellow himself.
Speaker:Right.
Speaker:Um, but, um, 'cause we have the, in this episode we have the scene
Speaker:of him paying money to go beat the crap outta some homeless dude.
Speaker:I, I do not know what that, I mean, clearly that's a, you know, it's a. It's
Speaker:like that's gonna come into play later.
Speaker:But, but this is the thing, like, like when you have a company, you have
Speaker:all sorts of people that work for you that have all sorts of weaknesses.
Speaker:Yep.
Speaker:They might be financial weaknesses, they might be drug weaknesses,
Speaker:they might be people, weaknesses.
Speaker:And if someone, if some entity.
Speaker:Wants to take your company down, they're, they're going to go through the trouble of
Speaker:doing this kind of recon, reconnaissance of figuring out who works at your
Speaker:company to see who they, who's gonna be dumb enough to take a CD off the street
Speaker:Yep.
Speaker:then put it into a network computer.
Speaker:Um,
Speaker:Do
Speaker:yeah.
Speaker:it drives me bonkers because remember back in the day, people would
Speaker:just leave, like USB sticks around
Speaker:Yeah.
Speaker:would pick it up and put it in their machines,
Speaker:Yes.
Speaker:would be like, please do not do this.
Speaker:That is bad.
Speaker:And then they had to start locking down all the USBs
Speaker:Yeah.
Speaker:Uh, another thing, um, is that, well, you, you can buy, like if you buy USB,
Speaker:like used thumb drives off of eBay or used hard drives, you will get data
Speaker:on those, on those drives, right?
Speaker:Um, and uh, again, I, I know I've told this story before, but I love this story.
Speaker:I'm gonna go back to.
Speaker:Several years ago when Symantec bought Veritas.
Speaker:And, um, it was the first, uh, that, and it had a, uh, Veritas vision was
Speaker:the name of the, of their conference, which it used to be called Vera Con.
Speaker:But then when they went to international, apparently Raan and
Speaker:French sounds like very stupid.
Speaker:No.
Speaker:and so they changed it to Veritas Vision and then Seman, and then it was
Speaker:Semantic Vision and it was the first.
Speaker:Uh, conference after the Semantic rebranding.
Speaker:And I, I remember two things.
Speaker:One is they didn't really do anything with NetBackup.
Speaker:They did literally, and because I remember blogging, I think you
Speaker:can find a blog on my website 'cause it's been around a while.
Speaker:You can find a blog on my website that says that the
Speaker:Semantic apparently spent a year.
Speaker:Painting everything yellow and black.
Speaker:That's, that's what I remember saying.
Speaker:But then it was the trade show and, um, they passed out a thumb
Speaker:drive, uh, for everyone to that, you know, it was the conference
Speaker:materials and the thumb drive that.
Speaker:At the Semantic Conference had had malware on it and um, and so like, it
Speaker:was like the next day and they were like, Hey, uh, have you got that?
Speaker:Some don't, don't put it in anything.
Speaker:It's a, it's kind a thing, which I mean, I mean that's just like.
Speaker:Ironic.
Speaker:Yeah.
Speaker:Ironic to the max, right?
Speaker:Um, the fact that a, you know, an antivirus company essentially would
Speaker:distribute a virus or whatever, whatever it was, I dunno if it
Speaker:was a virus, but it was malware.
Speaker:Yeah.
Speaker:Um, at their own conference.
Speaker:Yeah.
Speaker:So, I think the one interesting thing about this episode as well,
Speaker:right, so we talked about the human intelligence piece, right?
Speaker:Yeah.
Speaker:kind of understanding who's where.
Speaker:The other thing was in the episode they talked about, okay, all of their
Speaker:data is on their primary data center.
Speaker:Mm-hmm.
Speaker:Um, and they're like, yeah, we can go delete it.
Speaker:But being a financial company, guess what it has?
Speaker:They have paper records, right?
Speaker:Right,
Speaker:records still
Speaker:right.
Speaker:is actually what is in Steel Mountain.
Speaker:Oh, is that what's in steel mount?
Speaker:Is the paper records?
Speaker:Okay.
Speaker:I missed that part.
Speaker:And by the way, something I learned.
Speaker:I think I've said this in pre stuff, but something I learned is that if
Speaker:you see a truck that's branded and it says Iron Mountain, it's not like
Speaker:you did mention it
Speaker:Yeah.
Speaker:Level one stuff, right?
Speaker:It, it's like, I think it might be a,
Speaker:Shredding.
Speaker:only be a tape, a paper destruction, right?
Speaker:It's definitely not tapes.
Speaker:Uh, but I do remember many years ago, I don't know if it was Iron Mountain,
Speaker:but it was a, it was an offsite vaulting company and the offsite vault guy.
Speaker:He was driving his van.
Speaker:He was a man in a van,
Speaker:Yeah.
Speaker:stopped at Starbucks to get some stuff and he came back out and his van was gone.
Speaker:Oh no, that's not good.
Speaker:Yeah, it's like go from A to B. Do
Speaker:Yeah,
Speaker:Do not.
Speaker:yeah, yeah.
Speaker:Um, so yeah, so, so Go ahead.
Speaker:Go ahead.
Speaker:Oh
Speaker:ahead.
Speaker:yeah, so Steel Mountain.
Speaker:So they were like, yeah.
Speaker:And to find that out, right.
Speaker:They probably had to look at email records and pos and figure out like,
Speaker:when are records going out the door to this other place, and who's it
Speaker:going to and what's their schedule?
Speaker:And oh, you know what it was, is they
Speaker:I'll just interrupt there.
Speaker:Just interrupt there.
Speaker:And the, the amazing thing about things like pos and things like that
Speaker:is they're like just PDFs and they're generally stored in plain text.
Speaker:No one thinks about.
Speaker:Securing that data from outside access.
Speaker:Go ahead.
Speaker:Oh, the other thing is they did also mention in the episode they're like,
Speaker:where most of the s and p 500 stores their or archives, their data, and
Speaker:that's what they said, steel Mountain.
Speaker:Yeah.
Speaker:guess who one of those is?
Speaker:Is Evil Corp.
Speaker:Right, right.
Speaker:And
Speaker:It's, yeah.
Speaker:that's where they're like, it is this one facility that we need to attack.
Speaker:Yeah.
Speaker:And, I'm willing to go on a limb and say that there is nowhere where Iron Mountain
Speaker:has a facility next door to a gas.
Speaker:Uh.
Speaker:I was, I was, I was going to say, I was like, what is a likelihood that a company.
Speaker:That is, that is known for, that would put it like right next to a gas plant.
Speaker:Yeah.
Speaker:And you know, my, my previous employer I got sent to, um, I got sent to a facility,
Speaker:a, a secure tape storage facility for a household name financial organization.
Speaker:And it's in the middle of a giant field right,
Speaker:Mm-hmm.
Speaker:berms around it.
Speaker:Right.
Speaker:Um, and to get there with a car, you have to go through
Speaker:three levels of security, right?
Speaker:There's this, there's a giant like metal barricade that, that, that, that's down.
Speaker:You talk through a squawk box that lets you, through that barricade, through
Speaker:the steel reinforced fence, right?
Speaker:Then you go through there, then you park.
Speaker:In a parking lot.
Speaker:Then you go inside and you talk to the person who then determines, you know,
Speaker:and then, and then, and then you go through another barric, another of the,
Speaker:you know, crossing guard barricades to go inside a building where they then go
Speaker:around with one of those like scanning things to scan your car and they're
Speaker:putting stuff underneath, like I think, I think Iron Mountain would have something
Speaker:simple, I guess is what I'm saying.
Speaker:Yeah.
Speaker:It's like Fort Knox, right?
Speaker:You don't like
Speaker:Yeah.
Speaker:is in the middle of nowhere.
Speaker:Yeah, exactly.
Speaker:Exactly.
Speaker:Um, so yeah, so we talked about that, that basically they would do this, they
Speaker:would go through all of this effort to do reconnaissance and what we see,
Speaker:I think at the very end there is we see the beginning of a more digital.
Speaker:Method of reconnaissance, right?
Speaker:So now we've got access to the computer and we're, and they're gonna do, I
Speaker:think a couple of things there because obviously they have webcam access.
Speaker:So they're gonna be able to listen in on conversations, they're
Speaker:gonna be able to hear things.
Speaker:And this is Angela, who is part of allsafe.
Speaker:And so, and he's also part of allsafe, right?
Speaker:Ali
Speaker:Um, and so they're gonna have conversations that, you know,
Speaker:it'd be great to listen in on.
Speaker:And so they're, they're gonna be able to do again, um, you know, human-based
Speaker:intelligence and they're gonna, they're gonna learn all sorts of stuff.
Speaker:'cause these, these two people, they're,
Speaker:Yeah.
Speaker:they're very connected and they're gonna be in their, what they think is a
Speaker:very safe place discussing, uh, stuff.
Speaker:Um, but again, just, just going back to,
Speaker:you know, proper.
Speaker:Uh, stuff, right?
Speaker:You, you don't, you don't do that, right?
Speaker:You don't, you don't, uh, just take a CD off a guy or a thumb drive off
Speaker:a guy or a thumb drive that you find on the ground, and, uh, and then, uh,
Speaker:yeah, and then put it in your system.
Speaker:also please, when you're at an airport and you see those USB
Speaker:charging ports at an airport, do
Speaker:Yeah.
Speaker:in your phone to those.
Speaker:Well, I will say.
Speaker:So I'll, I'll, I'll push back on that a little bit.
Speaker:I, I, I can't argue with it too much, but what I will say is at least a
Speaker:decent modern phone will say, Hey, you just plugged into this device.
Speaker:Do you want to trust it?
Speaker:And I would say, make sure you say no.
Speaker:Okay,
Speaker:I mean, best practices don't do it.
Speaker:Right.
Speaker:Actually, best practice would be bring a plug.
Speaker:Yeah.
Speaker:Right, right.
Speaker:But yeah.
Speaker:Yeah.
Speaker:That, that's best practice, you know, good, better, best.
Speaker:Right.
Speaker:Yeah.
Speaker:even Department of Homeland Security also recommends not
Speaker:Yeah.
Speaker:Again, I can't, I can't disagree with you.
Speaker:I'm just saying if you're, if you're, if you're desperate, if you're gonna,
Speaker:yeah,
Speaker:but again, that's what they want.
Speaker:They want you to be desperate.
Speaker:Um, and also whatever you do, don't just trust a random cable.
Speaker:'cause I did watch a presentation on a cable that looked like
Speaker:just a regular normal cable.
Speaker:And it, and it, you know, it took over a phone.
Speaker:Yeah.
Speaker:Um, and what was that last thing you said?
Speaker:What was it?
Speaker:Oh, also on airplanes?
Speaker:Oh, yeah, yeah, yeah, yeah.
Speaker:Airplane.
Speaker:Yeah, because those are definitely, yeah.
Speaker:Yeah.
Speaker:Yeah.
Speaker:Um, so yeah, so basically, again, best practice is not to trust random guy.
Speaker:Yeah,
Speaker:Um,
Speaker:I think the other thing is also be careful what you post online some of these things,
Speaker:which maybe should not be out there
Speaker:yeah.
Speaker:It's something, it's something that, um.
Speaker:I think our, our generation you are in My generation aren't, no, actually
Speaker:aren't, aren't you a millennial?
Speaker:What are you
Speaker:I'm technically a millennial.
Speaker:Uh, you're an elder millennial.
Speaker:Just like I'm an elder.
Speaker:I'm an elder Gen Xer.
Speaker:Um, yeah.
Speaker:So both of our generations I think, understand that a little bit better
Speaker:than the current generations.
Speaker:The two, the two, um, where literally they just, they just, you know,
Speaker:they post, they, they got up.
Speaker:I, you know, I,
Speaker:Yeah.
Speaker:to the bathroom, here's what I had for breakfast, you know,
Speaker:Well, I
Speaker:you know what I mean?
Speaker:had like posted a video of like, they had joined a company and like were
Speaker:posting like their security stuff, like just a walkthrough of the building and
Speaker:the security things and it's like, uh,
Speaker:Yeah, it's no bueno.
Speaker:No bueno.
Speaker:Um, so, um, and again, I'll, I'll use this as an opportunity again that
Speaker:because the backup system is such a target, it needs to be segregated, right?
Speaker:It needs to be on a separate network.
Speaker:It needs to be on a separate authentication and authorization system.
Speaker:, It's gonna be on a separate Entra domain, formerly known as Active Directory.
Speaker:And, you know, my, my Prasannal is that you would use like local passwords and a
Speaker:password manager, um, that you wouldn't use a, a network based, um, you know.
Speaker:System and, and lots of, and lots of MFA and, you know, um, and, you
Speaker:know, UB keys and like by, you know, incorporate biometrics if you can.
Speaker:Right.
Speaker:Um, and, and just have that as separate as you can and, and, and
Speaker:it sounds like a pain to do it.
Speaker:And it is a pain the first time, but then when it's like, it's like,
Speaker:okay, when I'm doing backups, I just need to be on this other system and.
Speaker:The pain I went through recently, you know, after being chided from with Mike
Speaker:when he was on here and he was talking about, you know, don't do your financial,
Speaker:uh, transactions and anything that really matters from a security perspective.
Speaker:At the same time as you have other browser tabs open in the same browser.
Speaker:And, and I, I never really thought about that.
Speaker:And so I went through the trouble of getting a different browser, right.
Speaker:Um, and, uh, I had to get a browser that was supported by my
Speaker:password manager, uh, which I had like two or three to choose from.
Speaker:And then I also added a. Basically enforcement thing, so that if
Speaker:I forget that, and trust me, I do all day long, I forget it.
Speaker:Right.
Speaker:Um, I go to open up, you know, my, my bank on, uh, my usual browser
Speaker:and, uh, it, it basically says, you know, site prohibited, right?
Speaker:Yeah,
Speaker:Um, so it, it was a pain when I first first started doing it, but you
Speaker:know, there are ways to do it that.
Speaker:you don't just wipe your computer every hour
Speaker:I, I do not, I do not wipe my computer every hour.
Speaker:Um, and um, yeah, and I'll also say that, you know, his drilling of
Speaker:the thing, you know, for what it's worth, the drilling of the thing.
Speaker:I mean, it's helpful, but it's not, it doesn't, dam
Speaker:doesn't destroy the hard drive.
Speaker:Um, I, I think I like the idea of the, of the microwaving of the chips.
Speaker:I think that's probably an effective way of getting, you know, because
Speaker:that's the things that modern devices.
Speaker:Have all these like chips in them.
Speaker:What were you gonna say?
Speaker:he didn't have a giant magnet gals.
Speaker:The hard
Speaker:The hard drive.
Speaker:Those are really expensive.
Speaker:I mean, really expensive.
Speaker:Yeah.
Speaker:A, a ba a magnet big enough to dals a modern hard drive is
Speaker:actually, uh, quite expensive.
Speaker:See,
Speaker:Um,
Speaker:he would've had something around like his doorframe.
Speaker:So
Speaker:it would've to be.
Speaker:Yeah, that would have to be even, even more, uh, you know, uh, powerful.
Speaker:But, but the, but the thing that a lot of people do forget about are all the chips.
Speaker:The chips are in the tapes or in the hard drives or in all
Speaker:stuff, you know, all that stuff.
Speaker:The sim cards, sim card, I think sim cards is what he was, uh, destroying.
Speaker:Yep.
Speaker:Uh, but again, going back to the, the point of this episode, if someone,
Speaker:if some entity is going to try to take out your company, they're
Speaker:going to go through the effort.
Speaker:That, uh, of, of what we're describing.
Speaker:Right.
Speaker:Um, so
Speaker:is it hopeless then to try to protect against it?
Speaker:well no, well, no hope Hopeless is a hopeless, is a strong term.
Speaker:I, I would say in some sense, well, it, it's not hopeless in that like
Speaker:there is no point in doing it.
Speaker:Yeah.
Speaker:It is hopeless in that, oh, well I did it, I did all the things that.
Speaker:I was told to do, and so therefore I'm good that you know, you, you, you, you
Speaker:need to understand that you are most likely going to be compromised at some
Speaker:point, and you therefore need to be, uh, prepared to be able to, to deal with it.
Speaker:is it that or is it also you should estimate the risk look at your risk
Speaker:profile for these different activities?
Speaker:Yeah.
Speaker:Well, well that's kind of what I mean is like, you know, you, you
Speaker:need to prepare, you need to do what you can to limit the blast radius.
Speaker:Do what you can to limit, um, exfiltration and to detect of
Speaker:exfiltration when it's happening.
Speaker:Yeah.
Speaker:and, uh, yeah.
Speaker:way to understand how all this works,
Speaker:What's that?
Speaker:do tabletop exercises.
Speaker:Yes, tabletop exercises here.
Speaker:I thought you were gonna, uh, say buy a copy of my upcoming book, but
Speaker:Oh, that too.
Speaker:yeah, so, uh, all right, I think we're good.
Speaker:Um, uh, go watch episode three and, um, and we'll be ready to talk about that
Speaker:Or episode point or
Speaker:1.2. It's so,
Speaker:Yeah.
Speaker:1.0. Yep.
Speaker:Yeah.
Speaker:I live on the second.
Speaker:Yeah,
Speaker:that example.
Speaker:yeah.
Speaker:Yeah.
Speaker:It's very disconcerting if you're used to the, it's the
Speaker:first floor, so it's floor one.
Speaker:I, I, I, I don't get that.
Speaker:You know, European
Speaker:note,
Speaker:All right.
Speaker:the
Speaker:Like,
Speaker:and
Speaker:yeah.
Speaker:podcast episode.
Speaker:Yeah.
Speaker:Uh, thanks for helping me out.
Speaker:Prasanna.
Speaker:No, this was fun.
Speaker:I, I do enjoy rewatching the show 'cause I haven't seen it since it came out.
Speaker:So,
Speaker:Yeah.
Speaker:Uh,
Speaker:back
Speaker:well it's, it's either that or K-Pop demon hunters.
Speaker:So my niece wanted me to watch that.
Speaker:I have not watched it yet, but it's on the list.
Speaker:Li Lily, my granddaughter has watched it and she told me all about it
Speaker:and I'm like, okay, well, I'm good.
Speaker:I think I'm good.
Speaker:Anyway, um, anyway, thanks for listening folks, and uh, you
Speaker:know, you're, why we do this.
Speaker:That is a wrap
Speaker:. The backup wrap up is written, recorded, and produced by me w Curtis Preston.
Speaker:If you need backup or Dr. Consulting content generation or expert witness
Speaker:work, check out backup central.com.
Speaker:You can also find links from my O'Reilly Books on the same website.
Speaker:Remember, this is an independent podcast and any opinions that
Speaker:you hear are those of the speaker and not necessarily an employer.
Speaker:Thanks for listening.