Robin Stuart From Paralegal to Malware Researcher (and Cyber Crime Author!)

Robin Stuart0:09

Years of being a paralegal, I think like a lawyer, and that's helped me very well too.

Robin Stuart0:20

Are you enthusiastic? Are you curious? Do you have at least some basic foundational knowledge that we can build on? Are you self-driven? And do you play well with others?

Robin Stuart1:36

Happy to be here.

Robin Stuart1:42

Okay. So what I do today is threat research, which I liken to sort of a cyber criminology. So what I do is I study the ways and means of bad guys and how they do what they do, kind of visit the same haunts that they go to on the dark web. And basically know your enemy, understanding the adversary. And then that helps me to come up with new and creative ways to disrupt their operations and to make them unsuccessful. So like the old joke that you don't have to be the fastest runner when you're being chased by a bear. You just have to run faster than the other guy. So we apply the same sort of principles in my industry to raising the bar on criminals so that they will give up on us and go off to somebody who is not quite as equipped.

Robin Stuart3:12

Correct.

Robin Stuart3:15

So it's kind of a funny story. I was a paralegal a million years ago and kind of at a crossroads. I had topped out in my interest and also the pay.

Robin Stuart3:31

So I was thinking, well, I really enjoy research. That's what I was basically doing at that point. A lot of my research skills were taught to me by lawyers. And so that's why my Google tends to work a little bit differently than other people's Google. So I find things that other people won't find because I look at things differently.

Robin Stuart3:52

I was taught to do this kind of stuff in an opposition research kind of way. And when I was at the last law firm where I worked, I had gotten kind of bored. We were between massive trials. And our IT group, which consisted of two guys, Were transitioning the network from a flat open network to one where it was a hierarchical model for the first time. Back in the Windows NT days, they were rolling out NT and it was... Nice. Yeah, exactly. It tells you how long ago this was. It was the first time passwords were being introduced on endpoints. So the different computers for the paralegals and the secretaries and the lawyers. And I was just goofing around, hanging out in their office. They had this little

Robin Stuart5:43

So, yeah. So they said, OK, then we're going to introduce password complexity. And I said, yeah. Yeah. And that's where we're going to have to have letters and numbers. And I said, okay, great. Go for it. And then, you know, company-wide, everybody has to strengthen their passwords, blah, blah, blah. So they asked me to try again. And again, I got in on the first try because I guessed the password would be managing partner's daughter's name plus her birthday.

Robin Stuart6:13

So we kept playing this game, going around and around and around to see how hard it would be for me to break into various points around the network. And this was all in my spare time. And every single thing that I tried, I would get in within like three or four tries. I think the hardest thing was a four timer.

Robin Stuart6:32

And so that's when one of the guys said, you are definitely in the wrong line of work.

Robin Stuart6:37

And I said, well, what line of work should I be in? And they said, you should be doing this. And I said, wait, people get paid for this?

Robin Stuart6:45

I had no idea. Basically, what I was doing was penetration testing. Yeah. So they helped me find a program through UC Extension here in the Bay Area, through UC Berkeley. And I do not have a college degree.

Robin Stuart7:01

I'm now kind of proud of that, actually. But I did do this semester-long course to learn about computer networks because I knew absolutely nothing. And so I went through basically the MCSE, the Microsoft Certification Boot Camp. But it was a semester long deep dive. So in retrospect, it kind of blended elements of the CompTIA program with the Microsoft boot camp. So it was really good. It was a good foundational course.

Robin Stuart7:34

And prepared me to take the MCSE tests. At that time, it was, I think there were five tests that I had to take.

Robin Stuart7:41

I ended up quitting my job. I was trying to do both at the same time. And then when I got to the testing point, that's when I quit my job so I could study for the tests and pass them all. And then came the fun part of being somebody who was... How old was I? I think I was 30. Starting a new career. Completely new career. Scary. Yeah. And so I was answering ads on Craigslist and I think...

Robin Stuart8:14

Yeah, I wasn't actually even looking for information security specifically because the industry was so new that there weren't any jobs, really. So I did actually start off looking for security. And the whole reason I got interested in security as a discipline, besides the fact that I was good at it, was when I was talking to the guys at the law firm.

Robin Stuart8:37

One afternoon I was reading the paper, the San Francisco Chronicle, and they had done a profile on Deloitte and Touche at that time, their newest practice of digital forensics.

Robin Stuart8:48

And I was reading about what they did for a living and I'm like, this sounds so cool. And so that's when I was like, I went to one of the guys and said, how do I do this?

Robin Stuart8:57

So...

Robin Stuart9:02

Exactly. Yeah, exactly. And so I was figuring that I would have to start off doing something like help desk because that seemed to be everybody that I quizzed in my class and also the IT guys that I had worked with at the law firm. That seemed to be the path. But I didn't want to do that if I didn't have to, because I have zero patience with things like, did you turn on your computer? I'm just not cut out for that kind of thing.

Robin Stuart9:35

Yeah.

Robin Stuart9:39

Yeah, exactly. So I got a fair number of interviews. Doing the Craigslist thing and what they were looking for that time, I just ignored requirements for the most part and just applied to everything that sounded interesting from a company perspective. So I wasn't really looking so much at the job descriptions themselves because I didn't honestly understand a lot of the stuff.

Robin Stuart10:03

What I was looking at was interesting companies. And one of the companies that I came closest to getting hired at first, it was CNET, actually.

Robin Stuart10:15

The media company. I thought that would be super cool to do, like, you know, IT support at a media company because then it kind of would marry two interests, one being writing and one being technology.

Robin Stuart10:26

And they passed me over, but they were very, very nice about it. And then that same day, I got contacted by a headhunter who found my resume on Monster or one of those and brought me in for an interview on the basis of the structure of my resume. It wasn't because of the content. It was because of the structure and about a 10-minute conversation that I had with her. And later she told me that the whole reason that she wanted to work with me after speaking to me was my level of enthusiasm. Because even though I knew absolutely nothing, I was super, super enthusiastic and asked a ton of questions. And what she did for a living was technical staffing and support. So this was a very good alignment here.

Robin Stuart11:21

She worked with a lot and she was very good friends with the hiring manager that I met with. And that story is kind of silly too. I was like an hour late to the interview because of, yeah, it was a daylight savings time snafu.

Robin Stuart11:38

But the manager was, she, she thought it was funny. So that was good.

Robin Stuart11:45

Yeah, exactly. Exactly. And I went in there like, oh my God, oh my God, I blew this before I even started, but that actually made me relax. So when I got to the interview, it was the first time I'd ever seen the stereotypical cubicle farm with conference rooms and the glass walls and stuff. And I thought, oh, what a horrible way to work.

Robin Stuart12:18

No in law everybody had an office except for the admins gotcha because of the sensitivity the information that we were all working with and organization so with working as a paralegal I worked with tons literally tons of paper and so in order to keep it all you know evidence and depositions and all that crap yeah somewhat organized that my office was just a wall of boxes and So when I get to this financial institution, I see cubicles and I'm like, oh, this is kind of weird, but okay. And because I had already been late and figured that I had nothing to lose at this point anymore, I kind of just turned it into a conversation and wanted to learn. And I figured I could use the practice. And the interview took place in a conference room where one entire wall was a whiteboard.

Robin Stuart14:09

I didn't learn any of that until I was actually on the job. But in the interview, I made it clear that my interest was in the infosec space. And so again, the hiring manager was game to tell me what she knew about what they had in terms of Safety precautions and how this platform engineering role would feed into that greater security space. And like I said, at the end of the interview, she had drawn a network map, given me the names of the vendors that they used for various endpoint security, firewalls, egress and ingress, monitoring and filtering. And I sat back at the end and she said, any more questions? And I said, no. And I'm staring at the wall. And I said, you know what? You probably shouldn't have answered any of my questions, or at least you shouldn't have done this.

Robin Stuart15:14

She burst out laughing. And she said, okay, well, thanks very much. This has been entertaining. And I thought, okay, sure. So I blew it. And I'm driving home. And by the time I got home, there was an offer waiting for me on my voicemail.

Robin Stuart15:30

Yeah. So I got the job.

Robin Stuart15:38

Probably.

Robin Stuart15:42

Ethos is the worst thing that people can say to me is no. I mean, anything is worth a try. And if I don't succeed on the first try, then I'll change up what I do. And by the time I had gotten to this interview, I had already been through a dozen interviews with all different types of people, all different levels of friendliness and receptivity to my personality. And also in my background, I was a temp. Way, way, way back in the day when I was in high school to make extra money, I would, my mother was actually the manager for a temporary health agency. And she used to send me out on temp jobs that nobody else would take during the summer months. And that was how I made money for spending money for, you know.

Robin Stuart17:50

Right.

Robin Stuart17:53

Yeah, I do, actually. I'm in that position now and have been for quite some time. I've been in this field now for 20 years. Yeah, about 20 years. And so I've obviously hired quite a few people. I've been a people manager. I've managed teams. I've led teams. And I've been, if not directly, indirectly involved in hiring for most of my career. And what I see now in hiring decisions is a bias towards degrees. Advanced degrees and yeah okay it's getting better than it was like five years ago it was really bad where the recruiters would be like oh nope you don't have a phd we're not talking to you and i'm like really then i wouldn't have gotten in the door yeah and so fortunately that has started to change a little bit so what i would say is

Robin Stuart20:14

It was ego.

Robin Stuart20:43

Yeah, it really is. So, yeah, actually, to the point about where people, hiring managers should be looking. At my previous employer, I was very active with a group called Year Up. And Year Up is an internship program that brings in kids primarily from, I think the criteria is you have to be 18 and in school. So that can mean high school if you're a senior that graduates late because, you know, winter babies and all that. Or in an academic program. So not necessarily a four-year college, but you can be in a certification program, you can be in a trade school, you can be at a community college, or like I said, your last year of high school. And the kids that join that program tend to be from underrepresented communities.

Robin Stuart21:54

Yeah. And so it's a chance for the kid to see different parts of the field. So what we did at the previous employer was when we had our intern's You'd have your primary group that you were working with, but we would actually encourage them to shadow, job shadow other people in the same security department so that they could learn about all the different disciplines, everything from intrusion detection to policy and compliance to offensive security and pen testing. If a kid was like, hey, I want to be a manager one day, they would go and say, hey, shadow a manager, shadow the CIO if that's what you want to do. But it was all about exposure. So that's something that more companies are starting to do now.

Robin Stuart23:11

Yeah. And for hiring managers like me, I appreciate more creative approaches. And in this line of work, particularly around threat research and applied science, Creativity actually matters a lot. So if you're an out-of-the-box thinker, that's awesome. That's a big added bonus. And if you can demonstrate that by the way that you got to me in the first place through the recruiter, then... I might look at you more than another company would.

Robin Stuart23:47

Yeah.

Robin Stuart23:56

Yeah, exactly. Like the case in point where I started, the financial institution I started as a platform engineer, it was not security at all. And the way that I transitioned into security was when I overheard somebody that turned out to be the vice president of security talking to one of her managers, I heard the word firewall and I was just getting coffee. And she and her underling were talking about building out a new team. And I'm eavesdropping just Relentlessly and became more and more obvious about the fact that I was eavesdropping on their conversation until I was literally standing right next to the vice president and I said, that's what I want to do. And they both looked at me like, who the hell are you?

Robin Stuart25:04

And then she said to the guy who she was talking to about structuring a new IDS team, she said, I want you to talk to this woman and hear her out.

Robin Stuart26:33

I learned what Honeypot was. I read the book he recommended was Hacking Exposed. I read it cover to cover and did some of the exercises. And I also fit in a SANS course, the GSEC, Security Essentials, in that time. And I had passed part of it. I must have done the practical first. And then after you do the practical, which is a demonstration that you have mastered the knowledge, then they allow you to take the test. And I think I had just passed the practical, which was basically just a white paper. And so I go back to this manager and I show him all of my work, basically. And he said, wait, what, you did it? And I said, well, yeah, that's what you told me to do. And so he arranged for a transfer.

Robin Stuart27:20

And I became employee number three in the infosec department for the intrusion detection team there.

Robin Stuart27:27

Yeah.

Robin Stuart27:33

Yeah. And so I really enjoy giving back and mentoring. And when I'm choosing mentees, because everywhere I work, people know that I really like to develop talent, but I'm picky about who I'll work with.

Robin Stuart27:49

Because I've been burned by, hey, I'm going to be super optimistic about the outcome. And then I end up wasting my time because somebody doesn't do the work or they expect me to give them a brain dump. And now they're an expert. One kid really insulted me. He's like, I've got an hour. Can you teach me everything you know?

Robin Stuart28:11

Yeah. That was when I decided, okay, I need to have a threshold here and establish a sort of a gateway. Yeah. And that's when I adopted the same methodology that the manager, my first security manager gave to me. And that is, I'm going to give you some homework. You come back to me when you're done. If you actually do it, I will work with you. And it's interesting to me that People who are claiming to be clamoring for the experience and the opportunity, more than 50% of the time don't do it. And I'm like, wow, you are turning your back on the opportunity of a lifetime. But okay, it's your choice. I'm not going to force you. If you don't want to come under my wing, that's fine. But if you do, hey, let's go play.

Robin Stuart29:13

Exactly.

Robin Stuart29:33

Yeah, I wasn't always a great student myself. It really depended if the teacher was engaging and if the subject was interesting to me, I was a great student. And if not, not so much.

Robin Stuart29:57

First hack in life so yeah that you could talk about yeah so I don't know that I've ever knowingly broken the law but this has nothing to do with that When I was in junior high, we had student body elections coming up. And I started to see posters going up for somebody that I wasn't all that fond of running for student body president. And it was one of the popular kids. And so it was kind of a foregone conclusion that person would win. And I thought, I wonder... If I could upset the balance here. I had never run for any sort of student council ever. And I was just like, huh, I wonder if I could persuade people to vote for me, even though they may or may not know me. Where I grew up, There were two main elementary schools and two main junior high schools.

Robin Stuart31:25

Yeah, exactly. And so I was like, huh, I wonder if I could use that to my advantage and if I could beat this person.

Robin Stuart31:32

And so I ran. Yeah. I ran for president just to see. Well, it wasn't because I didn't really think about the outcome. It was really more about the race and the experience and manipulating human behavior and seeing if I could influence the outcome. So to the extent that's basically social engineering.

Robin Stuart31:57

I was wildly successful and I ended up winning. Yeah. Yeah. All of a sudden. Exactly. I'm like, Oh wait, I have to do stuff now. I have to be like at school after school. What? Oh no. What did I get myself into?

Robin Stuart32:16

Yeah. So I've done a lot of human hacking and also as a paralegal. Like I said, my Google works better than other people's Google because I learned how to do online searches using the LexisNexis database, which is the kind of the gold standard of everything you want to know about anything. Most of the use at law firms is to look up case precedent and personal information on people. I used it for that, but also for doing other types of research. So not strictly legal research and not strictly researching witnesses or opposing parties, but also understanding their backgrounds, like where they came from. So if somebody came from a small town that I had never heard of in a part of the country I wasn't familiar with, I studied up on that to understand what motivates people to

Robin Stuart34:16

Because she was just standing there washing her hands. And I said, because you're always at that sink and I usually go to the right sink and I'm right-handed and I was just testing a theory. He said, wow, well done. And it was somebody whose job was offensive security. So she was like, well done.

Robin Stuart34:38

Yes.

Robin Stuart34:58

That is more of an academic challenge. Again, I don't feel like you have to go through any sort of formal training, but it helps if you don't know where else to start. But there are so many resources available.

Robin Stuart35:19

That's a tough one for me to answer because they started to come out while I was doing that work. And it also depends on the foundational knowledge that you have. If you don't understand the stack, then you're not going to really get a lot out of things like a shell coder's handbook. That's one of the standards for reversing and exploit discovery. And it's a really good resource on understanding malware. That and also there's a book called Reversing. I'm actually looking at it on my bookshelf right now. Which was probably one of the first ones so in my mind is probably one of the better ones because it did kind of bring you up through understanding the execution and first the delivery and then the execution of malware and the intent and then discovery and reverse engineering and there's two different ways to do reversing there's behavioral and then there's

Robin Stuart37:27

A high threshold for tedium, I think, is really important. And it sounds funny, but it's true. Because when you're looking for... One of these things is not like the other. It takes a long, long time. And the newer you are to the field, the longer it takes. So first I learned the analytical piece. I actually taught myself assembly by writing a program all in assembly just to prove to myself that I understood it. And then I jumped over to behavioral analysis because that's more tactical and more applicable to learning. Defending so if you're looking to get a job at a security company you need to know both and you really need to know the code side so i would say study up on assembly and okay i would also encourage people to learn all three of the major operating systems because there is you know there's so much already on windows operating systems even though they've changed and evolved over time and

Robin Stuart39:34

I found to be more accurate in assessing the behaviors because so many pieces of malware will behave differently in a virtual environment than they will on what's called bare metal, which is like running on a real operating system. So I have a couple of laptops that I keep at home in my home lab that are made to be re-imaged. So how I studied malware for work and for play was running it. And at the same time, I had a couple of programs that would show me all the system changes that occurred while the malware was running. And I also would run malware in a bare metal environment Without the crutch of these programs that would show me the changes where I would go in and try to identify all the changes myself.

Robin Stuart40:27

Yeah. So that's, I don't want to say that's what made me so great at it, but that really helped a lot. It also helps a lot that I have a photographic memory. So that gives me an edge where other people don't have that. So it's easy for me to look at, say, the system 32 file on a Windows machine and pick out what changed. It's going to be harder for people who don't recognize things at a glance and say, Oh yeah, well, this is, these are all the files that should be in system 32.

Robin Stuart41:06

Awesome. Well, thank you for having me. This was fun.