Episode 1 · · 59 min
Dan Borges From Infosec ITAdmin to Red Teamer to CTF Organizer
Professional red teamer, blogger and security tool developer
Episode summary
Permalink and Transcript: http://gettingintoinfosec.com/dan
In this first episode, I chat with Dan Borges, a professional red teamer, blogger, and security tool developer.
Dan Borges discusses his early experiences using and exploiting computer systems, how InfoSec experts work with companies, and the new tools he and others created and released this year!
Episode Highlights:
Dan explains how he became involved in information security,
including his introduction to programming through a Lego robotics
program.
His early experiences as a pen-tester—i.e. a penetration tester, who
looks for system security weaknesses—and why it’s difficult to get
hands-on experience in that field.
The benefits of becoming an Offensive Security Certified Professional
(OSCP).
What does a red team do in an organization, and how is it different
from pen-testing?
Dan describes the day-to-day life of a pen-tester and the kind of
conflicts they can run into.
A few war stories from the trenches of InfoSec, as well as some of
the tools pen-testers use.
How being grounded led to Dan’s earliest hacking experiences, and the
ways his parents fostered his interests and mentality.
What conferences should InfoSec beginners check out?
Fun and beneficial ways you can “hack” reading.
Dan’s tips for those starting off or looking to transition into
Infosec.
An in-depth look at one of the newer tools Dan uses for his work.
The rules and intricacies of InfoSec competitions.
Quotes:
“It’s such a catch-22 to get practical, hands-on experience to go to these jobs because, y’know, hacking’s illegal, right?”
“We don’t just go in and blow the brakes off people, we’re trying to measurably improve security.”
“It was a constant escalation war, cat-and-mouse like that. They’d take something away and I’d figure out how to use the computer with that limitation.”
Before infosec: IT admin at a pen testing shop
Chapters
- 0:00
Intro: who Dan Borges is
Ayman explains why the first episode was edited down and introduces Dan, a red teamer and security tool developer.
- 1:22
From Lego robotics to an IT admin job at a pen test shop
Dan describes switching from robotics to security in college and taking an IT admin role while learning pen testing from his coworkers.
- 4:54
OSCP, hands-on labs and Hack The Box
Dan says the OSCP lab is worth the money, the course PDF is not, and recommends Hack The Box as free practice.
- 8:21
Red teaming versus pen testing and consulting burnout
Dan contrasts narrowly scoped pen tests and billable-hour consulting life with broader, slower internal red team work.
- 15:36
War story: keylogging a target who reported the compromise
A red team op nearly gets burned when the keylogged target messages the security team, and the team scrambles to pull its tools.
- 21:07
Earliest hacking memories and his parents' influence
Dan recalls beating parental computer restrictions and credits his mother's software testing work and his father's critiques.
- 24:10
Security conferences worth attending
Dan recommends BSides and DerbyCon for beginners and describes DEF CON as almost too big.
- 26:06
Blogging weekly and speed reading security books
Dan explains why he writes a weekly blog post, reads about two books a month and uses audiobooks and text-to-speech.
- 37:08
Staying current and practice resources for beginners
Dan shares his RSS and Reddit routine and recommends flAWS, Pentester Labs and CTFs that are not too hard.
- 43:05
gscript: the dropper built for CCDC red teams
Dan explains the gscript tool, its Golang and MIRV-style design and its 1.0 release at DEF CON.
- 49:27
Volunteering for CCDC and CPTC
Dan describes how newcomers can join the CCDC red or black teams and the Collegiate Penetration Testing Competition.
- 54:46
Corporate email cautionary tales and sign-off
Dan and Ayman swap stories about private activity on work email and laptops, then Ayman plugs his new community.
Key takeaways
- Pay for OSCP lab time rather than the training material, since the lab is where the hands-on confidence comes from.
- Use free hands-on practice such as Hack The Box, PentesterLab and the flAWS AWS course to get past the experience catch-22.
- If you work in IT at a security-adjacent company, ask to shadow the testers and learn on the job.
- Write a regular blog post summarizing what you learned; it forces understanding and builds a record of your growth.
- Volunteer for competitions like CCDC and CPTC; regional events welcome beginners and the black team builds vulnerable infrastructure.
- Keep your personal life off corporate email and laptops, because the blue team often has full access to them.
Notable quotes
It's such a catch-22 to get practical hands-on experience, you know, to go to these jobs because, you know, hacking is illegal, right?
we don't just go in and blow the brakes off people. We're trying to actually measurably improve security.
I view security as actually a subset of testing and quality, right? These are testing errors that are so bad that we can exploit them and turn them back on the programmer.
Questions answered in this episode
- How did Dan Borges become a red teamer?
- Dan studied computer science and infosec, then took an IT admin job at a pen testing shop. He learned from the testers, earned his OSCP, became a full-time web pen tester at AppSec Consulting and later moved into internal red teaming.
- Is the OSCP worth it for career changers?
- Dan says the OSCP lab is the valuable part because it gives you a large, interconnected network to attack hands-on. He suggests paying for the lab rather than the training PDF, which he found weak, and says the cert gave him confidence in interviews.
- What is the difference between red teaming and pen testing?
- Dan describes pen testing as narrowly scoped, such as a few web apps over a few weeks. Red teaming covers digital, social and physical attack surface, starts with threat modeling and may be broken into smaller pen tests.
Show notes and links
Show the original episode notes
In this first episode, I chat with Dan Borges, a professional red teamer, blogger, and security tool developer.
Dan Borges discusses his early experiences using and exploiting computer systems, how InfoSec experts work with companies, and the new tools he and others created and released this year!
Episode Highlights:
-
Dan explains how he became involved in information security,
including his introduction to programming through a Lego robotics
program. -
His early experiences as a pen-tester—i.e. a penetration tester, who
looks for system security weaknesses—and why it’s difficult to get
hands-on experience in that field. -
The benefits of becoming an Offensive Security Certified Professional
(OSCP). -
What does a red team do in an organization, and how is it different
from pen-testing? -
Dan describes the day-to-day life of a pen-tester and the kind of
conflicts they can run into. -
A few war stories from the trenches of InfoSec, as well as some of
the tools pen-testers use. -
How being grounded led to Dan’s earliest hacking experiences, and the
ways his parents fostered his interests and mentality. -
What conferences should InfoSec beginners check out?
-
Fun and beneficial ways you can “hack” reading.
-
Dan’s tips for those starting off or looking to transition into
Infosec. -
An in-depth look at one of the newer tools Dan uses for his work.
-
The rules and intricacies of InfoSec competitions.
Quotes:
-
“It’s such a catch-22 to get practical, hands-on experience to go to these jobs because, y’know, hacking’s illegal, right?”
-
“We don’t just go in and blow the brakes off people, we’re trying to measurably improve security.”
-
“It was a constant escalation war, cat-and-mouse like that. They’d take something away and I’d figure out how to use the computer with that limitation.”
Links:
-
Dan Borges’ personal blog: http://lockboxx.blogspot.com/
-
Dan’s LinkedIn: https://www.linkedin.com/in/borges1337/
-
Dan on Twitter: https://twitter.com/1njection
-
Dan and Alex's DEFCON Talk on Gscript: https://www.youtube.com/watch?v=8yjMlMf8NpQ
-
Gscript: Genesis Scripting Engine: https://github.com/gen0cide/gscript
-
NationalCPTC (Collegiate Penetration Testing Competition): https://nationalcptc.org/
-
Outro Music: Missing You by Trash80: https://trash80.bandcamp.com/track/missing-you
Getting Into Infosec:
-
Twitter: https://twitter.com/coffeewithayman
-
YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
-
Book: https://www.amazon.com/Breaking-Step-Step-Starting-Information-ebook/dp/B07N15GTPC/
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
Hi everyone, I'm really excited to have my first episode of the Getting Into Information Security podcast. My name is Ayman Elsawah and here we go. We have our first episode with Dan Borges. He's a longtime friend of mine and we just recorded for some time and instead of doing a part one, part two, I decided to just edit some parts out so we could have a decent episode. Ideally, I'd like to keep episodes to about 30 to 45 minutes in the future. So bear with me as I get through some of these first episodes, which were pretty meaty and had some really awesome conversations. So that, you know, I just want to share. So I'm a kind of sharing is caring kind of person. Anyway, if you also are a sharing and caring kind of person and like this episode, then please share this episode with your friends.
And if you have any questions or comments that you'd like me to answer, please send them to me via email or Twitter. Let's just get to it. Welcome to the Getting Into Information Security podcast, where we talk with information security professionals, learn from their experiences, and find out how they get started. I'm your host, Ayman Elsawah, and today our guest is Dan Borges. Dan is a professional red teamer, blogger, and security tool developer and contributor. Dan, welcome to the show.
Eamon, good to be here.
Yeah, thanks for coming on. Let's just get into it. Can you give us a little about how you got into information security, like paint us a
It's kind of a long story. I have to go back before I was even into information security. So when I was young in grade school, my mom put me in a Lego robotics course, and that was actually my introduction to programming. And that was like pre-high school, you know, this programming, this language called NQC with these Lego Mindstorm kids. And that was really cool, and it kind of opened my world to computer science in general. And that was my exposure to it. And that was originally my first love. I was huge into robotics, and I thought I was going to end up doing that professionally. And it wasn't until college when I really started looking at viable job options. I looked out there, and I was like, well, how many robotics jobs are there?
And there wasn't that many at the time. Yeah. And security was getting really hot and like it looked like, you know, a good field. And it also looked really challenging in computer science. So I made the switch leaving high school and going into college to start pursuing information security.
Your first professional job, I'm assuming, was not in information security. Did you have to do some odd jobs in between until you got, you know, information security in your title?
Yeah, that's a really good point. So then I went to college for computer science and infosec. It was a dual major at East Stroud University up in Pennsylvania, the Poconos. And then when I came out of school, you're right, I didn't get a job in infosec right away. I was part of a security group mailing list, Baja, the Bay Area Hacker Alliance. And I saw a job advertisement in San Jose, in Silicon Valley. And at the time, I was in Pennsylvania. So I took the opportunity to move and interview for the job. But the job was an IT admin at a pen testing shop. So I wouldn't be doing pen testing, but I would be maintaining their tools and IT infrastructure. Interesting. So that was my first job and kind of my intro job.
How did you make the transition? Was it hard? You know, I mean, being an IT, I mean, a pen testing shop, like so close yet so far, right?
Exactly. Exactly. It was very hard. Like I felt like I was constantly trying to prove myself to these guys. I was really burning the candle at both ends. You know, I'd spend all day trying to keep the infrastructure up. And then I'd spend all night like learning, pen testing and reviewing the reports to try and be like them. And it was very difficult those first few years because, yeah, I was doing IT and was trying to do security. Like I was trying to prove myself to this other team. The whole thing was a great learning opportunity because they would then take me on pen tests and kind of Teach me stuff so the whole thing was really beneficial and it was cool to have those guys as mentors would they let you shadow them yeah so i would do a few weeks of it work and then you know they'd bring me on a either an internal or an external and you know i'd kind of be dead weight i would contribute but right it was very much like learning on the job i remember we met at the b-side ctf and that was a really fun experience what was it i think shortly thereafter where you were able to actually make the official transition
Yeah, it was just around there that I ended up going to work for AppSec Consulting in South San Jose. And there I was a full-time web pen tester. So that was really kind of how I made the transition. But I would say I made it. I felt like I was a pen tester at the previous job. You know, I had done my OSCP while I was there with them. And I felt like I kind of learned the ropes. So I felt comfortable when I moved to AppSec.
How was OSCP?
The big issue is, oh, it was challenging, man. That was a really hard one. I think the big thing is with the previous employers, they didn't want to lose that IT admin, you know, that they had raised. So they were trepidatious about making me into a full-time pen tester. Yeah.
Oh, I see. I see. They kept seeing you, though, as the IT admin and not the pen tester.
Right. And I had learned all their infrastructure and maintained it all at that point. So I would have to train a replacement. It wouldn't be easy. Just move him on.
You did the OSCP. That probably gave you a lot of credit at that point to do interviews. Did you try interviewing for jobs before you got the OSCP?
Yeah, I did. And it was difficult, you know, because they always wanted to know, like, what is your pen test experience? And I had a lot of trouble with this in the beginning of my career. It's such a catch-22 to get practical hands-on experience, you know, to go to these jobs because, you know, hacking is illegal, right? So the OSTP and... I just heard Georgia Weidman on Thug Crowd, which is a podcast the other day, and she was saying just eight to ten years ago, there wasn't that many sites like VulnHub or things where you could download a VM and hack it. There was, I think, WebGoat or Metasploitable, just the first few of those. So yeah, OSTP at the time was a great lab where you really got to go in and hands-on and hack things, and it gave you that confidence of, I do this.
Yeah, that's right. That's right. Okay, so talk to us about the OSCP. How was that? I mean, I remember seeing it. It seemed pretty hard. I mean, it is pretty hard, but that's why it's so well regarded, right? Yeah.
The OSCP, in my mind, the best part is the lab. It's that they give you this multi-network lab with like 30 machines in each network, four or five networks. And it's just more than you can stand up on your own and they're all interconnected. You see this wide range of vulnerabilities. It's really great. But I would definitely encourage people to spend their time in that lab environment because the actual training material is kind of weak. It's just like a PDF, I think. And most of that stuff you can just look up online. So I wouldn't pay for the training material. I would pay for the lab.
Okay. Okay.
But it's fun. It's hard. It's really challenging. And I think those things are good because it gives you that hands-on kind of hacking. You hit a roadblock and you have to think about how to get around it.
Yeah.
Have you seen those Pentester labs? Oh, no, it's hackthebox.eu. Have you seen that? It's a website that you have to hack the invite code to get in. But once you do, it's basically like... The OSCP, like the offset labs, like they have a bunch of VMs and you make a VPN connection to their network and then you can hack the boxes. The difference is they're not really like networked or interconnected.
Oh, nice.
They're all like standalone VulnHub machines. Yeah, but it's really nice. It's one of the first nice free offerings that I've seen that can really compete with those offset labs.
That's really good. Would you recommend it for studying for the OSCP?
Oh yeah, absolutely. It's a good like road to OSCP. You know, if you feel comfortable in there, then I definitely suggest the OSCP is like the next, the next big challenge. And it's cool. Like the pen tester labs are free and you do it on your own time. And then the OSCP is like that cert, you know, that, that test.
Cool. Cool.
That's how I look at it.
So let's fast forward to what you, so now you're doing red teaming and you know, if you could help explain for the audience, like how is that different than pen testing necessarily? Yeah.
Right. So now I do internal red teaming. And pen testing, I would say, is very focused, kind of narrowly scoped. You might have an assessment, which is just a few web apps for a few weeks. Whereas red teaming, in my mind, encompasses the entire spectrum of attack surface, which is digital, social, and physical. And we do less physical, but definitely digital and social. And the idea is you threat modeling and you kind of build these different avenues of attack. And then you explore those concepts or those different avenues of attack and you see how vulnerable the organization is to that. So it's less boxed in and you're less constrained by these narrow scopes and specific tests. And you may do red teaming to do this threat modeling and then break out smaller pen tests to kind of build the whole red team together.
But that's it in my mind. It kind of encompasses this wider, broader scope of threat modeling.
Right, no holds barred kind of scenario.
Yeah, and we'll play with rules based on our different threat models and our different scenarios. So we don't just go in and blow the brakes off people. We're trying to actually measurably improve security.
Yeah. And, you know, going back to like a pen tester's life, I mean, there's a lot, I meet a lot of up and coming folks and, you know, the pen tester's life is what they see in the news and they, you know, they think is really glamorous. What I'm trying, I guess what I try to tell them is, you know, pen testing is great, but there are other parts of the field that you might not be aware of, right? So, you know, give us insight, you know, you did pen testing and from my brief experience doing it, you know, there are those days, I mean, there are those days where you get those really good wins, right? But there are those days where you don't. And, you know, maybe just help explain for some of the folks out there that might not understand the day-to-day life.
I mean, I know there's a lot of blog posts and things about it these days, but from your perspective, what's your input on that?
So I'll start with a consulting pen test life is, man, it is rough. In my experience, it really feels kind of like you're always chasing these billable hours. You're always trying to be max profit to the company, which means very little research and constantly doing, you know, whatever the clients ask is, whatever that work is. It also depends very much on the shop, but their time management is usually they put you on a pen test every week. So sometimes you'll be on a pen test for one week and you have one week of reporting. But if it's a really busy season and they're a really fast shop, they'll put you on a pen test every week and you'll have to do your reporting on Friday or on the weekend.
And if you are on a pen test every week and you are traveling, That also means you're traveling on Saturday and Sunday to go to these locations to do the engagements. And that's kind of the not glamorous side that nobody talks about. That's why these people get so burnt out. They're sitting there flying on their weekends. They're constantly doing these engagements where they can't talk about any of the results. They don't get anything to show for it. No research, nothing. It's all an investment and an introspection into this company. And then they write the report for the company. And it's kind of like gone and sealed. So it burns you out really quick is what I've found. There's a lot of people that do it and they kind of just get burnt out and then post that work.
So what I do is I do internal red teaming. And the reason I think that's a little different is it's a little more relaxed. So let's say there's a piece of software that I think is really harmful. I can spend the time to actually reverse that software, maybe develop an exploit, prove that, you know, this software can be leveraged to harm us. And then we can move that out of the organization. And it's not like a quick process. Like, you know, you have to work with IT to understand what is the software? How do we use it? What is a replacement for it? You have to then work with them to get it out and get this new solution in. So it's a lot more of like, it's a little slower. You can do the research.
You're more paced. You can take your time. But it's also, I don't want to say it's more working with other people, but there's definitely more of a team aspect to doing internal security than being a consultant.
Do you have a scenario where you brought something to someone and say, hey, I found this really bad bug and they were just not happy that you brought it to them?
Yeah, all the time. So you'll You'll get people that are like, hey, they don't want you finding holes or flaws in their software. So that's kind of what I was talking about. You have to learn how to work with these people. And it really helps, I think, to take the perspective of we're all on the same team and I'm just helping you improve the quality of the product. So it takes a while to get there socially, right? You have to position yourself on that team. So that takes a little bit. And then I've also had companies that said they won't patch the bug or whatever. And it's something that we use. Then we have to figure out how to work around that or secure the product in another way. And then what do you do with that phone at that point?
So those are definitely challenges. And then I just wanted to say, there's other positions on my team that are less glamorous, that are really critical and really important. We have people that constantly run vuln scanners and that, and they'll be maintaining tickets and tracking software life cycles. I think all that stuff's really important to the security life cycle, and it doesn't get enough attention.
So yeah, tell me about your first computer.
Oh, my first computer, geez. I mean, the first computer... That I guess I ever really played on and hacked with was probably a Nintendo. And then from there, I guess probably the LEGO Mindstorms stuff, like just those little microcontrollers and programming those. And then my first real tower Actually, a family friend built it for me as a Christmas gift. And he had built all the parts. And, you know, I couldn't name them for you today, but that was like my first gaming computer. Nice. And I was still in grade school. And I remember, you know, he gave me the whole parts list, but he had built it for me. You know, he kind of did all the legwork.
Okay.
Remember, that was really cool. And that's what really got me into computing, you know. I don't think I've bought a gaming system since then. I've been a big PC gamer. Yeah. That was my first computer. And now, you know, I have all kinds of weird mismatched computers and like I'll buy old computers. So I have like an Apple II in my closet. Oh, nice. Really? So yeah. I even have one of those voting machines from DEF CON. So I got a bunch of weird computers now at my house.
Sweet. Sweet. That's awesome. That's awesome. Wow. Apple II. That's, that's some memories. Do you have a floppy disk drive too?
Yes, I do. I don't have the monitor though. Okay. So I haven't, I haven't gotten it working yet. Just collect these things.
Wow.
Well, well, eventually I want to get it working when I mess with it.
Yeah. Yeah. Well, when I was in grade school, I was like, that's, that's what I had helpful too. So not to date myself, but.
Oh, cool.
Yeah. Yeah. It's a, it's pretty cool. Any cool stories that you've run into that, you know, you can share with the audience, kind of some interesting war stories. I think war stories are some of the greatest things that people, new people look forward to hearing.
Some of my favorite and the dirtiest tricks are key logging. And I have, you know, this one story. So this was just before the days of BloodHound. And you still had PowerView. And we were using PowerView on a very large, you know, Easily 100,000 to 500,000 host network, a very, very large network. And we were hunting for specific users.
So maybe for my audience, you could help explain BloodHound.
Yeah.
Yeah, sure.
Yeah, let's back it up a little bit.
Sure.
So BloodHound and PowerView are tools that will Kind of query the Windows domain, either the Active Directory infrastructure or just different local machines. Okay. And they'll look for the users and the trusts between different machines. And they'll say, you know, what user has local admin access to a different amount of machines. And BloodHound will actually take that data and then graph that data so you can visualize it. And you can say, like, you know, I just have to own this node and then that will lead me to that node. And then with that node, I get domain admin.
Okay.
So that's kind of where we were without the graph. We had this target in mind and we had to get access to that person's computer and then get their passwords to be them and then move on to another host that we really wanted access to. And we found where they were and we got access to the computer and we were just working on getting the passwords at this point. And I think we even had them at this point. But we were still monitoring the person because they were our target. And I started the story with, I really like keylogging. So we're keylogging the person. And this is the kind of stuff that you get from keylogging that it's harder to get from other security tools. And we saw they opened up their chat client and they start messaging the security team.
And they start going, hey, I think I'm compromised. Some weird stuff's happening. Oh, man. Which is great. That's exactly what you want to see. That's fantastic. Right. Like from a blue team perspective. Right. But that was really bad for us because it means, you know, our whole op was going to get burned. Yeah. We finally got this user who was the keys to the kingdom. So the person's like, all right, I'm coming up to your desk to see what's going on. And we were in the same building and we're sitting there key logging. So we're like, all right, we're going to send people to the desk too. So we looked them up in AD and we found out where they sat. And we sent one of our guys up and he sat there.
He stood there on like kind of the corner of the cubicles and listened to the security person like help troubleshoot the computer while we like factor our infection out of the computer agents.
Oh, man. So that was a pretty fun one. That's hilarious. Oh, and you were able to get out in time?
Yeah, yeah, yeah. We got all the tools off and we didn't get busted. Wow.
Wow. That's awesome. That's awesome.
It was a funny one.
That is really funny.
And I just love that because that's the stuff you'd never get from an interpreter, right? Unless you're key logging or you're taking screenshots and you're doing that human intel.
Yeah. No, it sounds like a Mr. Robot episode. Yeah. It's pretty fun. Yeah. Sounds like a Mr. Robot episode. That's cool. Did you ever, were you ever able to get to main admin at that one, at the one place?
Yeah. Yeah, we did. It was a pretty large one too. That was, that was a really fun one.
Okay. Okay.
And that one, that one, again, we were a full red team in that. So we, we designed all of the, the threat and I was doing it with a consulting company at the time, but We designed all of the threat perspectives, and then what we did is we broke it down into smaller, more manageable pen tests. So we would have an arm of the larger red team was breaking into this network, or an arm was getting DA in this domain, DA being domain admin. So this was one of those... Subset pen tests that we were doing. We were trying to, I think, break from one environment into another environment and use this person to get through that bastion.
I see. I see. That's a hilarious story. Wow. Wow. That's amazing. I'm surprised you didn't spill some coffee on him or something. Like, oh, I'm sorry. I'm sorry. Just try to distract him that way.
Go talk to him.
Spill some coffee by accident.
It was pretty funny because You know, eventually we did start getting caught and the IR team there, they had some guys that were really funny that, you know, they'd get pretty angry. I remember the one guy, I didn't realize until after he'd done it a few times, but he had magnets in the bridge of his glasses. So he wore glasses on the IR team and, The two lenses were held together in the middle by a back a magnet but when you get really frustrated like kind of tear his glasses in half and separate that i remember the first time i saw it i was like whoa like we gotta stop guys like we gotta stop what we're doing he's really pissed yeah exactly oh man that's hilarious
Wow. You can't make that stuff up, man. You just can't. That's, that's amazing.
It was pretty great.
That's amazing. That's amazing. Oh man.
But you know, all the power to blue teamers, like I've been in that role and it's a hard role, you know, so I get, I understand their frustration.
Yeah. Yeah. That's, that's great. That's what it is. You know, that's what it takes. That's awesome. Cool, man. No, what's your, what's your earliest hacking memory that you could talk about at least?
Oh yeah, this is a great one. So flashback to having that first tower and it's in my room. And one of the ways that my parents would try and like punish me or restrict my computer, like would be restricting my computer usage, right? Okay. And they had a number of ways to do this. So for a long time, they tried to do it via software and they'd have an administrator account and they would go and they would change the password to the machines, you know, so you couldn't log in. I remember the first hack I learned Was where you boot it into safe mode, and then you go and you change that administrator password back. So that was, you know, the first hack I really learned. And then they started taking away hardware.
So they would, you know, take away the keyboard or the mouse. So I started keeping, like, small little keyboards and stuff hidden places or little mice. And then I'd have, like, cheat sheets of commands where, you know, I could use a whole computer with just a mouse.
That's pretty cool. That's awesome. Oh, my God.
It was a constant escalation war, cat and mouse like that. So yeah, they would take something away and I would figure out how to use the computer without limitation. Oh my God.
Were they technically inclined?
Yeah, yeah, yeah. My mom is a programmer and my dad is a contractor, a builder. And I think I get a lot of my security instincts from my dad. So yeah, I would say that they were both inclined in that regard to try and stop my mischief. But I was a very mischievous kid.
Oh, okay. Okay. Okay. Do you think, do you think that helped? That's, that's crazy. Do you think that helped sway you? I mean, I guess you've always had a love for technology. Do you think your parents were a big part of that or, was it more like your school having access to computers? Like what was it that made it, you know, that really got you interested? I mean, I guess it's from necessity from your parents restricting you. It's kind of cool.
Well, you're exactly right. I think my parents had a huge influence on me. Growing up, my mom, she started actually in testing, software testing, and she used to test cable set-top boxes, so very direct influence there. Because I view security as actually a subset of testing and quality, right? These are testing errors that are so bad that we can exploit them and turn them back on the programmer. So I draw a lot of parallels there, but But even more so, I'd say like my dad, just from the perspective of he would always, you know, say you can do a better job. Right. He would always say he'd always find some critique like, you know, this is how you can do it better. This is how you can keep improving and keep leveling up.
And I think that mentality really like followed me into security. Right. Where it was like. Well, how could we just improve the process? How could we not cut corners? How could we do a quality job and really deliver the best product?
Good stuff. What's the first security conference you went to?
It would actually be DEF CON. So DEF CON 18 was the first one. I had an internship through college in San Diego at the Motorola PKI lab. And a bunch of those guys were going to DEF CON. And I had never been to any security conference before. Let alone DEF CON, and they all carpooled out. So I got in their carpool and went with them. It was really fun.
Cool. Yeah, yeah. And now there's just conferences galore, right? There's security conferences galore. What are some conferences you recommend for people starting out, right? I mean, DEF CON is definitely on the list, I'm sure, besides. But what other security conferences would you recommend?
DEF CON is almost too big, right? Yeah. You don't know who you're talking to. You don't know how credentialed they are. It's too big anymore. Although I did speak there this last year, so that was super cool and a personal milestone. Yeah, that's awesome. I haven't been to DerbyCon in a few years, like two years, but... I remember when I did go, that was really fun because it was really personal. Everybody would just talk to you and there was no really pretenses. And for the most part, they were all really into the security community. So it was like whoever you talk to knew their shit, which was awesome. They knew a lot. So I really liked DerbyCon. And then I'm a huge fan of the B-Sides conferences.
I think B-Sides... You know, but I do think there are a lot of good talks that come out of them. But in general, I'm a huge fan of the B-Sides conferences because it's put out by people that are passionate about the community and people that are doing it on their own free time.
Yeah.
So I think you usually find high quality stuff there.
You did speak at B-Sides and I liked your talk. It was really good. So I wouldn't say it's my call.
That's true. That's true. So I did like your talk. Thank you. Yeah.
So you have a blog called Lockbox and I'll put a link in the show notes, of course. And, you know, I'm just impressed with how much content you're able to post on the blog, you know, book reviews and, you know, just different tools and things like that. And you also, you mentioned that you did talk at, at DEF CON, which is awesome. You know, so tell us a little about, you know, some of the, you know, that talk and how that experience was for you and how you, how you, how do you get these blog posts out? Like, it's just, you know, how do
That work yeah let's let's start at the blog because i think that's really important like in my career and then it's also just good i think for other people to get involved in so the idea is i started that when i was in college and i was pursuing the security the track and And basically at the time, I felt like my lessons weren't giving me enough stuff to go study or pursue or really sink my teeth into practically. So I started the blog and the idea was I would just kind of do one post a week and it would be a topic that I'm interested in. And what the idea with the post would be is that it would just be like my summarizing thoughts on having investigated the topic. And I kind of use this both for myself to like write things down and make sure I understand it and get that summary.
And then historically to go back and look at it. And then also when I was in college, right around this time, I was starting a security club. So I would do it to write the notes down so that I can share them with people and not have to constantly like rewrite the notes down individually.
Okay.
So that's really how it started as a way to like, for myself, learn things and then also just kind of share it with
I left school I was already in this habit of like pursuing topics to learn about and then kind of summarize and digest them in my way and what started happening is I would run out of not that I would run out of projects it's that my projects were almost too big I would look at these things I'll be like man I really want to do that but that's going to take several months and you know I want to keep like this consistent kind of little chunks digestible chunks of learning So that's where I really started picking up the books and reading the books is I figured I could read like so many pages in a certain amount of time. And if I didn't have a big ongoing project, I could read these books and in the interim, keep learning stuff and keep having content to talk about.
So that kind of pushed me to read like about like two books a month for months. Geez, I don't know how long it's been several years now, which has been massive. Like that's been huge, I think.
Yeah, that's I mean, it's it's amazing. And like, so how do you get how do you get through these books so fast?
A lot of it is audio books. So I'll always have an audio book I'm listening to on my phone. I always have one in the queue and like one I'm actively listening to. And then it's the same with paper books. I always have a book that I'm reading and then like a book I'm interested in a backpack on me. Nice. It's really funny. Like my friends from Philadelphia back home. I just went to see them for this festival we all go to. And they called me Booking Hand Dan because they said I always have a book on me.
Nice, dude. Nice. I mean, that's awesome.
Yeah. But the idea was, you know, I think it was not before I had a smartphone, but the idea was like, you'll get all this downtime all the time, right? Like on airplanes, you know, when you're waiting to take off and all this stuff, like just sitting around waiting. Yeah. Just started carrying around books to read.
Yeah. Yeah, I agree. I recently converted to Kindle. I never thought I could. And I mean, I love it because then I always have all my books with me all the time, whether it's the Kindle app on my phone or Kindle device. So I've been voraciously going through books recently, which is awesome.
Yep. I'll do the same thing. I have the Kindle and I love the Kindle because you can get that On your laptop as well so you can you know read it yeah the same books and it marks your spot between them yeah and i'll like you were saying with the books on tape i'll totally cheat like i'll take that kindle and i'll have you know chrome read the page to me or whatever right i'll i'll do text to speech for that stuff sometimes oh nice that's a good hack that's awesome man yeah i do the same thing with a lot of blog posts too because there's so much to read in infosec so A lot of times I'll start reading the blog posts and then I'll hit a big chunk and I'll text a speech that or something. So it's definitely a good technique.
It's just horrible when you hit like hashes or something. Jesus, you get this robotic voice reading you an MD5 hash. You want to kill yourself, man. It's awful.
That's hilarious. But dude, that is a really good hack, actually. I got to give it to you. That is a really good hack. You just got this long post and yeah, that's awesome. What a great idea. That's awesome, dude.
Yeah, so I get Intel Briefs Weekly, these long summaries of what is the status of the cyber underground, if you will, right? And I text speech those and we'll eat lunch and listen to them every week because otherwise I just don't read them. Right there as well it's just when it hits a table of indicators man it's like oh no my ears backslash five four three two oh my god oh yeah it's it's awful wow that's hilarious i don't suggest that part but the other nice part is same with audible and with the books on tape well less so the books on tape or you know yeah it's with audible and less with the text-to-speech but You can turn the speed up too. You can have it read it faster and stuff. I'll do that with the Audible books is I'll have them read it like 1.25 speed.
Yeah. And I guess if you really want to get into my secrets, I read several articles on speed reading and like what are the techniques of speed reading? And I do apply a few of those when I'm going through the books to do the reviews.
Okay. Awesome. Yeah. Any websites? Just Google speed reading basically?
Yeah. Yeah. Yeah. Like I looked into speed reading competitions and like a lot of the strategies that they use for getting through stuff to get, to get my content in on time.
Oh dude, that's awesome. I think I might steal that hack if you don't mind. Yeah. That's awesome.
Yeah. Yeah. Yeah. A lot of it, I'll just break it down. It's going to sound really cheap, but a lot of it is skimming and then drilling into specific content that you find interesting. Right. So you read the different high levels and then you'll take a paragraph and you, you know, Again, it's going to sound cheap, but you read like two to three sentences out of that paragraph and you say like, is this talking about a subject that I find interesting and do I want to read all those details?
Right, right. Yeah, I hate it when the author kind of drags on and like, you know, yeah, I get the whole story thing, but you know, just get to the point and give me the action that you want me to do. So, or that, you know, you're trying to convey.
Yeah, like I just read this book. It's a Navy SEAL book by this guy, Jocko Willink. Extreme Ownership? Yep. That's it. Extreme Ownership. I thought it was really good. But yeah, he kept segwaying into these war stories. And at a certain point, I just wanted a book on leadership and not a book about his fighting. Oh, I see.
I see. Well, is it okay with you to share some of these secrets with the audience? Because I don't know if it's good. Yeah. Cool.
Absolutely. Absolutely. Cool. Yeah, and that really transformed the way I read because I'd always been a very meticulous reader. I'd read every line and make sure I understood everything exactly. Right. And those speed reading tips really helped me get through that more lengthy content.
Yeah. Yeah. I'm reading a book right now. It's kind of technical and it's just dragging on. I'm really having a hard time finishing it, but I have to finish it because it's supposedly going to help me. But we'll see. It's just dragging on.
Yeah. So I'll even... You know i'll bounce around in a book if i if i hit a chapter that i either want to do practically or you know for whatever reason the content is taking me a while to get through you should see the books i read man they have like at any given point they have like nine bookmarkers and i'm like you know all different color coordinated yeah half the pages are dog-eared like nice i mark these things up left or right nice dude that's awesome you get into it man you got to get into it that's awesome yeah that's good stuff
Report writing like it helps a lot if you take notes along the way as inspiration strikes yeah i guess the most i've done is highlight in kindle like you know i have used notes but maybe using notes i should probably take advantage of that i should probably highlight more i love that feature where it shows you the community highlights like
Especially in the security books like what other people in the industry find interesting yeah in fact i you know i wondered like if i really want to read a book but just want to get my the gist of it just go through only the community highlights i mean that might be a good like precursor before you read a book i know we're going way off topic but like yeah just go through all the community highlights first and then go back and read the book and you'll kind of have a pretext kind of like a minority part pre-recognition kind of thing
I really like that. Like the spark notes. That's why I try to do the, in the cases that I find is helpful. I try to list the table of contents because like sometimes I feel like that's, that's kind of cheating, right? It's like looking at the skeleton of the book and, and seeing what are the subjects they're going to touch on.
Yeah. Yeah. And, you know, for book authors, I really like when book authors, I see them starting to do that now, put summaries at the end of the chapters. I love that because it kind of just wraps everything up in a bullet point form because you already read the full content. And now when you have the chapter summary at the end, wow, that's just great. And then you could go back and just skim through the summaries and figure out where it was, you know?
100%. And the other thing I really like, Kim Zetter did this a lot in Zero Days, the Stuxnet book. She has references that link to the blog posts on reverse engineering the malware. So I thought that was incredible. Here's all the technical details on the internet where you can get to them via a link, but not in the book. Yes.
Yes. Exactly. Exactly. Why waste pages in a book on that? Exactly.
Exactly. That was so cool. One really interesting thing. And this is a tangent that came out of all the book reading was I got really big into comic books. So I just got tired of like you were talking about reading all this fiction and like dry, dry books all the time. And I just wanted to, you know, I got big into reading at that point, but I didn't want to read dry text.
So you're getting you in comic books now.
So that was a weird. Yeah, it was like this weird thing that came out of the whole thing where I had all these books on me and I wanted to keep reading, but I almost burnt myself out on reading technical books.
Yeah, yeah. So how do you stay up to date on current topics?
Oh, great question. So I like to subscribe to a lot of blogs via RSS feeds and an aggregator into a Slack channel. But in general, there's some blogs that I just always stay up on. And then... Even more in general than that, like Reddit net sec or Reddit reverse engineering, like just constantly quality posts being posted there. And those are really good communities. And then more recently, I've been looking for really healthy communities like. Like social media communities that really support each other and just generally like really good infosec social community social media communities and i found peer list is pretty fantastic i'm not like super active in it yet but i'm a big fan of it and now a message from our sponsor and it was i don't know if this is exactly platypus con but
There was this Australian conference that I was enamored with where you had to bring a laptop and you had to do like a hands-on activity. And then all day we're just different workshops and everybody kind of like broken up into all these different workshops.
Okay.
And I don't think there was talks.
Okay. Oh, not even talk. So just workshops all day long. That's awesome.
Yeah. I think the whole thing was like hands-on focus.
That's cool. I mean, the good thing is there's a lot of resources out there now on the internet for folks. It's just kind of like finding those resources and finding the time. And then, you know, what you mentioned earlier, you got that catch 22, right? Is you need security experience to become a security person professional, but in order to get security experience, you need to be a security professional. So, you know, I think with the proliferation of cloud and stuff like that, it's a little better where you can test some stuff out. But still, what are some recommendations that you have for some of those that are looking to transition or, you know, just starting out into information security?
So I think you're right. Like cloud is so cool. You have all this really cool stuff going on there. Yeah. There's this flAWS course, and that's like a how to hack AWS pen testing course that I think is really high quality and good. And then more in that same direction that we were talking about earlier, like the hack the box EU stuff. I really am a big fan of these things called Pentester Labs. I think it's pentesterlab.com. But they have... Topic-specific VMs. So let's say you're weak on SQL injection. They have multiple VMs on different levels of SQL injection and how to get better on that. So I'm a big fan of that because I think as you do CTFs and as you do the different things in your security career, you'll realize the extent of your knowledge and what plateau you're on.
And then at that point, you have to go do targeted learning. So you have to say, this is the subject I need to go learn. And then finding these sources that offer that targeted knowledge is really helpful.
Yeah. I really think that B-side CTF that we first met, that was just a wonderful CTF. It was well-written, not terribly hard, but not terribly easy either. Progressive, right? It kept, what is it called, when it's going to different levels. So, I mean, I think that was great. I think that's great. Yeah.
Yeah. I can't agree with you enough there, man. I really want to echo that. A lot of these CTFs are just too hard. And they're tailored to this really high-level audience. And I feel like You need to land somewhere in the middle, right? You need to get wind under your belt. You need to verify these techniques you've learned work. You need to learn how to modify those a little bit so more easy wins. And then you need to pressure yourself to learn new material, which are those harder wins. But at the same time, you shouldn't be spending 48 hours and solving one CTF challenge. I don't think that's a great use of anybody's time.
Yeah, not to mention that You know, a lot of the jobs that we need are on the blue team side, right? So, you know, where's the practicality in that? Not complaining, but I'm just...
Absolutely. A blue team CTF would be cool.
Yeah, a blue team CTF. Exactly right.
I've heard that sentiment echoed a lot recently, right? Which is... These CTF challenges are really obscure and niche and focused on red team exploitation or whatever, like you're just reverse engineering. And where's all this hunting and this rule writing and all the log pipelines and kind of that stuff we were talking about before, that there's other security jobs that don't get highlighted enough. That are really out there.
Yeah. Yeah. I mean, for me, you know, I'm a builder, not a breaker. Right. So, yes, it is good to know how to break things. No doubt about that. But, you know, am I going to am I going to do any reverse engineering? No, probably not. So, but, you know, am I going to do some forensics? Do I need to know, you know, you know, fat tables and, and, you know, going through exit files and whatever it is, right? You know, forensics, forensics I love. And I think as a builder, you do need to know some sort of forensics because it's kind of like part of the process. It's part of the process, right? You know, maybe they're starting to, but you know, it'd be nice to see a CTF that says, here's an IOC, right?
Go find it, you know, or, or something like that.
So that'd be so cool.
Yeah.
Yeah, absolutely. Yeah. That'd be so cool, man.
Yeah.
And I've heard that echoed a lot, right? And it's, it's kind of what we were talking about at the very beginning, which is, I feel like We need to highlight that stuff just to bring more attention to those other jobs, you know, those other fields.
Yeah.
Or other roles in the field, rather.
Yeah. Hey, so tell us about what you did at DEF CON. How was that experience for you? Oh, yeah. Tell us about, you know, the tool or the code that you wrote. Walk us through all that if you can.
Over the last two years, I guess, I'm just going to summarize it big and broad. Alex Levinson and myself and several other people like this guy, Virus, we've been writing this tool called GScript. And it's gone through many versions and iterations, but we just released our major 1.0 release at DEF CON this year. So that was my first... Yeah, yeah. And that was my first time speaking at DEF CON. It was his first time speaking there and Just a huge milestone, I think for both of us. Yeah. Yeah.
Congratulations.
The tool got a lot of traction. Thanks man. Yeah. It was really nerve wracking getting ready for the talk and then obviously preparing the tool, like a month leading up to it, it was like all I could think about, you know? So for a long time leading up to it, I was really nervous about it. But it all went smoothly and you know, I think it went really well. And so not only did we do a talk, But we spoke at besides the Las Vegas just before DEF CON. And then we had a four hour workshop on G script, the day after the talk. That's awesome. So super busy DEF CON. That's awesome. Way too busy. Yeah, but it all, it all went really well. And, and the new G script release is way cleaner than the previous versions.
We worked out so many bugs and it has crazy new features. And, I, I think we got a lot of people interested and they came to the workshop and we've seen a lot of involvement on the page since. So I'm really, I was so happy with the whole thing. I feel like it was really a big success for us in releasing the tool.
That's awesome, man.
I'd like to talk about the tool a bit if I could.
Yeah, that was my next question, actually. So yeah, go for it.
Basically, what you have to understand is where this tool exists and how we use it operationally. So we had written it for the CCDC, the Collegiate Cyber Defense Red Team. And that's a competition where you have a bunch of students that protect these networks and they have to defend these computer systems and these networks from a red team, which I'm on, where we pen test them and we simulate a breach. So in that environment, everybody brings really cool malware. They bring all these post exploitation tools. And what we wanted to do is we wanted to create a tool that could Effectively apply everybody's implants to everybody's teams so that means like if we have just in this example five custom implants can we wrap all of these into a single script that drops all these so we were doing this for a number of years with these things called jericho we had one for linux and we had one for windows and it was basically like you know a batch or powershell script that would pull these assets down and like run them in memory or do whatever
But this actually started coming back to bite us. And basically, we would have student teams forensically reverse these scripts and figure out all of our exact tactics. So about two years ago, we moved everything to Golang because you couldn't reverse engineer it. And we worked on this original version called Genesis. Where we would have an SMB share and people would put all these binaries in the SMB share, and then we would bundle them into this Golang binary at compile time and then redistribute this binary to everybody. So people would have just a native binary for Windows, like a.exe, or for Linux, like a.elf or whatever, just a native binary that can run on that system. So that worked really well, except for the fact that we were kind of just like taking this bag of malware that we got from everybody on the team and just kind of like dumping it on the desktop and running it, right?
Like it's very crude the way we would just drop everything and run everything. So the next idea was to attach a script to all these payloads. So now each payload would have like, I like to think of it if like before we had a cluster bomb, we were just dropping this bomb with lots of little bombs in it. Now each little bomb has individual targeting, so they go find their target. Yeah, so that's where we got the MIRV analogy, right? Like, if you had missiles before, now we've packaged them all into this, you know, multiple independent retargetable entry vehicle, this MIRV super missile.
Exactly. And if we if we pull it back and we look at like the theory of the kill chain or whatever, right, like I would call this a dropper. So what we're doing is we're hitting disk and we're dropping all of our other tools and then we're just saying how they run specifically on disk. So that's kind of G script in a nutshell. It's a dropper. It lets people take packages and then attach a script to them that says how they execute. And we used this ccdc this year in 2018 we had written it all at the end of 2017 and we used it at nationals i was kind of the g script czar like i managed all the persistence for the whole ccdc national red team it's really cool i had like this whole spreadsheet like yeah showing like what each payload contained and exactly what it would do nice and these were crazy payloads man you would
You would execute one and you would see like five child processes. And then each of those would have five child processes come off of it. Like you would see this execute. You just never want to use this computer again. You're like, Oh, well, that's definitely impacted now.
Okay. That's all bad. But very noisy though. Very, but you weren't trying to be noisy, I guess. Right. I mean, we're trying to be stealth at least.
Exactly.
Okay.
Well, you call out something that's amazing that I wish more people would recognize is this is absolutely the shotgun approach to infecting something, right? And all they have to do, if they're really smart about it, and I've been saying this for years, I just hope somebody listens at one point. All they have to do is find ways
Indicator will say they've run Jericho on this or they've run gscript on this and the entire box is compromised so I don't need to know what the rest of Jericho or gscript is doing because this one indicator is like my canary in the coal mine right and what they should do is just nuke and pave the box because we do a lot of nasty stuff right and they're not going to figure it all out right they don't have the time to reverse engineer all of it right there in the competition so they should roll to a backup or you know They should understand that it is compromised in a very bad way.
You've been going to CCDC for a while now. I remember meeting up with you one time and you were about to leave for it and you were just preparing your payloads and things like that. It sounds really fun. Is it something that new people can try out? What would you recommend? Is there anything to recommend there?
Yeah, I think CCDC is an amazing program, you know, like, so I volunteer for the Western regional red team. And then I also volunteer for the national red team. And I've been doing it for about five years. And I think it's an absolutely phenomenal program and it's largely put together by volunteers. And there's a lot of room for anybody to get involved. So you can jump on the red team and we're always taking new people like, you know, at the national level, we have to take really highly skilled people because we all have to be effective and it's a small team. But at the regional level, we're constantly taking on new people and especially for the invitationals, like, you know, just sign up and you're good to go.
But at the regional level, I feel like a lot of mentorship happens. Like if you're new to pen testing, it's a great place to join and meet other really experienced pen testers. And they'll show you a bunch of skills and like definitely a great place, I think, to learn and collaborate. So I'm really encouraging for people to sign up and volunteer there. And then also on the black team, like you were saying earlier, you're a builder, not a breaker. I know on the Western regional black team and black team is infrastructure, by the way, they
That everybody plays on.
Oh, okay.
But they don't run the game per se. There's white team, which runs the rules and the scoring and the game. But black team is kind of this independent team that builds the environment for every competition. So they're always taking on volunteers. And I'm a core organizer for a different competition that we started called CPTC, the Collegiate Penetration Testing Competition, which we can get into in a minute. But On that team, I'm like core black team. So I build the infrastructure. And that is a super fun job building infrastructure because you're building vulnerable security infrastructure. So, you know, like you learn about the hacks and you're kind of weaving the hacks into it. Wow. And you get to be creative and build fun, you know, internal crappy stuff.
So it's really fun.
Yeah. Yeah. Wow. Wow. That's, that's awesome. So that's when you get some of the, you know, the older Netgears and the older Linksys routers that can't be updated and just throw them on the network. Yep. Old Cisco. Exactly.
Exactly. Yeah. That's pretty cool, man. That's a riot. So we should just dive into that. I'm a core organizer for this competition, CPTC, the Collegiate Penetration Competition, which has run out of RIT just this last year. I want to say we became official and we became a 501c3 and we're like a nonprofit organization. Knock on wood. I don't know if that's exactly accurate, but we have a director now and it's kind of, I think it's our, our fourth year total doing it. It's my third year being part of the group. And, yeah, I'm a core organizer for the black team. So I helped build out all of our infrastructure there. And then I'm the lead for our OSINT team. So, Leading up to the competition, I build an entire fake social media presence for these companies.
And we put together fake websites and we put it all out there. And we let people do OSINT on the company and find real vulnerabilities, real things that we leak. I think last year we had an SSH key published to GitHub. We had internal network diagrams on Pinterest.
That's awesome. That's awesome. That's really good. That's really good. Yeah, it's a fun one. What's the format? Is it in person? It's all online?
Right. So for that one, just last year, we started doing regionals. So we have three regionals, West, Central, and East. And then out of all those competing teams, they have to go physically somewhere. I think East Coast, we did at State College last year at Penn State. And on the West Coast, we did it out of the Uber HQ in San Francisco. Oh, nice. I forget where it was for Central. Yeah, that was really fun. And then... That all accumulates into 10 teams going to nationals, which is at RIT in November. So this is, it's coming up in a few months. And we still need lots of volunteers. If anybody wants to get interested, involved, we need volunteers on the black team, on building things. And then on like my OSINT team, we can use help.
So yeah, You know there's there's tons of opportunity to get involved in that competition and i'm like i was saying i'm a core organizer so it's much easier for me to get people involved in that than with ccbc awesome not that ccbc is some great organization and people shouldn't volunteer for it yeah but no i have very direct connections with cbtc okay that's awesome and like should they just go to the website to volunteer or would that be a good way yeah they can just read Reach out to me. I think that would be the best way because I can directly plug them in. They can definitely go to the website. Like for CCDC, I would say the best way to get involved in either program would just be reach out to me and I can put you in direct contact with team leads.
Cool. So do you have one more story that you can share with the audience? Because I'm sure you have thousands.
I had built in email IDS while I was at Uber. And you see some crazy things come through email. So pretty much that was going to be the moral of my story is be careful what you send through corporate email, right? If you're signing up for new services like blind or gossip services or things like that, all of that's going to go through corporate email. All of that has a paper trail, like a very, very trackable paper trail or like, If you get caught into any kind of litigation, that all gets caught up in e-discovery. So it will likely be discovered at some point just based on keyword searches, right? So corporate email can be very tricky. And I see a lot of people take personal things in and out of that.
So just be very careful, you know, the things you send through corporate comms, because oftentimes the blue team has full access to that stuff, unencrypted stuff. Just something to be aware of.
Yeah. Yeah. I definitely can understand that. I had to set up DKM and SPF for a company one time. Large, very large company. And some people would decide to put or post Craigslist, like respond to Craigslist ads using their work email. And I mean, yeah, it's anonymized through Craigslist, but it's not anonymized to me. And I'm like, and in the email, right, Craigslist puts in the original posting URL. And we're talking about like, you know, personal ads. They were responding to personal ads online, like during work. And you can see a timestamp and everything.
There you go, man. That's a great story. That's a funny one. Yeah.
Yeah. I mean, you know, it's just like, come on. Like, really? And, you know, for DKIM and SPF, you have to touch all the email headers. And, you know, I'm like trying to look at all emails that are not DKIM signed. And there's all these Craigslist emails. I'm like, oh, my God. And they're not safe for work, right? Some of them are not safe for work. And so I'm clicking these links. Oh yeah and I'm like oops and oh thank god nobody saw it but like it was just come on come on people right oh yeah man I've
I've totally been there. So, yeah, I've done forensic investigations where, you know, we're trying to find what this person was doing at a certain time of a certain day. And they sunk their iPhone to, you know, to their iTunes on their corporate laptop. So we have all their pictures from their iPhone, you know, and looking through those date times. And, yeah, you come across some crazy stuff. So really a cautionary tale, like keep the lives separate, right? Yeah. If it's your work laptop, don't plug it into it. Don't take personal stuff to it.
Yeah.
Have you ever had... Because, yeah, all these forensic tools.
Have you ever had someone come to you saying their device has been infected and then you go and you say, okay, let's take a look and them actually decide to take their device back once they realize that you're going to go do a deep dive on their computer? Ever run into that?
That's really funny.
Yeah.
I've done the reverse. We've done reverse psychology when we're going to go get a laptop. So I've gone to somebody and I've been like, you know, when we suspected that they ran a tool maliciously, we've gone to them and we've said, hey, you know, we saw this tool running. We think your laptop's infected and we need to take it and do a forensic deep dive on it. And they've been like, no, no, no, no, no. Don't take my laptop. That was me doing this thing. I was like, cool. You just admitted to it.
That is funny. That's awesome. That's awesome.
Yeah, I always loved that one. A little reverse psychology.
Yeah, yeah. Good stuff, man. Good stuff. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
