You found the backup wrap up your go-to podcast for all things
backup recovery and cyber recovery.
In this episode, we're gonna talk about the cybersecurity concept
of a honeypot server through the lens of Mr. Robot episode or season
one, episode seven and eight.
We'll look at what makes one so effective, uh, how it can catch external hackers,
as well as, uh, insider threats.
Why?
The key to success is that nobody knows that it exists.
We also talk about proper log storage and why that's crucial for forensic analysis.
That's gonna be important if the bad guys actually come knocking.
By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr.
Backup, and I've been passionate about backup and recovery for over 30 years.
Ever since.
I had to tell my boss that there were no backups of the production
database that we just lost.
I don't want that to happen to you, and that's why I do this.
On this podcast, we turn unappreciated admins into Cyber Recovery Heroes.
This is the backup wrap up.
welcome to the show.
Hi, I am w Curtis Preston, AKA, Mr. Backup, and I have with me a guy who
probably should just be taking me to the hospital instead of talking
to me on a podcast recording.
Prasanna Malaiyandi, how's it going?
Prasanna,
I am good Curtis, and I would love to take you to the hospital, but unfortunately
by the time I get down there, uh, I don't think it would help your cause.
you could probably be, I would be expired.
well, hopefully not, but hopefully you'll just be better about that.
Yeah, so hopefully this is short term, you know, short-lived.
So for this, yeah,
listeners
yeah.
This, this is, this is,
know what?
It's actually been a while since you've had an injury, knock on wood.
But
this count as an injury.
I, I self-inflicted I think does count.
So, all right, so I have this product, uh, you know, called Pure Cleanse.
By the way, for those of you who watch us on YouTube, thank
Yeah.
who are
Uh,
you can watch our
I, I'm,
Faces on
I, yeah.
Uh, same, same name.
Uh, so I'm holding up a, a, a cup that looks like it's full of pea.
It is not full of pea.
So it, it's a product used for like cleansing, like a room,
Yeah.
Especially of smells.
Right.
And, um.
disinfectant, basically.
an industrial.
Yeah.
And, and, um, but, but from an air perspective.
So you drop a tablet, um, let me see here.
Oh, this is, this is a, this is the way it comes.
You get, you get this, you get this tablet, right?
And you put, you fill water up to that, to the red line, and then you
in.
drop the tablet in, and then you leave the room.
And it, it smells kind of like chlorine, but like really strong chlorine.
And, um, and, and then you, and then once, once that's done
and I
and then you,
is, uh, leave the room.
yeah.
Leave the room.
Wow.
Definitely still some.
So I did that.
I did all the stuff right and then.
I went in and I took it out, and then I was showing it to, uh, my cleaning
person and I was showing it to her.
And then I was like, it smells kind of like chlorine.
And I like popped the lid off and took a whiff and my nose was like
literally this close, and I thought I was gonna have to go to the hospital
yeah.
not convinced that I shouldn't be in the hospital.
Uh, my, my lungs, my, my airways closed up.
Yeah.
And, uh, that was, that was not a good move.
like you dummy, you're not supposed to be sniffing that stuff.
Yeah,
you.
yeah, yeah.
You, you're right.
You're probably right.
It was probably a, uh, yeah.
And basically it was like, it was like I sniffed fire into my air pod, you
know, into my air, long air airways.
Yeah.
It burned like a lot and it's still, and then like immediately, you know,
my nose started running and I couldn't breathe and I, I, I thought I was
gonna pass out, but luckily I did not.
And, uh, it's now an hour later and I'm still
Feeling it.
yeah, I'm still feeling it.
Um, yeah.
you do need to take a break during the podcast and go see, seek
medical attention, I think our listeners would totally understand.
Um, I think, you know, just, uh,
Yeah.
good times, good times.
Uh, so don't do that.
Uh, I like the product.
I like the product a lot, but, uh, don't, don't breathe it afterwards.
Not, you know, something that's meant to be an industrial
strength, like cleanse five.
It's, it's supposed to cleanse 500 square feet.
Then I just sniffed it like a maroon.
Oh, Curtis, Curtis.
Curtis, what are we going to do with you?
Nothing, nothing.
There's, it is just hopeless sometimes.
Sometimes I just ask myself, you know?
But, uh,
But it has been a while though, since you've injured
since I've done something really stupid.
Yeah, yeah.
Well, since I've,
well, no, no.
no.
I, it's probably been 2, 3, 4 months.
What was the last thing?
What are you, what are you thinking of?
Uh, remember when you, uh, were disinfecting a different room in your
Oh
uh, you decided to walk in while said
yeah, I was, that was an ozone machine and um, for those of you that aren't
familiar, so ozone is like oh two.
Right.
I think it's like two oxygen molecules and, um, I have a, again, an industrial
strength ozone machine, and you know, when you have an ozone machine, you're
not, you're not supposed to be in there.
And I, I went in because like, I, I was just sorting out
the, like, the timing part.
And, uh, I went in there and, um.
I was only in there maybe 30 seconds.
And same thing like this, like I, I, I had to go, I had to go sit down
for a while 'cause I couldn't breathe like my, again, my airway constricted.
So I think maybe, uh, for future reference,
Yeah.
seems potentially dangerous, don't sniff it.
Don't breathe it.
Well, I, I held my breath when I went in the room.
Right.
I ne I, I was just in, in there to sort out the timer.
I held my breath when I went in, but I was just in just a little bit too long
and so I ended up having to inhale and I inhaled, uh, and it was not good.
I'm just saying.
Yeah.
yeah, so for those listeners, if Curtis sounds a little under the
weather, that is why we wish him all a speedy recovery and hope he
comes back to his normal self soon.
Yeah.
So, uh, this will be an interesting episode.
We're gonna, we're we're gonna, we're gonna take two episodes, one episode
of Mr. Robot in our continued series.
Spoiler alert, we're gonna talk about all kinds of stuff.
And our continued series on stuff that we can pick up from Mr. Robot.
And the first episode, which is episode 1.6,
Yeah.
right?
Uh, and then second episode 1.7, 1.6.
Didn't have a whole lot in it from a cybersecurity perspective.
It did have a whole lot in it from a crime perspective, but, but not from
a cyber crime perspective so much.
You wanna, you wanna summarize, uh, 1.6 or you want me to do it?
Uh, I'll let you go ahead and do it.
Okay.
Right.
So this,
said, it was all like backstory, which
yeah.
the story, but not so much from a tech perspective.
Yeah.
So you may remember from the last episode, uh, it ended with Shayla's death.
So Elliot's neighbor.
Friend, uh, ended with her death.
This episode opens with like a flashback of when, when he first met her.
And, um, the, um, uh, and then we also see that Angela makes a deal with Terry
Colby, the former CTO of evil corp, that she will testify that she broke
the chain of custody with this DAT file.
And why does that matter?
It's because it renders it inadmissible in, uh, in court, right?
And
Uh,
the
yeah,
like their smoking gun to say
yeah, it's, yeah, exactly.
And so he, he's gonna, um, she's gonna say that she broke chain
of custody, which will then essentially let him off the hook.
But in, in, uh, she, he, he's going to in, um, what, what would you call that?
Um, what would you call that in exchange for him saying that he was
there when they decided to poison, you know, her family essentially.
Right.
Um, then we start to see the beginnings of this meetings with this
mysterious individual known as White Rose, the leader of the Dark Army.
Right.
We've, uh.
and I think in.
1.6. We don't actually know who white rose is.
No, no.
they've kind of talked about it before.
It's like the person who leads a dark army, but like we have
no idea who this person is and they just wanna set up a meeting.
And do you wanna talk about why they wanna set up a meeting?
I.
Um, well this is, this is because they want to do, they want to
be able to do attack all of the different, uh, steel mountain.
Um.
Data centers all at one time, and they need the dark army to be able to do that.
Right?
Yep.
Yeah.
Um, and then, um, you know, we get this, um, we get this, uh, this confession
from Elliot to, to his therapist that like, you know, he's act everything
and he's actually quite open with her, but in the process of opening
with her, he scares a crap out of her.
Like
Um,
Yeah,
yeah.
Yeah.
Uh.
says, I hacked you.
I know everything about
Yeah.
don't take your medicines.
I know all those things about you.
Yeah.
I know your, I know your,
Deepest secrets.
yeah.
Your deepest secrets.
Uh, yeah.
And then, and then, uh, Tyrell, uh, does a little thing.
Yeah, so Tyrell, if you remember from the last episode, he and his wife had gone
and had dinner with Scott and Sharon and there's sort of that entire scene in the
Yeah.
of that.
And
Yeah.
now it's actually where Scott gets officially announced as a CTO and
they throw a shin dig at the office.
once again, Tyrell is like, Hey, I'm gonna go meet up with Sharon.
He is like, come up to the rooftop, I know what you want.
And she shows up and uh, yeah.
And then he basically kills her
Yeah, he just strangles her.
Uh, that was a, that was a sort of an unexpected, you think
they're about to, you know,
yeah.
t wow.
And then next thing you know, it's,
Yeah.
and, uh, that was not good.
Yeah.
Um, so if we forward to, uh, the next episode.
Which is 1.7 AKA white rose.
So you see Darlene stealing a gun, right?
Because she's very worried about the fact that they're gonna meet
white rose and she, you know, she's scared of, of whoever white rose is.
Um, and then, um, we, we learned from, um.
Gideon visits Tyrell, and sort of says, Hey, this is all the stuff
that we've been doing on your behalf.
And he mentions that there actually is a honeypot.
We're gonna talk about that.
That's sort of, I think they're gonna be the key thing we're
gonna talk about in this episode.
But, uh, uh, and, and nobody, nobody but nobody, but uh, uh, Gideon seems
to want this honeypot to exist.
Um, and then, um.
The, we find out, uh, obviously there's this whole thing about, uh,
sort of the, the subplot is Tyrell freaking out about the fact that people
are looking into Sharon's murder.
Uh, his wife finds out about Sharon's murder.
Uh, but then we get, um, the whole big reveal about Mr. Robot.
So there's been a lot of, up to this point, there's been a
lot of people theorizing that Mr. Robot was all in his head.
And it's still, I'm still a little confused because Mr. Robot is his
father, and he's not, he's not old enough to be his father, so that
means he's gotta be in his head.
But that doesn't make any sense because we also have the scene of
him meeting with, with, uh, Tyrell.
Tyrell, and also he's talking to Darlene and all sorts of other things
He's not old enough to be his father.
Right.
Well, eh, I think he's old enough to be his father at the point, because Elliot
goes back right in this episode and he, so, because towards the end, right?
Um, he goes and tries to kiss Darlene.
Right.
Oh yeah.
Oh, I forgot about that.
And Darlene is like, Elliot, do you not know who I am?
Yeah.
like, you're Darlene.
And she's
Yeah.
am I?
then he's like, oh, you're my sister.
You're Princess Leia.
yeah.
And then he, and then he freaks out because he's like,
uh, what all am I forgetting?
And so if folks remember, he like would.
Compromise someone then delete all the data.
But before he did, he would burn it on a CD and keep the CD and name it with like
different bands and things like that.
Yeah.
he goes back and looks and he finds a CD that's not labeled and he looks
at it and he realizes it's his.
And
Yeah.
looking at the pictures and he sees like a picture of Mr. Robot, right?
And he sees pictures of his sister, Darlene and all the rest.
And then he starts putting together.
And then he's like, what is going on?
And that's when the episode ends with Mr. Robot pounding on the
door and saying, we need to talk
we need to talk.
It doesn't, I'm, I'm still confused.
And that, that's because like he's basically the same age
as a
as, as the picture, so.
Yeah.
So I'm very, so, you know, because I'm, I'm all confused,
but, uh, remind me who is Krista.
Krista is the psychologist
Oh, right, right, right.
Okay.
Um, okay.
Uh,
all right.
yeah.
And there's also, so one thing we didn't touch upon, and maybe we'll talk about
it uh, maybe in a different episode, maybe in this episode, right, is one of
the scenes is Cisco, who's the person who works for the Dark Army, right?
Yeah.
Ollie the cd.
Right.
Ollie and was like, Hey, I need you to do this for me.
Yeah.
And then there's this entire scene where Ali is basically in the middle of
this attack that happens on All Safe,
Right.
He goes up to Elliot and is like, Hey, I need you to go drop these
hard drives off at this place
Yeah.
And it was all the setup to, yeah.
It was all a setup.
And that is where he meets, uh, white Rose.
Yeah, play.
It's, you know what's funny is I knew BD Wong was in this episode
because it was in the thing.
And if it hadn't been for that, I'm not sure I would've recognized BD Wong.
But, uh, 'cause he is, he's playing, uh, you know, a trans, uh,
woman essentially in the episode.
Uh, and, um.
Uh, I, yeah, I'm not sure I would, I would've recognized him, but, um, so yeah.
So we're, we're gonna come back to that.
We're gonna, I think we're gonna do a separate episode on that aspect.
But today I, I wanted to talk about this idea of a honeypot, which is a really
cool idea that you can use, uh, and is frequently used in cybersecurity.
And I first learned about the concept of a honeypot.
When reading, um, a cuckoo egg,
Yep.
you read a cuckoo egg.
Right.
Um, and you wanna, you want to do a quick summary of a cuckoo
egg for those who haven't read
a Cuckoo's Egg is a nonfiction recount of Cliff Stoller, I think.
Ital?
Yeah.
Right.
who used to be, uh, employed at Berkeley, and he was managing computer
infrastructure and he once noticed that a mainframe, like the timing
would be off on the mainframe.
he was like, who's using the resources?
This is way back in the day when you shared CPUs and
all the other things and you
it was like a, it was like a three second difference between
the two different time, um, yeah.
Accounting system.
he basically was trying to understand where this was, what was going on,
and he unravels this like giant espionage plot of like, I think it was
hackers in Russia using resources and
Yeah.
use resources and
Yeah.
And,
networks in the us.
and it was early days of cyber hacking and so like they, he went to the FBI
and the FBI's like, I don't understand.
Did they steal anything?
And,
He's like, no, but they're in our network, you know?
yeah, and this is before like the normal internet as we think of it today, right?
Right.
Right,
DARPA back in the day, and the connectivity between like research
institutes and the Pentagon and other things, like it wasn't
as widely open as it is today.
right, right, right.
It's a
Uh
but people should go read.
Take a look at it.
uh, where, where did the term, where did the term Ferage Cage come up in there?
Faraday Cage came
I.
he was going into meet White Rose.
Oh, the whole, the whole room's a Faraday cage.
Okay.
And then there's just this one little thing in there.
There's this, uh, a
Steganography software, uh, that Elliot uses to.
Encrypt or to decrypt some, um, uh, information that he had in his wallet.
There's this thing called Deep Sound, which used to, um, uh, to encrypt
stuff inside a, uh, inside a music, which is kind of interesting, uh, way.
Back to.
Cliff stole in the middle of that story, he does set up a honeypot, and
so you, you want to just sort of give the basic concept of what a honeypot is.
Yeah, basically a honeypot is you create something that's so enticing for the
attackers that they will then focus on that instead of everything else.
And then this thing that you've created, you're monitoring, you're making it
obvious, and you're able to detect when someone is attacking, so you
know that someone's in your network.
Yeah, because the, the one really key thing of a honeypot, at least
a proper honeypot, I, I'd say a couple of things in there, right?
One is we don't want to put anything in there that's actually valuable, right?
Uh, because the whole point is to entice the, the hackers, uh, into that thing.
And then the other thing is that it needs to not.
That no one needs to ever log into the honeypot for any valid business reason.
Yeah,
Um, and and why would that be?
because then it might be used for legit traffic, and you want to
I.
basically know when someone's actually hit it and nothing else should have
hit it except a malicious person.
Yeah, exactly.
So you've got this server that looks very interesting, you know,
a server with, with the name.
Like, here's where all our important stuff is, right?
Um, uh, like, like priority one, documents, so we, we name it
like our 11, herbs and spices,
Hm.
corporate financial stuff.
Um, you know, um, I'm, I'm, I'm hearkening back to being in a, I was at a. It
was a vendor actually in, in my area.
So it was up in the Irvine area and it was a vendor that I was working
with and I just asked for a conference room to like make a phone call.
And I went in the conference room and while I'm in this conference room, I
look up at the whiteboard and all the corporate secrets were on the whiteboard.
And it was like, it was like, um.
No one should see this.
Literally, they, they, they, they, no one needs to know this.
It was something, something I was like, I was just like, uh, I don't
think I'm supposed to be in here.
take us picture?
but I did not take a picture.
Uh, for the record, this was before every phone had a camera on it.
Yeah.
Um, but yeah, so you, you, you, you, you, I guess you, you wouldn't want to
make it super obvious, but you want to.
Basically, um, included in the, in whatever naming convention
that you typically have.
And what, how would they find it then?
Right.
this is where they're doing like network discovery and right.
Right.
attacker gets into a network, they're probably gonna look and say, okay, what
other systems can we try to compromise?
And they will scan the network and say, okay, here's a system.
Okay, are there any ports open?
Are there any, what uh, operating system is it?
Can I actually get into it because maybe it'll allow me to escalate privileges.
Maybe that system has access to other resources.
All the
Yeah.
So during the reconnaissance phase, right, they, they identify
this potential resource and then they, um, they get in it.
And, and what you could also do is you could, uh, you could.
Include maybe some common exploits, right?
Do you remember what my favorite exploit is, or my least favorite exploit?
Depending on how you look at it.
No.
The ransomware deployment protocol.
Oh, RTP.
Right.
Uh, so you, you, you leave RDP on, you leave the administrative
share on, uh, in Windows, right?
Uh, you allow some well-known exploit, uh, to, to be there, right?
So you, you, you, you, you, it's like you, you have this, you have this,
uh, this, this building that's like.
It's flashing red sign, really important stuff.
And then you unlock all the doors,
Yeah.
right?
So you leave RDP open, you leave, uh, you don't have to do all these
things, but you could do one or more of these things where you leave RDP
open, you have a common exploit.
There's two times when you might want to have a honeypot.
One is just a honeypot all the time.
That's a server that's just there, just 24 7 that no one should ever access.
And if they do access, it sets off the klaxon on alerts.
Right?
Um, and then, uh, the other would be if you believe you have been infiltrated.
You don't, I mean, it takes a lot of chutzpah to do this second one,
right, where, you know, you believe that someone's in your network, but
you're not going to cut them off.
You want to see what they're up to.
Yeah.
you could actually sort of turn on this honeypot
And.
and, and, oh, the reason why I was bringing that up is
if you know that they've.
They have a compromised, uh, account.
They have access to a particular account.
You would wanna make sure that that account is available in that server.
The one other thing I was gonna mention, a honeypot, which you haven't mentioned
yet, is you might also run a honeypot just to look for insider threats as well.
Really?
Yeah.
It's a really good point, right?
Yeah.
Curtis, you should not have access to the financial data and.
are you going and accessing a random financial share
Right, right.
Yeah.
That'd be a really great way to find, uh, and you know, and I, I'll say this again.
I'm gonna, I'm gonna think about another one of my favorite TV shows.
I am The Danger No, no.
I am the Danger.
I got nothing,
I, I am the one who knocks nothing.
nothing.
Um.
Breaking bad.
Oh,
So the whole thing with, with, with the, the reason why he was so, one of
the reasons why he was so successful is the concept of hiding in plain sight.
Right?
Once that veneer was off, it, it took five minutes to figure out, to, to
prove that he was who he, who he was.
He, what was it?
What was his thing?
What was his name?
the German, the.
Heisenberg it o once the, once the whole, the, the, the,
the book on the toilet thing.
Once that came out, hiding in sight only works.
I if, if no one is looking
Yep.
right.
Um, and so, like, for example, uh, Marty Bird, uh, in, in Ozark, he was.
Not hiding in plain sight.
Everybody knew he was up to the, the, the genius of that was that he,
the FBI's looking directly at him and he manages to not get caught.
Why?
What, what's relevant in this case, a honeypot only works
if nobody knows it's there.
Yeah.
And so when we have this in the episode, uh, Tyrell, uh, finds out that the
honeypot and what, so it's kind of funny.
him.
Gideon tells him that there, that there's a honeypot and it, it's
like, why did you tell, I mean, I guess Gideon, you know Gideon's
didn't wanna
a, you know.
he didn't wanna lose a business.
Right.
Oh, that's right.
He wanted him to know about all of the different stuff that
they were doing to make sure
because he also had to tell him about, uh, Angela and the DAT file and
I.
Kolby,
Right?
Yeah, yeah, yeah.
So good news, bad news, good news, right?
So he's like, I want to, I want you to know about all the things we're doing
to try to find the, the bad guy, right?
Um, and what I don't yet remember is why, what was Tyrell doing with the Honey Pot?
So he wanted to go because he realized that, so here's the thing is I don't
think they quite got Honey pot, correct.
Okay.
well, I think what they were referring to is they knew that,
or they, Gideon suspected that that server was still compromised,
Right.
and so he set up monitoring on that
Uh.
than creating a new instance.
So it's still essentially a honey pot because he's monitoring it.
He's like firewalled it off from everything else so no one
Right.
it
Yeah.
He, he makes a point of saying that he, they think they're on
the network or the on the main network, but they're actually not.
Yeah.
They fired a while it off.
Yeah.
Right.
And so, so then Tyrell wants to go and look and say, okay,
what have they compromised?
Right.
Which is when he starts digging in and that's when you're like,
oh, we don't know what's going on.
And he has to leave because of the murder investigation.
Yeah.
Um,
also interesting though because even though he said yes, I fired it
off from the main network, Tyrell from his desktop PC was able to
SSH into it and connect into it.
LA la show is great.
I don't wanna hear any facts.
Um, yeah.
You know, I was gonna, yeah,
Which,
has his station over there.
it's all like V land off, and it only allows inbound connections
into that honeypot, right?
So,
Sure.
We'll, we'll, yeah.
Um,
being nitpicky as a
yeah, it's okay.
person.
It's, it's suited.
But, um, but in terms of, so I, I would just say that, you know,
if you haven't thought of the idea of having a honeypot server.
Or multiple honeypot servers.
Again, you know, you wanna, you wanna leave it with some common exploits,
you wanna leave it, uh, available.
You wanna make it look like it has some interesting stuff.
Um, and again, I I, there's all these TV references that keep coming up
in my head when I think about this.
And, and a lot of them have to do actually with, uh, with Alias a TV show alias.
There was, there were a lot of.
Systems in there.
There were a lot of episodes there where they would, they would
want to make the, the bad actor
It's almost like
believe that they Yeah, they, well, they want the bad actor to believe
they got something great when in reality they gave them garbage data.
Yeah.
Right.
Um, and, uh, so, um.
But, but, but that is the point.
A again, it only works if, um, it only works if they don't know it's there.
Yeah.
It only works if they're able to get in, right?
And again, if there's anything sniffing at those ports, it's a bad actor, right?
And so then you can do some, some, um, forensic, um, analysis and you
can figure out where that person is coming from and perhaps that will then
allow you to shut off that person.
Or the other thing is maybe it'll help you understand what are they looking for,
Right, right.
Because that's almost as important.
Actually, that's probably more important than just shutting them out, right?
Agreed.
And you know, because you know when I've talked with Mike a lot, right?
Our, you know, my.
Dr. Mike.
Mike?
Yeah.
Mike Sailor, my fellow co-author.
Fellow co-author.
That's redundant.
Yes.
co-author for my upcoming book, learning Ransomware Response and Recovery,
which by the way, I just found out today is actually already on Amazon.
Woohoo.
You can, you can pre-order it on Amazon.
Nice.
I was like, well, I should probably finish the day
we're in.
Um, we're in the fa we finished tech review.
The tech reviewers, uh, gave it overwhelmingly positive reviews.
Uh, you know, if you, you know, change this, change that emphasize
this deemphasize that, um, we, one of the things was that we did was we
reduced, there was a history session, like the history of ransomware,
and they're like, nobody cares.
Nobody cares about the history.
It was just, I think the only point of the history was.
To say, you know, this has actually been going on for a long time, you know,
all the way back since the eighties.
The first,
like it
um,
one page rather than like an entire
yeah, that, yeah, it was like five pages.
Yeah.
Um, and, um, so the one page, or the, the, the first known, the first
malware that's considered to be ransomware was actually called the
aids, um, Trojan back in the eighties.
Um.
But, uh, anyway, so, oh, go back to Mike.
One of the things that Mike talks a lot about is once you've like, stopped
the, you know, the attack, uh, or while it's going on, but, but, but generally,
once you've stopped the attack.
Now's the time to do forensic analysis to figure out how did the attack happen?
How did they get in?
And the honeypot system would be a prime way to do that, right?
Because if, if it's a good enough honeypot, perhaps there's many honeypots,
Yeah.
you're gonna see them logging in and you're gonna say, oh,
they logged in from this system.
Then you can go look at that system and you can see where that system,
and you can follow the trail
It's
where it leads.
Yeah, exactly Right.
And then the other thing, the other key to that is, is that log storage, right?
Uh, as, as much as you can set up log storage systems so that logs
don't get just randomly deleted by the, by the threat actor.
and preferably don't log locally.
Yeah.
That's what, yeah, that's kind of what I'm saying, right?
Se set up a system by which these important logs are stored
remotely, uh, and, and immutably.
Yes, I was gonna say, protect that log system just like you
would protect your backup system.
Yeah, exactly.
Uh, it's a great use for an object storage system with immutability turned on.
Right.
Yeah.
Just as the logs are, you know, created, shipped them off to the, um,
you know, this other storage system, uh, because it is, it is very common.
Um, you know, I was just, uh, you know, I just got to the part of the book where we
were talking about how that, you know, um.
Intrusion detection systems and, and, uh, EDR systems and all these
things, they're really only great at stopping the initial attack.
Once someone has access, one of the first things they do is shut those off.
Right?
And,
there
okay, go.
an article earlier this week, or maybe it was last week, talking about how
a lot of these malware operators now either have custom tools or off the
shelf tools to actually disable EDR.
Yeah.
Uh, and so, and, and another thing they're gonna do is to, is to basically
wipe the logs that will show the, you know, the, their, their trail.
And, um, and so the, the key to that is to store that stuff, uh, externally.
what Elliot did during the hack, right?
Would he?
Yep.
Yeah, he did exactly that.
Um, can you think of any, like, additional thoughts on the idea of a honeypot?
Uh, not so much on the honeypot.
No, I think that was it.
The one thing I did wanna bring up, not around the honeypot, but just
to quickly cover, is, um, also like Darlene was trying to set up this
meeting with White Rose, right?
And so she kept pushing the dark Army and do you remember what she did to Cisco?
No.
So Cisco is a guy, her contact at the Dark Army.
Yeah.
hacked his system, impersonated him their IRC chat channels and
basically is the way that she, uh,
Oh, right, right, right,
to be able to get a meeting on the books with white rose.
right.
was like, don't talk to me.
We're done after this.
I can't believe you hacked me.
So.
Yeah,
No honor amongst ths, I guess.
yeah, yeah.
Um, yeah, that, that, that was, uh, you know, when you're dealing with people
like this that are this, that this good at like, getting into your systems,
uh, kind of all bets are off, I think.
could have benefited from a.
Yeah.
Uh, it's, um.
Just thinking about, um, you, you know, you know, it's funny, um, I
got, I got, what was her name again?
What's her name?
Darlene,
Darlene.
Yeah.
I got, I got, uh, uh, my wife and I got Darlene this week.
Oh really?
Yeah.
So we got this, uh, this text message from my daughter.
That said, Hey, um, when do you guys, do you guys have time on Sunday to
do stuff for Lily's birthday, right?
were mentioning, yeah.
Yeah.
And so, you know, we worked it out and we, we, we were working it out.
You know, I want to make sure my, my other daughter's there and, and um, and so I
called, I called my daughter and I said.
I was like, Hey, so, you know, um, you know, da da da.
We're try to work this out.
And she's like, you know, I, I work on Sunday, like I work Sunday evening.
She works nights.
She's like, I work Sunday evening.
And I'm like, well, you're the one that sent the text.
And she's like, no, I was not.
I was asleep.
Lily took my phone and sent the message, asked me, when do you guys
want to come over for Lily's birthday?
Oh my gosh.
That girl.
So in, in four hours, we'll be having dinner with Lily, um,
as orchestrated by Marissa.
That is hilarious.
My, my granddaughter, the hacker.
Hmm.
Uh, she got access to her cell phone.
She must know her pin too.
Yeah.
All right.
Well, uh, hopefully you found some inform, you know, you found
some useful information here in our discussion on honeypots.
We're gonna continue talking about this episode in our next week.
Uh, and, uh, I, I think that'll be good as well.
Dun, dun.
Wait to hear, to
Done.
us talk about persistent access.
Yes, absolutely.
All right, well, thanks, Prasanna for having another chat.
Uh, I hope your breathing gets better, Curtis, but you do sound a lot
better than when we first started, so
I don't feel any better.
Um, literally I feel like, like I inhaled chlorine.
Like it's just not, it's not good.
do you still have your scuba tanks with oxygen?
Those don't, those aren't oxygen.
They're just air.
Okay.
You don't put oxygen.
Air,
Don't, don't, don't, don't stay in your lane, buddy and with
that, thanks folks for listening.
Uh, that is a wrap.