1 00:00:00,050 --> 00:00:03,770 You found the backup wrap up your go-to podcast for all things 2 00:00:03,770 --> 00:00:06,140 backup recovery and cyber recovery. 3 00:00:06,590 --> 00:00:09,710 In this episode, we're talking about living off the land attacks. 4 00:00:09,980 --> 00:00:14,600 And it's honestly, I think one of the sneakiest things that bad guys do, they 5 00:00:14,600 --> 00:00:18,170 get into your environment and instead of bringing their own tools, because 6 00:00:18,170 --> 00:00:23,300 you know they might trip your alarm systems, they use your tools against you. 7 00:00:23,330 --> 00:00:28,040 Things like PowerShell or WMI tools that you're likely already using. 8 00:00:28,640 --> 00:00:32,150 My co-author, Dr. Mike Saylor, breaks down how this works. 9 00:00:32,495 --> 00:00:37,025 Why it's so hard to detect and what you can actually do about it, I think, uh, 10 00:00:37,025 --> 00:00:38,765 there's a lot of value in this episode. 11 00:00:39,305 --> 00:00:43,865 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 12 00:00:43,865 --> 00:00:48,635 Backup, and I've been passionate about backup and recovery for over, can't 13 00:00:48,635 --> 00:00:52,985 believe it, 30 years ever since I had to tell my boss there were no backups of the 14 00:00:52,985 --> 00:00:54,845 production database that we had just lost. 15 00:00:55,460 --> 00:00:58,640 I don't want that to happen to you, and that's why I do this. 16 00:00:58,910 --> 00:01:03,470 On this podcast, we turn unappreciated admins into Cyber Recovery Heroes. 17 00:01:03,800 --> 00:01:05,840 This is the backup wrap up. 18 00:01:21,491 --> 00:01:22,931 Welcome to the backup wrap up. 19 00:01:22,931 --> 00:01:26,621 I'm your host, w Curtis Preston, AKA, Mr. Backup, and I have with me a 20 00:01:26,621 --> 00:01:29,021 guy who seems to laugh at my errors. 21 00:01:29,201 --> 00:01:31,601 Persona, Molly nios going Persona. 22 00:01:32,651 --> 00:01:33,941 I am good, Curtis. 23 00:01:33,941 --> 00:01:38,981 I nothing like with friends like this who needs enemies. 24 00:01:41,096 --> 00:01:41,906 Exactly. 25 00:01:42,116 --> 00:01:45,206 I just, I, I make, I make, I make mistakes. 26 00:01:45,326 --> 00:01:49,226 And you, well, honestly, I get, I get I like them too. 27 00:01:49,676 --> 00:01:51,206 I, it makes it, making me laugh. 28 00:01:51,266 --> 00:01:52,226 Makes me laugh. 29 00:01:52,796 --> 00:01:56,306 It's just funny that, uh, how long has the, has it, it been called the 30 00:01:56,306 --> 00:01:59,096 backup wrap up at least two years now. 31 00:01:59,686 --> 00:02:01,661 I think about, oh yeah, probably two years. 32 00:02:01,841 --> 00:02:05,351 And I still, my brain wants to say Backup centrals restore it all, which 33 00:02:05,351 --> 00:02:07,061 is the original name of the podcast. 34 00:02:07,871 --> 00:02:09,941 But, um, anyway, I don't know. 35 00:02:10,571 --> 00:02:13,211 Well, welcome to our, uh, pity party, Mike. 36 00:02:13,481 --> 00:02:14,541 Doctor Mike Saylor. 37 00:02:14,561 --> 00:02:15,161 How's it going? 38 00:02:16,001 --> 00:02:16,721 It is going well guys. 39 00:02:16,721 --> 00:02:17,441 Thanks for having me. 40 00:02:17,681 --> 00:02:21,581 My co-author on our lovely book, learning Ransomware Response and 41 00:02:21,581 --> 00:02:24,851 Recovery, which Mike, I understand you, you have some to show us. 42 00:02:24,851 --> 00:02:27,881 You don't have it hung yet, but there he is. 43 00:02:27,911 --> 00:02:28,901 The official. 44 00:02:29,336 --> 00:02:31,346 Framed copy of our book. 45 00:02:31,676 --> 00:02:33,026 Yeah, just hold it just like that. 46 00:02:33,026 --> 00:02:34,736 For the next, for the next half hour. 47 00:02:37,256 --> 00:02:37,526 Yeah. 48 00:02:37,526 --> 00:02:37,796 Very. 49 00:02:37,796 --> 00:02:38,126 Yeah. 50 00:02:38,126 --> 00:02:38,996 O'Reilly does that. 51 00:02:38,996 --> 00:02:41,216 They send you a copy when, uh, um. 52 00:02:42,206 --> 00:02:43,316 You know, when it's ready. 53 00:02:43,466 --> 00:02:49,046 And by the way, I just got a, I just got news from one of my folks 54 00:02:49,046 --> 00:02:53,486 on LinkedIn that the book said it's gonna be there on Tuesday. 55 00:02:53,696 --> 00:02:57,656 So they, you know, they ordered it in, they ordered it in January and uh, 56 00:02:57,656 --> 00:02:59,336 Amazon says it's gonna be there Tuesday. 57 00:02:59,336 --> 00:03:00,506 So, very exciting. 58 00:03:00,506 --> 00:03:00,596 Any, 59 00:03:02,051 --> 00:03:07,061 So for all our listeners, go out, order the book, listen, or then you can actually 60 00:03:07,061 --> 00:03:09,281 read what Curtis and Mike have been doing 61 00:03:09,506 --> 00:03:09,866 yeah. 62 00:03:10,091 --> 00:03:11,951 many, many, many, many months. 63 00:03:12,086 --> 00:03:13,556 Many, many months. 64 00:03:13,646 --> 00:03:17,606 And then give us a review on Amazon, uh, if you, if you like it, 65 00:03:17,621 --> 00:03:18,431 then come back 66 00:03:18,566 --> 00:03:18,956 yeah. 67 00:03:18,971 --> 00:03:20,381 come back to the podcast 68 00:03:20,546 --> 00:03:21,146 And comment. 69 00:03:21,221 --> 00:03:25,721 be going, no, because we'll be going more in depth into many of these topics. 70 00:03:26,396 --> 00:03:27,236 Yes, we will. 71 00:03:27,416 --> 00:03:28,226 Yes, we will. 72 00:03:28,286 --> 00:03:33,656 And today we're talking about something that honestly, I, I had, I had heard 73 00:03:33,656 --> 00:03:38,696 the, I had heard the term, but it wasn't, you know, given that I don't, uh, live 74 00:03:38,756 --> 00:03:40,676 that side of it the way you do, Mike. 75 00:03:40,796 --> 00:03:41,126 Um. 76 00:03:41,921 --> 00:03:46,061 The, um, this term living off land was something new to me. 77 00:03:46,301 --> 00:03:50,981 So, uh, I, why don't you give us a, do you have a story that kind of gives 78 00:03:50,981 --> 00:03:54,131 us an idea of what we're talking about when we talk about living off the land? 79 00:03:55,476 --> 00:03:57,576 Well, there's, there's lots of stories. 80 00:03:57,606 --> 00:04:03,786 Um, but living off the land is, is often part of some bigger, 81 00:04:05,586 --> 00:04:07,116 bigger campaign, bigger attack. 82 00:04:07,116 --> 00:04:08,586 Something you hear about in the news. 83 00:04:08,586 --> 00:04:12,006 You know, somebody got hacked, somebody had ransomware, somebody, 84 00:04:12,216 --> 00:04:13,956 you know, lost a bunch of data. 85 00:04:14,706 --> 00:04:15,996 the living off the land. 86 00:04:15,996 --> 00:04:18,126 Part of that was simply, um. 87 00:04:19,496 --> 00:04:22,196 Something that facilitated that attack to some degree. 88 00:04:22,196 --> 00:04:27,506 So, and, and from, as an auditor, an IT person, cyber person, you know, I 89 00:04:27,506 --> 00:04:29,786 harp on organizations all the time. 90 00:04:29,846 --> 00:04:33,746 Whatever you build, make it focused on whatever it's doing. 91 00:04:34,436 --> 00:04:36,926 so, you know, the other term for that is system hardening. 92 00:04:37,256 --> 00:04:39,386 You know, uh, delete things you, you don't need. 93 00:04:39,386 --> 00:04:43,316 Turn stuff off, you're not gonna use, close the port. 94 00:04:43,376 --> 00:04:45,626 Don't talk to things that you don't need to talk to. 95 00:04:46,181 --> 00:04:51,401 Um, those are all fruits of the land that a bad guy could use, 96 00:04:51,791 --> 00:04:53,561 uh, to facilitate an attack. 97 00:04:53,801 --> 00:04:58,241 Some of those you can't turn off, uh, like Windows Management as an example, or 98 00:04:58,241 --> 00:05:01,901 WMI, uh, the operating system needs that. 99 00:05:02,651 --> 00:05:07,601 Uh, there are other things like PowerShell, uh, whether it's a, a 100 00:05:07,601 --> 00:05:12,611 system that uses it or an admin that uses it for scripting, but story short. 101 00:05:13,361 --> 00:05:18,341 Uh, bad guys will figure out a way to circumvent the security controls you 102 00:05:18,341 --> 00:05:23,441 have that are looking for the deployment or installation of bad guy tools. 103 00:05:24,281 --> 00:05:30,521 they'll get through that, that filter, that gate, uh, by using 104 00:05:30,521 --> 00:05:34,841 tools that are native to the systems that they're attacking, uh, in 105 00:05:34,841 --> 00:05:36,371 order to facilitate their attack. 106 00:05:37,061 --> 00:05:37,721 Um, so. 107 00:05:38,006 --> 00:05:38,066 If 108 00:05:38,106 --> 00:05:38,326 So. 109 00:05:38,546 --> 00:05:43,016 there was a story in the book, you talked about a Seattle logistics firm, it was 110 00:05:43,016 --> 00:05:45,776 hit by a Conti ransomware, uh, variant. 111 00:05:46,466 --> 00:05:50,546 It was saying that it, it infected 60% of the firm servers and it, it was the 112 00:05:50,546 --> 00:05:53,966 same thing where it was, they somehow used the administrators, the, their 113 00:05:53,966 --> 00:05:55,226 administrative tools against them. 114 00:05:56,141 --> 00:05:56,351 Yep. 115 00:05:56,561 --> 00:06:02,681 So windows management and very powerful at, at deploying. 116 00:06:02,681 --> 00:06:02,741 Um. 117 00:06:04,331 --> 00:06:08,141 You know, code or, or malware across an environment, and especially if it's the 118 00:06:08,141 --> 00:06:11,051 admin or a service, running as an admin. 119 00:06:11,471 --> 00:06:15,671 I remember years ago we, we, uh, we responded to an incident where it 120 00:06:15,671 --> 00:06:20,591 was actually the, it was the security tool that was running, uh, a service 121 00:06:20,741 --> 00:06:24,131 with administrative privileges that was compromised by a bad guy. 122 00:06:24,131 --> 00:06:29,921 And they used the security tools itself, service that was running to, uh, to spread 123 00:06:29,921 --> 00:06:31,481 the, the malware across the environment. 124 00:06:33,356 --> 00:06:35,606 So Mike, just a clarification. 125 00:06:36,386 --> 00:06:42,086 you say living off the land, is it specifically just taking whatever 126 00:06:42,086 --> 00:06:47,996 tools are in an environment and using that in order to propagate your 127 00:06:48,026 --> 00:06:51,266 attack or to, uh, execute your attack? 128 00:06:52,016 --> 00:06:55,106 Or is it also, for instance, um. 129 00:06:55,856 --> 00:07:00,506 resources a as an example, someone might have had some virtual machines sitting 130 00:07:00,506 --> 00:07:06,176 around that they sort of forgot about from an inventory perspective or other 131 00:07:06,176 --> 00:07:10,796 things that might be deployed in a company that they're not, no longer tracking, 132 00:07:10,796 --> 00:07:12,236 doesn't get the latest security patches. 133 00:07:12,236 --> 00:07:16,681 Those sort of things that they then start to think about when you talk about land. 134 00:07:17,831 --> 00:07:20,351 It, it would definitely escalate to that if, if they have the 135 00:07:20,351 --> 00:07:21,561 time to identify those, but. 136 00:07:22,241 --> 00:07:28,151 Traditionally living off the land is, is services or applications, 137 00:07:28,241 --> 00:07:31,931 uh, resident on the machines they're attacking or using to attack. 138 00:07:31,931 --> 00:07:37,241 Now, as a bad guy, they, they find this, this, uh, this target 139 00:07:37,241 --> 00:07:38,861 host with all these goodies on it. 140 00:07:39,881 --> 00:07:43,691 but then they realize, well, this is the admin's computer, so if I do stuff from 141 00:07:43,691 --> 00:07:47,231 this computer, they may note, they may notice some latency or resource drain. 142 00:07:48,071 --> 00:07:51,701 so maybe they do some recon first, or they figure out a way to stand up a 143 00:07:51,701 --> 00:07:53,291 virtual machine in that environment. 144 00:07:53,711 --> 00:07:57,821 Uh, ideally using a dormant one instead of, you know, setting off some 145 00:07:57,821 --> 00:08:03,071 potential bells about creating a new one, but then migrate those tools or 146 00:08:03,071 --> 00:08:06,971 figure out if there's a way to, to, uh, uh, employ those tools on that 147 00:08:06,971 --> 00:08:08,801 virtual machine that's not being used. 148 00:08:10,406 --> 00:08:12,086 that's a, that would be a pretty good tactic. 149 00:08:12,896 --> 00:08:15,986 Yeah, I, it comes from, you know, the, the term, you know, for those 150 00:08:15,986 --> 00:08:21,716 of us that have been, uh, lived in either a suburb or urban environment 151 00:08:21,716 --> 00:08:24,966 or entire life, the concept of living off the land is that you're going. 152 00:08:25,166 --> 00:08:28,736 To literally live off of what is available. 153 00:08:29,336 --> 00:08:31,406 You know, that this term is, is an old term. 154 00:08:31,406 --> 00:08:34,136 It doesn't have anything to do or that originally didn't have anything to 155 00:08:34,136 --> 00:08:36,356 do with, uh, the world of computers. 156 00:08:36,356 --> 00:08:39,716 The idea is you're gonna live somewhere and you're going to 157 00:08:39,716 --> 00:08:41,786 use what is available on that. 158 00:08:42,656 --> 00:08:46,256 You know, that property in order to, uh, survive. 159 00:08:46,256 --> 00:08:49,226 And so I, I think, I think that's a perfect term. 160 00:08:49,676 --> 00:08:54,206 Uh, you know, think of like an episode of Survivor, uh, basically right? 161 00:08:54,386 --> 00:08:57,206 You're only allowed to use what's a avail, what's there, right? 162 00:08:57,596 --> 00:09:01,646 And so that's why, you know, they call this a living off the land because you're 163 00:09:01,646 --> 00:09:06,296 going to use, you know, you, meaning the, the attacker is going to use whatever 164 00:09:06,296 --> 00:09:08,426 tools are available to them and, and why. 165 00:09:09,011 --> 00:09:10,721 What, what's the purpose of that? 166 00:09:10,811 --> 00:09:15,311 Uh, Mike, meaning that, you know, why don't I want to, let's say I've got this 167 00:09:15,311 --> 00:09:18,671 great tool that does this amazing thing. 168 00:09:18,671 --> 00:09:23,051 Why wouldn't I, if I've got access to the environment, why wouldn't I just 169 00:09:23,621 --> 00:09:28,781 install this, this great tool that I have that does this cool thing? 170 00:09:28,961 --> 00:09:30,731 Why would I do this living off land? 171 00:09:31,956 --> 00:09:36,066 So there's a couple of layers of, uh, hopefully a couple of layers 172 00:09:36,066 --> 00:09:37,896 that organizations have in place. 173 00:09:38,256 --> 00:09:41,256 Uh, one of those is monitoring incoming payloads. 174 00:09:42,026 --> 00:09:44,516 Uh, so a file type. 175 00:09:44,756 --> 00:09:46,286 Well, and I guess that's the other part. 176 00:09:46,286 --> 00:09:49,706 How, how would you get that payload into the environment? 177 00:09:49,706 --> 00:09:52,556 Is that a, an attachment to a phishing email? 178 00:09:52,856 --> 00:09:54,626 Is it compromised credentials? 179 00:09:54,926 --> 00:09:56,246 Uh, in either case? 180 00:09:56,306 --> 00:10:00,056 Uh, payloads usually have a, a, you know, a good amount of baggage with them. 181 00:10:00,056 --> 00:10:02,306 It's not a, you know, it's not kilobytes. 182 00:10:02,306 --> 00:10:06,176 It's usually megabytes and sometimes, uh, multiple mega, you know, a hundred, 183 00:10:06,446 --> 00:10:09,086 400 megabytes of, of size, depending. 184 00:10:09,536 --> 00:10:09,926 Um. 185 00:10:10,256 --> 00:10:13,736 So the, the, the first layer is, or the first hurdle is how do 186 00:10:13,736 --> 00:10:14,966 I get it into the environment? 187 00:10:15,266 --> 00:10:18,236 The second one is, how do I get past all the filters, whether that's 188 00:10:18,236 --> 00:10:22,856 antivirus and malware, spam filter, et cetera, that's not gonna strip 189 00:10:22,856 --> 00:10:26,636 that attachment or that, that payload out of the, the communication. 190 00:10:26,996 --> 00:10:31,071 And then the last part of that is a lot of times, uh, ideally we would limit. 191 00:10:32,006 --> 00:10:36,206 Uh, a user's ability to install something on an endpoint, uh, to, 192 00:10:36,236 --> 00:10:37,676 uh, you know, a privileged account. 193 00:10:38,156 --> 00:10:43,226 Uh, so if, if, if you compromise the, you know, the receptionist, she shouldn't be 194 00:10:43,226 --> 00:10:47,726 a local admin, uh, so she shouldn't be able to, that account shouldn't be able 195 00:10:47,726 --> 00:10:50,186 to install stuff locally, that payload. 196 00:10:50,666 --> 00:10:57,056 So if you can craft your, your attack utilizing tools that are resident. 197 00:10:57,971 --> 00:11:01,541 You're simply connecting to the machine and running that stuff that's already 198 00:11:01,541 --> 00:11:03,101 installed and you're running it locally. 199 00:11:03,371 --> 00:11:07,631 The other benefit of running it locally, uh, is that a lot of times 200 00:11:07,631 --> 00:11:12,971 those services are already installed and using administrative privileges. 201 00:11:15,521 --> 00:11:19,751 Is it also true though, Mike, that I know you talked about how do you get the 202 00:11:19,751 --> 00:11:24,401 malware in or whatever the package is into the environment, like from an attacker's 203 00:11:24,401 --> 00:11:28,721 perspective, once they've sort of, like you mentioned PowerShell earlier, right? 204 00:11:29,051 --> 00:11:33,491 Once they sort of have a methodology to propagate the attack, to actually 205 00:11:33,521 --> 00:11:37,571 live off the land, that's something they can then replicate in other 206 00:11:37,601 --> 00:11:43,901 companies, organizations, and not just limit it to like one company, correct. 207 00:11:45,266 --> 00:11:45,566 Right. 208 00:11:45,566 --> 00:11:45,716 Yeah. 209 00:11:45,716 --> 00:11:49,556 So fundamentally windows and environments work the same. 210 00:11:49,646 --> 00:11:54,501 You know, there, there are some of the older ones have a few services and, and. 211 00:11:55,481 --> 00:11:58,871 Methods for communicating that are probably still enabled versus 212 00:11:58,871 --> 00:12:03,311 today's, um, I think there's a lot more network segmentation and 213 00:12:03,311 --> 00:12:07,061 some other things that, that are common today than there used to be. 214 00:12:07,631 --> 00:12:13,161 Uh, but for sure, if you can build a, an attack strategy in a Windows 215 00:12:13,161 --> 00:12:17,721 environment, um, you should be able to replicate that to some degree just 216 00:12:17,721 --> 00:12:20,151 about any, in any Windows network. 217 00:12:22,126 --> 00:12:24,076 When you were talking about the, the hurdles. 218 00:12:24,316 --> 00:12:28,696 W would another hurdle be even, even if you've got, you, you 219 00:12:28,696 --> 00:12:32,056 managed to download the file, you managed to get past the filters. 220 00:12:32,296 --> 00:12:37,006 Would there be additional filters required to actually execute this, uh, tool? 221 00:12:37,611 --> 00:12:38,911 If, if you're talking about some, yeah. 222 00:12:39,931 --> 00:12:40,351 Yeah. 223 00:12:40,356 --> 00:12:40,496 Um. 224 00:12:42,301 --> 00:12:44,611 a lot of environments would require administrative 225 00:12:44,611 --> 00:12:46,231 privileges in order to execute. 226 00:12:46,231 --> 00:12:52,321 So as an example, a normal user might not be able to run registry editor or 227 00:12:52,321 --> 00:12:56,461 even a command prompt or even change their desktop, you know, wallpaper. 228 00:12:56,941 --> 00:13:01,081 Um, and so, yeah, after, after you install it, you, you've also 229 00:13:01,081 --> 00:13:04,081 gotta figure out, you know, what privileges do you need to run it. 230 00:13:05,626 --> 00:13:08,146 Now I remember what I, now I remember what I forgot. 231 00:13:08,741 --> 00:13:12,376 You, you, you brought up a topic a couple of times and it's, it's outside 232 00:13:12,376 --> 00:13:14,566 of the scope of what I wanted to talk about today, but I thought we'd 233 00:13:14,566 --> 00:13:18,316 just talk a, talk about it, a little about it, and that is this concept 234 00:13:18,316 --> 00:13:26,266 of not allowing, uh, regular users to have admin on their own machines. 235 00:13:26,626 --> 00:13:28,426 I know that as best practice. 236 00:13:28,786 --> 00:13:31,036 The question is, is it common practice? 237 00:13:32,976 --> 00:13:35,466 Uh, whi which way that they do have admin practice. 238 00:13:35,551 --> 00:13:41,011 they do not have, that I, I know that it's best practice not to give Joe Schmo. 239 00:13:41,581 --> 00:13:45,691 You know that that shouldn't have admin, admin even on his local 240 00:13:45,691 --> 00:13:47,431 machine, even though that is. 241 00:13:48,361 --> 00:13:49,891 You know, inconvenient to him. 242 00:13:49,951 --> 00:13:52,741 Uh, we often talk about that security is, is inconvenient. 243 00:13:52,921 --> 00:13:53,011 Right? 244 00:13:53,791 --> 00:13:54,091 Right. 245 00:13:54,091 --> 00:13:57,721 So even though that's inconvenient, it's also inconvenient to the IT 246 00:13:57,931 --> 00:14:02,611 people because now that anytime Joe Schmo needs a new tool, we have 247 00:14:02,611 --> 00:14:04,291 to be the one to go install it. 248 00:14:04,711 --> 00:14:08,581 Which sounds amazing in terms of security, but it also sounds 249 00:14:08,581 --> 00:14:09,721 like a giant pain in the butt. 250 00:14:09,811 --> 00:14:14,576 What, uh, what, how common is it that people actually do this? 251 00:14:16,051 --> 00:14:18,451 Uh, that's, that's a, how common it is is difficult. 252 00:14:18,451 --> 00:14:22,351 But I can tell you in in regulated organizations, you know, those that 253 00:14:22,351 --> 00:14:23,581 have to be compliant with something. 254 00:14:24,541 --> 00:14:28,921 Uh, there is a, a control check for making sure that local, you 255 00:14:28,921 --> 00:14:32,881 know, users don't have, you know, um, more privileges than they need. 256 00:14:33,361 --> 00:14:38,251 Well, then organizations get around that by justifying the need for a user to 257 00:14:38,251 --> 00:14:41,731 have, uh, you know, admin privileges. 258 00:14:41,731 --> 00:14:45,661 And, and I see that even, um, and, and well, you know, mature. 259 00:14:46,501 --> 00:14:48,061 Uh, and secure environments. 260 00:14:48,091 --> 00:14:52,681 An engineer has local admin because he needs to run, you know, some kind 261 00:14:52,681 --> 00:14:57,031 of CAD software with, you know, the ability to manipulate memory and, you 262 00:14:57,031 --> 00:14:58,771 know, graphics and all this other stuff. 263 00:14:59,251 --> 00:15:01,771 Um, thinking, well, it's justified. 264 00:15:01,771 --> 00:15:03,791 Well, bad guys realize this too. 265 00:15:03,826 --> 00:15:05,701 So those are the users they're gonna target. 266 00:15:05,731 --> 00:15:09,541 They're not gonna target the receptionist, uh, you know, for, for the most part. 267 00:15:09,961 --> 00:15:10,381 Um. 268 00:15:11,791 --> 00:15:15,991 So it depends, uh, in, in smaller organizations where, you know, the, 269 00:15:16,021 --> 00:15:22,351 the, it, uh, you know, support doesn't want to have to answer the call to 270 00:15:22,351 --> 00:15:24,901 help someone install, you know, widget. 271 00:15:25,651 --> 00:15:29,521 Uh, they would much rather just give them the ability to do that and, and 272 00:15:29,521 --> 00:15:31,231 not have to take so many phone calls. 273 00:15:31,681 --> 00:15:35,701 Um, but in larger organizations that leads to what we call shadow it. 274 00:15:36,421 --> 00:15:39,841 You know, the, the ability to download and do stuff and make changes and build 275 00:15:39,841 --> 00:15:45,061 things without it being involved, well, that lends itself to more issues down the 276 00:15:45,061 --> 00:15:50,551 road with patch management and conflict and vulnerabilities and other things that 277 00:15:50,761 --> 00:15:54,451 it doesn't know about because they weren't involved with helping you do those things. 278 00:15:55,261 --> 00:16:00,271 And so, you know, restricting access and privilege is, is necessary in a large, 279 00:16:00,751 --> 00:16:03,541 um, user environment for a lot of reasons. 280 00:16:04,111 --> 00:16:04,951 Persona, do you? 281 00:16:06,046 --> 00:16:06,376 Go ahead. 282 00:16:06,481 --> 00:16:07,436 Security is one of those. 283 00:16:08,386 --> 00:16:08,896 Persona. 284 00:16:08,896 --> 00:16:12,016 You, you remember the, uh, the episode, the wifi is down 285 00:16:12,871 --> 00:16:13,171 Yep, 286 00:16:13,336 --> 00:16:18,106 one of our OG episodes, and they, that particular person said that they had, 287 00:16:18,676 --> 00:16:21,586 what was it, 450 SaaS applications. 288 00:16:21,661 --> 00:16:22,531 applications. 289 00:16:22,681 --> 00:16:22,921 Yeah. 290 00:16:23,026 --> 00:16:24,706 That just blew me away when they said that. 291 00:16:24,826 --> 00:16:25,426 Um. 292 00:16:26,401 --> 00:16:33,271 So Mike, this is all, um, like amazing, just learning about off the land attacks. 293 00:16:33,571 --> 00:16:36,301 How come it isn't talked about more often? 294 00:16:37,171 --> 00:16:42,151 Like it seems that this would be very common for a lot of the attack vectors and 295 00:16:42,151 --> 00:16:46,771 what guys are doing, but like Curtis, like you mentioned at the start of this, right? 296 00:16:46,771 --> 00:16:48,811 It's things, something you had really heard about. 297 00:16:51,396 --> 00:16:56,336 So it, it, it is, it's not the, it's not the sexy part of the attack. 298 00:16:57,301 --> 00:16:57,601 Right. 299 00:16:57,601 --> 00:17:00,451 So when you're telling a story, that's the part where people 300 00:17:00,451 --> 00:17:02,821 start to Yeah, absolutely. 301 00:17:04,651 --> 00:17:06,901 You know, that's the part of the, that's the part of the story where 302 00:17:06,901 --> 00:17:09,931 people's eyes kind of gloss over 'cause it gets pretty technical and 303 00:17:09,931 --> 00:17:11,761 it's not as exciting as, you know. 304 00:17:11,761 --> 00:17:15,571 They, they, they broke in and they, and then they, they made off with all the 305 00:17:15,571 --> 00:17:17,881 goods, uh, all that stuff in the middle. 306 00:17:17,911 --> 00:17:22,051 People just kind of get blurry about because it's, it's not the, it's not 307 00:17:22,051 --> 00:17:23,851 the, it's not the cause of the effect. 308 00:17:23,851 --> 00:17:26,041 It's the, it's the creamy feeling. 309 00:17:26,881 --> 00:17:29,371 that excites me sometimes, but, uh, 310 00:17:31,831 --> 00:17:35,971 I, if I, if I can make an analogy, there was recently this, uh, huge. 311 00:17:36,421 --> 00:17:40,171 Uh, uh, heist at the Louvre, right? 312 00:17:40,651 --> 00:17:44,341 Where, where the guys, and like I'm drawing an analogy where like the living 313 00:17:44,341 --> 00:17:46,351 off the land was like the yellow vests. 314 00:17:46,561 --> 00:17:49,591 Like they just pretended to be part of the crew. 315 00:17:50,071 --> 00:17:53,011 Uh, and so people just, they did, you know, it wasn't the 316 00:17:53,011 --> 00:17:54,181 sexy part that attacked that. 317 00:17:54,181 --> 00:17:57,991 They managed to just sort of look like they belong there and just sort of 318 00:17:57,991 --> 00:18:02,881 get in and out in the middle of broad daylight and steal the crown jewels. 319 00:18:03,301 --> 00:18:04,261 Um, yeah. 320 00:18:04,471 --> 00:18:10,021 many, are so many ties to, to the kinetic world with cyber, 321 00:18:10,021 --> 00:18:11,251 you know, all those analogies. 322 00:18:11,581 --> 00:18:16,321 Uh, I can, I've, I've done social engineering and, and red teaming and 323 00:18:16,321 --> 00:18:18,091 breaking into buildings for years and. 324 00:18:18,766 --> 00:18:20,536 All of that stuff is very similar. 325 00:18:20,536 --> 00:18:24,076 You know, as soon as I make it in a door a building, the first 326 00:18:24,076 --> 00:18:25,546 thing I target is the break room. 327 00:18:25,696 --> 00:18:27,016 And I get a cup of coffee. 328 00:18:27,106 --> 00:18:31,576 'cause somebody that's walking around with coffee less suspicious than someone 329 00:18:31,576 --> 00:18:33,076 that's wandering around aimlessly. 330 00:18:33,826 --> 00:18:37,396 Uh, and then, you know, if you've got a clipboard or a name badge or a 331 00:18:37,396 --> 00:18:41,776 notepad or whatever, I can tell you I started, I started breaking into 332 00:18:41,776 --> 00:18:45,346 buildings upon request, not, not 333 00:18:45,581 --> 00:18:45,781 Yeah, 334 00:18:46,876 --> 00:18:47,326 uh. 335 00:18:47,426 --> 00:18:48,016 understand. 336 00:18:48,646 --> 00:18:50,146 Man, 2004. 337 00:18:50,146 --> 00:18:51,616 So 22 years. 338 00:18:52,066 --> 00:18:57,166 Uh, and not once, never once has anybody stopped and asked me if I needed help 339 00:18:57,526 --> 00:18:58,996 or are you, who are you here to see? 340 00:18:58,996 --> 00:19:00,826 Or who are you or nothing? 341 00:19:01,636 --> 00:19:02,746 22 years. 342 00:19:03,046 --> 00:19:05,956 I, I, maybe I, people don't wanna talk to me, that's fine. 343 00:19:05,956 --> 00:19:09,706 But, but that's helped me be successful at social engineering. 344 00:19:11,341 --> 00:19:15,121 By the way, I love, I love your, I love it when you use fancy 345 00:19:15,121 --> 00:19:16,831 words like the kinetic world. 346 00:19:19,046 --> 00:19:22,471 I, I've never heard anyone call it the kinetic world before. 347 00:19:22,801 --> 00:19:26,851 You mean like the real world as opposed to the cyber world. 348 00:19:27,421 --> 00:19:28,471 and you can touch stuff. 349 00:19:28,531 --> 00:19:29,071 Okay. 350 00:19:29,581 --> 00:19:32,341 I've never, I've literally never heard the term kinetic. 351 00:19:32,371 --> 00:19:33,781 I, I know the term kinetic. 352 00:19:33,781 --> 00:19:33,961 Like, 353 00:19:34,471 --> 00:19:35,071 fall then? 354 00:19:35,401 --> 00:19:35,761 what's that? 355 00:19:35,761 --> 00:19:35,881 That's 356 00:19:36,691 --> 00:19:36,841 Where 357 00:19:36,966 --> 00:19:37,086 the, 358 00:19:37,471 --> 00:19:37,711 fall 359 00:19:37,711 --> 00:19:38,561 that's the virtual world. 360 00:19:38,656 --> 00:19:42,916 there's the kinetic, there's the kinetic, uh, matrix of, of things 361 00:19:42,916 --> 00:19:45,711 that supports the, the, the cyber. 362 00:19:46,211 --> 00:19:49,786 Uh, you know, and I guess you could, you could do analog 363 00:19:49,786 --> 00:19:52,306 and digital too, but, yeah, 364 00:19:52,786 --> 00:19:53,296 All right. 365 00:19:53,806 --> 00:19:56,236 I just, I just, I had to call that out. 366 00:19:56,536 --> 00:19:57,711 is, is in the kinetic world. 367 00:19:58,591 --> 00:19:59,131 What's that? 368 00:20:00,076 --> 00:20:01,906 The Nebuchadnezzar, the ship in 369 00:20:01,906 --> 00:20:03,166 Oh, right, right. 370 00:20:03,166 --> 00:20:04,246 It's in the kinetic world. 371 00:20:04,246 --> 00:20:04,816 Exactly. 372 00:20:04,816 --> 00:20:05,416 Exactly. 373 00:20:05,416 --> 00:20:07,966 Nice, nice, uh, deep reference there. 374 00:20:08,476 --> 00:20:13,666 So we, so this is about, we're, we're, we're in the environment, right? 375 00:20:13,936 --> 00:20:16,906 But basically we wanna spread around. 376 00:20:16,906 --> 00:20:20,506 We want to do stuff without being attacked, and the best, I'm 377 00:20:20,506 --> 00:20:22,036 sorry, without being detected. 378 00:20:22,516 --> 00:20:26,386 And so the best way to do that is to use tools that. 379 00:20:26,561 --> 00:20:29,381 Again, aren't being monitored because they're just part of the 380 00:20:29,381 --> 00:20:31,316 normal, uh, way of doing business. 381 00:20:31,586 --> 00:20:32,516 Does that sound about right? 382 00:20:32,626 --> 00:20:32,826 then. 383 00:20:34,006 --> 00:20:34,906 And, and you're right. 384 00:20:34,906 --> 00:20:38,566 And, and those tools can facilitate the different phases of an attack. 385 00:20:38,566 --> 00:20:43,306 So sometimes, uh, you know, those tools are used to do reconnaissance and, 386 00:20:43,306 --> 00:20:47,716 you know, the, the, the slow, the low and slow stuff, the stealthy stuff. 387 00:20:48,076 --> 00:20:51,346 'cause you don't want to get caught before you're able to, to really, 388 00:20:51,346 --> 00:20:53,596 you know, kick up your attack. 389 00:20:53,596 --> 00:20:57,826 So you do the, the reconnaissance stuff really quietly and then you use 390 00:20:57,826 --> 00:20:59,576 those tools to pull down, you know. 391 00:21:00,061 --> 00:21:01,441 The other parts of your attack. 392 00:21:01,441 --> 00:21:05,341 So maybe you've got payloads or, additional software like Mimi 393 00:21:05,341 --> 00:21:08,611 Cats as an example for credential harvesting and that kind of stuff. 394 00:21:08,911 --> 00:21:12,721 So you would, you would go slow and, and methodical first, and then once 395 00:21:12,721 --> 00:21:15,901 you figured out how you, what you need to do next or what your, you know, 396 00:21:15,901 --> 00:21:17,791 the, the, the environment looks like. 397 00:21:18,811 --> 00:21:20,131 you, you start to do more. 398 00:21:20,131 --> 00:21:22,861 You, you're more active and, and you take more risk. 399 00:21:23,341 --> 00:21:26,281 Uh, and that's where you would, you know, evolve your attack 400 00:21:26,286 --> 00:21:27,181 into, into different tools. 401 00:21:27,616 --> 00:21:32,656 Mike, how, what role does the, you know, like the level 402 00:21:32,656 --> 00:21:35,146 of credentials play in this? 403 00:21:35,206 --> 00:21:38,506 Um, you know, if you're doing a living off of the land attack, 404 00:21:38,506 --> 00:21:41,261 what role does, like the level of credentials that you're using play. 405 00:21:43,906 --> 00:21:45,076 Man, what do I always say? 406 00:21:45,076 --> 00:21:46,066 It depends, right? 407 00:21:46,156 --> 00:21:47,446 Um, so. 408 00:21:48,106 --> 00:21:48,466 You know what? 409 00:21:48,466 --> 00:21:51,196 I'm just gonna cut every time you ever say It depends. 410 00:21:51,196 --> 00:21:57,001 I'm gonna make a super cut and it'll be a four hour long video, but go ahead, Mike. 411 00:21:57,271 --> 00:22:01,141 Somebody did a meme, uh, where, where they took all the ums. 412 00:22:01,201 --> 00:22:03,511 Oh, it was, it was our intern program. 413 00:22:03,601 --> 00:22:08,311 So the interns were, were doing a presentation and we, we, we give 414 00:22:08,311 --> 00:22:11,431 them constructive feedback and they were using the filler words, the ums 415 00:22:11,431 --> 00:22:16,051 and the, and so somebody, somebody on one of the other interns did 416 00:22:16,051 --> 00:22:17,821 a compilation of all the ums and 417 00:22:17,821 --> 00:22:18,241 Wow. 418 00:22:18,781 --> 00:22:21,781 And so it was just a consistent, um, uh, uh. 419 00:22:25,591 --> 00:22:26,966 So your answer is, it depends. 420 00:22:28,111 --> 00:22:33,121 so it does depend, uh, and what I mean by that is it depends on the 421 00:22:33,121 --> 00:22:36,691 capabilities in the environment to monitor for weird stuff. 422 00:22:36,781 --> 00:22:42,781 So it would be weird for the receptionist to run PowerShell in an environment 423 00:22:43,741 --> 00:22:46,921 she's also a, you know, a computer science student or something like that. 424 00:22:47,761 --> 00:22:50,971 It would not be weird for an admin to be running these 425 00:22:50,971 --> 00:22:53,791 administratively related tools. 426 00:22:54,211 --> 00:22:57,871 Or scripts or uh, uh, activities. 427 00:22:58,291 --> 00:23:02,281 So in the cyber world, we have tools that do what are called 428 00:23:02,281 --> 00:23:05,371 user and behavioral user behavior. 429 00:23:06,241 --> 00:23:07,291 I'll get it right in a second. 430 00:23:08,461 --> 00:23:12,331 User and event behavior analytics or UEBA. 431 00:23:13,321 --> 00:23:17,131 a user, it creates a baseline, so type of user, type of device. 432 00:23:17,191 --> 00:23:21,751 And it, it tries to delineate between what's normal on these anomalies. 433 00:23:21,751 --> 00:23:25,996 So if you've got a. Even an admin account that doesn't use PowerShell 434 00:23:25,996 --> 00:23:29,716 very often if a bad guy compromises that environment and that admin 435 00:23:29,716 --> 00:23:33,046 account, now he's running PowerShell in some weird way that should, that 436 00:23:33,046 --> 00:23:34,576 could be flagged or should be flagged. 437 00:23:34,576 --> 00:23:38,416 But it depends on, depends on the capabilities in that environment. 438 00:23:38,986 --> 00:23:42,556 Now Windows inherently you, you can set up logging and alerting, 439 00:23:42,561 --> 00:23:44,236 but a lot of organizations don't. 440 00:23:44,236 --> 00:23:47,206 They don't, they don't wanna spend the time it's noisy. 441 00:23:47,596 --> 00:23:50,866 'cause Windows environments talk a lot. 442 00:23:51,166 --> 00:23:51,491 Uh, and then. 443 00:23:52,306 --> 00:23:56,536 Even if there is an alert that one or two or a few, it people are busy putting 444 00:23:56,536 --> 00:23:59,866 out fires and it's gonna be a day or a week before they go, Hey, there was this 445 00:23:59,866 --> 00:24:02,446 alert thing, that I need to look into. 446 00:24:02,446 --> 00:24:04,936 So it's a mess. 447 00:24:04,996 --> 00:24:09,496 Uh, but yeah, uh, there, there are ways of there identifying weird 448 00:24:09,496 --> 00:24:14,416 stuff based on the type of user, uh, that's conducting that activity. 449 00:24:16,006 --> 00:24:18,586 So, I know you talked about monitoring, alerting, Mike. 450 00:24:19,386 --> 00:24:20,971 there other things that. 451 00:24:22,411 --> 00:24:26,911 can do because with these living off the land attacks, it's already 452 00:24:26,911 --> 00:24:29,641 there, like all the tools are there that this person needs. 453 00:24:30,481 --> 00:24:35,581 so basically saying you're screwed if you're trying to protect these things 454 00:24:36,271 --> 00:24:39,841 and prevent these sort of attacks from using the tools that already exist. 455 00:24:40,681 --> 00:24:41,266 You are not, and. 456 00:24:41,761 --> 00:24:46,711 And, and it, it, it's just how much overhead do you wanna put 457 00:24:46,951 --> 00:24:48,661 on securing your environment? 458 00:24:49,111 --> 00:24:53,251 One of the things, just taking you back to another example of a resource 459 00:24:53,251 --> 00:24:56,011 that's available 24 7 that shouldn't be. 460 00:24:56,161 --> 00:24:59,521 And, and I'm, so I'm alluding to, you know, some of these administrative 461 00:24:59,521 --> 00:25:02,701 tools being available all the time, even if the administrator doesn't 462 00:25:02,701 --> 00:25:07,111 need it, remote access into your network from supporting vendors. 463 00:25:07,921 --> 00:25:11,401 Why is that available 24 hours a day if I don't currently need your help? 464 00:25:11,971 --> 00:25:16,561 It's because someone's too lazy to go turn off the modem and yeah, I said modem, 465 00:25:18,631 --> 00:25:23,851 or disable that VPN access or suspend that user account because it, it's, 466 00:25:23,851 --> 00:25:26,581 it creates overhead very similarly. 467 00:25:27,331 --> 00:25:30,571 can suspend services running on in our environment. 468 00:25:30,571 --> 00:25:35,071 We can turn off, uh, administrative services that aren't being used when 469 00:25:35,071 --> 00:25:37,711 they're not necessary, don't do that. 470 00:25:38,971 --> 00:25:43,081 And then ideally, um, because we don't do that, uh, you would wanna 471 00:25:43,081 --> 00:25:45,001 monitor for the use of those things. 472 00:25:45,031 --> 00:25:49,051 And a lot of organizations still think that we don't need that, or it's too 473 00:25:49,051 --> 00:25:53,371 expensive, or, you know, we don't have the skillset, you know, whatever the case is. 474 00:25:53,371 --> 00:25:55,331 There's always, there's excuses after excuses, but. 475 00:25:55,921 --> 00:25:59,401 Yeah, I think, I think this, we, we've talked about this, uh, and 476 00:25:59,401 --> 00:26:01,861 we're gonna give, we're gonna give a couple action items here. 477 00:26:02,341 --> 00:26:05,491 Uh, we've talked about, like, one of the things that comes up a lot is RDP, right? 478 00:26:05,611 --> 00:26:07,681 And that RDP is very, very useful. 479 00:26:08,071 --> 00:26:13,201 But RDP open all the time, and RDP, especially RDP, accessible via. 480 00:26:13,261 --> 00:26:14,551 The internet, right. 481 00:26:14,551 --> 00:26:17,461 Directly accessible via the internet is just, you're just, it's just, 482 00:26:17,461 --> 00:26:18,871 there's like asking for trouble. 483 00:26:18,871 --> 00:26:19,201 Right? 484 00:26:19,741 --> 00:26:25,681 Um, and so there are ways to turn it off and turn it on when you need it. 485 00:26:26,161 --> 00:26:29,011 Uh, and there's also, and, and, and you know, again, 486 00:26:29,011 --> 00:26:30,571 you, you, you, you alluded to. 487 00:26:31,741 --> 00:26:33,811 You alluded to, there's, there's a, there's a budget, 488 00:26:34,021 --> 00:26:35,371 uh, aspect of this, right? 489 00:26:35,371 --> 00:26:39,001 So there are remote access tools that are much more secure 490 00:26:39,001 --> 00:26:41,761 than RDP that you could enact. 491 00:26:42,091 --> 00:26:45,991 Uh, it, it's just, it's going to increase your costs, but perhaps 492 00:26:46,441 --> 00:26:49,831 increase your costs a little bit with a much higher level of security. 493 00:26:50,101 --> 00:26:54,511 I, I think it's a matter of like finding, finding that sweet spot, right? 494 00:26:54,511 --> 00:26:57,421 Where, where's the, some things I think we can do. 495 00:26:57,826 --> 00:27:02,296 Where it's, it's a, there's a little bit of hassle and I, I, I'll give another 496 00:27:02,296 --> 00:27:06,526 perfect example of something that you suggested back on a previous podcast 497 00:27:06,526 --> 00:27:08,266 that I enacted in my personal life. 498 00:27:08,266 --> 00:27:14,746 And that was using, um, you know, you, the idea was that don't have, uh, you 499 00:27:14,746 --> 00:27:17,041 know, when you, when you go into your bank, like don't have a bunch of other 500 00:27:17,041 --> 00:27:18,526 tabs open and all that kind of stuff. 501 00:27:18,796 --> 00:27:23,446 And, and the way I, and the way I. Decided to implement that was, if 502 00:27:23,446 --> 00:27:28,396 I do anything that's that level of security, I do it in a different browser. 503 00:27:28,726 --> 00:27:28,906 Right. 504 00:27:28,906 --> 00:27:31,006 Meaning a different brand of browser. 505 00:27:31,066 --> 00:27:31,486 Right. 506 00:27:31,846 --> 00:27:36,376 And, and then I, um, and since I use Chrome as like my main browser, 507 00:27:36,676 --> 00:27:42,226 I implemented a, uh, I, there's a tool that allows me to blacklist. 508 00:27:42,791 --> 00:27:44,531 Certain sites, right? 509 00:27:44,621 --> 00:27:46,001 Like Citibank, right? 510 00:27:46,451 --> 00:27:49,481 I can say if I ever, 'cause, 'cause I, I don't know if you 511 00:27:49,481 --> 00:27:51,311 know this, Mike, I forget stuff. 512 00:27:52,061 --> 00:27:56,201 I got CRS like a lot and I forget that I, that I told myself, I'm 513 00:27:56,201 --> 00:27:58,031 not gonna log into Citibank on my. 514 00:27:59,136 --> 00:28:00,336 Chrome browser. 515 00:28:00,486 --> 00:28:01,266 And so I do it. 516 00:28:01,266 --> 00:28:04,806 I'll type in, I'll type in citi.com, and Chrome will say, you know, you 517 00:28:04,806 --> 00:28:06,456 told us not to let you do that. 518 00:28:06,666 --> 00:28:07,416 And I'm like, oh yeah. 519 00:28:07,416 --> 00:28:11,856 And then I go over to Firefox minor level of inconvenience for 520 00:28:11,856 --> 00:28:13,866 a significant change in security. 521 00:28:13,866 --> 00:28:17,136 And I think it's a matter of finding those things for these 522 00:28:17,136 --> 00:28:19,326 living off the land, uh, attacks. 523 00:28:19,326 --> 00:28:20,271 Does that sound about right? 524 00:28:21,681 --> 00:28:22,281 It does. 525 00:28:22,281 --> 00:28:24,981 And if I could continue your bank analogy a little further. 526 00:28:25,551 --> 00:28:28,821 So your browser would be the living off the land part, especially 527 00:28:28,821 --> 00:28:29,991 if you save your password. 528 00:28:30,201 --> 00:28:30,491 Yeah. 529 00:28:30,561 --> 00:28:35,781 Uh, so that guy just has to compromise your machine and identify 530 00:28:35,781 --> 00:28:37,316 the browsers you use and then. 531 00:28:38,731 --> 00:28:39,961 Yeah, trial and error. 532 00:28:40,531 --> 00:28:41,311 Chrome doesn't work. 533 00:28:41,341 --> 00:28:42,841 Oh, Firefox does work. 534 00:28:43,111 --> 00:28:44,491 Oh, and you saved your password. 535 00:28:44,941 --> 00:28:48,151 So now I'm, I'm in your bank because I've used the resources 536 00:28:48,151 --> 00:28:50,461 available to me on your machine. 537 00:28:51,001 --> 00:28:54,541 Well, then the, the evolution of that activity would generate, 538 00:28:54,781 --> 00:28:59,341 you know, some kind of log, or event triggers in the bank, right? 539 00:28:59,341 --> 00:29:06,121 So somebody logged in at 2:00 AM from a different IP address than, you know, your. 540 00:29:06,796 --> 00:29:08,326 Recent IP addresses. 541 00:29:08,356 --> 00:29:08,686 Right. 542 00:29:08,806 --> 00:29:12,766 a, an email or a text message potentially related to that. 543 00:29:13,546 --> 00:29:17,386 if they buy stuff or change stuff, you should hopefully have 544 00:29:17,386 --> 00:29:19,426 alerting or events related to that. 545 00:29:19,936 --> 00:29:23,236 And if there's any transactions over a certain threshold, you should have 546 00:29:24,076 --> 00:29:25,696 alerting related to those things. 547 00:29:26,056 --> 00:29:26,386 Right. 548 00:29:26,536 --> 00:29:28,846 are the, those are the things. 549 00:29:29,296 --> 00:29:30,931 And just going back to the living off the land part. 550 00:29:31,741 --> 00:29:34,921 know, bad guys are gonna do reconnaissance first and be quiet, but then when 551 00:29:34,921 --> 00:29:40,261 they're ready to, to execute their, plan, they're not necessarily as up, uh, as 552 00:29:40,261 --> 00:29:42,151 concerned with how loud they're gonna be. 553 00:29:42,481 --> 00:29:44,011 'cause it's gonna happen very quickly. 554 00:29:44,561 --> 00:29:44,641 Hmm. 555 00:29:46,041 --> 00:29:46,331 Nice. 556 00:29:46,576 --> 00:29:47,206 So let's talk. 557 00:29:47,391 --> 00:29:48,011 Go ahead, prana. 558 00:29:48,286 --> 00:29:53,326 we, so Mike, I know you said that people will act fast. 559 00:29:54,631 --> 00:30:00,691 How far or how much time is taken usually in that first step of kind of scoping 560 00:30:00,691 --> 00:30:05,491 things out, using, uh, living off the land versus, okay, now I'm actually 561 00:30:05,491 --> 00:30:07,861 gonna execute and sort of run with it. 562 00:30:07,861 --> 00:30:10,231 And like you said, they don't care how loud it is. 563 00:30:10,231 --> 00:30:12,541 They're gonna make a bunch of noise, break a bunch of things, but 564 00:30:12,871 --> 00:30:15,391 they're trying to go as quickly as possible before they're detected. 565 00:30:16,546 --> 00:30:19,546 If I could write, it depends backwards so that it would show up the right 566 00:30:19,546 --> 00:30:22,546 way, I would, uh, but it depends. 567 00:30:22,936 --> 00:30:27,826 But like is it like 90% of the time is typically spent in the first phase 568 00:30:28,786 --> 00:30:30,616 and less time is spent in the second? 569 00:30:30,616 --> 00:30:31,876 Is that a fair assumption? 570 00:30:32,101 --> 00:30:34,171 and there, there are some good statistics around that. 571 00:30:34,171 --> 00:30:34,651 But yeah. 572 00:30:34,741 --> 00:30:40,351 As an example, a, an attack that could last four hours had probably 30 to 90 573 00:30:40,351 --> 00:30:42,241 days worth of reconnaissance ahead of it. 574 00:30:42,616 --> 00:30:42,946 Hmm. 575 00:30:44,386 --> 00:30:45,646 So, yeah, that's interesting. 576 00:30:46,696 --> 00:30:47,356 Um. 577 00:30:48,286 --> 00:30:54,106 So, uh, all right, well, let's talk about, we, PowerShell has come up a lot. 578 00:30:54,106 --> 00:31:00,016 What, what can we do with PowerShell and, you know, is there anything that's like 579 00:31:00,436 --> 00:31:02,896 the easy idea that I talked about earlier? 580 00:31:02,896 --> 00:31:06,761 Is there a way to easily disable and re-enable PowerShell when we need it? 581 00:31:09,316 --> 00:31:13,186 So of all the environments that I've, I've worked with or in. 582 00:31:13,771 --> 00:31:16,621 Very few of them use PowerShell very much. 583 00:31:16,621 --> 00:31:20,581 There's usually that one, that one admin, that one person that knows how to use it 584 00:31:20,581 --> 00:31:23,821 and that uses it because they're, they get it and then man, it makes life easy. 585 00:31:24,541 --> 00:31:25,981 Everybody else doesn't need it. 586 00:31:26,761 --> 00:31:30,901 And in a lot of cases, PowerShell is not necessarily required or 587 00:31:30,901 --> 00:31:33,091 needed across an entire environment. 588 00:31:33,211 --> 00:31:33,361 Hmm. 589 00:31:33,391 --> 00:31:37,831 You might just need it between your admin machine and Office 365 or 590 00:31:37,831 --> 00:31:41,311 those, or, or your server cluster, take it off of everything else. 591 00:31:42,886 --> 00:31:45,166 And, and that just, that goes back to hardening. 592 00:31:45,166 --> 00:31:47,026 So how do I harden my network? 593 00:31:47,356 --> 00:31:51,736 Well, you've first gotta understand your network, right? 594 00:31:51,736 --> 00:31:52,576 Know yourself. 595 00:31:52,936 --> 00:31:55,306 What, what do I, what am I responsible for? 596 00:31:55,486 --> 00:31:57,046 How do all these things work? 597 00:31:57,136 --> 00:31:58,816 What is their primary role? 598 00:31:59,281 --> 00:32:01,681 Hopefully you've got one machine for one role. 599 00:32:01,681 --> 00:32:05,491 We, we would call that a bastion host, like your web server's, just 600 00:32:05,491 --> 00:32:10,471 your web server, that's not also your financial server or your backup server. 601 00:32:10,891 --> 00:32:17,491 Uh, and then for, for those roles and that purpose of that machine, what's needed, 602 00:32:17,611 --> 00:32:19,891 what's necessary to, to support it. 603 00:32:20,251 --> 00:32:24,031 Like you don't need Bluetooth active on a production server. 604 00:32:24,121 --> 00:32:26,761 It doesn't need to be a web server unless it's a web server. 605 00:32:27,121 --> 00:32:28,051 You don't need. 606 00:32:28,471 --> 00:32:31,441 Uh, it doesn't need print server services running. 607 00:32:32,281 --> 00:32:34,981 so those are just examples of the services running. 608 00:32:34,981 --> 00:32:40,231 Well, now let's, let's look at all the, the, the overhead from a, a file and 609 00:32:40,831 --> 00:32:43,441 help, uh, you know, software perspective. 610 00:32:43,861 --> 00:32:47,311 Your server doesn't need Microsoft Solitaire and games. 611 00:32:47,551 --> 00:32:48,631 It doesn't need all the help. 612 00:32:49,471 --> 00:32:53,011 It doesn't need all the help files, it doesn't need templates. 613 00:32:53,011 --> 00:32:56,221 And, and all of the, the pre-installed. 614 00:32:57,541 --> 00:33:03,991 You know, garbage that the, the vendor, whether it's Dell or whoever, uh, so much 615 00:33:03,991 --> 00:33:08,791 that can be done to, to make a machine run more effectively and securely. 616 00:33:09,091 --> 00:33:11,821 If you can really understand what it's gonna do, and then 617 00:33:11,821 --> 00:33:13,321 take everything else off, turn it 618 00:33:13,441 --> 00:33:15,826 But Mike, that takes, but that takes work. 619 00:33:16,996 --> 00:33:17,941 it, it takes work. 620 00:33:18,661 --> 00:33:19,891 So again, it depends. 621 00:33:19,891 --> 00:33:21,631 So if, if I've got all these machines. 622 00:33:23,686 --> 00:33:27,586 And I spend the time to develop what I would call a, a golden image, right? 623 00:33:27,586 --> 00:33:31,936 So, um, I, I take one machine and I say, this is exactly how I want this done. 624 00:33:32,266 --> 00:33:35,566 Well create an image of that and apply it on the other, however many. 625 00:33:35,926 --> 00:33:39,976 And then for each one of those golden images, I can add back on top of 626 00:33:39,976 --> 00:33:44,776 that base golden image, the things that are particular to that server. 627 00:33:45,001 --> 00:33:49,111 So your, so your golden image is, is, is, uh, like in this case, uh, 628 00:33:49,411 --> 00:33:51,661 PowerShell is disabled everywhere. 629 00:33:51,931 --> 00:33:55,441 But then for that one person who needs PowerShell, you can turn it on. 630 00:33:56,401 --> 00:33:56,941 Correct. 631 00:33:58,231 --> 00:33:58,471 Yeah. 632 00:33:58,711 --> 00:34:01,231 And that's, that's great too because if you have an issue with that 633 00:34:01,231 --> 00:34:05,071 machine, re-apply the image, right? 634 00:34:05,071 --> 00:34:05,101 Uh, 635 00:34:05,221 --> 00:34:05,521 Hmm. 636 00:34:06,151 --> 00:34:06,511 Yeah. 637 00:34:06,686 --> 00:34:09,406 from scratch without having to figure out what broke and how to fix it. 638 00:34:10,156 --> 00:34:14,986 Is there, is there a way for us to figure out the tools, esp if we're, 639 00:34:15,016 --> 00:34:19,426 if we're, if we're trying to secure things for, you know, against a living 640 00:34:19,426 --> 00:34:24,436 off the land attack, is there a way to figure out the tools like PowerShell 641 00:34:24,436 --> 00:34:26,146 that are in use in our environment? 642 00:34:26,146 --> 00:34:30,406 By, by the use of, by looking at like the ports that they're using, for example. 643 00:34:31,681 --> 00:34:32,996 There are, um, and. 644 00:34:34,171 --> 00:34:35,191 And, and there's free tools. 645 00:34:35,191 --> 00:34:37,861 One's called Nmap, uh, another one's called Wireshark. 646 00:34:38,191 --> 00:34:42,451 Uh, so those are network protocol analyzers, so you can run 647 00:34:42,451 --> 00:34:43,651 that across your environment. 648 00:34:43,651 --> 00:34:45,601 It'll tell you by IP address. 649 00:34:45,601 --> 00:34:49,981 Here's the ports that are open and based on the, the 650 00:34:52,561 --> 00:34:57,691 default service for a given port, it'll, it'll give you a description of what it 651 00:34:57,691 --> 00:34:59,701 thinks might be running on that port. 652 00:35:00,691 --> 00:35:06,211 But bad guys are also pretty good, uh, at, at changing what ports are being 653 00:35:06,211 --> 00:35:12,871 used so that you're not suspicious of, uh, um, of network activity. 654 00:35:12,871 --> 00:35:18,151 Like we had an incident call on on Friday where a school district 655 00:35:18,151 --> 00:35:19,441 said, I think I'm getting hacked. 656 00:35:19,446 --> 00:35:20,701 I just shut my network down. 657 00:35:21,301 --> 00:35:22,411 right, well, let's look into that. 658 00:35:23,011 --> 00:35:24,001 Well, it was, uh. 659 00:35:25,186 --> 00:35:29,386 Um, expired certificates for a website, and then on the back 660 00:35:29,386 --> 00:35:31,786 end, the logs showed that, 661 00:35:34,096 --> 00:35:35,416 data was going out. 662 00:35:35,506 --> 00:35:43,156 Uh, iic ICMP data was going out to this, uh, AWS IP address. 663 00:35:44,866 --> 00:35:50,686 Well, ICMP by itself, not a bad thing, but to a, uh, an IP address that 664 00:35:50,746 --> 00:35:52,306 maybe doesn't have a good reputation. 665 00:35:52,636 --> 00:35:56,176 That could be a bad guy just sending, like intentionally changing what 666 00:35:56,176 --> 00:36:00,796 port they're sending data out so that it looks like ICMP, but maybe 667 00:36:00,796 --> 00:36:05,626 it's just low throttle, you know, throttled down data exfiltration, uh, 668 00:36:05,626 --> 00:36:06,946 turned out to be a false positive. 669 00:36:06,946 --> 00:36:09,526 It was actually their web filter for the school district. 670 00:36:11,086 --> 00:36:13,156 but, uh, we helped them learn something new that day. 671 00:36:14,596 --> 00:36:15,796 but bad guys do that. 672 00:36:15,856 --> 00:36:20,386 Uh, our, our engineers will exfil credentials over the DNS port 673 00:36:20,386 --> 00:36:21,646 because you can't block DNS. 674 00:36:23,281 --> 00:36:25,591 hardly anybody's, you know, monitoring that port. 675 00:36:25,941 --> 00:36:26,221 Right. 676 00:36:26,251 --> 00:36:29,611 you just do it slow and methodically, then you could, you could exfil quite a 677 00:36:29,611 --> 00:36:31,531 bit of data, uh, over a period of time. 678 00:36:31,786 --> 00:36:36,046 Yeah, I think we talked about that with when we had, um, uh, what's his name? 679 00:36:36,046 --> 00:36:37,426 Uh, Dwayne Persona. 680 00:36:37,456 --> 00:36:38,266 The Red Teamer. 681 00:36:38,296 --> 00:36:38,506 Yeah. 682 00:36:38,506 --> 00:36:42,376 When we had the red teamer on there, he talked a lot about, about the use of DNS. 683 00:36:42,886 --> 00:36:47,626 Um, you know, you gave me a memory back when my daughter was young and I was a 684 00:36:47,626 --> 00:36:52,576 little concerned about some of the traffic that I was seeing, uh, coming into. 685 00:36:52,656 --> 00:36:57,936 Um, the computer she was using and I went and I bought a SonicWall firewall, right. 686 00:36:57,936 --> 00:36:59,106 That had content filtering. 687 00:36:59,556 --> 00:37:02,526 And she came in the front, she came in the front, it was literally 688 00:37:02,526 --> 00:37:05,346 just sit, there was a box, a SonicWall box sitting on the couch. 689 00:37:05,616 --> 00:37:08,646 She walked in, she goes, SonicWall, what's that doing here? 690 00:37:08,676 --> 00:37:10,866 And I said, well, yeah, it's for this. 691 00:37:11,106 --> 00:37:13,386 She's like, they use that at the school. 692 00:37:13,836 --> 00:37:15,366 It won't let you do anything. 693 00:37:15,606 --> 00:37:16,836 And I'm like, yes. 694 00:37:17,376 --> 00:37:17,856 I was like. 695 00:37:19,186 --> 00:37:20,176 I bought the right one. 696 00:37:20,626 --> 00:37:27,856 Um, anyway, so the other, uh, so something you talked about with, um, this idea of 697 00:37:27,856 --> 00:37:32,236 that it was going to a place that maybe that isn't quite trusted, that brings 698 00:37:32,236 --> 00:37:37,186 up another concept of this idea, either either application, white listing or IP 699 00:37:37,186 --> 00:37:43,576 address, white listing in terms of is that another way that we can And, and, and it's 700 00:37:43,576 --> 00:37:47,806 another tool where it's, when you start, it's probably gonna be a giant pain. 701 00:37:48,166 --> 00:37:48,646 Right. 702 00:37:48,946 --> 00:37:52,336 If you say no applications are allowed to be used except for those 703 00:37:52,336 --> 00:37:55,846 that have been blessed by it, it's gonna really suck for a while. 704 00:37:56,176 --> 00:38:02,086 But is that, again, this goes back to the turning off, um, admin, is 705 00:38:02,086 --> 00:38:03,586 this a common practice as well? 706 00:38:03,586 --> 00:38:03,616 I. 707 00:38:04,671 --> 00:38:05,151 It is. 708 00:38:05,151 --> 00:38:08,331 And if you put the work in upfront, it's gonna be a little less headache. 709 00:38:08,361 --> 00:38:10,656 And what I mean by that is if, if you want to implement. 710 00:38:11,596 --> 00:38:15,256 You know, kind of white listing, black listing policies start 711 00:38:15,256 --> 00:38:17,386 with getting to know everybody. 712 00:38:17,386 --> 00:38:21,076 Like go sit with the engineers, go sit with the accounting and executives 713 00:38:21,076 --> 00:38:24,496 and find out what they're using, or do some of your own homework. 714 00:38:24,496 --> 00:38:25,876 You know, there's logs out there. 715 00:38:26,296 --> 00:38:30,616 Uh, but go, go talk to them about what you want to do and, and the, the purpose, 716 00:38:30,616 --> 00:38:35,326 like we're, we're doing this to, to make things, uh, safer, but it also helps us 717 00:38:35,326 --> 00:38:39,466 reduce risk and problems with computers and, you know, all that good stuff. 718 00:38:39,466 --> 00:38:40,486 So help me understand. 719 00:38:41,326 --> 00:38:45,916 What you need to do your job, and then I'm gonna use that to, to develop a 720 00:38:45,916 --> 00:38:50,716 plan to, to make us all safe and, and, you know, better, better, you know, 721 00:38:50,716 --> 00:38:55,276 better running and, uh, environment and computers with fewer problems. 722 00:38:55,321 --> 00:38:58,681 So you really have to do that research upfront where you're looking at 723 00:38:58,681 --> 00:39:00,271 the, the things that are being used. 724 00:39:00,511 --> 00:39:03,661 And again, you can do, you can use the network monitoring tool to do that. 725 00:39:04,081 --> 00:39:05,551 These are the things that are happening. 726 00:39:05,611 --> 00:39:06,061 What's that? 727 00:39:06,076 --> 00:39:08,481 I've got another, another example of that and, and. 728 00:39:12,406 --> 00:39:13,966 Yeah, how you, how you do this. 729 00:39:13,996 --> 00:39:17,656 Uh, and, and by this I mean this exercise of, of understanding what 730 00:39:17,656 --> 00:39:20,926 your business needs or what the, your employees need to do their job. 731 00:39:22,216 --> 00:39:27,976 a lot of times it just, no, nobody spends time on an exercise like that 732 00:39:27,976 --> 00:39:30,406 until there's smoke or fire, right? 733 00:39:30,406 --> 00:39:32,446 And then, and then we're like, well, what caused it? 734 00:39:32,446 --> 00:39:33,196 Why did this happen? 735 00:39:33,196 --> 00:39:34,636 How did you let this get this bad? 736 00:39:34,636 --> 00:39:35,446 You know, that kind of thing. 737 00:39:35,836 --> 00:39:38,176 And, and really, if you, if you. 738 00:39:38,986 --> 00:39:43,456 understand security and whether that's physical security or cyber, it's gotta 739 00:39:43,456 --> 00:39:47,986 start with understanding what you're protecting and how this whole place works. 740 00:39:48,376 --> 00:39:51,616 A good example of that would be a school district. 741 00:39:52,366 --> 00:39:58,696 Schools in Texas primarily don't care to have network connections to 742 00:39:58,696 --> 00:40:03,136 China unless you've got like some sister school and there's a program 743 00:40:03,136 --> 00:40:04,456 over there and this kind of thing. 744 00:40:05,116 --> 00:40:07,171 the most part, we don't communicate with China. 745 00:40:08,416 --> 00:40:10,456 Uh, a a a public school in Texas. 746 00:40:10,696 --> 00:40:15,046 So why are we allowing traffic from China to even reach our network? 747 00:40:15,616 --> 00:40:15,766 Right? 748 00:40:15,766 --> 00:40:16,306 So there's that. 749 00:40:17,026 --> 00:40:22,726 Alright, well then, uh, uh, a bigger kind of, more interesting story is I 750 00:40:22,726 --> 00:40:28,966 had a friend that worked for match.com as their IT security person, and they 751 00:40:28,966 --> 00:40:33,646 didn't do any geo IP blocking at the firewall and they were getting hit 752 00:40:33,646 --> 00:40:37,306 millions of times a day from overseas. 753 00:40:38,191 --> 00:40:43,681 And a lot of those, the intent was to create fake female profiles in the 754 00:40:43,681 --> 00:40:51,991 application, uh, for the only purpose of phishing, um, personal email addresses 755 00:40:51,991 --> 00:40:57,421 out of the male members of match.com that they could then spam those male 756 00:40:57,421 --> 00:41:04,681 me, those male uh, members', personal emails with, uh, pornography links. 757 00:41:05,806 --> 00:41:13,066 And those bad guys were making millions of dollars a day through phished pornography 758 00:41:13,066 --> 00:41:19,276 link clicks because of bots on the dating site that were coming from overseas. 759 00:41:19,876 --> 00:41:23,536 And the moment, I'll tell you how bad this was, the moment that they 760 00:41:23,536 --> 00:41:25,906 implemented geo IP blocking@max.com, 761 00:41:26,611 --> 00:41:28,021 The traffic to 10%. 762 00:41:29,296 --> 00:41:33,886 well, uh, from an organized crime perspective, this is how bad it was. 763 00:41:34,651 --> 00:41:38,821 Uh, you know, they were just kind of a, uh, an introverted kind of nobody. 764 00:41:38,821 --> 00:41:42,601 They just did their job and went home and played Xbox, you know, that kind of thing. 765 00:41:42,991 --> 00:41:46,741 And one day they went home after having implemented geo ip blocking. 766 00:41:46,801 --> 00:41:49,801 It did, it had such an impact on the organized crime ring 767 00:41:49,801 --> 00:41:50,941 that was running this thing. 768 00:41:51,751 --> 00:41:58,591 they had actually shipped a wooden casket and it was propped up on their front porch 769 00:41:58,921 --> 00:42:01,381 that told them to undo the GOIP blocking. 770 00:42:01,516 --> 00:42:01,846 Oh 771 00:42:04,201 --> 00:42:05,161 That doesn't sound good. 772 00:42:06,361 --> 00:42:07,891 That's the dark side, you know. 773 00:42:08,281 --> 00:42:11,041 Um, so, uh, all right. 774 00:42:11,041 --> 00:42:14,206 Well, I, we could, we could talk about this all day, but I, I, I, I 775 00:42:14,206 --> 00:42:15,806 think we get, you know, identify. 776 00:42:16,951 --> 00:42:21,751 Things that you need to, you know, that your organization needs to get the job 777 00:42:21,751 --> 00:42:25,531 done, places that your organization needs to communicate with to get the job done. 778 00:42:26,341 --> 00:42:30,961 Investigate all that stuff and then start investigating, locking things down, right? 779 00:42:31,261 --> 00:42:34,981 Turning off applications that aren't being used, turning off regions that are, that, 780 00:42:35,016 --> 00:42:36,961 that we have no reason communicating with. 781 00:42:37,471 --> 00:42:42,121 And, um, and, and consider application white listing, uh, you 782 00:42:42,121 --> 00:42:46,771 know, and, and no administrative privileges on machines, right? 783 00:42:46,771 --> 00:42:47,911 Unless, unless that. 784 00:42:48,206 --> 00:42:51,326 Person needs and I'll, I'll tell one final story about this. 785 00:42:51,326 --> 00:42:54,266 Going back a hundred years when I was consulting at a certain 786 00:42:54,716 --> 00:42:57,011 communication company and um. 787 00:42:58,486 --> 00:43:02,296 I, we had determined, or I had figured out that, that all their 788 00:43:02,446 --> 00:43:07,666 engineering team had, um, admin route on their Unix workstations. 789 00:43:08,236 --> 00:43:09,436 And I talked to the boss. 790 00:43:09,436 --> 00:43:11,806 I was like, there is no reason that they need route on 791 00:43:11,806 --> 00:43:13,306 their, on their workstations. 792 00:43:13,306 --> 00:43:17,451 And so I went around and I. I changed the root password. 793 00:43:17,811 --> 00:43:21,621 The, uh, each of them had a use, like, let's say the user ID was Curtis. 794 00:43:21,921 --> 00:43:25,581 There was a user ID called Curtis Zero that had a UID of zero, which was 795 00:43:25,581 --> 00:43:27,351 basically root and they had that password. 796 00:43:28,011 --> 00:43:31,521 And I went around and I removed that entry and I rebooted the machine, right? 797 00:43:32,181 --> 00:43:36,501 And, um, one of the guys was really, really angry and, um. 798 00:43:36,731 --> 00:43:39,071 He was like, well, you know when you reboot the machine, like the 799 00:43:39,071 --> 00:43:40,751 license manager doesn't come back up. 800 00:43:40,751 --> 00:43:45,161 And I go, well, if the license manager needs to come back up when you reboot the 801 00:43:45,161 --> 00:43:49,151 machine, why don't you just put it in the startup file so that it reboots or so it 802 00:43:49,151 --> 00:43:50,741 restarts when they reboot the machine. 803 00:43:50,741 --> 00:43:52,391 He says, I don't know how to do that. 804 00:43:52,601 --> 00:43:54,131 And that's her is why you don't have root. 805 00:43:56,726 --> 00:44:00,506 And I actually like your, your story about the, the Unix environment 806 00:44:00,506 --> 00:44:06,356 because, um, you could, you can take away people's and, and I and I, and I 807 00:44:06,356 --> 00:44:11,396 will also promote this, even if you're an admin, run your machine as admin, 808 00:44:12,241 --> 00:44:12,441 Right, 809 00:44:12,596 --> 00:44:17,876 machine as a normal user and then elect to run applications as admin. 810 00:44:17,966 --> 00:44:19,946 You just have to put your credentials in every time, 811 00:44:20,746 --> 00:44:20,836 right. 812 00:44:21,086 --> 00:44:21,596 save you. 813 00:44:21,946 --> 00:44:25,786 So similar to the Unix environment, you know, you, you, you run as a normal user 814 00:44:25,786 --> 00:44:31,006 and then you pseudo to, to route when you need to use, and that also creates a 815 00:44:31,006 --> 00:44:36,526 log, uh, an audit log of If everybody's using Curtis Zero, then no one, there's 816 00:44:36,526 --> 00:44:38,356 no accountability for who did what. 817 00:44:38,386 --> 00:44:39,646 It just says Curtis zero. 818 00:44:41,116 --> 00:44:42,796 That was actually my nickname in high school. 819 00:44:42,856 --> 00:44:43,606 Curtis Hero. 820 00:44:44,176 --> 00:44:44,326 Anyway. 821 00:44:44,716 --> 00:44:45,046 All right. 822 00:44:45,046 --> 00:44:46,696 Well, thank you very much, Mike. 823 00:44:46,786 --> 00:44:50,266 Uh, and everyone thank you persona again. 824 00:44:51,376 --> 00:44:52,576 No, this was good. 825 00:44:53,071 --> 00:44:53,281 Yeah. 826 00:44:53,521 --> 00:44:53,881 All right. 827 00:44:54,271 --> 00:44:55,441 That is a wrap.