David Scrobonia Lifelong builder, Appsec Engineer, Creator of ZAP Heads Up Display

David Scrobonia0:00

And so I went from like no knowledge of any of this stuff to playing with Metasploit and Retroperter, you know, attacking old XP images on VMs and just being able to learn so much in that short time. And what seemed like black magic suddenly had me like, oh, it's really not that hard. I immediately fell in love with it.

David Scrobonia0:56

I was like, I know nothing about computer networks. I was like, well, go read man pages, go Google. I was like, all right. And so I spent the summer teaching myself TCP and all those basics and ended up building out a couple of Android applications, actually.

David Scrobonia1:15

What I found surprising from not being involved in these projects to being involved was Is by how few people manage to maintain these things and how big of an impact you can have.

David Scrobonia1:30

Don't underestimate yourself. I know I personally have had like a lot of trouble with like the imposter syndrome aspect of it.

David Scrobonia1:45

Yeah. So I do security engineering at a company called Segment in the Bay Area. And Segment is a tool for consumer analytics to help companies understand their customers. And working on the security engineering team, it's a combination of application security, cloud security, and product security. We kind of just mash all those responsibilities into one team, and there's about five of us on it.

David Scrobonia2:14

I have more of an application security background, but learning a lot more about those other two disciplines as well.

David Scrobonia2:26

Probably like 60% AppSec, 40% like cloud security. Okay. We're starting to mix in our product security projects right now. And my coworker has been working on some cool projects in that area. But so far, we've mainly focused on those two things.

David Scrobonia2:48

Yes, application security, we're focused on protecting our web application. And it's interesting that people can approach, I think, that role from a lot of different angles. Like some people think it means spinning up SAS and DAS tools and getting results and feeding that out. But our security program started just over a year ago. Okay. And so we've been focusing a lot on how we can embed security, not only in the culture of our engineering teams, but then also providing secure by default tools, a lot of developer training, and then also figuring out how we're going to scale things like vulnerability triage in a bug bounty program and things like that, really putting like a base layer down.

David Scrobonia3:32

Yeah.

David Scrobonia3:38

Yeah. I think it's interesting. There's a lot of people in infosec, definitely a lot of people I respect who had, I think it's like that really cool, gritty infosec background, right? Like they started in IT or, you know, they're playing in terminals when they were six, all that sort of stuff. I mean, I got into computers mainly when I was in high school through our AP computer science class. Okay. I was fortunate enough to have a great professor to teach us that stuff. But I mean, at that point, it was Windows, Java, and Swing, you know? It wasn't those typical skills you need for infosec.

David Scrobonia4:13

I enjoyed playing on them. Right. Did some like lightweight stuff. I mean, I think I played a little bit of basic, but I was most interested in architecture. And my dad is a mechanical engineer by trade. So did a lot of like building in the garage.

David Scrobonia4:29

That's actually a good question. For my first car, we were thinking about fixing something up, getting something beat up and fixing it up because my dad has been working on cars for a while. But we decided to actually build an electric car. Oh, nice. So there's this kit you can buy online and you get this forklift motor and you just get a bunch of batteries and some super loose instructions on how it's supposed to be wired together. Yeah. And so we got this super beat up Porsche 914 for a couple hundred bucks out of some guy's backyard. Wow. And it's a perfect car for it because it's got a mid-engine. And so you actually have a front trunk and a back trunk, which you fill with 15 golf cart batteries.

David Scrobonia5:23

Yeah. Yeah, still running. Still good to go. He's replacing the batteries now. But yeah, it's pretty funny. People in town see him zip around. That's awesome.

David Scrobonia5:42

Oh, yeah, I think so. A lot of times my dad would want to build things in the garage and teach me how to use different tools. And one of the things that I was always doing in high school was the science fair. And we'd always do the Rube Goldberg machines. Are you familiar with those? Walk us through that. Rube Goldberg machine is supposed to be this like intentionally elaborate contraption to do some simple tasks. So it might be something like write a note and put it in an envelope. But you create this series of, you know, 20, 30, 40 steps with like marbles falling down and spinning other things and knocking down things that kind of make this simple process extremely complex, I guess. So yeah, me and my friends are always kind of building those sort of things, you know, looking around the garage, what things can we strap together, spin in a weird way to make these things work.

David Scrobonia6:26

I don't think so. I was always interested in building things one way or another.

David Scrobonia6:37

Yeah. So I went to school at Cal Poly in San Luis Obispo and went in as a computer engineering. So it's like half computer science and half hardware.

David Scrobonia6:46

Thinking at the time, I want, you know, because I'm kind of like playing with my hands, I want to do more hands on stuff and quickly fell in love with the coding side, as a lot of people do. And while I was going to there, there was this guy, John Wright from Raytheon, who came one weekend and he was hosting a full weekend, three days hands on workshop on intro to hacking. And I had to check it out.

David Scrobonia7:09

It was awesome. It was the full range. I mean, it was working in a lot of the information warfare stuff for Raytheon. And so I went from like no knowledge of any of this stuff to playing with Metasploit and Retroperter, you know, attacking old XP images on MVMs and just being able to learn so much in that short time. And what seemed like black magic that suddenly had me like, oh, it's really not that hard. I immediately fell in love with it.

David Scrobonia7:36

Not really.

David Scrobonia7:38

I mean, the closest thing to it was creating those little like replicating batch files and making one of your friends open it so he could crash their computer. That's hilarious.

David Scrobonia7:59

Yeah, it must have been towards the end of my freshman year.

David Scrobonia8:10

Yeah, I immediately fell into it. And I was fortunate enough to attend Cal Poly on a scholarship. And part of the scholarship was that it was put together by this group of people in various engineering disciplines. And one of the guys, he was the CEO for this company called Parsons. And a subsidiary of Parsons is a cybersecurity firm. And so when I mentioned I was interested in this, He passed my resume along and I worked at this company called Sparta, a government contractor.

David Scrobonia8:38

And yeah, that was quite an experience getting into the government contracting world and the world of security clearances. It was out in Virginia. Oh, okay. And so they weren't really used to having an intern program per se. So when I was there, it was like a lot of older folks. Hey, what are you working on? Just trying to be friendly and learn things. Yeah. Why are you asking? Yeah.

David Scrobonia9:21

It was interesting because, I mean, still super new to computer science and without like this, like this background in it. So, you know, they wanted me to start doing some network stuff. And I was like, I know nothing about computer networks as they're all go read man pages, go Google. I was like, all right. And so I spent this summer teaching myself TCP and all those basics and ended up building out a couple of Android applications, actually. One, to work with the PCAP library, and you plug in a Wi-Fi card into an Android tablet, and then it was just doing packet snipping. But as far as these guys were concerned, there was no Android app out there doing that yet, because no one had just bothered to take the PCAP library and put it into an Android package.

David Scrobonia10:11

This would be the summer of my second year.

David Scrobonia10:13

And so I was working on that project and then worked on another one, some training software for military running drills, and it would kind of show GPS dots along the map, which is pretty neat. Okay. But yeah, definitely showing the wireless sniffing on Android tablet was a pretty cool project to work on, just going from not knowing networks to now just like watching traffic flow by. Certainly, it was a huge learning experience for sure.

David Scrobonia10:46

I remember reading a lot of not pretty docs. So I think it was quite a few old documents, quite a few man pages, and definitely some help from the people there for sure.

David Scrobonia11:04

Like I had to learn like from now, from blank?

David Scrobonia11:08

Oh, man. Yeah, I guess I would start Googling and asking friends. I guess luckily now I do know a lot more people in the community, which is, you know, a great resource.

David Scrobonia11:34

Yeah, I was super fortunate that I think it was after that summer, our school hired a professor just dedicated to security for the first time.

David Scrobonia11:42

He said it'd be interesting that going up and asking, you know, what classes are going to be offered. And he recommended I actually take Dan Bonet's cryptography class on Coursera. Oh, yeah. It was just free online.

David Scrobonia11:53

And he mentioned that, oh, and I'll help you through it. I'll give you some exercises on top of it, but do that and I'll give you credit for it. I was like, oh, fantastic.

David Scrobonia11:59

Wow. Yeah. And that's it. So I guess you're mentioning if you didn't know anything, you're trying to get in. Of course, there's a fantastic resource. And specifically if you're interested in cryptography, Dan Bonet's course is phenomenal. Yeah, it is. So yeah, I did that. Started working with him on developing some labs. And it was another example of Not knowing simple things and kind of learning them was that the professor wanted me to create some labs with just a basic server, right? And so he says, oh, can you set up a server, you know, with some Git and Post endpoints? I was like, what's Git? What's Post? What do you mean? And he kind of looked at me like, what do you mean? Like, you don't know HTTP?

David Scrobonia12:39

Right, which is super interesting. Yeah.

David Scrobonia12:43

And so it's like, I don't know how to set the server. And so going from, again, from zero to being like, oh, that's how web server works. It's just a program. And it just listens on these like silly protocols, like not that hard.

David Scrobonia12:53

Before you know it, right? Like it seems so daunting.

David Scrobonia13:00

Exactly.

David Scrobonia13:01

So you did that project. Now you're learning web.

David Scrobonia13:05

Learning web and got really into that. And then I worked for an internship at a company called MindBody. They're a mobile app and a web app for booking like yoga classes and gym studio stuff.

David Scrobonia13:16

And I was the first intern there on the security program. And that's where I learned all my AppSec chops and definitely kind of started honing in on that field in security. Okay.

David Scrobonia13:32

The role became available, which I think what initially pulled me into it. But then once I got into it, I think just because apps are so complex and always so public facing, I find security with them so interesting. I mean, there's an infinite number of business logic issues that can be described, right? And there's just so much attack surface there. I think something about that really caught my eye.

David Scrobonia13:59

Exactly.

David Scrobonia14:06

And it was cool there. I mean, that's when I started understanding all the intricacies of XSS. And one of the things they're working on, because they were at.NET, but before that, like ASP shop.

David Scrobonia14:18

And so they're transitioning out of like old school ASP written by two, you know, business folks in a garage that turned into this full company. Right. They're working on converting this, you know, over to.NET, but there's still a lot of legacy stuff in there. And so, like, the XSS protections and libraries are so much different than what I'm used to now, which is, you know, you use React and you can forget about so many things, right? Because you have automatic output encoding.

David Scrobonia14:50

Right.

David Scrobonia14:53

Right.

David Scrobonia14:54

Yeah, with cross-site scripting, the best way to prevent that attack from occurring is to encode your output. And so what that means is that when the browser gets all the code that you send it, all the HTML, any user information that's being rendered in there, you want to be encoded in a way that the browser doesn't interpret it as code, but instead interprets it as text. And so a lot of languages, you kind of had to do this yourself. Every time a user says, here's my name, you need to properly encode this thing before you display it on the website. Or else if they put, you know, some script tags in there, your browser will think it's code and run some JavaScript. So with React, because it's this framework, it actually manages a ton of this for you.

David Scrobonia15:54

Yeah.

David Scrobonia16:02

Definitely not. I think with modern languages and frameworks, we can solve classes of bugs, which is awesome. Like those protections should be built into modern frameworks, SSS. But as our stack evolves, so do the challenges. And so even though we lose those things, like server-side request forgery, SSRF, is becoming much more prevalent. Everyone kind of moving towards the cloud and a lot more distributed systems and microservices and things like that.

David Scrobonia16:40

That and I'll say, I don't know the percentages, especially because I live in the bubble of the Bay Area, but there are still a lot of old tech running. There's still a lot of companies not using these frameworks anymore. Me and my coworkers on the security team say, you know, we're kind of in a privileged position, right? We've got one application and it's, you know, in modern languages. And, you know, we'll talk to some of our friends in the industry and, you know, they're working at places where they have hundreds of applications all running, you know, older code bases that are just, you know, littered with these kind of issues. So still plenty of opportunities out there. The world will be a long time before the world's perfect and secure.

David Scrobonia17:33

Yeah, I'll definitely start off with a bad interview story.

David Scrobonia17:38

One of my, I had an internship in high school and as a part of that project, I wrote an insane VB script on the backside of Excel. There's an engineer there who wasn't doing computer stuff by trade and hacking out a script and it would take 16 minutes to run and it would take all these inputs in this field and create this like 400 page PDF. It was like this insane block of code. And so I went in there, you know, cleaned it up, sped it up so it would run, you know, quickly. But part of that was changing some of the SQL queries. And all I was doing was kind of copying, pasting, tweaking. And this was all of my SQL experience still through like going into college. I mean, I just never had a project where I was playing with that stuff.

David Scrobonia19:03

Oh, yeah. I mean, I appreciate that. I mean, getting up to that point, just having the professional experience and having the perspective of what that looks like from the interviewer side. And nowadays, I mean, that makes a lot more sense to me having interviewed people where it's, I care less about a long list of items on a resume. Mm-hmm. And really, it's just going to be a few projects that you've worked on, and then like passion for it. Like those two things. It's like, okay, you've got interest. Like, you know what you're talking about. You're not trying to like, trying to say you know more than you do. And those are the only things I think are really that important.

David Scrobonia19:37

I think that was definitely the worst one. Okay. Yeah. Yeah. And then as I was getting ready to graduate, I decided to do this four plus one program at Cal Poly. So stayed to get my master's degree and spend one more year doing just security stuff.

David Scrobonia19:54

Yeah, yeah. And so before that, actually, I did a summer at Raytheon internship there. It was through this original guy, John Wright, who had done the workshop, really got me into infosec. And he'd come back, I asked him and an internship there and I got to spend the whole summer. They put a DJI drone on my desk and said, hack this.

David Scrobonia20:15

And so it was a lot of fun finding the developer port in there and finding out that their encrypted communications were this home-baked encoding system. And so it was a lot of fun playing with that. And they gave us two drones. And so we flew them both up and strapped a Wi-Fi pineapple to one just basically to have the Wi-Fi card on it. But then because they were using these pseudo-encrypted communications... Send it information to say, you know, head to this GPS point, which was like longitude, latitude, but also altitude. So you say go to altitude negative 400. And then the other one would just like go straight down and crash.

David Scrobonia20:55

For that interview too, I actually did forgot. This one is arguably worse.

David Scrobonia20:59

When it was me and another kid from school, we went down there for this interview and they told us to get a rental car. And so we've been in this hotel and we're driving to the interview, which I put in my GPS, right? And it says it's like a few blocks away. It's like, that makes sense. And the other kid I'm with, he goes, oh, whoa, this is like 10 miles away. And we're in traffic. It's going to take us 30 minutes to get there. And we're like 15 minutes supposed to be getting interviewed. We go, oh, no. And I panic. So we turn, we get on the freeway. And we were in El Segundo. So we hop on the freeway. This is in LA. And we're driving. And we go freeway. We go to the address. And we look, and it's this beat up old apartment building.

David Scrobonia22:32

Yeah, that was extremely fortunate. I'm glad to had a good sense of humor or else that would not have gone over well.

David Scrobonia22:46

The interview process for this one was pretty interesting. And this is where I think with all those things I've been working in the security industry, but I didn't really feel a part of any security community. And when I was working on my master's thesis, I stumbled across the AppSensor project. Have you heard of the AppSensor project?

David Scrobonia23:06

OWASP AppSensor project is an application layer intrusion detection system, which is a really fancy way of saying that it was a way to kind of monitor your web application. And so the way it'd work is you put these little snippets of code in interesting parts of your server. So, you know, on failed login attempts, for example, and it would just send kind of requests to this App sensor server you're running, it would say, hey, someone failed to log in. But you could build these things and say, someone failed to log in 10 times in a minute. You should probably get alerted about that. A similar process project contributed to it. It was an open source project. And it was the guy who was running that project, John Melton, who really introduced me to a lot of people in the industry.

David Scrobonia24:35

Yeah. Networking and the open source community. I have nothing but good things to say about the open source community. It's certainly led to where I am now, for sure.

David Scrobonia25:00

Yeah. So ZAP, attack proxy, if someone's not familiar, it's a tool which you proxy your traffic from a browser running on your computer to some server. And you can use this to do a bunch of application security testing. But the hassle with it is that you've got this swing application open on one side on your desktop and your browser open on another. You're kind of going between the both of them, like intercept HTTP requests and do other things. And so the heads up display for ZAP Takes all that functionality and puts it right in the browser. So the idea is that you'll have your browser open to the application that you want to test. You'll have these buttons kind of appear on the left and right side of the screen.

David Scrobonia25:49

One of the motivations for the project was that we want developers to be able to use security tools, but it's such a hassle for even security professionals to use some of these tools because they're just not really built with user experience first. It's like, why would we expect, you know, Asking a developer, hey, can you run this before you finish your test? It seems unfair. And so we wanted to design this so that whether you were new to security, whether you're a developer, you're QA, whatever your needs were, we wanted this to be a low floor way to start getting involved in testing your application.

David Scrobonia26:23

From my perspective, this actually started back in school. Me and a couple of friends were, you know, we had a project for a class and we wanted to create this vulnerability visualizer, right? We wanted to kind of just highlight forms in a webpage that you could attack with, that you might want to attack. And we worked on it for a little while. I mean, it was really ugly looking and didn't really do a whole lot. But there was the Google Summer of Code project This program where you can submit an idea to an open source project. And if they pick your idea, they'll give you a small grant to work on it. And so I took this idea and I submitted it to the Awesome Zap Project. And it was funny because the lead of that project, Simon Bennett's,

David Scrobonia27:34

From there, we've been working together, working through iterations and been able to build it out to what it is today.

David Scrobonia27:42

A lot of positive reactions, a lot of great feedback from people who think they'll be able to use this. The problem we're trying to solve seems to be pretty well received, whether it's, you know, developers saying, oh, I never want to use these tools or even just like everyday pen testers saying, I hate these interfaces. This is so much better. And we're still working on getting it to that point where we can feel really comfortable with its reliability. On certain sites, I mean, it works like a charm and on others, it doesn't because I mean, the web and browsers are just so wild.

David Scrobonia28:13

So yeah, definitely had some positive reactions.

David Scrobonia28:28

Yeah, it's a fantastic feature. So Zap has this built-in idea of scripts. And so you can Write your own code, whether it's in JavaScript, the few language support, I think Python, Java, and you can hook into the various parts of Zap or you can just run your code. And this feature is already built into Zap itself, but we've exposed that to the heads up display so that within just a few minutes, you can kind of copy and paste a few things, change a few fields, Whatever your custom script was, you'll now have a button for that in your browser on top of the application you're testing. So I think that's a great use case for QA or dev where, oh, for my QA scripts, I kind of do this, this, and this.

David Scrobonia29:13

That's a great question. If you're into application security, there's no better resource than OWASP. You can look for the OWASP project page and find a project that interests you. What I found surprising from not being involved in these projects to being involved Is by how few people manage to maintain these things and how big of an impact you can have. With something with the Zap, I mean, it was the tool I learned a lot of application security concepts through. So, you know, I kind of assumed, like, oh, man, it's this tool. Like, it's using all these features. Like, it must be this big group. And that must be, you know, crazy smart people. Like, I probably wouldn't be able to help out too much.

David Scrobonia29:51

And you get in there and it's, you know, there's a strong community around it, but when it comes down to the end of the day, I mean, it's three or four people who are working on it really, really hard. And it's neat to see that you can go in there and just make a big impact on a project like that.

David Scrobonia30:14

That and I think people underestimate what they're able to contribute.

David Scrobonia30:17

Because at the end of all of my talks, they say, please come help us. Right. I taught myself like JavaScript dev working on this project. Like I guarantee you, if you've done any JavaScript dev, you can probably do a lot better than this.

David Scrobonia30:30

But even then, if you say, oh, you know, it'd be cool to help. I mean, you guys, it's like, well, no, like any small amount you can contribute, I'm sure someone will be able to help with. So for anyone who's listening and thinking, you know, oh, well, I probably can't do it. Or maybe it's too much of a time drain. Just reach out to a project that you like or start searching through concepts that you're interested in, whether it's outside of application security and try to find an open source project that you'd want to contribute to. Any good project owner will never say no to free help.

David Scrobonia31:04

I think it's a fantastic way to get in one for the experience, learning with the project to writing code on these projects. And now you have this like project on your resume, which is hugely powerful. But then three, and I think it's most important, I kind of alluded to earlier, is the networking aspect of it. The people who work on these projects tend to be pretty smart and know other people in the community. I mean, if they're maintaining these things, you know, to some degree by themselves or, you know, a few other people, great people know. And that's honestly how I've met so many people in this industry is through that. And I would even say, too, even if you don't feel like you have this technical or coding background, currently on the Heads Up Display project, we have someone who's trying to get into infosec.

David Scrobonia32:17

Right. And having your name on some documentation, there will be a lot of people who see those documents and you'll get a lot of thanks for them. It's a great way to get your name out there.

David Scrobonia32:48

I definitely can start looking at GitHub issues, but I'd say just from my limited experience, I mean, every single project needs help. There's very few projects where someone's like, oh, nope, I got it all done, and I get all the things I want. No, there's always that visions for future ideas, features, bug fixes, any other thing. So... For me personally, I found people just reaching out to me to be the most helpful. So whether there's like a Slack community, there's an awesome Slack group, or reaching out to someone on Twitter, or getting their email, or going to the GitHub and reaching out to them there, or finding an issue and tagging yourself on it, or opening an issue maybe if you have a feature idea.

David Scrobonia33:39

I would definitely say, don't underestimate yourself. I know I personally have had like a lot of trouble with like the imposter syndrome aspect of it. I like working on all these projects and you know, there's like days, it feels like you're on the nail, right? It feels like you're cruising and you're learning all these things and these days are just like, oh my God. Everyone here knows so much more than me, which is awesome because you get to learn a lot, but it's just like me so deflating sometimes. And I think the best way to fight through that is just, you know, one day at a time, one step at a time and keep pushing towards it and trying not to underestimate yourself. I would say additionally, I mean, get involved with the community as much as you can, even if you go to a few talks and, you know, maybe sit in the back for a little bit if you feel nervous.

David Scrobonia34:38

Thank you very much. It's been a pleasure to be on.

David Scrobonia34:41

Yeah.