Hossam Mohamed Young Hacker to "Not A Security Researcher"

Hossam Mohamed0:05

No, no. Actually, there is no kind of boring job.

Hossam Mohamed0:08

Today is Saturday. Okay. And I'm in the office. I'm talking with you while I'm in the office. I'm in the meeting room, actually. And I'm in the office because it's more about I like the job. I love the job. This is my day, you know?

Hossam Mohamed0:22

I feel bad when I get sick because I don't go to work. I don't do my job. I don't open my laptop and look into code. I don't, you know, I don't get into someone's system.

Hossam Mohamed1:05

And I wanted to understand how these games work.

Hossam Mohamed1:10

The thing is, it didn't work because of my age and because of my education. I was only 18.

Hossam Mohamed1:21

People just think when it's about assembly and reverse engineering, oh man, this is untouchable. This is like, you know, too much low-level stuff. No, I'm telling you, there's much more lower levels than that.

Hossam Mohamed1:39

All right, on to the show.

Hossam Mohamed1:42

You're welcome, man.

Hossam Mohamed1:48

Yeah, it's all right, but I'm not calling myself a security researcher.

Hossam Mohamed1:53

Yeah, as you mentioned before, I'm just 19 years old, you know. So I didn't reach this stage of my life that I can call myself a security researcher, but one day I will be. Yeah, that's what my person said. Okay.

Hossam Mohamed2:13

Yeah.

Hossam Mohamed2:20

About the career or employment.

Hossam Mohamed2:43

Thing is, I don't really maybe agree with achievement that I got is OSC. It's not really big achievement for me, but we will counting it as big one. So I took it like this. But it wasn't, you know, just a checkpoint for me. That's a proof for my knowledge, because as you told in the beginning, I'm just 19 years old. So no one would hire someone 19 years old into cybersecurity field. Yeah.

Hossam Mohamed3:14

Why is that? Because of my age, because of, you know, there is a lot of limitations out there for education and age problem. Also, you know, it's kind of a problem for companies, but not all of companies, you know. So for me, after OSCE, I started getting a lot of job offers from around the world, actually. But I decided to stay in Turkey and focus on my study and continue my education there. So I will attend electronic engineering program next year. I hope so. And once I finish, maybe I will focus on academic parts of my life.

Hossam Mohamed3:52

Yeah, besides security.

Hossam Mohamed3:58

Yeah i work as a security analyst for business solution company i was handling not only you know kind of security analysis for servers and so on i was handling also application security parts because i love code okay i love looking to code i like write code and so on so i'm kinda into application security But there's a difference, of course, between application security term and bug hunting, you know. I'm not a bug hunter or something like that. I like, you know, white box approach more than black box one, specifically in application security stuff.

Hossam Mohamed4:37

Yeah, like code reviews and so on.

Hossam Mohamed4:39

Securing code and so on.

Hossam Mohamed4:52

Quite hard but i don't have another choice i will do it because i cannot stop my career okay it's already started yes you know so i cannot just stop it so i will continue i know it's hard but you know i hope everything going well okay and tell us about your youth it says you've been on the computer since you were four so tell us about you know how you got into technology and then more specifically into hacking yeah since i was four I just found myself like computers and so on, you know. I got my first computer since I was four. I didn't even remember that I was four and I was sitting in a computer, but my mom kept telling me that you was four and you was using the computer, you know.

Hossam Mohamed5:34

Yeah, of course. I believe in that. Yeah, I remember that. Then it just started with games, you know, and I wanted to understand how these games work. Then I got the idea about the codes. There is a code running, you know, there's kind of zero and ones on this computer. And I really wanted to understand what is going on and what is going on. Why is this zeros and ones, you know? So I started learning, oh, there's something called codes because I was like games. And still, actually, I'm kind of a crazy gamer, you know?

Hossam Mohamed6:07

So i started you know research about code and all this stuff in school library and so on because i didn't have internet okay oh okay and this you know early age so i got internet when i was 10 or something like that And it was you know my entry point but i spent like two years like middle school time you know just downloading games and play games and so on then i realized that i need to back to my right pass which is code okay so i started learning code and i was preparing myself to be you know a computer hacker you know yeah so i thought that what got you interested in hacking did you see movies what was it that got you interested in hacking Just movies about hacking, you know, hackers, movie and so on.

Hossam Mohamed6:59

Yeah. Then I started learning code. I started with web language. I didn't start with C or something like that, but I just started with simple front-end languages. And I go through back-end language like PHP. Actually, at this moment, I wasn't know any kind of this term like there's front end or back end. I just was learning how this is going to work, you know, and even I developed a project for my school, a really simple project using B2B and HTML. They liked it, but no one cares actually.

Hossam Mohamed7:35

Yeah, it was just computer science class in high school. Okay. So, you know, in high school, I was already know PHP and Python as backend language and not really good knowledge about them, but I was more interested in Python. Besides that, I was already started hacking, you know, let's just be clear, you know, kids always play. And no one in Infotech doesn't play a little bit all times and so on. So I played a bit around web hacking and maybe pop up some shells and so on. You know, that's it. Then after high school, I decided that I have to take a decision on my career and I have to start my career. Since, you know, last year in high school, I already knew about web security. Plus, I knew a little more about programming for web specifically.

Hossam Mohamed8:38

Yeah, I was trying to move out. I decided to move to Istanbul because I came here when I was a kid, I remember. And I was like, oh, this place is really good. I wish I would live here. Because people living here are so lucky in this place, you know, it's a good place and so on. It was just a small trip, you know. So I just like the place and I was good.

Hossam Mohamed9:04

No, no, no. I already handled on this period freelance projects. Okay. One of them was penetration test project.

Hossam Mohamed9:15

Freelance work, yeah.

Hossam Mohamed9:17

And before getting into penetration testing projects, I was into web development projects.

Hossam Mohamed9:23

So that make a really good money for me.

Hossam Mohamed9:25

And I was, you know, just living with my parents, so I didn't spend too much, so I would have too much money.

Hossam Mohamed9:32

Yeah, then I started doing, you know, some Pinterest projects for small clients and so on, you know. So I got the money required and I told myself, it's okay, I can start now. So when I moved to Istanbul, I was having no amount of money to live, like really good time to learn something and chill out, you know. But I decided I don't want to chill out. I want to learn something. I want to start my career. So I started looking for a job or something like that. And actually, somehow I have been dropped an interview on Instagram. Really international big company okay however then i got into this interview you know it was like technical interview was great and the guys into interview like me too much and so on but you know thing is didn't work because of my age and because of my education i was only 18 okay it's

Hossam Mohamed10:25

So they liked you, but they... Yeah, but we cannot just hire you right now. You can go to university or something like that. And we can come back again and we will hire you as an intern or something like that.

Hossam Mohamed10:39

So I told them, it's okay. It was a really bad day for me, actually. But... I found, you know, startup and business solution. Then I started working for them as security analyst. I always care about securing servers and so on. I was working, you know, also on application security. So I was working with system administrators and IT guys. As well, I was working with development team. So I was handling tasks between both of those teams. But I got really huge experience from this company because, as I told you, I was working in two different levels. I improved my development skills too much.

Hossam Mohamed11:19

No, no, my development skills. Coding skills.

Hossam Mohamed11:24

I got, you know, too much information about a lot of stuff. And since, you know, I already know about, I know Python, for example, I learned it batch on this company. Got some batch skills as well, PowerShell and so on. So I was automating my tasks and so on. So I got kind of Free time to improve myself more and more and doing some research okay nice so i decided to get into exploitation okay since i was you know some Plus and so on i learned it not from too much time ago but i just quick pass on them so i can understand most of cnc plus because it's not big deal you know since you are into programming and code you can understand any syntax in this world because the logic is the same every language so it wasn't a big deal right so i decided to get into cnc plus code reviews and i hunted some do you ever dream in code yeah actually

Hossam Mohamed12:31

Yeah, actually, I don't know how did you know that, but it happened for me once. And let me tell you about something. It's really weird, you know. I was sleeping and I dreamed like something like that, you know. I just waked up and opening my laptop and running Wireshark, then I slept. That's it.

Hossam Mohamed12:50

So I thought that I can capture the dream using Wireshark or something like that.

Hossam Mohamed12:57

It was really weird, you know? When I woke up in the morning, I told myself, what the heck I did? Why are you opening White Shark? Then I remembered, you know? Yeah, I dreamed it was code, but not solving problems. No, okay. I dreamed like I'm writing zero days on all of this stuff. Yeah.

Hossam Mohamed13:19

Yeah. One day, actually, I dreamed like with web exploits. And next day, it was really exist because I was reviewing this application. Okay. But, you know, I just passed at this point for a letter check. When I go home and slept, I dreamed about next day. Oh, it exists. It's executable.

Hossam Mohamed13:43

Yeah. And also dreams, you know.

Hossam Mohamed13:56

I don't have too much experience in exploitation, but I can tell you that I learned too much about exploitation. I got into more and more low-level details. Right now I can read assembly like normal code, you know? So I can imagine how code patterns and how execution flow working. You know, like if it's been some for loops and so on, then this is coming from, you know, reading too much assembly code. So people just think when it's about assembly and reverse engineering, oh my God, this is untouchable. This is like, you know, too much low level stuff. No, I'm telling you there's much more lower level than that. Yeah, but, you know, I just like assembly and low-level exploitation. I felt like this is real security.

Hossam Mohamed15:01

Currently, I'm working in two jobs for now. I'm working full-time in an education-related company in Istanbul. It's one of the biggest companies for education solutions in Istanbul. I'm kind of handling most of universities in Turkey's security.

Hossam Mohamed15:24

Yeah, also into application security, which means more code and more code review. Even writing some code. It's a small company, but I like it because they kind of helped me to get me into my academic education best.

Hossam Mohamed15:41

Yeah. Another company, which is Cyber Struggle, it's a training company. They are a Turkish company. But recently, they started their startup in Estonia. And, you know, this guy is really skilled technically and so on. I joined them recently as a lab developer. So I'm developing labs for offensive security labs, running machines and so on. And, you know, they are going to start kind of new trainings. They will, you know, change the game on training-filled cybersecurity. I hope so. So I'm working also with them. So that's my current employment status. But I don't write all this, you know, on LinkedIn or CV or whatever because it doesn't matter right now.

Hossam Mohamed16:35

Yeah, malware analysis. Yeah, I didn't mention about malware analysis. You know, I'm into malware analysis also. It's like one of my daily jobs because I'm receiving malwares from, as I told you, universities and so on. Even, you know, some Linux malwares affected Linux servers starting to analysis it and so on. So I like really malware analysis stuff.

Hossam Mohamed16:57

Going through binaries and so on.

Hossam Mohamed17:00

To be specifically and be clear, I improved my assembly skills, okay, and better understanding of assembly code and reverse engineering from malware analysis, not from exploitation. Then when I got into exploitation, it was kind of pretty easy. I know assembly, of course. I already have some information. Then I started to study code patterns of bugs and so on, like use of trophy and all of this cool stuff.

Hossam Mohamed17:33

Yeah, it's about, you know, I got some connections. Okay. So I started freelance locally. Then I started globally, like, okay, I will be clear for you. I was making tons of accounts on Upwork and freelance and, you know, running some booths. Okay. I will talk clearly, you know, it's okay. So I was running kind of booths and collecting jobs. That's it.

Hossam Mohamed17:56

But I work on freelance websites just stuff right now.

Hossam Mohamed18:01

Also, I don't work like this kind of freelance stuff anymore because I already have like one full-time job as well as a part-time job because I struggle and Yeah but for those out there looking to start their career sometimes freelance is a good way to start so yeah of course also to getting some knowledge some challenges but when it's about hacking and security i got into freelance because no too much programming and so on but when it's about security and so on people looking for bug hunting and so on okay Yeah. And web bug hunting specifically, like hacker one, bug crowd and so on.

Hossam Mohamed18:39

I didn't get into bug bounties. Okay. I'm doing security research, but I'm not the bad guy here. But when I found a bug and it's not kind of valuable, you know, because people keep reporting really silly issues as security issues. And I cannot understand why companies pay for this bug. Like missing rate limits. What is the impact of missing rate limits, you know? What is the security impact? It's okay. It's kind of resources impact, okay? Like you're sending emails, maybe user information. Yeah, it's kind of what affects the business itself. But what is the security impact? Impact from like you have a platform with 10k users maximum okay let's imagine that there is an endpoint somewhere and you have like missing rate limits on login okay it's maybe a little bit security but this doesn't serve you know that much point you just give it to security research as well putting him how

Hossam Mohamed20:22

No, no, actually there is no kind of boring job.

Hossam Mohamed20:25

Today is Saturday. Okay. And I am in the office. I'm talking with you while I'm in the office. I'm meeting room actually. And I'm in the office because it's more about I like the job. I love the job. This is my day, you know.

Hossam Mohamed20:39

I feel bad when I get sick because I don't go to work. I don't do my job. I don't open my laptop and look into code. I don't, you know, I don't get into someone's system, for example. You know, so I told you I was in computer since I was four.

Hossam Mohamed20:57

When, you know, I'm far from my computer, like for two or three days, maybe I will be depressed or something like that.

Hossam Mohamed21:07

This is my life, man. Nice.

Hossam Mohamed21:14

Yeah, it's depending actually on the one who wants to get into the field. Like, you can't really do it because it's all about you. It's all about your study. It's all about your research. It's all about your time. So there is nothing called, I will get into information security and I will start studying some courses and then I will become an information security expert. This is the reality of outside, you know. So you have, you know, to development yourself. And I prefer you and suggest people want to start starting from low level stuff. Because if you want to break something, you need, you know, to understand how it's work first. So you can crack it better. Not even just to understand how it's work, but build one.

Hossam Mohamed22:25

I'm talking about university students, for example.

Hossam Mohamed22:29

As well as high school students, it's like you don't have too much time to make kind of study for cybersecurity and so on. But you can make it like part of your day, you know. For example, I was working too far place, which place I was living in. It's like two hours by bus, okay?

Hossam Mohamed22:50

So I got like four hours per day. So I decided to use this time by reading books and so on. And I got really huge knowledge from that time, you know, because this time is already, you are spending it in your day. So spend it in something useful in your life because you'll just need this somehow or someday or whatever. Getting so much information and knowledge Not bad thing at all. You can just improve yourself and read books.

Hossam Mohamed23:21

Not just read books or watching videos. As I told you, we have to build it, then understand it, then crack it. That's it.

Hossam Mohamed23:35

Actually, you know, I have, you know, like weird dream story. You can take it as a story, you know.

Hossam Mohamed23:50

Yeah. I was, you know, we was in penetration testing projects for one of our clients, an old company. We didn't receive too much, you know, penetration testing project. It was like projects from our clients only. They are already clients on our company. We are offering them penetration testing and so on.

Hossam Mohamed24:11

So they accepted, you know, However, I was working alone with this project, really. Yeah, there wasn't any kind of activity or something like that. It was like assessment, you know, and exploitation. That's it. And you do it, you're nice to report. But, you know, we was like kind of late on deadline for this project. So I told my manager, it's okay. It's okay, I will deliver the report on Monday. Somehow I delivered this report with the engagement and contract. They allowed us, if you give it to a resource, to the organization, you can do whatever you want without affecting employees or company data. So we don't want to lose any data. Then it was okay, you know. So I chose Monday because, you know, I wanted to send them the new domain controller password.

Hossam Mohamed25:31

Just escalating Chromebooks to other and so on. It was like small organizations that would have one domain controller, two file servers, but too much endpoints.

Hossam Mohamed25:45

It was a really old WordPress instance. There was running blog, not even a blog, it's like internal blog for them, but it

Hossam Mohamed26:34

Yeah, about B-Sides, yeah.

Hossam Mohamed26:39

Yeah besides istanbul going to be one of the biggest conferences on the area you know because we have like kind of hacking villages and so on by the way i'm one of organizing team for besides istanbul okay as well you know this guy is doing really great work okay by the way they are starting rescheduling the conference to october right and you know there's a lot of Heavy stuff we are preparing for like car hacking and iot scale systems hackings and so on we have a lot of workshops we have a lot of trainings and you know it's going to be really one of the biggest information security conferences in the area i believe in that's awesome yeah that's really exciting Yeah, I believe that's what's going, you know, bringing something new to the area.

Hossam Mohamed27:31

Yeah, I'm giving a talk about a small research about IBC exploitation, Windows operating systems, like how you can, you know, discover some kind of IBC issues on applications. And even, you know, I will release some tools as well. And there is another friend talking about automation and backbone technology. I also, you know, I will share some scripts with him, you know, release some tools and so on. But my main talk is about IBC exploitation and I will release some exploits templates and, you know, make people focus more on IBC and all this stuff in Windows operating system because you may find an IBC bug on one of Windows executables, default Windows executables to be specific, and you would gain zero

Hossam Mohamed28:40

I will see you there. Okay.