1 00:00:00,049 --> 00:00:03,920 You found the backup wrap up your go-to podcast for all things 2 00:00:03,920 --> 00:00:06,320 backup recovery and cyber recovery. 3 00:00:06,770 --> 00:00:10,430 In this episode, we're gonna talk about the cybersecurity concept 4 00:00:10,430 --> 00:00:15,680 of a honeypot server through the lens of Mr. Robot episode or season 5 00:00:15,680 --> 00:00:17,180 one, episode seven and eight. 6 00:00:17,870 --> 00:00:23,240 We'll look at what makes one so effective, uh, how it can catch external hackers, 7 00:00:23,240 --> 00:00:25,250 as well as, uh, insider threats. 8 00:00:25,670 --> 00:00:25,970 Why? 9 00:00:25,970 --> 00:00:29,330 The key to success is that nobody knows that it exists. 10 00:00:29,690 --> 00:00:34,550 We also talk about proper log storage and why that's crucial for forensic analysis. 11 00:00:34,700 --> 00:00:38,000 That's gonna be important if the bad guys actually come knocking. 12 00:00:38,510 --> 00:00:42,290 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 13 00:00:42,290 --> 00:00:46,909 Backup, and I've been passionate about backup and recovery for over 30 years. 14 00:00:47,119 --> 00:00:47,629 Ever since. 15 00:00:47,629 --> 00:00:50,570 I had to tell my boss that there were no backups of the production 16 00:00:50,570 --> 00:00:51,980 database that we just lost. 17 00:00:52,489 --> 00:00:55,730 I don't want that to happen to you, and that's why I do this. 18 00:00:55,969 --> 00:01:00,619 On this podcast, we turn unappreciated admins into Cyber Recovery Heroes. 19 00:01:00,920 --> 00:01:02,839 This is the backup wrap up. 20 00:01:17,394 --> 00:01:18,079 welcome to the show. 21 00:01:19,164 --> 00:01:23,484 Hi, I am w Curtis Preston, AKA, Mr. Backup, and I have with me a guy who 22 00:01:23,484 --> 00:01:26,604 probably should just be taking me to the hospital instead of talking 23 00:01:26,604 --> 00:01:28,134 to me on a podcast recording. 24 00:01:28,544 --> 00:01:30,414 Prasanna Malaiyandi, how's it going? 25 00:01:30,414 --> 00:01:30,874 Prasanna, 26 00:01:31,014 --> 00:01:37,074 I am good Curtis, and I would love to take you to the hospital, but unfortunately 27 00:01:37,434 --> 00:01:41,754 by the time I get down there, uh, I don't think it would help your cause. 28 00:01:42,084 --> 00:01:44,124 you could probably be, I would be expired. 29 00:01:44,844 --> 00:01:48,174 well, hopefully not, but hopefully you'll just be better about that. 30 00:01:49,419 --> 00:01:53,259 Yeah, so hopefully this is short term, you know, short-lived. 31 00:01:53,259 --> 00:01:54,579 So for this, yeah, 32 00:01:54,639 --> 00:01:55,179 listeners 33 00:01:55,209 --> 00:01:55,779 yeah. 34 00:01:56,504 --> 00:01:57,834 This, this is, this is, 35 00:01:57,969 --> 00:01:58,209 know what? 36 00:01:58,209 --> 00:02:02,259 It's actually been a while since you've had an injury, knock on wood. 37 00:02:02,709 --> 00:02:03,189 But 38 00:02:03,299 --> 00:02:04,389 this count as an injury. 39 00:02:04,464 --> 00:02:07,509 I, I self-inflicted I think does count. 40 00:02:09,249 --> 00:02:16,749 So, all right, so I have this product, uh, you know, called Pure Cleanse. 41 00:02:17,049 --> 00:02:19,869 By the way, for those of you who watch us on YouTube, thank 42 00:02:19,914 --> 00:02:20,454 Yeah. 43 00:02:20,499 --> 00:02:20,679 who are 44 00:02:20,844 --> 00:02:21,024 Uh, 45 00:02:21,249 --> 00:02:22,179 you can watch our 46 00:02:22,614 --> 00:02:22,944 I, I'm, 47 00:02:22,959 --> 00:02:24,189 Faces on 48 00:02:24,324 --> 00:02:25,554 I, yeah. 49 00:02:25,554 --> 00:02:27,144 Uh, same, same name. 50 00:02:27,234 --> 00:02:32,904 Uh, so I'm holding up a, a, a cup that looks like it's full of pea. 51 00:02:33,114 --> 00:02:34,404 It is not full of pea. 52 00:02:35,754 --> 00:02:40,944 So it, it's a product used for like cleansing, like a room, 53 00:02:41,139 --> 00:02:41,439 Yeah. 54 00:02:41,754 --> 00:02:43,044 Especially of smells. 55 00:02:43,044 --> 00:02:43,554 Right. 56 00:02:43,974 --> 00:02:45,024 And, um. 57 00:02:45,474 --> 00:02:46,854 disinfectant, basically. 58 00:02:46,854 --> 00:02:47,964 an industrial. 59 00:02:47,964 --> 00:02:48,414 Yeah. 60 00:02:48,414 --> 00:02:51,144 And, and, um, but, but from an air perspective. 61 00:02:52,164 --> 00:02:55,674 So you drop a tablet, um, let me see here. 62 00:02:55,704 --> 00:02:58,014 Oh, this is, this is a, this is the way it comes. 63 00:02:58,464 --> 00:03:02,964 You get, you get this, you get this tablet, right? 64 00:03:03,384 --> 00:03:07,014 And you put, you fill water up to that, to the red line, and then you 65 00:03:07,259 --> 00:03:07,429 in. 66 00:03:07,584 --> 00:03:10,104 drop the tablet in, and then you leave the room. 67 00:03:10,344 --> 00:03:15,294 And it, it smells kind of like chlorine, but like really strong chlorine. 68 00:03:15,444 --> 00:03:18,774 And, um, and, and then you, and then once, once that's done 69 00:03:18,909 --> 00:03:19,179 and I 70 00:03:19,224 --> 00:03:19,674 and then you, 71 00:03:19,779 --> 00:03:21,894 is, uh, leave the room. 72 00:03:26,004 --> 00:03:26,424 yeah. 73 00:03:26,959 --> 00:03:27,589 Leave the room. 74 00:03:27,889 --> 00:03:28,109 Wow. 75 00:03:29,214 --> 00:03:29,964 Definitely still some. 76 00:03:30,354 --> 00:03:32,724 So I did that. 77 00:03:32,724 --> 00:03:34,284 I did all the stuff right and then. 78 00:03:35,469 --> 00:03:40,179 I went in and I took it out, and then I was showing it to, uh, my cleaning 79 00:03:40,179 --> 00:03:42,759 person and I was showing it to her. 80 00:03:43,089 --> 00:03:45,039 And then I was like, it smells kind of like chlorine. 81 00:03:45,219 --> 00:03:50,889 And I like popped the lid off and took a whiff and my nose was like 82 00:03:51,069 --> 00:03:55,749 literally this close, and I thought I was gonna have to go to the hospital 83 00:03:56,454 --> 00:03:57,144 yeah. 84 00:03:57,249 --> 00:03:59,139 not convinced that I shouldn't be in the hospital. 85 00:04:00,039 --> 00:04:04,569 Uh, my, my lungs, my, my airways closed up. 86 00:04:04,944 --> 00:04:05,334 Yeah. 87 00:04:05,499 --> 00:04:05,919 Yeah. 88 00:04:05,979 --> 00:04:08,919 And, uh, that was, that was not a good move. 89 00:04:09,069 --> 00:04:11,799 like you dummy, you're not supposed to be sniffing that stuff. 90 00:04:11,949 --> 00:04:12,669 Yeah, 91 00:04:12,704 --> 00:04:12,914 you. 92 00:04:13,539 --> 00:04:14,469 yeah, yeah. 93 00:04:14,469 --> 00:04:15,159 You, you're right. 94 00:04:15,159 --> 00:04:15,879 You're probably right. 95 00:04:15,879 --> 00:04:18,189 It was probably a, uh, yeah. 96 00:04:18,579 --> 00:04:25,449 And basically it was like, it was like I sniffed fire into my air pod, you 97 00:04:25,449 --> 00:04:27,369 know, into my air, long air airways. 98 00:04:27,474 --> 00:04:27,764 Yeah. 99 00:04:28,959 --> 00:04:32,649 It burned like a lot and it's still, and then like immediately, you know, 100 00:04:32,709 --> 00:04:36,729 my nose started running and I couldn't breathe and I, I, I thought I was 101 00:04:36,729 --> 00:04:38,529 gonna pass out, but luckily I did not. 102 00:04:39,639 --> 00:04:43,449 And, uh, it's now an hour later and I'm still 103 00:04:43,824 --> 00:04:44,364 Feeling it. 104 00:04:44,979 --> 00:04:45,939 yeah, I'm still feeling it. 105 00:04:46,149 --> 00:04:48,519 Um, yeah. 106 00:04:48,564 --> 00:04:52,194 you do need to take a break during the podcast and go see, seek 107 00:04:52,194 --> 00:04:55,584 medical attention, I think our listeners would totally understand. 108 00:04:56,214 --> 00:04:58,044 Um, I think, you know, just, uh, 109 00:05:00,654 --> 00:05:00,864 Yeah. 110 00:05:01,764 --> 00:05:03,054 good times, good times. 111 00:05:04,434 --> 00:05:05,874 Uh, so don't do that. 112 00:05:06,054 --> 00:05:07,164 Uh, I like the product. 113 00:05:07,164 --> 00:05:11,424 I like the product a lot, but, uh, don't, don't breathe it afterwards. 114 00:05:11,964 --> 00:05:14,574 Not, you know, something that's meant to be an industrial 115 00:05:14,574 --> 00:05:16,854 strength, like cleanse five. 116 00:05:16,854 --> 00:05:19,644 It's, it's supposed to cleanse 500 square feet. 117 00:05:21,099 --> 00:05:24,309 Then I just sniffed it like a maroon. 118 00:05:27,099 --> 00:05:29,079 Oh, Curtis, Curtis. 119 00:05:29,079 --> 00:05:31,779 Curtis, what are we going to do with you? 120 00:05:31,839 --> 00:05:32,829 Nothing, nothing. 121 00:05:32,829 --> 00:05:34,659 There's, it is just hopeless sometimes. 122 00:05:34,659 --> 00:05:37,809 Sometimes I just ask myself, you know? 123 00:05:39,224 --> 00:05:39,939 But, uh, 124 00:05:39,939 --> 00:05:42,189 But it has been a while though, since you've injured 125 00:05:42,339 --> 00:05:44,079 since I've done something really stupid. 126 00:05:44,079 --> 00:05:45,069 Yeah, yeah. 127 00:05:45,129 --> 00:05:46,059 Well, since I've, 128 00:05:46,239 --> 00:05:47,364 well, no, no. 129 00:05:48,399 --> 00:05:48,699 no. 130 00:05:48,699 --> 00:05:52,444 I, it's probably been 2, 3, 4 months. 131 00:05:53,634 --> 00:05:54,594 What was the last thing? 132 00:05:54,594 --> 00:05:55,914 What are you, what are you thinking of? 133 00:05:56,049 --> 00:06:01,209 Uh, remember when you, uh, were disinfecting a different room in your 134 00:06:01,524 --> 00:06:01,704 Oh 135 00:06:02,229 --> 00:06:05,619 uh, you decided to walk in while said 136 00:06:05,849 --> 00:06:11,694 yeah, I was, that was an ozone machine and um, for those of you that aren't 137 00:06:11,694 --> 00:06:13,884 familiar, so ozone is like oh two. 138 00:06:15,459 --> 00:06:15,819 Right. 139 00:06:15,819 --> 00:06:22,059 I think it's like two oxygen molecules and, um, I have a, again, an industrial 140 00:06:22,059 --> 00:06:27,399 strength ozone machine, and you know, when you have an ozone machine, you're 141 00:06:27,399 --> 00:06:29,049 not, you're not supposed to be in there. 142 00:06:29,229 --> 00:06:32,289 And I, I went in because like, I, I was just sorting out 143 00:06:32,289 --> 00:06:33,639 the, like, the timing part. 144 00:06:34,899 --> 00:06:37,959 And, uh, I went in there and, um. 145 00:06:38,994 --> 00:06:41,094 I was only in there maybe 30 seconds. 146 00:06:41,364 --> 00:06:45,714 And same thing like this, like I, I, I had to go, I had to go sit down 147 00:06:45,714 --> 00:06:49,914 for a while 'cause I couldn't breathe like my, again, my airway constricted. 148 00:06:50,199 --> 00:06:54,459 So I think maybe, uh, for future reference, 149 00:06:54,864 --> 00:06:55,404 Yeah. 150 00:06:55,809 --> 00:06:58,749 seems potentially dangerous, don't sniff it. 151 00:06:58,779 --> 00:06:59,769 Don't breathe it. 152 00:07:00,219 --> 00:07:04,059 Well, I, I held my breath when I went in the room. 153 00:07:04,599 --> 00:07:05,019 Right. 154 00:07:05,019 --> 00:07:07,989 I ne I, I was just in, in there to sort out the timer. 155 00:07:07,989 --> 00:07:11,469 I held my breath when I went in, but I was just in just a little bit too long 156 00:07:12,189 --> 00:07:17,379 and so I ended up having to inhale and I inhaled, uh, and it was not good. 157 00:07:17,829 --> 00:07:18,309 I'm just saying. 158 00:07:19,119 --> 00:07:19,449 Yeah. 159 00:07:20,319 --> 00:07:20,739 Yeah. 160 00:07:21,324 --> 00:07:24,804 yeah, so for those listeners, if Curtis sounds a little under the 161 00:07:24,804 --> 00:07:30,114 weather, that is why we wish him all a speedy recovery and hope he 162 00:07:30,114 --> 00:07:32,364 comes back to his normal self soon. 163 00:07:33,084 --> 00:07:33,474 Yeah. 164 00:07:34,374 --> 00:07:38,064 So, uh, this will be an interesting episode. 165 00:07:38,064 --> 00:07:41,424 We're gonna, we're we're gonna, we're gonna take two episodes, one episode 166 00:07:41,424 --> 00:07:43,614 of Mr. Robot in our continued series. 167 00:07:43,764 --> 00:07:45,954 Spoiler alert, we're gonna talk about all kinds of stuff. 168 00:07:46,704 --> 00:07:49,734 And our continued series on stuff that we can pick up from Mr. Robot. 169 00:07:50,394 --> 00:07:55,914 And the first episode, which is episode 1.6, 170 00:07:56,324 --> 00:07:56,534 Yeah. 171 00:07:57,084 --> 00:07:57,534 right? 172 00:07:57,594 --> 00:08:00,504 Uh, and then second episode 1.7, 1.6. 173 00:08:00,804 --> 00:08:04,554 Didn't have a whole lot in it from a cybersecurity perspective. 174 00:08:04,554 --> 00:08:09,084 It did have a whole lot in it from a crime perspective, but, but not from 175 00:08:09,084 --> 00:08:11,574 a cyber crime perspective so much. 176 00:08:12,984 --> 00:08:16,284 You wanna, you wanna summarize, uh, 1.6 or you want me to do it? 177 00:08:16,554 --> 00:08:18,234 Uh, I'll let you go ahead and do it. 178 00:08:18,294 --> 00:08:18,714 Okay. 179 00:08:18,894 --> 00:08:19,344 Right. 180 00:08:19,734 --> 00:08:20,094 So this, 181 00:08:20,214 --> 00:08:21,954 said, it was all like backstory, which 182 00:08:22,404 --> 00:08:22,944 yeah. 183 00:08:23,004 --> 00:08:25,494 the story, but not so much from a tech perspective. 184 00:08:25,644 --> 00:08:26,124 Yeah. 185 00:08:26,124 --> 00:08:32,124 So you may remember from the last episode, uh, it ended with Shayla's death. 186 00:08:32,124 --> 00:08:34,944 So Elliot's neighbor. 187 00:08:36,009 --> 00:08:38,319 Friend, uh, ended with her death. 188 00:08:38,649 --> 00:08:42,309 This episode opens with like a flashback of when, when he first met her. 189 00:08:42,819 --> 00:08:49,339 And, um, the, um, uh, and then we also see that Angela makes a deal with Terry 190 00:08:49,339 --> 00:08:54,319 Colby, the former CTO of evil corp, that she will testify that she broke 191 00:08:54,319 --> 00:08:56,179 the chain of custody with this DAT file. 192 00:08:56,479 --> 00:08:57,499 And why does that matter? 193 00:08:58,279 --> 00:09:02,869 It's because it renders it inadmissible in, uh, in court, right? 194 00:09:02,914 --> 00:09:03,124 And 195 00:09:03,199 --> 00:09:03,439 Uh, 196 00:09:03,634 --> 00:09:03,784 the 197 00:09:04,084 --> 00:09:04,374 yeah, 198 00:09:04,444 --> 00:09:06,034 like their smoking gun to say 199 00:09:06,229 --> 00:09:07,819 yeah, it's, yeah, exactly. 200 00:09:07,999 --> 00:09:11,629 And so he, he's gonna, um, she's gonna say that she broke chain 201 00:09:11,629 --> 00:09:15,229 of custody, which will then essentially let him off the hook. 202 00:09:16,279 --> 00:09:23,539 But in, in, uh, she, he, he's going to in, um, what, what would you call that? 203 00:09:23,659 --> 00:09:29,089 Um, what would you call that in exchange for him saying that he was 204 00:09:29,089 --> 00:09:32,839 there when they decided to poison, you know, her family essentially. 205 00:09:33,229 --> 00:09:33,589 Right. 206 00:09:34,009 --> 00:09:39,049 Um, then we start to see the beginnings of this meetings with this 207 00:09:39,049 --> 00:09:43,579 mysterious individual known as White Rose, the leader of the Dark Army. 208 00:09:43,609 --> 00:09:43,999 Right. 209 00:09:44,179 --> 00:09:44,809 We've, uh. 210 00:09:44,824 --> 00:09:45,724 and I think in. 211 00:09:47,044 --> 00:09:51,424 1.6. We don't actually know who white rose is. 212 00:09:51,529 --> 00:09:51,764 No, no. 213 00:09:51,874 --> 00:09:53,734 they've kind of talked about it before. 214 00:09:53,734 --> 00:09:57,514 It's like the person who leads a dark army, but like we have 215 00:09:57,514 --> 00:10:00,244 no idea who this person is and they just wanna set up a meeting. 216 00:10:00,244 --> 00:10:02,434 And do you wanna talk about why they wanna set up a meeting? 217 00:10:02,434 --> 00:10:02,464 I. 218 00:10:03,514 --> 00:10:07,204 Um, well this is, this is because they want to do, they want to 219 00:10:07,204 --> 00:10:11,464 be able to do attack all of the different, uh, steel mountain. 220 00:10:12,514 --> 00:10:12,994 Um. 221 00:10:13,864 --> 00:10:17,314 Data centers all at one time, and they need the dark army to be able to do that. 222 00:10:17,344 --> 00:10:17,674 Right? 223 00:10:17,829 --> 00:10:18,049 Yep. 224 00:10:18,964 --> 00:10:19,444 Yeah. 225 00:10:19,534 --> 00:10:27,304 Um, and then, um, you know, we get this, um, we get this, uh, this confession 226 00:10:27,304 --> 00:10:32,374 from Elliot to, to his therapist that like, you know, he's act everything 227 00:10:32,374 --> 00:10:35,284 and he's actually quite open with her, but in the process of opening 228 00:10:35,284 --> 00:10:36,574 with her, he scares a crap out of her. 229 00:10:37,714 --> 00:10:37,894 Like 230 00:10:37,924 --> 00:10:38,554 Um, 231 00:10:38,764 --> 00:10:39,214 Yeah, 232 00:10:39,484 --> 00:10:39,994 yeah. 233 00:10:40,024 --> 00:10:40,534 Yeah. 234 00:10:40,594 --> 00:10:41,164 Uh. 235 00:10:41,284 --> 00:10:42,724 says, I hacked you. 236 00:10:42,724 --> 00:10:43,954 I know everything about 237 00:10:44,044 --> 00:10:44,434 Yeah. 238 00:10:44,494 --> 00:10:45,724 don't take your medicines. 239 00:10:45,724 --> 00:10:47,344 I know all those things about you. 240 00:10:47,434 --> 00:10:47,734 Yeah. 241 00:10:47,734 --> 00:10:48,934 I know your, I know your, 242 00:10:49,144 --> 00:10:50,194 Deepest secrets. 243 00:10:50,554 --> 00:10:50,794 yeah. 244 00:10:51,484 --> 00:10:52,684 Your deepest secrets. 245 00:10:52,744 --> 00:10:54,064 Uh, yeah. 246 00:10:54,064 --> 00:10:58,109 And then, and then, uh, Tyrell, uh, does a little thing. 247 00:10:59,284 --> 00:11:05,314 Yeah, so Tyrell, if you remember from the last episode, he and his wife had gone 248 00:11:05,314 --> 00:11:09,244 and had dinner with Scott and Sharon and there's sort of that entire scene in the 249 00:11:09,334 --> 00:11:10,024 Yeah. 250 00:11:10,084 --> 00:11:10,444 of that. 251 00:11:10,444 --> 00:11:10,774 And 252 00:11:10,889 --> 00:11:11,179 Yeah. 253 00:11:11,644 --> 00:11:15,514 now it's actually where Scott gets officially announced as a CTO and 254 00:11:15,514 --> 00:11:17,284 they throw a shin dig at the office. 255 00:11:18,244 --> 00:11:21,274 once again, Tyrell is like, Hey, I'm gonna go meet up with Sharon. 256 00:11:21,274 --> 00:11:23,164 He is like, come up to the rooftop, I know what you want. 257 00:11:24,094 --> 00:11:27,814 And she shows up and uh, yeah. 258 00:11:27,814 --> 00:11:30,604 And then he basically kills her 259 00:11:30,859 --> 00:11:33,259 Yeah, he just strangles her. 260 00:11:34,099 --> 00:11:37,399 Uh, that was a, that was a sort of an unexpected, you think 261 00:11:37,399 --> 00:11:38,599 they're about to, you know, 262 00:11:38,704 --> 00:11:39,124 yeah. 263 00:11:39,724 --> 00:11:39,854 t wow. 264 00:11:40,669 --> 00:11:42,829 And then next thing you know, it's, 265 00:11:44,254 --> 00:11:44,584 Yeah. 266 00:11:44,689 --> 00:11:46,069 and, uh, that was not good. 267 00:11:46,384 --> 00:11:46,654 Yeah. 268 00:11:47,059 --> 00:11:51,619 Um, so if we forward to, uh, the next episode. 269 00:11:52,039 --> 00:11:55,519 Which is 1.7 AKA white rose. 270 00:11:56,119 --> 00:11:58,759 So you see Darlene stealing a gun, right? 271 00:11:58,759 --> 00:12:01,069 Because she's very worried about the fact that they're gonna meet 272 00:12:01,069 --> 00:12:05,209 white rose and she, you know, she's scared of, of whoever white rose is. 273 00:12:05,809 --> 00:12:11,059 Um, and then, um, we, we learned from, um. 274 00:12:12,259 --> 00:12:16,999 Gideon visits Tyrell, and sort of says, Hey, this is all the stuff 275 00:12:16,999 --> 00:12:18,349 that we've been doing on your behalf. 276 00:12:18,349 --> 00:12:20,899 And he mentions that there actually is a honeypot. 277 00:12:21,199 --> 00:12:22,279 We're gonna talk about that. 278 00:12:22,279 --> 00:12:24,709 That's sort of, I think they're gonna be the key thing we're 279 00:12:24,709 --> 00:12:25,969 gonna talk about in this episode. 280 00:12:26,749 --> 00:12:34,669 But, uh, uh, and, and nobody, nobody but nobody, but uh, uh, Gideon seems 281 00:12:34,669 --> 00:12:36,169 to want this honeypot to exist. 282 00:12:36,679 --> 00:12:38,419 Um, and then, um. 283 00:12:39,664 --> 00:12:44,044 The, we find out, uh, obviously there's this whole thing about, uh, 284 00:12:44,314 --> 00:12:48,664 sort of the, the subplot is Tyrell freaking out about the fact that people 285 00:12:48,664 --> 00:12:50,194 are looking into Sharon's murder. 286 00:12:50,674 --> 00:12:52,744 Uh, his wife finds out about Sharon's murder. 287 00:12:52,984 --> 00:13:00,154 Uh, but then we get, um, the whole big reveal about Mr. Robot. 288 00:13:00,214 --> 00:13:02,554 So there's been a lot of, up to this point, there's been a 289 00:13:02,554 --> 00:13:06,724 lot of people theorizing that Mr. Robot was all in his head. 290 00:13:07,639 --> 00:13:11,419 And it's still, I'm still a little confused because Mr. Robot is his 291 00:13:11,419 --> 00:13:15,469 father, and he's not, he's not old enough to be his father, so that 292 00:13:15,469 --> 00:13:16,729 means he's gotta be in his head. 293 00:13:16,729 --> 00:13:19,459 But that doesn't make any sense because we also have the scene of 294 00:13:19,879 --> 00:13:22,459 him meeting with, with, uh, Tyrell. 295 00:13:22,684 --> 00:13:28,714 Tyrell, and also he's talking to Darlene and all sorts of other things 296 00:13:28,909 --> 00:13:30,349 He's not old enough to be his father. 297 00:13:30,349 --> 00:13:30,709 Right. 298 00:13:32,644 --> 00:13:38,974 Well, eh, I think he's old enough to be his father at the point, because Elliot 299 00:13:38,974 --> 00:13:43,624 goes back right in this episode and he, so, because towards the end, right? 300 00:13:43,924 --> 00:13:45,844 Um, he goes and tries to kiss Darlene. 301 00:13:46,714 --> 00:13:47,134 Right. 302 00:13:47,194 --> 00:13:47,434 Oh yeah. 303 00:13:47,974 --> 00:13:48,784 Oh, I forgot about that. 304 00:13:48,919 --> 00:13:51,889 And Darlene is like, Elliot, do you not know who I am? 305 00:13:52,264 --> 00:13:52,804 Yeah. 306 00:13:52,819 --> 00:13:53,809 like, you're Darlene. 307 00:13:53,839 --> 00:13:54,169 And she's 308 00:13:54,274 --> 00:13:54,694 Yeah. 309 00:13:54,889 --> 00:13:55,489 am I? 310 00:13:56,239 --> 00:13:58,699 then he's like, oh, you're my sister. 311 00:13:59,074 --> 00:14:00,254 You're Princess Leia. 312 00:14:00,439 --> 00:14:00,799 yeah. 313 00:14:01,249 --> 00:14:04,939 And then he, and then he freaks out because he's like, 314 00:14:04,969 --> 00:14:07,279 uh, what all am I forgetting? 315 00:14:07,279 --> 00:14:10,519 And so if folks remember, he like would. 316 00:14:11,719 --> 00:14:14,059 Compromise someone then delete all the data. 317 00:14:14,059 --> 00:14:17,689 But before he did, he would burn it on a CD and keep the CD and name it with like 318 00:14:17,689 --> 00:14:19,039 different bands and things like that. 319 00:14:19,134 --> 00:14:19,424 Yeah. 320 00:14:19,669 --> 00:14:23,179 he goes back and looks and he finds a CD that's not labeled and he looks 321 00:14:23,179 --> 00:14:24,829 at it and he realizes it's his. 322 00:14:25,069 --> 00:14:25,279 And 323 00:14:25,344 --> 00:14:25,634 Yeah. 324 00:14:25,909 --> 00:14:31,039 looking at the pictures and he sees like a picture of Mr. Robot, right? 325 00:14:31,099 --> 00:14:35,179 And he sees pictures of his sister, Darlene and all the rest. 326 00:14:35,179 --> 00:14:36,559 And then he starts putting together. 327 00:14:36,889 --> 00:14:39,199 And then he's like, what is going on? 328 00:14:39,199 --> 00:14:42,619 And that's when the episode ends with Mr. Robot pounding on the 329 00:14:42,619 --> 00:14:44,269 door and saying, we need to talk 330 00:14:44,479 --> 00:14:45,259 we need to talk. 331 00:14:45,799 --> 00:14:47,809 It doesn't, I'm, I'm still confused. 332 00:14:47,809 --> 00:14:50,869 And that, that's because like he's basically the same age 333 00:14:51,619 --> 00:14:51,889 as a 334 00:14:52,309 --> 00:14:53,569 as, as the picture, so. 335 00:14:53,749 --> 00:14:53,989 Yeah. 336 00:14:54,859 --> 00:14:58,009 So I'm very, so, you know, because I'm, I'm all confused, 337 00:14:58,009 --> 00:15:00,379 but, uh, remind me who is Krista. 338 00:15:01,254 --> 00:15:03,139 Krista is the psychologist 339 00:15:03,769 --> 00:15:04,789 Oh, right, right, right. 340 00:15:04,849 --> 00:15:05,329 Okay. 341 00:15:05,869 --> 00:15:07,099 Um, okay. 342 00:15:07,879 --> 00:15:08,449 Uh, 343 00:15:11,629 --> 00:15:12,019 all right. 344 00:15:12,454 --> 00:15:12,694 yeah. 345 00:15:12,694 --> 00:15:17,254 And there's also, so one thing we didn't touch upon, and maybe we'll talk about 346 00:15:17,254 --> 00:15:21,844 it uh, maybe in a different episode, maybe in this episode, right, is one of 347 00:15:21,844 --> 00:15:27,754 the scenes is Cisco, who's the person who works for the Dark Army, right? 348 00:15:27,789 --> 00:15:28,079 Yeah. 349 00:15:28,294 --> 00:15:29,464 Ollie the cd. 350 00:15:29,824 --> 00:15:30,184 Right. 351 00:15:30,274 --> 00:15:33,064 Ollie and was like, Hey, I need you to do this for me. 352 00:15:33,784 --> 00:15:34,144 Yeah. 353 00:15:34,474 --> 00:15:40,234 And then there's this entire scene where Ali is basically in the middle of 354 00:15:40,234 --> 00:15:42,544 this attack that happens on All Safe, 355 00:15:42,994 --> 00:15:43,414 Right. 356 00:15:43,474 --> 00:15:47,524 He goes up to Elliot and is like, Hey, I need you to go drop these 357 00:15:47,524 --> 00:15:49,264 hard drives off at this place 358 00:15:49,594 --> 00:15:50,044 Yeah. 359 00:15:50,254 --> 00:15:51,729 And it was all the setup to, yeah. 360 00:15:52,174 --> 00:15:52,709 It was all a setup. 361 00:15:52,984 --> 00:15:55,229 And that is where he meets, uh, white Rose. 362 00:15:56,104 --> 00:15:57,844 Yeah, play. 363 00:15:57,844 --> 00:16:01,444 It's, you know what's funny is I knew BD Wong was in this episode 364 00:16:02,554 --> 00:16:03,844 because it was in the thing. 365 00:16:03,844 --> 00:16:08,044 And if it hadn't been for that, I'm not sure I would've recognized BD Wong. 366 00:16:08,044 --> 00:16:12,424 But, uh, 'cause he is, he's playing, uh, you know, a trans, uh, 367 00:16:12,454 --> 00:16:14,884 woman essentially in the episode. 368 00:16:14,914 --> 00:16:16,624 Uh, and, um. 369 00:16:17,794 --> 00:16:23,764 Uh, I, yeah, I'm not sure I would, I would've recognized him, but, um, so yeah. 370 00:16:23,764 --> 00:16:25,234 So we're, we're gonna come back to that. 371 00:16:25,234 --> 00:16:28,144 We're gonna, I think we're gonna do a separate episode on that aspect. 372 00:16:28,144 --> 00:16:33,994 But today I, I wanted to talk about this idea of a honeypot, which is a really 373 00:16:33,994 --> 00:16:41,494 cool idea that you can use, uh, and is frequently used in cybersecurity. 374 00:16:42,004 --> 00:16:45,064 And I first learned about the concept of a honeypot. 375 00:16:45,754 --> 00:16:48,184 When reading, um, a cuckoo egg, 376 00:16:49,004 --> 00:16:49,224 Yep. 377 00:16:49,924 --> 00:16:50,914 you read a cuckoo egg. 378 00:16:50,914 --> 00:16:51,244 Right. 379 00:16:52,114 --> 00:16:55,384 Um, and you wanna, you want to do a quick summary of a cuckoo 380 00:16:55,384 --> 00:16:56,734 egg for those who haven't read 381 00:16:56,929 --> 00:17:03,679 a Cuckoo's Egg is a nonfiction recount of Cliff Stoller, I think. 382 00:17:04,054 --> 00:17:04,684 Ital? 383 00:17:04,744 --> 00:17:05,254 Yeah. 384 00:17:05,399 --> 00:17:05,749 Right. 385 00:17:06,394 --> 00:17:14,764 who used to be, uh, employed at Berkeley, and he was managing computer 386 00:17:14,764 --> 00:17:18,904 infrastructure and he once noticed that a mainframe, like the timing 387 00:17:18,904 --> 00:17:20,674 would be off on the mainframe. 388 00:17:21,754 --> 00:17:23,314 he was like, who's using the resources? 389 00:17:23,314 --> 00:17:25,354 This is way back in the day when you shared CPUs and 390 00:17:25,354 --> 00:17:26,704 all the other things and you 391 00:17:26,749 --> 00:17:29,809 it was like a, it was like a three second difference between 392 00:17:29,809 --> 00:17:32,629 the two different time, um, yeah. 393 00:17:32,779 --> 00:17:33,649 Accounting system. 394 00:17:33,739 --> 00:17:38,179 he basically was trying to understand where this was, what was going on, 395 00:17:38,539 --> 00:17:44,119 and he unravels this like giant espionage plot of like, I think it was 396 00:17:44,119 --> 00:17:47,329 hackers in Russia using resources and 397 00:17:47,899 --> 00:17:48,259 Yeah. 398 00:17:48,379 --> 00:17:49,639 use resources and 399 00:17:49,969 --> 00:17:50,449 Yeah. 400 00:17:50,899 --> 00:17:51,169 And, 401 00:17:51,559 --> 00:17:52,969 networks in the us. 402 00:17:53,359 --> 00:17:58,909 and it was early days of cyber hacking and so like they, he went to the FBI 403 00:17:58,909 --> 00:18:00,199 and the FBI's like, I don't understand. 404 00:18:00,199 --> 00:18:01,129 Did they steal anything? 405 00:18:01,609 --> 00:18:01,849 And, 406 00:18:01,909 --> 00:18:03,469 He's like, no, but they're in our network, you know? 407 00:18:03,679 --> 00:18:08,269 yeah, and this is before like the normal internet as we think of it today, right? 408 00:18:08,404 --> 00:18:08,734 Right. 409 00:18:08,734 --> 00:18:09,124 Right, 410 00:18:09,379 --> 00:18:13,699 DARPA back in the day, and the connectivity between like research 411 00:18:13,699 --> 00:18:17,449 institutes and the Pentagon and other things, like it wasn't 412 00:18:17,449 --> 00:18:19,924 as widely open as it is today. 413 00:18:21,274 --> 00:18:22,444 right, right, right. 414 00:18:22,804 --> 00:18:22,984 It's a 415 00:18:23,044 --> 00:18:23,404 Uh 416 00:18:23,524 --> 00:18:24,544 but people should go read. 417 00:18:24,814 --> 00:18:25,384 Take a look at it. 418 00:18:25,954 --> 00:18:30,484 uh, where, where did the term, where did the term Ferage Cage come up in there? 419 00:18:31,024 --> 00:18:32,314 Faraday Cage came 420 00:18:32,569 --> 00:18:32,689 I. 421 00:18:32,914 --> 00:18:37,294 he was going into meet White Rose. 422 00:18:37,624 --> 00:18:39,784 Oh, the whole, the whole room's a Faraday cage. 423 00:18:40,114 --> 00:18:40,534 Okay. 424 00:18:40,654 --> 00:18:44,014 And then there's just this one little thing in there. 425 00:18:44,014 --> 00:18:45,874 There's this, uh, a 426 00:18:48,559 --> 00:18:53,434 Steganography software, uh, that Elliot uses to. 427 00:18:54,184 --> 00:19:00,694 Encrypt or to decrypt some, um, uh, information that he had in his wallet. 428 00:19:00,874 --> 00:19:06,604 There's this thing called Deep Sound, which used to, um, uh, to encrypt 429 00:19:06,604 --> 00:19:11,794 stuff inside a, uh, inside a music, which is kind of interesting, uh, way. 430 00:19:11,914 --> 00:19:12,784 Back to. 431 00:19:13,564 --> 00:19:19,504 Cliff stole in the middle of that story, he does set up a honeypot, and 432 00:19:19,714 --> 00:19:23,824 so you, you want to just sort of give the basic concept of what a honeypot is. 433 00:19:23,989 --> 00:19:30,259 Yeah, basically a honeypot is you create something that's so enticing for the 434 00:19:30,259 --> 00:19:34,369 attackers that they will then focus on that instead of everything else. 435 00:19:34,369 --> 00:19:38,419 And then this thing that you've created, you're monitoring, you're making it 436 00:19:38,419 --> 00:19:42,469 obvious, and you're able to detect when someone is attacking, so you 437 00:19:42,469 --> 00:19:43,849 know that someone's in your network. 438 00:19:44,494 --> 00:19:49,504 Yeah, because the, the one really key thing of a honeypot, at least 439 00:19:49,504 --> 00:19:53,284 a proper honeypot, I, I'd say a couple of things in there, right? 440 00:19:53,284 --> 00:19:58,864 One is we don't want to put anything in there that's actually valuable, right? 441 00:19:58,864 --> 00:20:05,074 Uh, because the whole point is to entice the, the hackers, uh, into that thing. 442 00:20:05,344 --> 00:20:08,639 And then the other thing is that it needs to not. 443 00:20:10,129 --> 00:20:16,069 That no one needs to ever log into the honeypot for any valid business reason. 444 00:20:16,204 --> 00:20:16,504 Yeah, 445 00:20:16,729 --> 00:20:18,679 Um, and and why would that be? 446 00:20:18,994 --> 00:20:23,254 because then it might be used for legit traffic, and you want to 447 00:20:23,434 --> 00:20:23,554 I. 448 00:20:23,674 --> 00:20:27,214 basically know when someone's actually hit it and nothing else should have 449 00:20:27,214 --> 00:20:28,864 hit it except a malicious person. 450 00:20:29,434 --> 00:20:30,514 Yeah, exactly. 451 00:20:31,294 --> 00:20:34,954 So you've got this server that looks very interesting, you know, 452 00:20:34,954 --> 00:20:36,634 a server with, with the name. 453 00:20:36,634 --> 00:20:40,504 Like, here's where all our important stuff is, right? 454 00:20:40,984 --> 00:20:46,804 Um, uh, like, like priority one, documents, so we, we name it 455 00:20:46,804 --> 00:20:49,774 like our 11, herbs and spices, 456 00:20:50,194 --> 00:20:50,414 Hm. 457 00:20:51,334 --> 00:20:53,554 corporate financial stuff. 458 00:20:53,944 --> 00:21:02,239 Um, you know, um, I'm, I'm, I'm hearkening back to being in a, I was at a. It 459 00:21:02,239 --> 00:21:05,449 was a vendor actually in, in my area. 460 00:21:05,629 --> 00:21:08,389 So it was up in the Irvine area and it was a vendor that I was working 461 00:21:08,389 --> 00:21:13,849 with and I just asked for a conference room to like make a phone call. 462 00:21:15,049 --> 00:21:18,289 And I went in the conference room and while I'm in this conference room, I 463 00:21:18,289 --> 00:21:23,359 look up at the whiteboard and all the corporate secrets were on the whiteboard. 464 00:21:23,749 --> 00:21:26,344 And it was like, it was like, um. 465 00:21:28,039 --> 00:21:29,419 No one should see this. 466 00:21:29,419 --> 00:21:33,349 Literally, they, they, they, they, no one needs to know this. 467 00:21:33,349 --> 00:21:36,979 It was something, something I was like, I was just like, uh, I don't 468 00:21:36,979 --> 00:21:38,119 think I'm supposed to be in here. 469 00:21:38,309 --> 00:21:39,304 take us picture? 470 00:21:40,189 --> 00:21:41,509 but I did not take a picture. 471 00:21:41,749 --> 00:21:45,159 Uh, for the record, this was before every phone had a camera on it. 472 00:21:45,159 --> 00:21:45,399 Yeah. 473 00:21:46,059 --> 00:21:52,359 Um, but yeah, so you, you, you, you, you, I guess you, you wouldn't want to 474 00:21:52,359 --> 00:21:53,924 make it super obvious, but you want to. 475 00:21:54,504 --> 00:21:58,914 Basically, um, included in the, in whatever naming convention 476 00:21:58,914 --> 00:21:59,994 that you typically have. 477 00:22:00,424 --> 00:22:01,954 And what, how would they find it then? 478 00:22:02,554 --> 00:22:02,914 Right. 479 00:22:03,244 --> 00:22:07,324 this is where they're doing like network discovery and right. 480 00:22:07,439 --> 00:22:07,789 Right. 481 00:22:07,954 --> 00:22:11,674 attacker gets into a network, they're probably gonna look and say, okay, what 482 00:22:11,674 --> 00:22:13,564 other systems can we try to compromise? 483 00:22:13,564 --> 00:22:17,074 And they will scan the network and say, okay, here's a system. 484 00:22:17,074 --> 00:22:18,694 Okay, are there any ports open? 485 00:22:18,694 --> 00:22:21,274 Are there any, what uh, operating system is it? 486 00:22:21,274 --> 00:22:25,294 Can I actually get into it because maybe it'll allow me to escalate privileges. 487 00:22:25,294 --> 00:22:27,934 Maybe that system has access to other resources. 488 00:22:28,354 --> 00:22:28,564 All the 489 00:22:28,624 --> 00:22:29,224 Yeah. 490 00:22:29,404 --> 00:22:29,734 Yeah. 491 00:22:29,734 --> 00:22:32,854 So during the reconnaissance phase, right, they, they identify 492 00:22:33,694 --> 00:22:37,354 this potential resource and then they, um, they get in it. 493 00:22:37,684 --> 00:22:41,414 And, and what you could also do is you could, uh, you could. 494 00:22:42,259 --> 00:22:45,709 Include maybe some common exploits, right? 495 00:22:46,309 --> 00:22:49,669 Do you remember what my favorite exploit is, or my least favorite exploit? 496 00:22:49,669 --> 00:22:50,809 Depending on how you look at it. 497 00:22:51,609 --> 00:22:51,829 No. 498 00:22:53,269 --> 00:22:54,829 The ransomware deployment protocol. 499 00:22:54,919 --> 00:22:56,014 Oh, RTP. 500 00:22:58,474 --> 00:22:58,954 Right. 501 00:22:58,984 --> 00:23:02,554 Uh, so you, you, you leave RDP on, you leave the administrative 502 00:23:02,554 --> 00:23:05,134 share on, uh, in Windows, right? 503 00:23:05,884 --> 00:23:14,764 Uh, you allow some well-known exploit, uh, to, to be there, right? 504 00:23:14,764 --> 00:23:20,284 So you, you, you, you, you, it's like you, you have this, you have this, 505 00:23:20,284 --> 00:23:23,104 uh, this, this building that's like. 506 00:23:23,704 --> 00:23:27,154 It's flashing red sign, really important stuff. 507 00:23:27,304 --> 00:23:28,744 And then you unlock all the doors, 508 00:23:29,154 --> 00:23:29,444 Yeah. 509 00:23:29,944 --> 00:23:30,364 right? 510 00:23:30,364 --> 00:23:34,534 So you leave RDP open, you leave, uh, you don't have to do all these 511 00:23:34,534 --> 00:23:37,774 things, but you could do one or more of these things where you leave RDP 512 00:23:37,774 --> 00:23:39,874 open, you have a common exploit. 513 00:23:40,144 --> 00:23:42,544 There's two times when you might want to have a honeypot. 514 00:23:42,544 --> 00:23:44,314 One is just a honeypot all the time. 515 00:23:45,334 --> 00:23:51,334 That's a server that's just there, just 24 7 that no one should ever access. 516 00:23:51,634 --> 00:23:54,274 And if they do access, it sets off the klaxon on alerts. 517 00:23:54,274 --> 00:23:54,664 Right? 518 00:23:55,504 --> 00:24:01,294 Um, and then, uh, the other would be if you believe you have been infiltrated. 519 00:24:02,374 --> 00:24:07,564 You don't, I mean, it takes a lot of chutzpah to do this second one, 520 00:24:07,564 --> 00:24:13,174 right, where, you know, you believe that someone's in your network, but 521 00:24:14,014 --> 00:24:16,594 you're not going to cut them off. 522 00:24:16,594 --> 00:24:18,334 You want to see what they're up to. 523 00:24:18,364 --> 00:24:18,664 Yeah. 524 00:24:18,904 --> 00:24:22,624 you could actually sort of turn on this honeypot 525 00:24:23,434 --> 00:24:23,854 And. 526 00:24:24,124 --> 00:24:26,974 and, and, oh, the reason why I was bringing that up is 527 00:24:27,004 --> 00:24:28,174 if you know that they've. 528 00:24:28,879 --> 00:24:31,579 They have a compromised, uh, account. 529 00:24:31,609 --> 00:24:33,319 They have access to a particular account. 530 00:24:33,319 --> 00:24:35,869 You would wanna make sure that that account is available in that server. 531 00:24:36,379 --> 00:24:39,649 The one other thing I was gonna mention, a honeypot, which you haven't mentioned 532 00:24:39,649 --> 00:24:44,719 yet, is you might also run a honeypot just to look for insider threats as well. 533 00:24:46,009 --> 00:24:46,339 Really? 534 00:24:46,339 --> 00:24:46,699 Yeah. 535 00:24:46,729 --> 00:24:48,019 It's a really good point, right? 536 00:24:48,409 --> 00:24:48,709 Yeah. 537 00:24:49,134 --> 00:24:52,789 Curtis, you should not have access to the financial data and. 538 00:24:53,959 --> 00:24:57,409 are you going and accessing a random financial share 539 00:24:58,084 --> 00:24:59,164 Right, right. 540 00:24:59,614 --> 00:25:00,064 Yeah. 541 00:25:00,124 --> 00:25:05,194 That'd be a really great way to find, uh, and you know, and I, I'll say this again. 542 00:25:05,194 --> 00:25:09,544 I'm gonna, I'm gonna think about another one of my favorite TV shows. 543 00:25:10,054 --> 00:25:11,914 I am The Danger No, no. 544 00:25:12,424 --> 00:25:13,144 I am the Danger. 545 00:25:14,534 --> 00:25:14,974 I got nothing, 546 00:25:15,124 --> 00:25:18,724 I, I am the one who knocks nothing. 547 00:25:18,914 --> 00:25:19,404 nothing. 548 00:25:21,039 --> 00:25:21,259 Um. 549 00:25:23,404 --> 00:25:24,154 Breaking bad. 550 00:25:24,344 --> 00:25:24,564 Oh, 551 00:25:26,254 --> 00:25:31,324 So the whole thing with, with, with the, the reason why he was so, one of 552 00:25:31,324 --> 00:25:34,624 the reasons why he was so successful is the concept of hiding in plain sight. 553 00:25:35,404 --> 00:25:35,794 Right? 554 00:25:36,394 --> 00:25:42,454 Once that veneer was off, it, it took five minutes to figure out, to, to 555 00:25:42,454 --> 00:25:44,854 prove that he was who he, who he was. 556 00:25:44,854 --> 00:25:45,574 He, what was it? 557 00:25:45,604 --> 00:25:46,354 What was his thing? 558 00:25:46,384 --> 00:25:46,784 What was his name? 559 00:25:48,274 --> 00:25:49,054 the German, the. 560 00:25:50,434 --> 00:25:54,994 Heisenberg it o once the, once the whole, the, the, the, 561 00:25:55,024 --> 00:25:56,374 the book on the toilet thing. 562 00:25:57,064 --> 00:26:01,564 Once that came out, hiding in sight only works. 563 00:26:01,684 --> 00:26:03,844 I if, if no one is looking 564 00:26:03,864 --> 00:26:04,084 Yep. 565 00:26:04,504 --> 00:26:05,014 right. 566 00:26:05,164 --> 00:26:14,104 Um, and so, like, for example, uh, Marty Bird, uh, in, in Ozark, he was. 567 00:26:15,499 --> 00:26:16,849 Not hiding in plain sight. 568 00:26:16,849 --> 00:26:19,969 Everybody knew he was up to the, the, the genius of that was that he, 569 00:26:20,509 --> 00:26:24,259 the FBI's looking directly at him and he manages to not get caught. 570 00:26:24,829 --> 00:26:25,369 Why? 571 00:26:25,369 --> 00:26:28,609 What, what's relevant in this case, a honeypot only works 572 00:26:28,609 --> 00:26:29,659 if nobody knows it's there. 573 00:26:29,749 --> 00:26:30,049 Yeah. 574 00:26:31,009 --> 00:26:39,199 And so when we have this in the episode, uh, Tyrell, uh, finds out that the 575 00:26:39,199 --> 00:26:41,094 honeypot and what, so it's kind of funny. 576 00:26:41,269 --> 00:26:41,569 him. 577 00:26:42,454 --> 00:26:46,294 Gideon tells him that there, that there's a honeypot and it, it's 578 00:26:46,294 --> 00:26:50,404 like, why did you tell, I mean, I guess Gideon, you know Gideon's 579 00:26:50,479 --> 00:26:50,869 didn't wanna 580 00:26:50,899 --> 00:26:51,364 a, you know. 581 00:26:51,439 --> 00:26:52,459 he didn't wanna lose a business. 582 00:26:52,459 --> 00:26:52,699 Right. 583 00:26:52,744 --> 00:26:53,584 Oh, that's right. 584 00:26:53,584 --> 00:26:55,894 He wanted him to know about all of the different stuff that 585 00:26:55,894 --> 00:26:57,124 they were doing to make sure 586 00:26:57,169 --> 00:27:02,114 because he also had to tell him about, uh, Angela and the DAT file and 587 00:27:02,179 --> 00:27:02,299 I. 588 00:27:02,564 --> 00:27:02,914 Kolby, 589 00:27:03,349 --> 00:27:03,979 Right? 590 00:27:04,009 --> 00:27:05,239 Yeah, yeah, yeah. 591 00:27:05,239 --> 00:27:07,279 So good news, bad news, good news, right? 592 00:27:08,149 --> 00:27:11,239 So he's like, I want to, I want you to know about all the things we're doing 593 00:27:11,239 --> 00:27:13,699 to try to find the, the bad guy, right? 594 00:27:13,849 --> 00:27:25,099 Um, and what I don't yet remember is why, what was Tyrell doing with the Honey Pot? 595 00:27:25,849 --> 00:27:32,479 So he wanted to go because he realized that, so here's the thing is I don't 596 00:27:32,479 --> 00:27:34,789 think they quite got Honey pot, correct. 597 00:27:36,139 --> 00:27:36,429 Okay. 598 00:27:37,759 --> 00:27:41,209 well, I think what they were referring to is they knew that, 599 00:27:41,989 --> 00:27:45,889 or they, Gideon suspected that that server was still compromised, 600 00:27:46,204 --> 00:27:46,684 Right. 601 00:27:46,849 --> 00:27:49,819 and so he set up monitoring on that 602 00:27:50,019 --> 00:27:50,239 Uh. 603 00:27:50,479 --> 00:27:51,979 than creating a new instance. 604 00:27:52,309 --> 00:27:55,909 So it's still essentially a honey pot because he's monitoring it. 605 00:27:55,909 --> 00:27:58,969 He's like firewalled it off from everything else so no one 606 00:27:59,104 --> 00:27:59,584 Right. 607 00:27:59,659 --> 00:27:59,839 it 608 00:27:59,944 --> 00:28:00,274 Yeah. 609 00:28:00,274 --> 00:28:03,214 He, he makes a point of saying that he, they think they're on 610 00:28:03,214 --> 00:28:05,644 the network or the on the main network, but they're actually not. 611 00:28:06,034 --> 00:28:06,244 Yeah. 612 00:28:06,244 --> 00:28:07,384 They fired a while it off. 613 00:28:07,384 --> 00:28:07,534 Yeah. 614 00:28:08,104 --> 00:28:08,404 Right. 615 00:28:08,404 --> 00:28:11,704 And so, so then Tyrell wants to go and look and say, okay, 616 00:28:11,704 --> 00:28:12,964 what have they compromised? 617 00:28:12,964 --> 00:28:13,144 Right. 618 00:28:13,144 --> 00:28:15,814 Which is when he starts digging in and that's when you're like, 619 00:28:15,814 --> 00:28:17,434 oh, we don't know what's going on. 620 00:28:17,434 --> 00:28:19,504 And he has to leave because of the murder investigation. 621 00:28:19,749 --> 00:28:20,039 Yeah. 622 00:28:20,584 --> 00:28:21,244 Yeah. 623 00:28:21,334 --> 00:28:21,724 Yeah. 624 00:28:23,389 --> 00:28:23,989 Um, 625 00:28:24,064 --> 00:28:27,124 also interesting though because even though he said yes, I fired it 626 00:28:27,124 --> 00:28:31,684 off from the main network, Tyrell from his desktop PC was able to 627 00:28:31,684 --> 00:28:34,204 SSH into it and connect into it. 628 00:28:37,039 --> 00:28:38,929 LA la show is great. 629 00:28:38,929 --> 00:28:40,279 I don't wanna hear any facts. 630 00:28:40,999 --> 00:28:42,169 Um, yeah. 631 00:28:42,199 --> 00:28:43,519 You know, I was gonna, yeah, 632 00:28:44,194 --> 00:28:44,404 Which, 633 00:28:44,509 --> 00:28:45,529 has his station over there. 634 00:28:45,604 --> 00:28:49,354 it's all like V land off, and it only allows inbound connections 635 00:28:49,354 --> 00:28:51,124 into that honeypot, right? 636 00:28:51,149 --> 00:28:51,369 So, 637 00:28:51,679 --> 00:28:52,609 Sure. 638 00:28:53,059 --> 00:28:55,219 We'll, we'll, yeah. 639 00:28:55,549 --> 00:28:56,269 Um, 640 00:28:56,359 --> 00:28:57,719 being nitpicky as a 641 00:28:58,489 --> 00:28:59,454 yeah, it's okay. 642 00:28:59,459 --> 00:28:59,699 person. 643 00:29:00,919 --> 00:29:01,519 It's, it's suited. 644 00:29:03,139 --> 00:29:06,589 But, um, but in terms of, so I, I would just say that, you know, 645 00:29:06,589 --> 00:29:10,309 if you haven't thought of the idea of having a honeypot server. 646 00:29:10,939 --> 00:29:12,559 Or multiple honeypot servers. 647 00:29:13,069 --> 00:29:16,459 Again, you know, you wanna, you wanna leave it with some common exploits, 648 00:29:16,459 --> 00:29:19,399 you wanna leave it, uh, available. 649 00:29:19,399 --> 00:29:23,119 You wanna make it look like it has some interesting stuff. 650 00:29:23,629 --> 00:29:29,779 Um, and again, I I, there's all these TV references that keep coming up 651 00:29:29,779 --> 00:29:31,069 in my head when I think about this. 652 00:29:31,069 --> 00:29:35,689 And, and a lot of them have to do actually with, uh, with Alias a TV show alias. 653 00:29:35,689 --> 00:29:36,859 There was, there were a lot of. 654 00:29:37,729 --> 00:29:38,809 Systems in there. 655 00:29:38,809 --> 00:29:43,369 There were a lot of episodes there where they would, they would 656 00:29:43,369 --> 00:29:46,489 want to make the, the bad actor 657 00:29:46,984 --> 00:29:47,554 It's almost like 658 00:29:47,599 --> 00:29:51,799 believe that they Yeah, they, well, they want the bad actor to believe 659 00:29:51,799 --> 00:29:55,069 they got something great when in reality they gave them garbage data. 660 00:29:55,144 --> 00:29:55,384 Yeah. 661 00:29:55,609 --> 00:29:55,969 Right. 662 00:29:55,969 --> 00:30:01,309 Um, and, uh, so, um. 663 00:30:02,464 --> 00:30:03,994 But, but, but that is the point. 664 00:30:03,994 --> 00:30:09,184 A again, it only works if, um, it only works if they don't know it's there. 665 00:30:09,559 --> 00:30:09,849 Yeah. 666 00:30:10,264 --> 00:30:12,574 It only works if they're able to get in, right? 667 00:30:12,994 --> 00:30:18,934 And again, if there's anything sniffing at those ports, it's a bad actor, right? 668 00:30:18,994 --> 00:30:25,774 And so then you can do some, some, um, forensic, um, analysis and you 669 00:30:25,774 --> 00:30:29,434 can figure out where that person is coming from and perhaps that will then 670 00:30:29,434 --> 00:30:30,764 allow you to shut off that person. 671 00:30:31,249 --> 00:30:36,019 Or the other thing is maybe it'll help you understand what are they looking for, 672 00:30:36,334 --> 00:30:37,204 Right, right. 673 00:30:37,219 --> 00:30:38,809 Because that's almost as important. 674 00:30:38,839 --> 00:30:42,199 Actually, that's probably more important than just shutting them out, right? 675 00:30:42,784 --> 00:30:43,294 Agreed. 676 00:30:43,294 --> 00:30:47,704 And you know, because you know when I've talked with Mike a lot, right? 677 00:30:47,704 --> 00:30:49,324 Our, you know, my. 678 00:30:49,729 --> 00:30:50,209 Dr. Mike. 679 00:30:50,404 --> 00:30:50,704 Mike? 680 00:30:50,854 --> 00:30:51,274 Yeah. 681 00:30:51,304 --> 00:30:53,824 Mike Sailor, my fellow co-author. 682 00:30:53,974 --> 00:30:54,814 Fellow co-author. 683 00:30:54,874 --> 00:30:55,594 That's redundant. 684 00:30:55,739 --> 00:30:56,149 Yes. 685 00:30:56,164 --> 00:31:01,054 co-author for my upcoming book, learning Ransomware Response and Recovery, 686 00:31:01,354 --> 00:31:04,804 which by the way, I just found out today is actually already on Amazon. 687 00:31:05,004 --> 00:31:05,424 Woohoo. 688 00:31:05,944 --> 00:31:07,924 You can, you can pre-order it on Amazon. 689 00:31:08,024 --> 00:31:08,314 Nice. 690 00:31:08,734 --> 00:31:10,474 I was like, well, I should probably finish the day 691 00:31:12,544 --> 00:31:12,994 we're in. 692 00:31:12,994 --> 00:31:15,334 Um, we're in the fa we finished tech review. 693 00:31:16,189 --> 00:31:21,019 The tech reviewers, uh, gave it overwhelmingly positive reviews. 694 00:31:21,079 --> 00:31:25,309 Uh, you know, if you, you know, change this, change that emphasize 695 00:31:25,309 --> 00:31:30,169 this deemphasize that, um, we, one of the things was that we did was we 696 00:31:30,169 --> 00:31:34,339 reduced, there was a history session, like the history of ransomware, 697 00:31:34,549 --> 00:31:35,809 and they're like, nobody cares. 698 00:31:35,989 --> 00:31:37,249 Nobody cares about the history. 699 00:31:37,489 --> 00:31:39,859 It was just, I think the only point of the history was. 700 00:31:40,684 --> 00:31:43,864 To say, you know, this has actually been going on for a long time, you know, 701 00:31:43,864 --> 00:31:45,184 all the way back since the eighties. 702 00:31:45,424 --> 00:31:46,054 The first, 703 00:31:46,129 --> 00:31:46,429 like it 704 00:31:46,534 --> 00:31:46,894 um, 705 00:31:46,939 --> 00:31:48,649 one page rather than like an entire 706 00:31:48,784 --> 00:31:50,494 yeah, that, yeah, it was like five pages. 707 00:31:50,599 --> 00:31:50,899 Yeah. 708 00:31:50,914 --> 00:31:57,904 Um, and, um, so the one page, or the, the, the first known, the first 709 00:31:57,904 --> 00:32:00,574 malware that's considered to be ransomware was actually called the 710 00:32:00,574 --> 00:32:03,964 aids, um, Trojan back in the eighties. 711 00:32:04,204 --> 00:32:04,504 Um. 712 00:32:05,989 --> 00:32:11,989 But, uh, anyway, so, oh, go back to Mike. 713 00:32:13,159 --> 00:32:16,849 One of the things that Mike talks a lot about is once you've like, stopped 714 00:32:17,539 --> 00:32:24,019 the, you know, the attack, uh, or while it's going on, but, but, but generally, 715 00:32:24,019 --> 00:32:25,729 once you've stopped the attack. 716 00:32:26,824 --> 00:32:31,594 Now's the time to do forensic analysis to figure out how did the attack happen? 717 00:32:31,594 --> 00:32:32,704 How did they get in? 718 00:32:33,154 --> 00:32:37,024 And the honeypot system would be a prime way to do that, right? 719 00:32:37,024 --> 00:32:41,314 Because if, if it's a good enough honeypot, perhaps there's many honeypots, 720 00:32:41,314 --> 00:32:41,644 Yeah. 721 00:32:41,644 --> 00:32:43,594 you're gonna see them logging in and you're gonna say, oh, 722 00:32:43,594 --> 00:32:45,214 they logged in from this system. 723 00:32:45,214 --> 00:32:47,764 Then you can go look at that system and you can see where that system, 724 00:32:47,974 --> 00:32:49,354 and you can follow the trail 725 00:32:49,954 --> 00:32:50,044 It's 726 00:32:50,134 --> 00:32:50,824 where it leads. 727 00:32:51,844 --> 00:32:53,164 Yeah, exactly Right. 728 00:32:53,284 --> 00:32:59,014 And then the other thing, the other key to that is, is that log storage, right? 729 00:32:59,404 --> 00:33:07,174 Uh, as, as much as you can set up log storage systems so that logs 730 00:33:07,174 --> 00:33:10,304 don't get just randomly deleted by the, by the threat actor. 731 00:33:10,684 --> 00:33:13,084 and preferably don't log locally. 732 00:33:13,969 --> 00:33:14,359 Yeah. 733 00:33:14,359 --> 00:33:14,659 Yeah. 734 00:33:14,659 --> 00:33:16,579 That's what, yeah, that's kind of what I'm saying, right? 735 00:33:16,579 --> 00:33:21,289 Se set up a system by which these important logs are stored 736 00:33:21,289 --> 00:33:24,194 remotely, uh, and, and immutably. 737 00:33:24,604 --> 00:33:27,064 Yes, I was gonna say, protect that log system just like you 738 00:33:27,064 --> 00:33:27,939 would protect your backup system. 739 00:33:29,179 --> 00:33:30,109 Yeah, exactly. 740 00:33:30,139 --> 00:33:33,679 Uh, it's a great use for an object storage system with immutability turned on. 741 00:33:33,679 --> 00:33:34,009 Right. 742 00:33:34,164 --> 00:33:34,324 Yeah. 743 00:33:34,339 --> 00:33:39,139 Just as the logs are, you know, created, shipped them off to the, um, 744 00:33:39,349 --> 00:33:43,789 you know, this other storage system, uh, because it is, it is very common. 745 00:33:43,849 --> 00:33:47,989 Um, you know, I was just, uh, you know, I just got to the part of the book where we 746 00:33:47,989 --> 00:33:51,379 were talking about how that, you know, um. 747 00:33:51,979 --> 00:33:56,629 Intrusion detection systems and, and, uh, EDR systems and all these 748 00:33:56,629 --> 00:34:01,549 things, they're really only great at stopping the initial attack. 749 00:34:02,509 --> 00:34:06,979 Once someone has access, one of the first things they do is shut those off. 750 00:34:07,789 --> 00:34:08,209 Right? 751 00:34:08,959 --> 00:34:09,289 And, 752 00:34:09,559 --> 00:34:09,739 there 753 00:34:09,804 --> 00:34:10,104 okay, go. 754 00:34:10,249 --> 00:34:14,869 an article earlier this week, or maybe it was last week, talking about how 755 00:34:15,109 --> 00:34:20,509 a lot of these malware operators now either have custom tools or off the 756 00:34:20,509 --> 00:34:22,924 shelf tools to actually disable EDR. 757 00:34:23,884 --> 00:34:24,244 Yeah. 758 00:34:24,634 --> 00:34:24,904 Yeah. 759 00:34:25,684 --> 00:34:30,124 Uh, and so, and, and another thing they're gonna do is to, is to basically 760 00:34:30,124 --> 00:34:35,524 wipe the logs that will show the, you know, the, their, their trail. 761 00:34:35,674 --> 00:34:39,999 And, um, and so the, the key to that is to store that stuff, uh, externally. 762 00:34:40,324 --> 00:34:42,034 what Elliot did during the hack, right? 763 00:34:42,034 --> 00:34:42,514 Would he? 764 00:34:43,264 --> 00:34:43,594 Yep. 765 00:34:44,764 --> 00:34:46,084 Yeah, he did exactly that. 766 00:34:46,504 --> 00:34:51,724 Um, can you think of any, like, additional thoughts on the idea of a honeypot? 767 00:34:52,054 --> 00:34:55,444 Uh, not so much on the honeypot. 768 00:34:55,474 --> 00:34:57,064 No, I think that was it. 769 00:34:57,424 --> 00:35:01,204 The one thing I did wanna bring up, not around the honeypot, but just 770 00:35:01,204 --> 00:35:06,994 to quickly cover, is, um, also like Darlene was trying to set up this 771 00:35:06,994 --> 00:35:08,134 meeting with White Rose, right? 772 00:35:08,134 --> 00:35:12,454 And so she kept pushing the dark Army and do you remember what she did to Cisco? 773 00:35:15,634 --> 00:35:16,054 No. 774 00:35:16,249 --> 00:35:19,099 So Cisco is a guy, her contact at the Dark Army. 775 00:35:19,359 --> 00:35:19,649 Yeah. 776 00:35:20,089 --> 00:35:26,809 hacked his system, impersonated him their IRC chat channels and 777 00:35:26,809 --> 00:35:29,989 basically is the way that she, uh, 778 00:35:30,334 --> 00:35:31,444 Oh, right, right, right, 779 00:35:31,669 --> 00:35:34,039 to be able to get a meeting on the books with white rose. 780 00:35:34,054 --> 00:35:34,414 right. 781 00:35:34,489 --> 00:35:36,259 was like, don't talk to me. 782 00:35:36,259 --> 00:35:37,369 We're done after this. 783 00:35:37,369 --> 00:35:38,629 I can't believe you hacked me. 784 00:35:38,629 --> 00:35:39,049 So. 785 00:35:39,544 --> 00:35:39,964 Yeah, 786 00:35:40,549 --> 00:35:42,919 No honor amongst ths, I guess. 787 00:35:43,414 --> 00:35:44,644 yeah, yeah. 788 00:35:45,304 --> 00:35:51,004 Um, yeah, that, that, that was, uh, you know, when you're dealing with people 789 00:35:51,004 --> 00:35:54,064 like this that are this, that this good at like, getting into your systems, 790 00:35:54,094 --> 00:35:56,314 uh, kind of all bets are off, I think. 791 00:35:56,514 --> 00:35:57,554 could have benefited from a. 792 00:35:59,704 --> 00:36:00,454 Yeah. 793 00:36:01,774 --> 00:36:02,284 Yeah. 794 00:36:02,344 --> 00:36:04,774 Uh, it's, um. 795 00:36:05,959 --> 00:36:11,029 Just thinking about, um, you, you know, you know, it's funny, um, I 796 00:36:11,029 --> 00:36:13,969 got, I got, what was her name again? 797 00:36:15,439 --> 00:36:16,009 What's her name? 798 00:36:16,114 --> 00:36:16,684 Darlene, 799 00:36:16,999 --> 00:36:17,329 Darlene. 800 00:36:17,329 --> 00:36:17,599 Yeah. 801 00:36:18,049 --> 00:36:22,129 I got, I got, uh, uh, my wife and I got Darlene this week. 802 00:36:22,324 --> 00:36:22,834 Oh really? 803 00:36:23,749 --> 00:36:24,229 Yeah. 804 00:36:24,254 --> 00:36:28,234 So we got this, uh, this text message from my daughter. 805 00:36:28,999 --> 00:36:34,189 That said, Hey, um, when do you guys, do you guys have time on Sunday to 806 00:36:34,189 --> 00:36:38,359 do stuff for Lily's birthday, right? 807 00:36:38,434 --> 00:36:39,214 were mentioning, yeah. 808 00:36:39,289 --> 00:36:39,799 Yeah. 809 00:36:39,829 --> 00:36:43,999 And so, you know, we worked it out and we, we, we were working it out. 810 00:36:44,029 --> 00:36:49,639 You know, I want to make sure my, my other daughter's there and, and um, and so I 811 00:36:49,639 --> 00:36:52,039 called, I called my daughter and I said. 812 00:36:52,504 --> 00:36:55,859 I was like, Hey, so, you know, um, you know, da da da. 813 00:36:55,924 --> 00:36:57,064 We're try to work this out. 814 00:36:57,064 --> 00:37:00,484 And she's like, you know, I, I work on Sunday, like I work Sunday evening. 815 00:37:00,484 --> 00:37:01,414 She works nights. 816 00:37:01,894 --> 00:37:03,094 She's like, I work Sunday evening. 817 00:37:03,094 --> 00:37:05,434 And I'm like, well, you're the one that sent the text. 818 00:37:05,434 --> 00:37:08,314 And she's like, no, I was not. 819 00:37:08,824 --> 00:37:09,844 I was asleep. 820 00:37:10,084 --> 00:37:16,654 Lily took my phone and sent the message, asked me, when do you guys 821 00:37:16,654 --> 00:37:20,644 want to come over for Lily's birthday? 822 00:37:24,859 --> 00:37:26,689 Oh my gosh. 823 00:37:27,124 --> 00:37:28,024 That girl. 824 00:37:29,794 --> 00:37:37,474 So in, in four hours, we'll be having dinner with Lily, um, 825 00:37:37,594 --> 00:37:39,964 as orchestrated by Marissa. 826 00:37:41,839 --> 00:37:43,369 That is hilarious. 827 00:37:45,244 --> 00:37:46,744 My, my granddaughter, the hacker. 828 00:37:47,379 --> 00:37:47,499 Hmm. 829 00:37:48,184 --> 00:37:50,464 Uh, she got access to her cell phone. 830 00:37:50,704 --> 00:37:52,444 She must know her pin too. 831 00:37:53,194 --> 00:37:53,704 Yeah. 832 00:37:53,854 --> 00:37:54,364 Yeah. 833 00:37:55,744 --> 00:37:56,194 All right. 834 00:37:56,194 --> 00:37:59,344 Well, uh, hopefully you found some inform, you know, you found 835 00:37:59,344 --> 00:38:01,864 some useful information here in our discussion on honeypots. 836 00:38:01,864 --> 00:38:05,434 We're gonna continue talking about this episode in our next week. 837 00:38:05,854 --> 00:38:08,644 Uh, and, uh, I, I think that'll be good as well. 838 00:38:08,824 --> 00:38:09,184 Dun, dun. 839 00:38:09,394 --> 00:38:10,324 Wait to hear, to 840 00:38:10,594 --> 00:38:10,894 Done. 841 00:38:11,074 --> 00:38:13,594 us talk about persistent access. 842 00:38:13,864 --> 00:38:15,304 Yes, absolutely. 843 00:38:15,424 --> 00:38:18,424 All right, well, thanks, Prasanna for having another chat. 844 00:38:19,024 --> 00:38:22,474 Uh, I hope your breathing gets better, Curtis, but you do sound a lot 845 00:38:22,474 --> 00:38:24,214 better than when we first started, so 846 00:38:25,174 --> 00:38:26,164 I don't feel any better. 847 00:38:27,544 --> 00:38:31,384 Um, literally I feel like, like I inhaled chlorine. 848 00:38:31,504 --> 00:38:33,004 Like it's just not, it's not good. 849 00:38:33,094 --> 00:38:35,014 do you still have your scuba tanks with oxygen? 850 00:38:36,334 --> 00:38:37,654 Those don't, those aren't oxygen. 851 00:38:37,654 --> 00:38:38,584 They're just air. 852 00:38:38,779 --> 00:38:39,109 Okay. 853 00:38:39,544 --> 00:38:40,594 You don't put oxygen. 854 00:38:41,089 --> 00:38:41,539 Air, 855 00:38:41,834 --> 00:38:46,649 Don't, don't, don't, don't stay in your lane, buddy and with 856 00:38:46,649 --> 00:38:48,569 that, thanks folks for listening. 857 00:38:48,749 --> 00:38:50,129 Uh, that is a wrap.