1 00:00:00,567 --> 00:00:04,437 You found the backup wrap up your go-to podcast for all things 2 00:00:04,437 --> 00:00:06,897 backup recovery and cyber recovery. 3 00:00:07,557 --> 00:00:11,787 This episode, we continue our Mr. Robot series by breaking down advanced 4 00:00:11,787 --> 00:00:15,567 persistent threats, those sneaky attacks that stick around in your 5 00:00:15,567 --> 00:00:17,307 network way longer than they should. 6 00:00:17,817 --> 00:00:21,597 We're talking about how they get in, how they set up shop, operate 7 00:00:21,597 --> 00:00:23,817 undetected for weeks or even months. 8 00:00:24,207 --> 00:00:28,467 You'll learn about dwell time, why you need to monitor, uh, new devices, 9 00:00:28,977 --> 00:00:33,057 uh, also why the scan and restore approach to ransomware recovery is 10 00:00:33,357 --> 00:00:35,037 really kind of just asking for trouble. 11 00:00:35,667 --> 00:00:38,637 I hope you enjoy this episode on advanced persistent threats. 12 00:00:39,087 --> 00:00:43,347 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 13 00:00:43,407 --> 00:00:46,947 Backup, and I've been passionate about backup and recovery for 14 00:00:46,947 --> 00:00:48,987 over 30 years, ever since. 15 00:00:48,987 --> 00:00:51,987 I had to tell my boss that there were no backups of the 16 00:00:51,987 --> 00:00:53,362 production database we just lost. 17 00:00:53,697 --> 00:00:56,967 I don't want that to happen to you, and that's why I do this. 18 00:00:57,387 --> 00:01:01,977 On this podcast, we turn unappreciated admins into Cyber Recovery Heroes. 19 00:01:02,337 --> 00:01:04,317 This is the backup wrap up. 20 00:01:19,095 --> 00:01:20,025 Welcome to the show. 21 00:01:20,970 --> 00:01:25,440 Hi, I am w Curtis Preston, AKA, Mr. Backup, and I have with me a guy 22 00:01:25,440 --> 00:01:31,470 that I know is 100% super jealous of the shirt I'm wearing right now 23 00:01:32,625 --> 00:01:37,605 You know how many years I've been asking you to get merchandise? 24 00:01:37,605 --> 00:01:41,775 So for those of you who don't catch us on YouTube, we are on YouTube 25 00:01:41,775 --> 00:01:43,425 under the backup wrap up channel. 26 00:01:43,875 --> 00:01:47,025 And there today for, uh, today's 27 00:01:47,095 --> 00:01:47,495 first time. 28 00:01:47,655 --> 00:01:48,825 see, yeah, for the first 29 00:01:48,840 --> 00:01:49,230 Yeah. 30 00:01:49,485 --> 00:01:53,685 you could see the new shirts, which says the backup wrap up. 31 00:01:53,925 --> 00:01:54,165 It's a 32 00:01:54,390 --> 00:01:55,530 Um, yeah. 33 00:01:56,580 --> 00:01:57,120 Yeah. 34 00:01:57,180 --> 00:01:59,790 Um, and we're, and we're not even, we're not selling the merch or 35 00:01:59,790 --> 00:02:01,920 anything, at least not yet, but, um, 36 00:02:02,325 --> 00:02:02,535 If 37 00:02:02,580 --> 00:02:03,000 yeah, 38 00:02:03,195 --> 00:02:04,065 let us know. 39 00:02:04,435 --> 00:02:04,725 yeah. 40 00:02:04,845 --> 00:02:08,655 us or leave a comment on your favorite pod catcher and let us 41 00:02:08,790 --> 00:02:09,630 Absolutely. 42 00:02:09,750 --> 00:02:10,590 Absolutely. 43 00:02:11,160 --> 00:02:13,830 Um, yeah, so, um, 44 00:02:14,715 --> 00:02:15,045 Five 45 00:02:15,150 --> 00:02:17,310 so I finally, I finally ordered it What. 46 00:02:17,775 --> 00:02:18,795 Five years. 47 00:02:21,520 --> 00:02:23,745 So I finally received it and now I have it. 48 00:02:23,745 --> 00:02:25,665 It got, both of 'em got shipped to my house, 49 00:02:26,010 --> 00:02:26,130 Hmm. 50 00:02:26,505 --> 00:02:29,715 my shirt, and your tiny, your tiny little shirt. 51 00:02:30,975 --> 00:02:31,665 Medium. 52 00:02:31,665 --> 00:02:32,805 He says medium. 53 00:02:32,865 --> 00:02:34,515 I'm like, what is a medium? 54 00:02:34,845 --> 00:02:37,515 I don't even, I don't even know they made such sizes. 55 00:02:39,135 --> 00:02:45,135 Um, anyway, so, um, you'll look forward to receiving your shirt 56 00:02:45,135 --> 00:02:47,235 when I decide to grace it upon you. 57 00:02:48,105 --> 00:02:49,215 It's sitting in my bedroom. 58 00:02:49,995 --> 00:02:50,505 Um, 59 00:02:50,550 --> 00:02:50,760 that's 60 00:02:50,895 --> 00:02:51,315 oh, you're 61 00:02:51,480 --> 00:02:52,980 it's, whenever it's ready. 62 00:02:53,070 --> 00:02:53,880 It'd be amazing. 63 00:02:55,115 --> 00:02:55,145 Okay, 64 00:02:57,770 --> 00:02:58,910 so, so wait, 65 00:02:59,405 --> 00:02:59,795 what. 66 00:03:00,470 --> 00:03:02,900 I wanna know when do I get my shirt? 67 00:03:03,095 --> 00:03:07,415 When, when I decide to send it to you, it's, oh, by the way, it's right here. 68 00:03:08,975 --> 00:03:09,785 There's your shirt. 69 00:03:10,385 --> 00:03:14,405 There's your little, little tiny, the one with the with the M on it. 70 00:03:14,435 --> 00:03:15,215 There you go. 71 00:03:15,275 --> 00:03:16,100 There's your M. 72 00:03:16,385 --> 00:03:17,030 You know, if you 73 00:03:17,170 --> 00:03:17,460 Yeah. 74 00:03:17,780 --> 00:03:19,085 if you look at it upside down, it's a w. 75 00:03:19,920 --> 00:03:20,210 Yeah. 76 00:03:20,270 --> 00:03:22,445 For women's, that's, uh. 77 00:03:24,980 --> 00:03:25,880 So there you go. 78 00:03:26,030 --> 00:03:30,770 Uh, that's the big day Today we finally have a, a branded shirt where 79 00:03:30,770 --> 00:03:32,180 it's like, we're like a real podcast. 80 00:03:34,385 --> 00:03:38,315 Um, so hey, we are gonna get right into it today. 81 00:03:38,375 --> 00:03:42,185 Um, and we're gonna talk about, I, I I, a topic that comes up quite a bit. 82 00:03:42,515 --> 00:03:48,665 We're continuing our coverage of Mr. Robot, which I'm now one episode 83 00:03:48,665 --> 00:03:53,345 in the future and I now know why Mr. Robot is called Mr. Robot 84 00:03:53,670 --> 00:03:53,950 tell me. 85 00:03:54,110 --> 00:03:54,510 I have not 86 00:03:54,515 --> 00:03:54,905 Y. 87 00:03:54,950 --> 00:03:55,150 yet. 88 00:03:55,235 --> 00:03:55,865 Yeah. 89 00:03:55,895 --> 00:03:58,355 So, um, yeah. 90 00:03:58,775 --> 00:04:00,875 Um, and. 91 00:04:01,715 --> 00:04:06,395 This episode, which as you may recall, uh, we we're, we're doing two episodes, 92 00:04:06,515 --> 00:04:09,035 do two podcast episodes on one Mr. 93 00:04:09,035 --> 00:04:09,875 Robot episode. 94 00:04:10,415 --> 00:04:13,775 Uh, last week we talked about the concept of honeypots, and this week 95 00:04:13,775 --> 00:04:18,395 we're talking about, um, the, the cyber attack that happens on All Safe. 96 00:04:18,395 --> 00:04:18,695 So if. 97 00:04:18,895 --> 00:04:21,095 technically we're doing two episodes on two episodes. 98 00:04:22,250 --> 00:04:23,510 Yeah, you're right, you're right. 99 00:04:23,510 --> 00:04:24,380 That's kind of why we did it. 100 00:04:24,410 --> 00:04:26,240 'cause the one episode had hardly anything in it. 101 00:04:26,240 --> 00:04:26,510 Right? 102 00:04:26,510 --> 00:04:26,870 Yeah. 103 00:04:27,920 --> 00:04:32,990 So, um, but one of the things that happens in these two episodes, which 104 00:04:32,990 --> 00:04:41,420 were episodes seven and eight, AKA 1.6, and 1.7, um, that, uh, in the episode, 105 00:04:41,520 --> 00:04:44,850 the main episode that we're talking about in this episode is White Rose, 106 00:04:45,390 --> 00:04:49,170 which we, we are actually introduced to the character of White Rose. 107 00:04:49,500 --> 00:04:54,500 But in the midst of all of this, there is a cyber attack of Allsafe. 108 00:04:54,500 --> 00:04:58,340 And it was, it was really kind of, it was kind of cool how it all went down. 109 00:04:58,490 --> 00:05:03,170 So, uh, Gideon is over there visiting Tyrell and he's telling them about all 110 00:05:03,170 --> 00:05:06,200 the stuff that they've done to, um. 111 00:05:07,040 --> 00:05:11,270 To regarding basically the initial hack that caused the, 112 00:05:11,270 --> 00:05:12,740 the email leak and all of that. 113 00:05:13,250 --> 00:05:18,560 Uh, and, and in the midst of that, his phone starts blowing up with, uh, 9 1 1. 114 00:05:18,950 --> 00:05:19,970 Everything is down. 115 00:05:20,010 --> 00:05:20,230 Yep. 116 00:05:20,300 --> 00:05:24,290 So all you know, we, we, at that point, you know, anybody who follows the 117 00:05:24,290 --> 00:05:25,850 show would know that they got hacked. 118 00:05:26,015 --> 00:05:26,315 yeah, 119 00:05:26,420 --> 00:05:26,960 Um, 120 00:05:27,035 --> 00:05:28,655 and Elliot gets paged as well. 121 00:05:28,715 --> 00:05:29,590 I don't know if you caught that. 122 00:05:29,690 --> 00:05:31,700 yeah, yeah, Elliot gets Paige as well. 123 00:05:31,760 --> 00:05:35,330 Uh, but the thing that I liked about the scene with Gideon and, and, um. 124 00:05:35,810 --> 00:05:42,440 And Tyrell is, uh, Gideon gets, you know, um, you know, e everything's down. 125 00:05:42,560 --> 00:05:46,580 And then Tyrell's next line was, well, I really appreciate your transparency. 126 00:05:48,710 --> 00:05:49,730 Yeah, 127 00:05:49,790 --> 00:05:52,850 which of course he is not being transparent at that exact moment. 128 00:05:53,240 --> 00:05:58,310 And he goes back and his first response is, um, basically 129 00:05:58,310 --> 00:05:59,960 we've got to figure this out. 130 00:06:00,350 --> 00:06:02,510 If this gets out, we're toast. 131 00:06:02,930 --> 00:06:03,410 Right? 132 00:06:04,070 --> 00:06:04,610 sorry. 133 00:06:04,700 --> 00:06:05,690 Clarification. 134 00:06:06,890 --> 00:06:13,370 I thought he goes and tells Tyrell that he, the DAT file was compromised. 135 00:06:13,790 --> 00:06:15,140 That, but that's separate. 136 00:06:15,140 --> 00:06:17,165 That's referring to the original hack. 137 00:06:19,235 --> 00:06:19,715 That's right. 138 00:06:19,715 --> 00:06:25,655 And then doesn't he also tell him not that they've been attacked 139 00:06:25,655 --> 00:06:27,545 because they don't know that yet? 140 00:06:27,845 --> 00:06:33,695 I thought he tells 'em think that we found something left behind. 141 00:06:35,540 --> 00:06:40,460 He said he, he said that he's gonna continue to like look into that hack. 142 00:06:40,460 --> 00:06:40,750 Okay. 143 00:06:40,850 --> 00:06:41,360 Right? 144 00:06:41,390 --> 00:06:45,260 Um, and, and we've got the, we, we, we put the honeypot and all of that. 145 00:06:45,500 --> 00:06:46,790 That's what that was about. 146 00:06:47,060 --> 00:06:51,020 But then what we have is, while this is happening, he finds out 147 00:06:51,020 --> 00:06:52,340 essentially that they've been hacked. 148 00:06:52,640 --> 00:06:55,760 And his first reaction is not transparency, 149 00:06:55,835 --> 00:06:56,055 Yep. 150 00:06:56,090 --> 00:06:58,100 his first reaction, he gets back and he's like. 151 00:06:58,490 --> 00:06:59,630 We gotta figure this out. 152 00:06:59,720 --> 00:07:02,300 Uh, you know, gimme all the logs and everything and, and, and 153 00:07:02,300 --> 00:07:03,830 if this gets out, we're toast. 154 00:07:03,890 --> 00:07:04,250 yep. 155 00:07:04,940 --> 00:07:06,390 um, uh, which. 156 00:07:06,500 --> 00:07:08,000 the accounts, all the sales calls, 157 00:07:08,240 --> 00:07:08,450 Yeah. 158 00:07:08,450 --> 00:07:13,160 That cancel all the sales calls you, you know, no one's gonna figure out anything. 159 00:07:13,610 --> 00:07:20,120 Uh, and, and that of course, uh, backfires because f Society who caused the attack, 160 00:07:20,720 --> 00:07:25,005 um, they take over their, uh, again, with the, the hat we've talked about it. 161 00:07:25,385 --> 00:07:27,605 You know, before the hack of the, of the tv. 162 00:07:27,965 --> 00:07:32,015 So they hack the TV and um, and they play the, you know, it's 163 00:07:32,015 --> 00:07:35,015 the, this is like, this is the, this is what it's in the movies. 164 00:07:35,015 --> 00:07:36,845 It's always in the movies where they do this, right. 165 00:07:37,355 --> 00:07:38,075 Where they take over the 166 00:07:38,155 --> 00:07:38,315 mask. 167 00:07:38,705 --> 00:07:40,655 TV and they play the message and the remote doesn't work. 168 00:07:40,685 --> 00:07:43,685 Ah, can't even the, even the electrical plug. 169 00:07:43,715 --> 00:07:44,015 Yeah. 170 00:07:44,915 --> 00:07:45,935 It's like, no, I wanna see it. 171 00:07:45,935 --> 00:07:52,805 And what you see, see is that basically f society, and again, this is, this is all. 172 00:07:53,735 --> 00:07:59,825 Whatever, but, but f Society's message to them is you have helped 173 00:07:59,825 --> 00:08:05,165 protect Evil Corp and therefore we are going to take you out as well. 174 00:08:05,165 --> 00:08:11,555 You are com complicit in Evil Corp's evilness and um, what? 175 00:08:11,600 --> 00:08:14,600 but the entire reason they did that though was it was a misdirection. 176 00:08:15,050 --> 00:08:16,190 Yes, yes. 177 00:08:16,280 --> 00:08:18,860 Again, but what they're being told is right. 178 00:08:18,860 --> 00:08:19,790 We're, we're gonna do this. 179 00:08:19,790 --> 00:08:20,150 Right. 180 00:08:20,330 --> 00:08:24,320 And, uh, and they also said that they even posted it to their website 181 00:08:24,470 --> 00:08:29,570 so, so much for, you know, not, uh, not letting the world know. 182 00:08:29,720 --> 00:08:30,110 Yep. 183 00:08:30,650 --> 00:08:31,310 but yeah. 184 00:08:31,460 --> 00:08:32,540 it was a misdirection. 185 00:08:32,540 --> 00:08:35,690 So Elliot can steal the MFA from Gideon 186 00:08:36,110 --> 00:08:36,590 Right. 187 00:08:36,770 --> 00:08:40,070 actually send an email telling them to shut down the honeypot and they have 188 00:08:40,130 --> 00:08:40,400 Yeah. 189 00:08:40,430 --> 00:08:40,730 hours. 190 00:08:41,135 --> 00:08:42,365 Yeah, exactly. 191 00:08:42,695 --> 00:08:50,075 Um, which is, um, did I miss anything in the summary, which is, um, let, 192 00:08:50,075 --> 00:08:52,160 that's relevant to this, to this 193 00:08:53,420 --> 00:08:56,205 well, the one thing you did miss. 194 00:08:57,130 --> 00:08:57,480 Uhhuh 195 00:08:57,665 --> 00:09:02,885 Is when, uh, told Terrell about, well there are two things. 196 00:09:03,125 --> 00:09:06,335 One, when Gideon told Tyrell about the dat file 197 00:09:06,460 --> 00:09:06,810 Uhhuh. 198 00:09:06,875 --> 00:09:07,295 and honey 199 00:09:07,310 --> 00:09:07,730 Mm-hmm. 200 00:09:08,165 --> 00:09:12,275 right, the first thing Tyrell did is he logged into the server, 201 00:09:12,905 --> 00:09:13,595 Right, right. 202 00:09:13,715 --> 00:09:14,165 right? 203 00:09:14,225 --> 00:09:14,435 And 204 00:09:14,615 --> 00:09:14,855 Yeah. 205 00:09:14,885 --> 00:09:17,255 he sort of was like, let me hunt ter around and see 206 00:09:17,255 --> 00:09:18,395 what I don't have access to. 207 00:09:18,395 --> 00:09:22,985 And he noticed an F Society file before he like has to leave all of a 208 00:09:22,985 --> 00:09:23,795 sudden because the police are there. 209 00:09:24,665 --> 00:09:25,535 Right, right. 210 00:09:25,925 --> 00:09:26,405 Because of 211 00:09:26,435 --> 00:09:26,765 one. 212 00:09:27,185 --> 00:09:27,365 the murder. 213 00:09:27,605 --> 00:09:28,145 Yeah. 214 00:09:29,975 --> 00:09:30,275 Yeah. 215 00:09:30,515 --> 00:09:36,065 So the thing that happened to Ollie was they weren't letting go of him. 216 00:09:36,095 --> 00:09:36,665 Remember? 217 00:09:36,665 --> 00:09:39,935 And they still had access to the networks. 218 00:09:40,775 --> 00:09:41,195 Right. 219 00:09:41,225 --> 00:09:41,555 And 220 00:09:41,670 --> 00:09:41,960 Yeah. 221 00:09:42,095 --> 00:09:44,615 where they wanted, 222 00:09:44,840 --> 00:09:45,220 in this 223 00:09:45,275 --> 00:09:45,635 sorry. 224 00:09:46,115 --> 00:09:47,735 They as a dark army and 225 00:09:47,830 --> 00:09:49,100 Right, right, 226 00:09:50,135 --> 00:09:50,735 Elliot. 227 00:09:51,350 --> 00:09:53,840 To have this meeting with White Rose, which is what 228 00:09:53,840 --> 00:09:55,130 Darlene was trying to arrange. 229 00:09:55,460 --> 00:09:55,810 right. 230 00:09:55,850 --> 00:09:56,210 Right? 231 00:09:56,300 --> 00:10:01,130 And they literally still had access to the networks because remember Angela 232 00:10:01,130 --> 00:10:06,260 had put the CD in the computer and had put the virus out there and they still 233 00:10:06,260 --> 00:10:11,710 had access to the network and they were doing things, and this is where Ollie. 234 00:10:12,035 --> 00:10:15,605 Comes up to Elliot in the middle of this attack, by the way, 235 00:10:16,160 --> 00:10:16,670 Yeah. 236 00:10:16,955 --> 00:10:17,585 is freaking out. 237 00:10:17,585 --> 00:10:18,935 Everyone's in the room, 238 00:10:19,220 --> 00:10:19,580 Right. 239 00:10:20,195 --> 00:10:22,745 Everyone is like panicking and trying to figure out what's 240 00:10:22,745 --> 00:10:24,695 going on and all hands on deck. 241 00:10:24,935 --> 00:10:29,315 Elliot sits down at his desk, He's like, okay, let me start doing some research. 242 00:10:29,315 --> 00:10:32,765 And then all, he just kind of strolls up and he's like the sales guy, right? 243 00:10:32,765 --> 00:10:35,885 And he is like, yo, bro, I got two hard drives for you. 244 00:10:36,155 --> 00:10:38,825 Take it over to the recovery place or the shredding place. 245 00:10:40,250 --> 00:10:42,920 Yeah, and he's like, what about one of the IT guys, gophers? 246 00:10:42,920 --> 00:10:44,870 He is like, no, man, it has to be you. 247 00:10:45,590 --> 00:10:50,300 Elliot thinks, and he is like, oh, this is why Dark Army wanted me 248 00:10:50,420 --> 00:10:51,350 Yeah, yeah, 249 00:10:51,620 --> 00:10:57,650 all of this was because the Dark Army still had a foothold inside of allsafe. 250 00:10:58,160 --> 00:10:58,970 Right, right. 251 00:10:59,300 --> 00:10:59,660 Yeah. 252 00:11:00,200 --> 00:11:00,650 So, yeah. 253 00:11:00,650 --> 00:11:03,890 So those, those were, uh, two, uh, kind of important things that 254 00:11:03,890 --> 00:11:05,150 are relevant to the topic here. 255 00:11:05,150 --> 00:11:09,350 So this week we're gonna talk about, uh, I think the formal term would be 256 00:11:09,350 --> 00:11:10,310 called advanced persistent threat. 257 00:11:11,330 --> 00:11:11,690 Right. 258 00:11:11,920 --> 00:11:12,210 Yeah. 259 00:11:12,320 --> 00:11:18,080 And this idea of you've got a threat actor that is, that has, as you mentioned, 260 00:11:18,080 --> 00:11:22,670 a foothold that has, you know, they've used maybe an initial access broker. 261 00:11:22,670 --> 00:11:27,800 Maybe they, you know, somehow they are in the network and they're, they are 262 00:11:27,800 --> 00:11:30,710 operating undetected in the network. 263 00:11:31,160 --> 00:11:34,430 And, um, because they're able to do that. 264 00:11:34,835 --> 00:11:39,245 They're able to, you know, to do a, a lot of things, right? 265 00:11:39,245 --> 00:11:42,485 So in this case, what we see is they, they're, they're able to 266 00:11:42,485 --> 00:11:44,015 control one of the employees. 267 00:11:44,345 --> 00:11:47,495 They're able to control sort of a second employee in the 268 00:11:47,495 --> 00:11:49,325 case of, uh, Elliot, right? 269 00:11:49,385 --> 00:11:49,715 Mm-hmm. 270 00:11:49,745 --> 00:11:53,375 Um, and then also you've got two sort of. 271 00:11:54,125 --> 00:11:58,715 Um, two persistent threats going on because, uh, because they have 272 00:11:58,715 --> 00:12:02,855 the, the connection and all safe, they're also able to, to facilitate 273 00:12:02,855 --> 00:12:04,595 this, the, what do you call it? 274 00:12:04,595 --> 00:12:09,305 Um, f society is able to do this hack whose entire purpose was 275 00:12:09,305 --> 00:12:10,565 redirection, as you mentioned. 276 00:12:10,565 --> 00:12:10,925 Right. 277 00:12:11,255 --> 00:12:15,905 Um, because we want to be able to do this, this thing with the phone and, um. 278 00:12:16,440 --> 00:12:21,330 So that he could get in and, and, uh, get that, get that M-F-A-M-F-A. 279 00:12:21,450 --> 00:12:26,700 Again, as we've discussed, m FFA is not perfect if you let your battery run down. 280 00:12:26,700 --> 00:12:31,080 I like how he run the, he ran the battery down, uh, by the way, 281 00:12:31,080 --> 00:12:34,440 um, story from back in the day. 282 00:12:35,040 --> 00:12:39,930 Um, so this is in my very first job and I, I don't know if I've told you 283 00:12:39,930 --> 00:12:45,390 this story before, but my very first job we used to have, we were at a. 284 00:12:46,475 --> 00:12:48,935 We were, it was a, a DEC shop, right? 285 00:12:48,935 --> 00:12:54,095 It was, it was, it was, uh, Ultrix, which was the, the DEC, this 286 00:12:54,095 --> 00:12:55,805 is before digital Unix, right? 287 00:12:55,805 --> 00:13:01,745 This was Ultrix and we had, our servers were Ultrix and uh, 288 00:13:01,745 --> 00:13:04,355 and our desktops were Ultrix. 289 00:13:04,655 --> 00:13:05,915 Important part of the story. 290 00:13:05,945 --> 00:13:08,305 Both the servers and the desktops were Ultrix. 291 00:13:08,495 --> 00:13:09,675 And one of the things that. 292 00:13:10,535 --> 00:13:12,365 We would do back in the day. 293 00:13:12,695 --> 00:13:17,285 Um, gosh, I don't, I don't, I don't think this lasted, but if you wanted 294 00:13:17,285 --> 00:13:25,655 to run a, um, an application on. 295 00:13:26,810 --> 00:13:32,030 The server and have the UI of that application display 296 00:13:32,030 --> 00:13:34,760 its UI onto your server. 297 00:13:35,000 --> 00:13:35,300 X 298 00:13:35,390 --> 00:13:39,440 had to run this command right to, to allow that to happen. 299 00:13:40,340 --> 00:13:45,770 And it was common in our environment to just run that, that command as 300 00:13:45,770 --> 00:13:50,060 part of like your login, like, like you always ran that because you 301 00:13:50,060 --> 00:13:52,250 always wanted to, um, to do that. 302 00:13:53,330 --> 00:13:54,920 That left you open. 303 00:13:55,625 --> 00:13:57,515 For anyone to open up 304 00:13:57,620 --> 00:13:57,980 Yep. 305 00:13:57,995 --> 00:13:59,165 X display 306 00:13:59,180 --> 00:13:59,570 yep. 307 00:13:59,585 --> 00:14:01,265 thing on your, on your desktop. 308 00:14:02,225 --> 00:14:08,135 And, uh, there was a program called Stars 309 00:14:08,390 --> 00:14:08,810 Hmm. 310 00:14:08,885 --> 00:14:10,805 it was a, uh, it was a screensaver 311 00:14:10,970 --> 00:14:11,270 Okay. 312 00:14:11,270 --> 00:14:11,420 Yeah. 313 00:14:11,420 --> 00:14:11,630 Yeah. 314 00:14:12,755 --> 00:14:18,455 and if you wanted to crash someone's server, you would just 315 00:14:18,455 --> 00:14:23,435 run a quick for loop and fire off stars like a thousand times. 316 00:14:24,170 --> 00:14:24,590 Right. 317 00:14:25,490 --> 00:14:33,860 And um, one day, you know, one of the guys in the shop was gonna 318 00:14:33,860 --> 00:14:35,990 do that to one of the other guys. 319 00:14:36,890 --> 00:14:39,860 And so he just did it, is like in the middle of the workday, 320 00:14:39,860 --> 00:14:42,590 you know, and, uh, he said, boom. 321 00:14:42,710 --> 00:14:46,160 And you set your display to that workstation and then you fire it off. 322 00:14:47,000 --> 00:14:49,640 And, um, he did that. 323 00:14:49,910 --> 00:14:51,500 And then we're waiting for the reaction. 324 00:14:52,775 --> 00:14:53,555 No reaction. 325 00:14:55,055 --> 00:15:01,625 And then, and then, uh, this guy is like, Hey Joe, how's your workstation? 326 00:15:02,555 --> 00:15:04,925 And Joe's like, it's fine. 327 00:15:05,195 --> 00:15:07,355 Why pregnant? 328 00:15:07,355 --> 00:15:07,775 Pause. 329 00:15:08,375 --> 00:15:09,095 Oh shit. 330 00:15:11,135 --> 00:15:13,235 And he had his display set to the server, 331 00:15:13,790 --> 00:15:15,020 Oh no. 332 00:15:15,695 --> 00:15:18,695 so he had just crashed a production server in the middle of the 333 00:15:18,695 --> 00:15:20,165 workday as a practical joke. 334 00:15:21,410 --> 00:15:22,640 Career ending move. 335 00:15:23,465 --> 00:15:25,445 Uh, no, no. 336 00:15:25,655 --> 00:15:29,975 That guy had, that guy was like a, like a nine lives of a cat. 337 00:15:30,575 --> 00:15:33,905 'cause he definitely did some, some serious CLMs. 338 00:15:34,445 --> 00:15:35,945 Um, yeah. 339 00:15:36,230 --> 00:15:36,590 so 340 00:15:36,725 --> 00:15:38,495 It, yeah. 341 00:15:38,555 --> 00:15:38,945 Go ahead. 342 00:15:39,050 --> 00:15:39,860 back, back to the, 343 00:15:39,935 --> 00:15:41,495 Back, back to the scope. 344 00:15:41,765 --> 00:15:42,245 Yeah. 345 00:15:42,800 --> 00:15:51,680 one thing about, about this entire like F Society hack on Evil Core, 346 00:15:52,130 --> 00:15:52,370 Mm-hmm. 347 00:15:53,465 --> 00:15:54,275 Elliot goes, right. 348 00:15:54,275 --> 00:15:56,615 He flies in the data center, right in the earlier episodes. 349 00:15:56,615 --> 00:15:57,125 He fixes it. 350 00:15:57,125 --> 00:15:57,875 He gets everything back. 351 00:15:59,195 --> 00:16:02,015 They never follow the best practices when it comes to 352 00:16:02,015 --> 00:16:04,685 recovering from ransomware, right? 353 00:16:04,945 --> 00:16:05,185 Right. 354 00:16:05,195 --> 00:16:05,645 they do? 355 00:16:05,675 --> 00:16:08,135 They just scanned the server and they're like, yeah, it's good to go. 356 00:16:08,135 --> 00:16:08,375 Let's 357 00:16:08,570 --> 00:16:08,660 Yeah. 358 00:16:08,660 --> 00:16:09,320 It looks good. 359 00:16:09,410 --> 00:16:09,800 Yeah. 360 00:16:09,980 --> 00:16:10,370 Yeah. 361 00:16:10,565 --> 00:16:12,545 They didn't quarantine it really, 362 00:16:13,310 --> 00:16:13,700 Right, 363 00:16:13,775 --> 00:16:15,455 for like the 30 seconds, whatever. 364 00:16:15,455 --> 00:16:15,665 When 365 00:16:15,920 --> 00:16:16,220 right. 366 00:16:17,045 --> 00:16:18,425 they didn't rebuild it. 367 00:16:18,875 --> 00:16:19,235 Yeah. 368 00:16:19,355 --> 00:16:20,765 still left it in production. 369 00:16:21,005 --> 00:16:21,215 It was 370 00:16:21,425 --> 00:16:21,725 Right. 371 00:16:21,815 --> 00:16:22,385 available. 372 00:16:22,775 --> 00:16:23,165 Yeah. 373 00:16:23,345 --> 00:16:23,675 Yeah. 374 00:16:24,635 --> 00:16:31,265 And, and the thing is, with with, you know, when we talk about APTs, the 375 00:16:31,265 --> 00:16:35,045 thing to understand about this is the, the length of the dwell time, right? 376 00:16:35,045 --> 00:16:36,575 So you wanna define dwell time. 377 00:16:37,115 --> 00:16:42,125 Yeah, the dwell time is basically long ransomware sits on your 378 00:16:42,125 --> 00:16:45,485 system before it either starts running or it's been detected. 379 00:16:46,355 --> 00:16:46,745 Yeah. 380 00:16:47,375 --> 00:16:53,045 And um, you know, in this case it was there for quite a long time and, um. 381 00:16:53,930 --> 00:16:54,230 That's, yeah. 382 00:16:54,980 --> 00:16:55,370 Yeah. 383 00:16:55,550 --> 00:16:58,940 Well, and you had, you had a couple of different APTs going on here, right? 384 00:16:58,940 --> 00:17:02,390 You had the one going on at Ollie's home, 385 00:17:02,585 --> 00:17:02,885 Yep. 386 00:17:03,680 --> 00:17:06,140 Uh, and then you had the one going on in the Evil Corp 387 00:17:06,200 --> 00:17:07,640 network, by the way, isn't it? 388 00:17:07,640 --> 00:17:09,680 Evil Corp? I think you're saying Evil Corp 389 00:17:10,235 --> 00:17:10,745 Evil, evil 390 00:17:10,775 --> 00:17:11,900 or, okay. 391 00:17:11,915 --> 00:17:13,235 my, my P is very silent. 392 00:17:13,820 --> 00:17:14,210 Oh, so, 393 00:17:14,315 --> 00:17:14,705 Yeah. 394 00:17:15,680 --> 00:17:18,770 um, the, um, go ahead. 395 00:17:18,935 --> 00:17:19,595 missing one, 396 00:17:20,780 --> 00:17:21,590 What's the third one? 397 00:17:22,085 --> 00:17:22,685 the fourth, 398 00:17:24,050 --> 00:17:24,950 What the, what? 399 00:17:25,415 --> 00:17:26,255 there's a four. 400 00:17:27,695 --> 00:17:29,765 So what, so I just remembered two. 401 00:17:29,815 --> 00:17:31,100 There is a fourth one that you missed. 402 00:17:31,330 --> 00:17:32,740 Well wait, we didn't get to a third, 403 00:17:32,890 --> 00:17:33,190 Okay, 404 00:17:33,340 --> 00:17:33,430 it, 405 00:17:33,550 --> 00:17:37,750 first is Evil Corp. Hack by F Society. 406 00:17:38,140 --> 00:17:38,500 yeah, 407 00:17:38,590 --> 00:17:41,980 The second is Ollie's laptop at home. 408 00:17:42,250 --> 00:17:42,700 yeah. 409 00:17:43,180 --> 00:17:48,935 The third is, uh, dark Armies Hack on All Safes Network, right? 410 00:17:49,335 --> 00:17:49,685 Right. 411 00:17:51,280 --> 00:17:54,130 Technically the fourth is FSO Society, but I don't think it's 412 00:17:54,130 --> 00:17:56,470 really a persistent threat 'cause that was like a one time hack. 413 00:17:57,065 --> 00:17:57,355 Okay. 414 00:17:58,000 --> 00:17:58,390 Right. 415 00:17:58,660 --> 00:18:02,890 But I would say that the actual fourth one, and this is one that was very subtle, 416 00:18:02,890 --> 00:18:08,290 you may not have picked up on Elliot Hack on Steel Mountain of the thermostats. 417 00:18:08,920 --> 00:18:10,000 Oh, right. 418 00:18:10,120 --> 00:18:10,630 Yeah. 419 00:18:10,960 --> 00:18:11,440 Right. 420 00:18:11,440 --> 00:18:13,300 That was definitely an a PT right there. 421 00:18:13,300 --> 00:18:13,720 Right. 422 00:18:14,320 --> 00:18:16,540 Um, he had a foothold in there. 423 00:18:16,570 --> 00:18:16,870 Yep. 424 00:18:17,170 --> 00:18:22,270 So, you know, you go back a few episodes and we talked about their plan with, 425 00:18:22,300 --> 00:18:25,840 um, steel Mountain was to hack the. 426 00:18:26,635 --> 00:18:31,825 The, uh, climate control system and then set off, uh, the, you know, basically 427 00:18:31,825 --> 00:18:36,115 make it too hot in the, the data center for tapes and have the tapes melt. 428 00:18:36,535 --> 00:18:39,805 We discussed that that was kind of bs, but that was the plan. 429 00:18:39,805 --> 00:18:41,005 And their plan succeeded. 430 00:18:41,005 --> 00:18:45,235 They, they had gained, they, they, you know, they put a raspberry pie in the 431 00:18:45,235 --> 00:18:49,645 right place, which of course, everyone knows where your, uh, climate control 432 00:18:49,645 --> 00:18:52,645 system controls are, are in the executive. 433 00:18:52,865 --> 00:18:53,375 Washroom. 434 00:18:53,675 --> 00:18:54,485 Everybody knows that. 435 00:18:54,505 --> 00:18:54,775 Yeah, 436 00:18:54,905 --> 00:18:57,665 Um, and that's, that's where they put it. 437 00:18:58,235 --> 00:19:01,715 Um, and yeah. 438 00:19:01,715 --> 00:19:06,725 And so they, they had this, this problem sitting there ready to go 439 00:19:06,725 --> 00:19:08,195 anytime that they needed to do it. 440 00:19:08,255 --> 00:19:08,345 Yeah. 441 00:19:08,750 --> 00:19:09,100 Right. 442 00:19:09,145 --> 00:19:13,435 and, but then did you remember also during that episode, because remember by 443 00:19:13,435 --> 00:19:15,355 this time the Dark Army had an attack. 444 00:19:15,355 --> 00:19:17,515 They weren't able to raise a temperature on the data center and 445 00:19:17,515 --> 00:19:19,555 burn the tapes, right, ruin the tapes. 446 00:19:20,905 --> 00:19:24,715 But what they did have is they had that device and still connected 447 00:19:25,045 --> 00:19:25,315 Yep. 448 00:19:25,465 --> 00:19:30,415 and they realized that the company that manufactures that thermostat 449 00:19:30,745 --> 00:19:32,905 has networked is has a cloud, 450 00:19:33,570 --> 00:19:33,920 Right, 451 00:19:34,045 --> 00:19:36,855 and they're using this exact same thermostat at all the 452 00:19:36,855 --> 00:19:37,905 other steel mounted facilities. 453 00:19:39,015 --> 00:19:39,435 right. 454 00:19:40,245 --> 00:19:43,915 And so do they, do they end up controlling all of the thermostats or. 455 00:19:44,040 --> 00:19:45,450 they have done nothing yet. 456 00:19:45,900 --> 00:19:46,230 Okay. 457 00:19:46,230 --> 00:19:47,940 So they just know that Yeah. 458 00:19:48,210 --> 00:19:53,460 And this is why Elliot asks and meets White Rose and says, Hey, need time. 459 00:19:53,460 --> 00:19:55,410 I, or I need you guys to act now. 460 00:19:56,160 --> 00:19:56,550 Right. 461 00:19:56,550 --> 00:19:57,060 And this is 462 00:19:57,120 --> 00:19:57,450 Right. 463 00:19:57,570 --> 00:20:01,380 Rose tells him, I will give you 43 hours or 464 00:20:01,500 --> 00:20:01,770 Yeah. 465 00:20:01,770 --> 00:20:02,910 Some, some very, 466 00:20:02,910 --> 00:20:03,180 think it was 467 00:20:03,240 --> 00:20:04,710 some very precise time. 468 00:20:04,710 --> 00:20:05,040 Yeah. 469 00:20:05,220 --> 00:20:05,610 Yeah. 470 00:20:06,120 --> 00:20:09,540 And so that's why Elliot's in this rush trying to get like turn 471 00:20:09,540 --> 00:20:11,040 off the honey pot so then they 472 00:20:11,040 --> 00:20:11,430 Right. 473 00:20:11,550 --> 00:20:17,910 go do the rest of the hack and hopefully try to destroy Steel Mountain and 474 00:20:17,940 --> 00:20:18,300 Yeah. 475 00:20:18,630 --> 00:20:20,160 Army attack the China data center. 476 00:20:20,820 --> 00:20:21,060 Yeah. 477 00:20:21,060 --> 00:20:25,530 And we can play with the, the thing of the honeypot and how that, the way 478 00:20:25,530 --> 00:20:29,820 he described how the honeypot is that if the honeypot is what it says it is, 479 00:20:30,510 --> 00:20:33,480 that they, they wouldn't be detected because it's not on the network. 480 00:20:33,480 --> 00:20:34,080 But anyway, I, 481 00:20:34,530 --> 00:20:34,800 Yeah. 482 00:20:35,010 --> 00:20:35,940 you know, yeah. 483 00:20:36,000 --> 00:20:39,570 the fact, and even the fact that like right? 484 00:20:39,660 --> 00:20:40,380 That's in the thing. 485 00:20:40,620 --> 00:20:40,740 The 486 00:20:40,860 --> 00:20:41,190 Mm-hmm. 487 00:20:41,220 --> 00:20:45,450 it's been days, no one's recogni, like you scan the network, right? 488 00:20:45,450 --> 00:20:48,090 No one's realized, Hey, what is this thing that's on 489 00:20:48,195 --> 00:20:48,615 Yeah. 490 00:20:48,975 --> 00:20:49,425 Yeah. 491 00:20:50,475 --> 00:20:50,865 Yeah. 492 00:20:51,375 --> 00:20:55,305 And, and that's, and that's kind of what we need to talk about a little bit is 493 00:20:55,635 --> 00:20:58,155 there are ways to detect APTs, right? 494 00:20:58,215 --> 00:21:00,825 You're looking for, and I think. 495 00:21:02,955 --> 00:21:04,815 There's, there's two things, right? 496 00:21:04,815 --> 00:21:05,775 There's a couple of things. 497 00:21:05,835 --> 00:21:10,995 One is you are looking for devices that have IP addresses on your network 498 00:21:10,995 --> 00:21:14,235 that they didn't, so how do you, you know, that they're not supposed to 499 00:21:14,235 --> 00:21:15,585 have, or that, that, that they're new. 500 00:21:15,915 --> 00:21:18,945 Every new IP address on your network should be registered 501 00:21:18,945 --> 00:21:20,925 and should be known, right? 502 00:21:20,955 --> 00:21:24,915 Uh, both from a wireless perspective and a and a wired perspective. 503 00:21:24,915 --> 00:21:28,005 And certainly anything if you, if you have wireless, if you have. 504 00:21:28,575 --> 00:21:32,235 Unregistered, like guest wireless access, that's one thing, right? 505 00:21:32,235 --> 00:21:35,445 And they have access just to the internet, but not to the corporate network. 506 00:21:36,075 --> 00:21:40,185 You could probably allow unregistered devices there, but if you're allowing 507 00:21:40,185 --> 00:21:46,785 a device to gain a IP address on your corporate network and you don't know 508 00:21:46,785 --> 00:21:48,705 what this device is, this is a problem. 509 00:21:48,885 --> 00:21:50,325 Yeah, and just a slight correction. 510 00:21:50,325 --> 00:21:53,445 You're probably referring to a Mac address, at least at the minimum. 511 00:21:53,865 --> 00:21:55,220 You had said IP address of 512 00:21:55,395 --> 00:21:57,255 What's, why is that a problem? 513 00:21:58,980 --> 00:22:02,730 Because anyone can have an ip, sorry, the MAC address is what they would 514 00:22:02,730 --> 00:22:06,060 typically use to register against the network to then get the IP address. 515 00:22:06,600 --> 00:22:07,395 Uh, yeah. 516 00:22:07,425 --> 00:22:07,755 Okay. 517 00:22:07,755 --> 00:22:09,075 I, you know, you're, 518 00:22:09,270 --> 00:22:10,740 authentication mechanisms like 519 00:22:10,935 --> 00:22:11,355 yeah, 520 00:22:11,400 --> 00:22:11,790 other things 521 00:22:11,805 --> 00:22:12,555 but I'm just saying 522 00:22:12,600 --> 00:22:13,020 secure. 523 00:22:13,160 --> 00:22:17,235 a, a new device was given an IP address, right? 524 00:22:17,325 --> 00:22:20,745 A New Mac address to, you know, to use, to use your, um, 525 00:22:21,030 --> 00:22:21,600 Well, a device 526 00:22:21,645 --> 00:22:21,745 to know. 527 00:22:21,780 --> 00:22:24,120 a nuke Mac address was given an IP address and the 528 00:22:24,180 --> 00:22:24,630 Okay. 529 00:22:24,695 --> 00:22:24,775 not. 530 00:22:24,775 --> 00:22:24,895 No. 531 00:22:24,900 --> 00:22:25,290 Yeah. 532 00:22:25,290 --> 00:22:25,590 Okay. 533 00:22:25,620 --> 00:22:25,980 Okay. 534 00:22:26,790 --> 00:22:27,150 Okay. 535 00:22:27,150 --> 00:22:28,890 That, that's perfectly correct. 536 00:22:28,890 --> 00:22:29,220 Yeah. 537 00:22:29,430 --> 00:22:29,640 Yeah. 538 00:22:32,910 --> 00:22:33,840 Tomato potato. 539 00:22:34,140 --> 00:22:36,150 Um, so 540 00:22:36,330 --> 00:22:36,510 but 541 00:22:36,660 --> 00:22:40,830 but, but you've got a new device that got it, that's gi, but given an IP 542 00:22:40,830 --> 00:22:45,960 address on the network and no one seems to notice and it's there for how long? 543 00:22:47,520 --> 00:22:49,500 at least three days, 544 00:22:49,920 --> 00:22:50,400 Yeah. 545 00:22:50,880 --> 00:22:57,210 Yeah, I, I'd like to think that a new device, you know, if you're doing 546 00:22:57,210 --> 00:23:02,370 this properly, especially if you're at a place like Steel Mountain, no 547 00:23:02,370 --> 00:23:06,450 new device should be given an IP address, no New Mac address, right? 548 00:23:06,450 --> 00:23:12,480 Should be given a new IP address that isn't already known to the network. 549 00:23:12,630 --> 00:23:12,900 Right? 550 00:23:13,370 --> 00:23:13,860 exactly. 551 00:23:14,865 --> 00:23:17,145 Uh, now we know that that actually happens all the time. 552 00:23:17,145 --> 00:23:20,655 We actually did an episode a while back, I dunno if you remember this, 553 00:23:20,775 --> 00:23:26,835 but we did an episode a while back on like wireless hacking where people are 554 00:23:26,835 --> 00:23:33,075 creating devices that, that get sent to the network to be able to get on 555 00:23:33,075 --> 00:23:36,765 the wireless network to then be able to get onto the corporate network. 556 00:23:37,065 --> 00:23:38,385 Um, and, and. 557 00:23:38,420 --> 00:23:39,740 like what he did with the cop car. 558 00:23:41,085 --> 00:23:42,945 It is a little bit like what he did with the cup card. 559 00:23:43,005 --> 00:23:43,335 Yeah. 560 00:23:43,875 --> 00:23:48,345 Um, and, uh, and we know that that happens. 561 00:23:48,345 --> 00:23:53,745 We know that corporations all the time allow new devices to be registered 562 00:23:53,745 --> 00:23:58,635 on the network, get IP addresses and communicate with the network completely 563 00:23:58,635 --> 00:24:01,455 unmonitored, you know, completely unmonitored like you would think at, 564 00:24:01,455 --> 00:24:05,655 at a minimum you would if you do allow. 565 00:24:06,090 --> 00:24:11,550 An unregistered address, you know, you would then monitor that device like crazy. 566 00:24:11,610 --> 00:24:12,810 What is this device doing? 567 00:24:13,170 --> 00:24:13,620 Right? 568 00:24:13,680 --> 00:24:16,980 Oh, it's communicating to all my other facilities, you know, 569 00:24:17,085 --> 00:24:17,895 Yeah, that's probably not 570 00:24:17,910 --> 00:24:18,030 or 571 00:24:18,075 --> 00:24:18,405 idea. 572 00:24:18,900 --> 00:24:19,800 Yeah, or lock it down. 573 00:24:19,800 --> 00:24:20,310 Good point. 574 00:24:20,370 --> 00:24:20,730 Right? 575 00:24:20,820 --> 00:24:23,730 Lock it down so that it can only communicate with whatever. 576 00:24:23,730 --> 00:24:23,905 I don't know. 577 00:24:24,140 --> 00:24:24,300 internet. 578 00:24:25,350 --> 00:24:32,190 I mean, so, uh, the other thing that, again, this would help minimize. 579 00:24:33,150 --> 00:24:42,480 The blast radius of an a PT, and that is devices, servers should really only, you 580 00:24:42,480 --> 00:24:46,650 should also be following, um, the concept of least privilege for them as well. 581 00:24:46,680 --> 00:24:47,130 Mm-hmm. 582 00:24:47,850 --> 00:24:52,260 Smart devices like, uh, thermostat controlling the network or 583 00:24:52,260 --> 00:24:58,020 controlling your, your, um, cooling system should not be also be able 584 00:24:58,020 --> 00:25:00,180 to talk to servers, you know. 585 00:25:00,900 --> 00:25:01,320 what was it? 586 00:25:01,320 --> 00:25:03,300 Was it Home Depot or Albertson? 587 00:25:04,125 --> 00:25:04,815 Was Target. 588 00:25:05,310 --> 00:25:05,430 the 589 00:25:05,535 --> 00:25:05,955 target. 590 00:25:06,090 --> 00:25:06,960 attack, right. 591 00:25:07,455 --> 00:25:07,725 Yeah. 592 00:25:07,725 --> 00:25:07,735 Yeah, 593 00:25:08,160 --> 00:25:09,090 How did they get in? 594 00:25:09,465 --> 00:25:09,765 it was. 595 00:25:09,765 --> 00:25:10,095 Yeah. 596 00:25:10,140 --> 00:25:10,620 commercials. 597 00:25:11,085 --> 00:25:12,195 Yeah, yeah. 598 00:25:12,255 --> 00:25:13,455 So again, we know what happens. 599 00:25:13,740 --> 00:25:14,100 Yep. 600 00:25:15,315 --> 00:25:17,655 But how, but how do we, how do we stop this, right? 601 00:25:17,790 --> 00:25:18,030 Yeah. 602 00:25:18,225 --> 00:25:21,825 I would say one of the first things is to detect for new devices. 603 00:25:22,065 --> 00:25:26,595 That's the one to stop new, like this kind of attack. 604 00:25:26,865 --> 00:25:32,265 But many times the device that's doing the communicating is an existing device 605 00:25:32,265 --> 00:25:34,995 that's been, uh, compromise in some way. 606 00:25:35,390 --> 00:25:36,970 And so I think. 607 00:25:38,310 --> 00:25:44,730 The only way for that to work is either, either a human being that's really good at 608 00:25:44,730 --> 00:25:49,530 monitoring the different types of traffic or, you know, use of machine learning, 609 00:25:50,130 --> 00:25:55,650 um, to, to watch what is normal traffic, what are the servers and things that 610 00:25:55,650 --> 00:26:01,650 we normally talk to, and if suddenly a thermostat that controls the, you know. 611 00:26:03,270 --> 00:26:08,130 Whatever the Toronto facility is, suddenly talking to all the other thermostats, 612 00:26:09,270 --> 00:26:09,715 but but 613 00:26:09,780 --> 00:26:10,500 that's a problem. 614 00:26:10,680 --> 00:26:12,675 also remember, I think it was when we had. 615 00:26:13,905 --> 00:26:16,605 Mike, I wanna say it might have been an episode with Mike. 616 00:26:17,775 --> 00:26:21,945 are Mike Saylor, by the way, who is Curtis's co-author on 617 00:26:21,945 --> 00:26:23,475 the upcoming O'Reilly book, 618 00:26:24,295 --> 00:26:24,905 Very excited. 619 00:26:25,335 --> 00:26:25,755 Yes. 620 00:26:25,995 --> 00:26:28,575 Um, he'll add one more to the shelf behind you. 621 00:26:29,295 --> 00:26:30,285 Um, so. 622 00:26:31,620 --> 00:26:35,130 I think it was Mike who had mentioned like, people are now starting to 623 00:26:35,160 --> 00:26:38,160 exfiltrate, uh, exfiltrate data, 624 00:26:38,610 --> 00:26:38,940 Right, 625 00:26:39,000 --> 00:26:44,010 by communicating directly to another server, but by sending DNS packets 626 00:26:44,790 --> 00:26:45,060 right. 627 00:26:45,210 --> 00:26:46,260 doing lookups. 628 00:26:46,620 --> 00:26:50,340 So very, very small amounts of data and that's really, really hard to catch. 629 00:26:51,630 --> 00:26:51,960 Yeah. 630 00:26:52,560 --> 00:26:53,220 Well, it is. 631 00:26:53,220 --> 00:26:55,110 It is, and it's not right. 632 00:26:55,110 --> 00:26:55,710 So. 633 00:26:56,640 --> 00:27:01,470 The, the person that we had, uh, that talked about that talked about how 634 00:27:01,470 --> 00:27:06,540 that you actually can recognize, you can have, you can f first off you can. 635 00:27:06,990 --> 00:27:07,680 Yeah, you can. 636 00:27:07,860 --> 00:27:12,810 The, the, the domains that are used for these types of things for command and 637 00:27:12,810 --> 00:27:16,350 control, for, uh, you know, malware. 638 00:27:16,935 --> 00:27:18,255 They look really weird. 639 00:27:18,255 --> 00:27:19,335 They're not normal. 640 00:27:19,395 --> 00:27:23,295 Um, so again, I, I go back to machine learning. 641 00:27:23,445 --> 00:27:26,205 This is not a normal, uh, type request. 642 00:27:26,265 --> 00:27:26,685 Right? 643 00:27:27,015 --> 00:27:33,105 Um, he also talked about looking for communication to new domains, right? 644 00:27:33,195 --> 00:27:35,145 Um, things like that, right? 645 00:27:35,475 --> 00:27:38,775 Um, the, um, um, 646 00:27:38,905 --> 00:27:39,125 But 647 00:27:39,165 --> 00:27:39,495 but I. 648 00:27:39,605 --> 00:27:42,325 is really around like the active persistent threats, right? 649 00:27:42,325 --> 00:27:42,645 It's like. 650 00:27:43,110 --> 00:27:43,530 Yeah. 651 00:27:43,590 --> 00:27:44,280 Yeah. 652 00:27:44,280 --> 00:27:47,970 And really I think the, the thing that you've got to do is you, you just 653 00:27:47,970 --> 00:27:50,070 have to be monitoring your network. 654 00:27:50,310 --> 00:27:54,210 You've got to be looking for behaviors, looking for behavior anomalies. 655 00:27:54,630 --> 00:28:00,030 Uh, you do need an EDR system, uh, to, to watch for that sort of stuff. 656 00:28:00,270 --> 00:28:03,960 But again, as we discussed, I believe in last week's episode, the 657 00:28:03,960 --> 00:28:06,060 EDR is only helpful on the way in. 658 00:28:06,540 --> 00:28:06,600 Yeah. 659 00:28:06,675 --> 00:28:07,125 Right. 660 00:28:07,185 --> 00:28:12,495 Um, the, the, the EDR might, uh, that's, um, endpoint detection and response. 661 00:28:13,575 --> 00:28:19,965 It, depending on where it is, it might detect an a PT 662 00:28:20,010 --> 00:28:20,340 Yeah. 663 00:28:20,685 --> 00:28:22,785 that a PT tries to then, uh, 664 00:28:22,950 --> 00:28:23,220 Yeah. 665 00:28:23,235 --> 00:28:25,125 move outside where it currently is. 666 00:28:25,380 --> 00:28:28,500 it did in the case of Darlene trying to hack the police department, right? 667 00:28:29,160 --> 00:28:29,370 They 668 00:28:29,565 --> 00:28:29,835 Yeah. 669 00:28:30,120 --> 00:28:33,510 software run being like, Hey, you should not be loading this file. 670 00:28:34,250 --> 00:28:34,600 Right. 671 00:28:35,040 --> 00:28:35,160 Right. 672 00:28:35,870 --> 00:28:36,160 Yeah. 673 00:28:36,350 --> 00:28:36,640 Yeah. 674 00:28:36,900 --> 00:28:44,310 But I think the challenge, or one thing I wanted to mention with APTs is, right, 675 00:28:44,310 --> 00:28:51,030 if I look at the all, uh, the Evil Corp exercise right where they hacked 676 00:28:51,690 --> 00:28:53,460 and they still left things behind. 677 00:28:53,760 --> 00:28:58,050 The fact that they're not monitoring the network continually or looking 678 00:28:58,050 --> 00:28:59,520 for these sort of activities 679 00:28:59,730 --> 00:29:00,080 Right. 680 00:29:00,120 --> 00:29:02,460 a little scary because I think I was reading. 681 00:29:03,390 --> 00:29:07,170 Some statistics or some article about ransomware gangs, right? 682 00:29:07,170 --> 00:29:11,520 And it's not like they come in, they attack, they steal some data, 683 00:29:11,550 --> 00:29:15,120 they encrypt data, and then you pay them and then they go away, right? 684 00:29:15,150 --> 00:29:18,960 They might come back into your network again to extort you for more money. 685 00:29:19,480 --> 00:29:19,770 Yeah. 686 00:29:19,800 --> 00:29:21,060 sell that attack, right? 687 00:29:21,060 --> 00:29:27,600 Or that, uh, the initial attack to another ransomware group, right? 688 00:29:27,600 --> 00:29:27,990 So now 689 00:29:28,230 --> 00:29:28,520 Yeah. 690 00:29:28,860 --> 00:29:29,100 you. 691 00:29:29,100 --> 00:29:29,280 And 692 00:29:29,535 --> 00:29:29,775 Yeah. 693 00:29:30,765 --> 00:29:34,965 If you don't make sure that you've closed off all the gates, right, 694 00:29:34,965 --> 00:29:36,225 you're still leaving yourself open. 695 00:29:37,005 --> 00:29:37,335 Yeah. 696 00:29:37,485 --> 00:29:37,965 Agreed. 697 00:29:38,085 --> 00:29:38,505 Agreed. 698 00:29:39,165 --> 00:29:43,245 The episodes we've done with Mike have been enlightening because he really 699 00:29:43,245 --> 00:29:49,665 understands like what the recovery process looks like and how companies recover. 700 00:29:49,665 --> 00:29:54,075 And it's fascinating to see, a lot of times on TV it's like, 701 00:29:54,105 --> 00:29:56,895 oh, they got hit with ransomware, boom, they're back up and running. 702 00:29:56,895 --> 00:29:57,285 Or what? 703 00:29:57,285 --> 00:29:57,855 You imagine it's 704 00:29:57,940 --> 00:29:58,230 Yeah. 705 00:29:58,245 --> 00:29:59,145 it's a quick operation. 706 00:29:59,145 --> 00:30:01,155 But no, these could be weeks 707 00:30:01,650 --> 00:30:01,940 Yeah. 708 00:30:02,175 --> 00:30:04,575 before they really know what was impacted. 709 00:30:04,575 --> 00:30:07,185 And it takes time and people are careful. 710 00:30:07,995 --> 00:30:12,285 Yeah, the, the, the, um, containment and eradication phase 711 00:30:12,285 --> 00:30:14,145 is the single biggest phase. 712 00:30:14,385 --> 00:30:18,675 The actual restoring of servers is the easy part, assuming that you, 713 00:30:18,825 --> 00:30:20,445 you know, backed up all the things. 714 00:30:21,470 --> 00:30:25,490 Um, well, I think that can end our coverage of advanced persistent 715 00:30:25,490 --> 00:30:32,320 threats from, uh, season one, episode eight, AKA 1.7 of Mr. 716 00:30:32,320 --> 00:30:32,830 Robot. 717 00:30:33,400 --> 00:30:33,790 Thanks. 718 00:30:33,820 --> 00:30:35,110 Thanks again, Prasanna. 719 00:30:35,180 --> 00:30:38,960 No, this was a good episode and don't tell me what happens 'cause 720 00:30:38,960 --> 00:30:41,450 I want to see what Mr. Robot is. 721 00:30:41,875 --> 00:30:42,165 Okay. 722 00:30:43,390 --> 00:30:46,780 And, uh, with that, thanks to our listeners. 723 00:30:47,110 --> 00:30:48,010 That is a wrap. 724 00:30:51,687 --> 00:30:56,397 The backup wrap up is written, recorded and produced by me w Curtis Preston. 725 00:30:56,967 --> 00:31:01,767 If you need backup or Dr. Consulting content generation or expert witness 726 00:31:01,767 --> 00:31:04,317 work, check out backup central.com. 727 00:31:05,067 --> 00:31:08,187 You can also find links from my O'Reilly Books on the same website. 728 00:31:08,847 --> 00:31:12,927 Remember, this is an independent podcast and any opinions that you 729 00:31:12,927 --> 00:31:14,847 hear are those of the speaker. 730 00:31:14,912 --> 00:31:16,772 And not necessarily an employer. 731 00:31:17,672 --> 00:31:18,392 Thanks for listening. 732 00:31:32,547 --> 00:31:32,667 I.