Getting Into Infosec, Episode 31: Syntax - Arrested Teenager to Motorcycle Racer To Pentester
Published March 10, 2020 · 47 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/syntax/

[0:00] Ayman Elsawah: Welcome to Getting Into Infosec. I'm your host, Ayman Elsawah. My guest this week is Brandon Prince, aka Syntax. Brandon was influenced by computers from an early age, but ran into the pitfalls of responsible disclosure the hard way.

[0:13] Syntax: I got arrested in high school for computer crimes.

[0:17] Ayman Elsawah: He then got burned again as a result of his success.

[0:20] Syntax: Yeah, I was so mad. I was like, no, I'm like, I'm never going to work in tech again.

[0:25] Ayman Elsawah: But he eventually got drawn back into tech, yet really had to persevere through the rejections.

[0:29] Syntax: You're a motorcycle mechanic. Like, why should we hire you? In the end, he made it.

[0:34] Ayman Elsawah: He didn't give up. And he was creative about getting in. Once a hacker, always a hacker. By the way, I wrote a book. Here's a sample from the audiobook version. I was once in your shoes, trying to break into the industry, learning everything I could online, buying books and trying out new things in a virtual lab, applying for jobs, barely getting interviews, not hearing anything back. But I knew this field was for me. It was part of my personality. More on my journey later. This book is intended for those who are looking to get into the information security field but are not sure where to start, are overwhelmed with the information out there, or not able to close any interviews. Let's make sure to clear up any misconceptions.

[1:07] Ayman Elsawah: This book is not going to teach you how to program or code. This book is not going to teach you how to hack. This book is going to teach you the mindset you need. This book is going to map the open sea of information security and how to navigate it. All right, on to the show. Hey, Brandon, welcome to the show. Hey, how are you? Good, how are you? I'm wonderful. Awesome. You go by Syntax as well on Twitter?

[1:29] Syntax: I do, just about anywhere on the internet, yeah.

[1:32] Ayman Elsawah: Okay, that's awesome. So maybe you could explain to the folks out there what you do, at least by day.

[1:39] Syntax: So I am a web app penetration tester now. I'm on an internal pen test team. So I basically get to sit in my office and hack things all day. Okay.

[1:50] Ayman Elsawah: And you do it for other companies or for your own company?

[1:54] Syntax: We do it for our own company. I'm on an internal team. Now, granted, we have hundreds of web apps out there. Oh. So each week we've got two or three that we test for about a week and we just go really hard on them, finding anything we can from like the simplest like HTML injection all the way to getting remote code execution and getting onto the backend server. And then the real fun begins there.

[2:17] Ayman Elsawah: Yeah. And so how's life as a internal app pen tester? Is it as glamorous as everybody thinks it is?

[2:23] Syntax: I really want to say yes, that we are like the rock stars or the infosec mafia, but really not. I mean, a lot of our time is spent arguing with The other departments and justifying our findings. They're like, so is this cross-site scripting really a problem? And I'm like, yeah, yeah, no, it is. Stop it.

[2:50] Syntax: Yeah, it's good. And a lot of report writing. And, you know, people think, oh, you're on an internal team, the reports can't be as bad. And they're not as bad as doing like a big, huge report, but we're doing them every week. And we're doing a lot of them. Okay. Yeah, it's the life of an investor.

[3:07] Ayman Elsawah: Yeah. And is it just you out on your own? Or are you working with a team kind of collaborating on a project?

[3:13] Syntax: No, we've got a team. So there's, yeah, the pen test team, there's 20 of us. There's 18 or so active pen testers. And I mean, juniors, mid seniors. So there's some people who are just starting out as pen testers. They don't know a ton, but in there, I love our juniors because they're all really excited and they really want to learn. And then mid seniors and the seniors go after the Really kind of weird, complex things that you don't normally see. But, you know, they still find some really neat things. And we've got a PM and our team lead. And so it's actually a fairly large team, especially for just a single organization.

[3:53] Ayman Elsawah: But like if you're going on a web application, for example, or a particular project or application, would it be a team of two, three, four?

[4:00] Syntax: It depends. It depends on how many tests we have that week. If there's like one or two tests that we have to do, then everyone is going to be on everything and you just get to choose what you want to do. If we've got three or four or five, then we'll get broken up into usually two or three teams. And our team is neat because it's about... 40% onsite, 60% remote workers. So there are times when I'm collaborating with someone from, we have a pen tester in Hawaii. We've got some in Seattle and LA. So there's people all over the country that we get to collaborate with. And so doing it over Skype or Slack, you know, it's a lot of fun.

[4:43] Ayman Elsawah: And what do you do when you get stuck? So I know that getting stuck is just part of the game. But what do you do to get unstuck?

[4:50] Syntax: I get stuck a lot. Everybody does, yeah. Yeah, yeah. It's kind of the nature of the beast. Right. Especially with pen testing, because there isn't a set like, oh, do this and then this and then this and then shell.

[4:59] Ayman Elsawah: Right.

[5:00] Syntax: Even though that's how it looks sometimes. In fact, I did this today where I was stuck on this CSRF. And I couldn't get it to pop. So I stood up and went walking around our office and our office is big and it's all, so it's both blue team and red team. And then policy, like everyone is in this one office. Oh, wow. Okay. So I wandered over and I talked with incident response and went and talked to some people in the SOC. And just kind of got up and left my cube and ended up like wandering downstairs and outside. Right. And, you know, for about 10 or 15 minutes and then, you know, went back and sat down and started working on it again and actually got it to go. But I think that's one of the best things.

[5:43] Syntax: And I try and tell people like, yeah. If you get stuck, like stand up, disconnect, even if it's, you know, spinning around and not looking at your computer for five minutes, you know, just disconnect from it. Watch a YouTube video or listen to some music, something that's not like, this is what you should be doing or, you know, just, yeah, disconnect.

[6:04] Ayman Elsawah: Yeah. Like a different part of your brain.

[6:06] Syntax: Yeah.

[6:06] Ayman Elsawah: Yeah. And that could probably relate to just getting into the field in general, right? In any part of information security, would you say? Yeah, absolutely. Okay. And so walk us through how you got into tech or information security from the get-go.

[6:20] Syntax: So it started with my dad. My dad saw that tech was going to be a thing, and this is in the mid-80s. I was real young. And he bought a computer kit. So it showed up in boxes. And I remember sitting down, and we put this whole thing together, and it was an 8088 computer. With 512 kilobytes of RAM. Right. And a one megabyte hard drive. Yeah.

[6:49] Ayman Elsawah: Like that was as big as a brick probably, right?

[6:52] Syntax: Oh yeah. Yeah. And we were balling. We're like, yeah, we are never going to need anything more than this.

[6:58] Ayman Elsawah: Nice. And yeah,

[7:01] Syntax: You know, putting that together and then like watching it come up and a thing happened. And I remember being little and just watching that and being like, this is amazing. And then didn't think anything of it. Like there was always a computer in my house and it wasn't really, you know, and I'd always been kind of into tech. And then the movie hackers came out and I know this sounds kind of contrived, but I asked my mom to go watch it. And she was like, no, So then I asked to watch a different movie and she gave me the money and I just wouldn't watch hackers anyways.

[7:29] Ayman Elsawah: Nice. Yeah.

[7:31] Syntax: Sorry, mom.

[7:35] Syntax: And I watched that. I'm like, I want to do this thing. And then I really started like kind of learning and then getting into it and then went to college for computer science and then promptly dropped out.

[7:49] Ayman Elsawah: Okay.

[7:49] Syntax: What made you drop out? Oh, a bunch of different things. One was money. I didn't do well enough in high school for a couple of reasons. I got arrested in high school for computer crimes. Oh, okay. Yeah, I found an issue in the high school's computer network. So they got a huge grant and built this beautiful computer lab with a huge server and digitized all of the student and teacher's records.

[8:16] Ayman Elsawah: Oh, wow.

[8:17] Syntax: And so I'm sitting here in computer class in this beautiful lab and bored because they're teaching us typing. And I'm like, I was already like I had known a little visual basic and I knew my way around a computer. And I'm like, this is boring. So I was just playing around on the network. You know, I knew what a network was. I had been on bulletin boards at that point. And, you know, this was the very start of the Internet. And I found that all of this network was completely flat. There was no segmentation. Of course, yeah. And if you knew the name of the server, you could just log into it. Right. And every username and password worked. Wow. So I could log in and just be like, oh, look, here's my records.

[9:03] Syntax: Here's my friend's records. And then I'm like, oh, here's the principal's records. Yeah. I know, I now know how much you guys make. Like this was not an okay thing. So I took it to my vice principal.

[9:14] Ayman Elsawah: Oh, all that stuff was on there, huh?

[9:16] Syntax: Yeah. Just everything. Okay. Yeah. All of their like W2s, all of student records for as long as they had been in that school district. I mean, Everything was kept in this new digital repository. And of course, this was the very start of digitizing records. Like no one knew. Everyone's like, ah, look, it's digital. We can access it from anywhere. Security, what's that?

[9:38] Ayman Elsawah: Yeah. Security by security was the name of the game. Exactly.

[9:42] Syntax: Yeah. And so I took it to my vice principal and he was like, I don't believe you. And I'm like, here, watch. And I showed him. And he's like, okay, Brandon, here, go sit over there. You know, sit outside my office. I want to call somebody, you know, have them come in and look at this. I went, okay, cool. So I sat down and about an hour passes and I popped my head in. I'm like, he's like, no, just sit down. I'm like, okay, fine. And another hour passes and it's just about the end of the day. And two gentlemen in suits walk in and they, Walk past me into the vice principal's office and come back out. And they're like, Mr. Prince. And I was like, yeah. And like, stand up. And I was like, oh, OK. Like, what's up?

[10:19] Ayman Elsawah: Oh, man.

[10:20] Syntax: And they like turn me around and handcuff me and like, all right, we're taking you in. Wow. And, you know, about that time, of course, you know, the end of the day bell rings. So everyone in the entire school is on a Friday, like is watching me get drug out in handcuffs. That's crazy. And like the rumors were amazing. Wow. But luckily my dad is awesome. And he was corporate pilot for big corporation. He rushed down. So he brought their lawyer and his son had actually just passed the bar. So here comes these two lawyers in this town and they. Nice. And I don't know what they said or did, but, you know, several hours later, like, I got released. But I, at that point, had been charged with the Computer Fraud and Abuse Act.

[11:10] Syntax: A few months later, eventually everything got dropped, and I was a minor.

[11:13] Ayman Elsawah: Okay, I was going to say, were you a minor, like, 15, I guess, or something?

[11:16] Syntax: Yeah, yeah.

[11:17] Ayman Elsawah: Okay.

[11:17] Syntax: And so that was my first, like, introduction to, like— Oh, don't tell anybody because you're going to go to jail. And that was really kind of my start with a lot of things was, oh, I can do these things, but just don't tell anybody.

[11:33] Ayman Elsawah: Yeah. And then if you tell them, they won't believe you. So it's funny how even in your job today, people still don't believe you. Yeah. How many years later? Yeah. Yeah. So funny. Nothing's changed.

[11:44] Syntax: So then in college, like it was the same thing. And this is the first time I'd ever really met people because I grew up in this very rural town. And so I went to college and now there's these other people who like thought like I did and could do these other things. And this was amazing. And we ended up, there was five of us. We dropped out and started a little consultancy that was like the absolute right idea for 10 years too early okay and we had got a couple of clients and things were going well and a larger company came in and you know we're 21 years old we have no idea really how to run a business or what goes into it but we're trying like we're doing the best we can and this bigger company comes in and says hey we're gonna buy you and we're like awesome let's do this thing and so we sold and

[12:34] Ayman Elsawah: Cool.

[12:34] Syntax: And after we signed all the papers and we were like, all right, cool. Like, are we going to go into your office? Are you going to come in? And they're like, oh, no, no, no. We bought the company and we bought your client list and we bought your name. We didn't buy you guys.

[12:48] Ayman Elsawah: Yeah.

[12:49] Syntax: And so I got completely disheartened and left tech entirely. Oh, wow. Wow. Yeah, I was so mad. I was like, no, I'm never going to work in tech again. I had this huge wad of money that was way more than a 21-year-old should ever have. My dad just retired from being a pilot and opened up a small little motorcycle shop. And I was like, hey, you know what? I'm going to let my inner 10-year-old make some choices for me. And I'm going to go play with motorcycles. Nice. This is what I'm going to do.

[13:21] Ayman Elsawah: Nice.

[13:22] Syntax: So I helped my dad and we opened this motorcycle shop.

[13:26] Ayman Elsawah: And were you a biker before that? Yeah.

[13:28] Syntax: Yeah. I had always ridden. My dad always rode motorcycles. And so it was just like, it was a thing. I was like, cool. I don't ever have to wear a tie again. I can wear jeans. Right. And I got, you know, tattoos. In fact, I started my, cause I have full sleeve tattoos and I started my, my sleeves right after I left tech. So I was like, I'm never going to have to work in a place that wouldn't like my tattoos ever again. Right. And so I did that. I started racing motorcycles. I ended up racing motorcycles professionally.

[13:56] Ayman Elsawah: Oh, nice.

[13:57] Syntax: And that took me to France and all over the world doing that.

[14:01] Ayman Elsawah: What's the top speed you've ever ridden a motorcycle?

[14:04] Syntax: Just a touch over 200 miles an hour. Wow. And it's weird. So I get that question a lot. And I don't actually know because we don't have a speedometer on a race bike. You have a tack. But you don't have a speedo because you don't care how fast you're going. Right, right. You just care about like your times. That's kind of cool.

[14:22] Ayman Elsawah: It's actually a little less distracting, I guess, in a way, right? It is, 100%. Okay.

[14:27] Syntax: Yeah, so I'm like 200-ish.

[14:30] Ayman Elsawah: That's awesome. What's life like at 200 miles an hour?

[14:33] Syntax: It's a lot like 120 mile an hour. Oh, okay. Because your brain can't really determine the difference between 120, 130, or 200. It's all just real fast.

[14:43] Ayman Elsawah: Gotcha. That's crazy. So you did the motorcycle thing for a while. You raced. You had a shop. I did. With your dad, which must have been awesome.

[14:51] Syntax: It was. It was great. Yeah. And I still loved tech, and I loved to play with it. And I kept doing some... I mean, hacking, I still did some CTFs. And every time I would buy something online, I was throwing SQL injection into the coupon field. Because every once in a while, you put You know, or one equals one and it now applies every coupon and you get like 60% off. And I was excited about that. Nice. And so I kind of kept my skills going, but I let a lot of them just kind of lax. And then I had a fairly big accident on the track and got to the point where I was like, you know what? This is kind of for the birds. I don't like standing all day and working with my hands and my hands hurt. My back hurts and my knees hurt.

[15:37] Syntax: And I've never once had a computer try and kill me. Yeah. Yeah it's not sustainable for the long run basically what you're saying yeah you know i also found out no one's ever going to get rich running a motorcycle shop you know you're you're gonna keep putting money into it and eventually it'll be self-sustaining but you're not going to make any sort of money at it and i was young right and i needed to kind of think about my future so About five years ago, I decided, you know what, I'm going to get – I guess it's a little more than that now. It's about seven years ago. I decided I'm going to get back into tech. And, yeah, I was completely just put aback at how much things had changed.

[16:20] Ayman Elsawah: Yeah.

[16:21] Syntax: Where people actually cared about security now and all of these things that I had screamed 20 years ago. Actually kind of doing now. And I was amazed. Yeah.

[16:34] Ayman Elsawah: Where there's actually departments that handle this and things like that, right? Yeah.

[16:38] Syntax: And it's not one sysadmin who's overworked in a closet who's responsible for everything. There was now an entire department

[16:48] Ayman Elsawah: Separate from it that handled security yeah that was just amazing that's awesome that's awesome i actually did recently see assist admin sitting in the closet i couldn't believe it he was actually in a closet it was it was really small and he had like a hang in there cat poster in the back it's quite hilarious So now you're trying to transition back into tech and maybe into security. Did you try for security positions at the get-go or just anything in tech?

[17:17] Syntax: I was really leveraging for security because that was always my passion was security. Security, especially starting off kind of with the crime early, you know, it really seemed like the natural progression, you know, security always made sense to me. And so I'm like, this is where I want to be. And I'm old enough now that I don't want to do something that's not fun. I want to do something that I enjoy. Right. That's worth your time. Absolutely. And so I just started putting in and I got in at one place and And it was good. And then it went away. And then I started my own company again. Well, hold on.

[17:55] Ayman Elsawah: So when you were actually applying, did you have any difficulty? Did you have people say, oh, you know, you don't have any relative experience, recent experience? What were some of the negative stuff?

[18:05] Syntax: Oh, yeah. And that was really the big reason that I started my own company. But yeah, I got... A stack of, I mean, I say a stack, they're all digital, but a stack of rejection letters. And people always tell me, oh, don't keep those. But I have a folder in my email that's like rejection letters. And there's hundreds, hundreds in there. And I look at those and some of them, I'm like, yep, I'm not a right fit for that company. And others are like, okay, I'm going to work towards maybe working for this company, but I'm not what they need yet, but I'll get there. So it was kind of motivation to keep me going. But Yeah. The biggest thing was you're a motorcycle mechanic. You know, you're a motorcycle racer.

[18:45] Syntax: Like, why should we hire you?

[18:46] Ayman Elsawah: Okay.

[18:47] Syntax: And I'm like, well, I did this thing a lot and I continued to like keep my skills sharp. And I think one of the biggest things for me was I kept going to DEF CON.

[18:57] Ayman Elsawah: Oh, okay.

[18:58] Syntax: Even throughout those years when I was... Know a motorcycle mechanic right or a racer i still went to DEF CON every year in fact this year was a big year for me because it was the first time where i had been to over 50 of them nice your heart was still in it you know you're still active relatively yeah it's my hacker family yeah you know and it was always the culture and the people that i'm like yeah these are my people you know everyone make in security they make sense to me because they're all kind of like me

[19:29] Ayman Elsawah: Yeah. And that was mentioned in the previous episode as well. You know, Tanya, she had the same thing. So how did you persevere though with all the rejection letters? You know, I mean, how did you do that? How'd you persevere?

[19:38] Syntax: So the first time around, I kind of didn't. So after all of these rejection letters kept going, kept going, kept going. I was like, you know what? Okay. I need to show that I'm competent.

[19:49] Ayman Elsawah: Okay.

[19:50] Syntax: And I was in a, I was still in a fairly rural area that didn't have any real like it consulting or security consulting. So I'm like, okay, I'm going to start a little business, you know, and by this point I actually know how to run a business, which, you know, if I would have known that, you know, 10 years before, who knows where things would have gone. But yeah, Right. So I did. I opened this little consulting company and my niche was small companies that couldn't really afford an IT department.

[20:24] Ayman Elsawah: Yeah.

[20:25] Syntax: But because of the way things were going, you had to have an IT department. Right. You know, I mean, so I was like, cool, I'm going to be cheap. And I'm just going to work my butt off for a while, and I'm going to get my name out there, and I'm just going to do whatever. No job is too small. Whether it's going and hooking up an accountant's printer or securing a lawyer's office. If it's there and they're going to pay me, I'm going to do it. Nice. And I'm going to do it to the absolute best of my ability. And I learned a ton doing that. And it kind of got me back to the basics of... You know, learning networking again and learning how to set things up correctly and securely. And so I just kind of bust my way through that.

[21:09] Syntax: And I kept kind of applying to places. I'm like, look, I have some relevant experience now. Like, this is great. And eventually I got picked up by a fairly large company. I mean, big, big company. And they were like, well, we don't have a pure security role, but we need a security person in our NOC.

[21:30] Ayman Elsawah: Oh, okay. I'm like, oh,

[21:31] Syntax: Okay, cool. So I just said, yeah, I'm like, I haven't done that before. Let's do that. And then they were like, oh, we need someone who does this, you know, security, like, And so I just kept getting these little projects coming my way. And, you know, I just constantly said yes.

[21:46] Ayman Elsawah: Okay. So you were known as a security person from the get-go. Is that right? Yeah.

[21:50] Syntax: My resume was definitely like, oh, look, I am security person. I've got... Screaming security.

[21:55] Ayman Elsawah: Yeah. How did you spin some of the, you know, doctor's offices and lawyer stuff? How did you spin that on a resume with a big company?

[22:03] Syntax: Well, so everything that touches like a doctor's office, there has to be security in it because of HIPAA. Right. Okay. And same thing with lawyers. They have to have the privacy of their clients spun into it. Yeah. And people like doctors and lawyers, like they understand that they have to have security.

[22:22] Ayman Elsawah: Right.

[22:23] Syntax: And so I actually kind of went to those people and was like, Hey, what are you doing? Like, I'm a guy, I can help you. Okay. And, but then there was like a hardware store. They didn't care about security. You know, they were like, Oh, we have a credit card machine, but we don't, Like we didn't put it in, like someone came in and they plugged it in and it's fine. Right. You know, so I had to like tell these people. And so on a resume, I could be like, yeah, I was teaching security.

[22:48] Ayman Elsawah: Oh, okay.

[22:49] Syntax: And on my own, I was doing the security plus on my own. I ended up doing this EH, you know, on my own, all of this out of my own pocket and self-studying. Like I didn't take a class or a workshop or anything. I was watching, you know, videos on the internet and buying books.

[23:06] Ayman Elsawah: Yeah.

[23:06] Syntax: And then living it, you know. Exactly.

[23:09] Ayman Elsawah: I mean, that's my preferred method, self-study, but I know not everyone can do that, but yeah, definitely. That's.

[23:15] Syntax: Yeah. And then on my resume, I very much put the language as, yes, I was doing networking, but I was doing networking while teaching secure practices, you know, to small business owners.

[23:28] Ayman Elsawah: And so now you're in this knock. So now you're in this knock and you're kind of like the go-to person for security. Yeah.

[23:33] Syntax: And I just kept getting these little projects. And then I became the person that did research for For patching. So all the patch notes would come out. We would actually get all of the patches early from Microsoft because we had a really good relationship with them. And so I would spin up VMs with these weird custom VMs from these big companies because they had this weird custom software that was built in 2002. That they were still using on like windows 2003 servers and you know we were throwing custom patches into this stuff because these companies were big enough that they had someone write it but then we had to validate that it wasn't going to break this weird app yeah and they were like yeah can you do this is kind of security stuff and

[24:22] Syntax: So I started doing that for one company and then several, and then all of their patch research I was doing as well as knock stuff. And yeah, there was many like 16 hour days, seven days a week with that company. But it really was, I refused to say no. You know, if they had a project and they're like, Hey, do you want to try this? I'm like, yeah, absolutely. Nice. Like, have you done this before? I'm like, no, but I'll learn. Yeah. Right. Sweet. And that said a lot, especially transferring from a kind of infrastructure or sysadmin into security, you know, because if they're like, yeah, we don't really know security, but you kind of seem to care, try this thing. I'm like, all right, cool. And I was seeing alerts in the NOC that the other NOC analysts were like, oh, this is like an infrastructure thing.

[25:17] Syntax: And I'm like, no, no, no, no, no. No, this is a security incident. Wow. Something like, I was like, oh, wow, there's like 3,000 connections to this one server. Like, oh, man, you know, there must be, you know, a switch dying or something's being weird. And I'm like, no, this is website scraping.

[25:33] Ayman Elsawah: Yeah.

[25:33] Syntax: And because I had that mindset because I was just constantly in it, I was seeing it different than the other analysts.

[25:41] Ayman Elsawah: Mm-hmm.

[25:41] Syntax: And it's kind of like the, you know, when the only tool you have is a hammer, everything looks like a nail. Yeah. Well, when your mindset is that of a sysadmin, everything or an infrastructure administrator, everything looks like it's a system problem or an infrastructure problem. Right. And I guess you can kind of say that everything to me looks like a security issue.

[26:00] Ayman Elsawah: Yeah. I mean, that's how I go about it. And it's draining, but like, you know, you're like, oh, what if this is a compromise? And you go and you spend extra time to kind of verify that whether it is or not.

[26:10] Syntax: Yeah. And anymore, it's better to spend that time to validate that it wasn't. Right. Exactly. Instead of going, oh no, that's not it. And then having it turn out that it was. Yeah. Then you end up in the newspapers.

[26:23] Ayman Elsawah: Yeah. Crazy. Do you have a time where you caught an incident that almost got missed?

[26:29] Syntax: Yeah, so that right there, there was many, many incoming connections to a site. And it turns out someone had figured out, and this was a bunch of years ago, that they could kind of increment our website and pull different user data off of it. Right. And it was just such a weird pattern that it threw an infrastructure ticket. And I looked at it. I'm like, no, this is not an infrastructure issue. And everyone else in the NOC is like, no, absolutely. It's just something's broken somewhere. We'll go look. And we did some digging. And we're like, no, no, this is absolutely someone...

[27:07] Ayman Elsawah: Scraping a website and attempting to pull like customer data okay wow it's crazy and so at this point you're still a knock person you're kind of doing security stuff but not really officially yeah when was it that you kind of what was the transition after that so after that there was a

[27:26] Syntax: An unfortunate transition. So the company I was working with brought in a new management team at the C-level. And they went, what do you mean you have 60% remote workers? Either bring them into an office or let them go. And I was technically working out of an office in Toronto, even though I was living in New Mexico. And so I couldn't immigrate to Canada. So they were like, we're sorry, here's a severance. We really wish we could keep you. Bye. And so I'm like, oh, okay, well, how hard can it be to find a new job? And I made the decision that I was going to get a security job, whether it be in a SOC or Or doing IR or doing something. Right. But I wanted it to be a security job. And that actually lasted about nine months of me being unemployed.

[28:24] Syntax: Oh. I was still doing research and I was still doing some odd jobs. But I was still, for the most part, unemployed.

[28:32] Ayman Elsawah: Okay. Yeah.

[28:33] Syntax: And sending out five or six resumes a day. Right. To companies all over the country.

[28:39] Ayman Elsawah: Yeah.

[28:40] Syntax: And I actually found a fun post-exploitation technique with Windows using language packs. And I gave a talk at QueerCon, you know, which is the LGBTQ side of DEF CON. Right. And someone in that talk, someone who saw that talk, you know, came and found me afterwards and was like, that's... Really kind of interesting i had no idea that this worked that way and you had said that you were looking for work because it was actually the week before DEF CON that i found out that i was getting laid off oh okay and so i'm like yeah absolutely like anyone who wants to hire me come hire me he's like we might have a position coming up soon but you know it's going to be just a little bit out and i was like well hey right now i'm like first come first serve yeah

[29:27] Syntax: And I was putting in all of these resumes. So flash forward about eight months, I got a DM on Twitter from this guy. And he's like, hey, do you remember me? I was like, yeah, yeah, I absolutely remember. Yeah. And I did actually met. So I had finished the talk and I walked back to the bar and there was a guy with an old 80s hat. Like Moog style synthesizer sitting at the bar because it's DEF CON. And of course he had one. Right. Of course. And I remember the guy came up and we both kind of geeked out over this synth first. And then we started talking about my talk. And yeah, he was like, hey, so we have a position open. Like, send me your resume. He's like, it's for a pen tester. And I was like, okay, like I've done some pen testing and some CTFs, but never like full time.

[30:18] Syntax: And I'm like, in fact, I've never had an actual full time infosec job. And he's like, doesn't matter. Send me your resume. So I did. And he gave it to the higher ups and it turns out he was the, Like deputy team lead for this team and like recused himself from the interview. Cause it was usually the team lead that did all the interviews. Okay. And he was like, nope. And yeah, I went through this three interview kind of interview process and they're like, yeah, we would really like to have you come pen test for us. And I was like, yeah, absolutely. Woo. This will be great. And they're like, yeah, but you need to move to Maryland. And I'm like, oh, yeah. Okay, cool. Let's do this thing. Okay. And that was about 18 months ago.

[31:07] Syntax: And yeah, so I've been out here ever since. Gotcha.

[31:11] Ayman Elsawah: Is that your first quote unquote infosec job?

[31:13] Syntax: Yeah. My first full pure infosec job is here. Okay. Everything else had been infrastructure and security. Right. Okay. Or sysadmin and some security. Okay. Minus the company that I had started in 2000. So-

[31:29] Syntax: I, one thing I negotiated with my new job was DEF CON where I, it was like, I don't care. Like, I don't care what happens. I'm going to DEF CON. And, and I, I negotiated that, You know, it's like everything is negotiable. And that was one thing that I made sure to do. I've been going to it for so long that I have to go to this. This is something I do.

[31:52] Ayman Elsawah: Yeah, that's something I don't understand. You know, companies that don't send security, their security people to conferences or to DEF CON in particular. I think it's just a must. I mean, I don't know. I'm very opinionated about that, but...

[32:08] Syntax: It is. And I've made more connections... At DEF CON, even like at the bar. And I'm not always gonna tell my employer that, but I've made so many really good connections. In fact, I have a crew that I run around with and we do unofficial DEF CON badges, DCZia. And I've learned so much from them. And like we had talked about earlier, when I get stuck every once in a while, I can get on to our private chat and be like, hey, I'm doing this thing. Has anyone else like run into this problem where like I'm doing this, but it's not working? Can you know, does anyone have an idea? And lots of times within five minutes, I get 14 ideas and sometimes one works.

[32:52] Ayman Elsawah: There's just something to be said about the care and feeding of hackers.

[32:56] Syntax: Yeah.

[32:56] Ayman Elsawah: Or, you know, security engineers. I just, I don't get it. You know, as an employer, you have responsibility to... It's more than just, you know, PTO and even training. But sending them to Hacker Summer Camp is like a way for them to recharge. A way for us to recharge. Absolutely. You know, it's so recharging. You're so, like, you're just... All year you're beat down and you're trying to convince people that the security doing is wrong. You're just, it's always an uphill battle. And here's like one place we can go where everybody understands you and you don't have to like keep battling and you could talk about war stories confidentially or whatever, you know?

[33:35] Syntax: Yeah. And there's, there's thousands of us. Everyone that you turn to, you can stop to someone at the bar and you see that they have a badge on. You'd be like, you know, You understand me that's right i was gonna say the same thing and yeah you know you can buy them a beer and they will tell you stories and you will both laugh and you will then have a friend and a network Comrade, yeah. Person.

[34:06] Ayman Elsawah: Although I found a lot of people still hesitant to even mention their name or whatever. They're still putting up this fake wall. It depends. Your mileage may vary, but yeah, you're right. Exactly. For the most part, I've met a lot of good friends. Some of my really good friends, I've met them at DEF CON, so randomly.

[34:27] Syntax: Yeah, and I still, even when I'm at DEF CON, I still generally only go by Syntax. And there are people that I see there that only know me as Syntax, but we'll chat on Twitter or wherever, and it never fails. Like, I run into them at DEF CON, and it's hugs and beers and, you know, fun is had. Right.

[34:54] Ayman Elsawah: Mm-hmm. Very true. Very true. Yeah. I think that was, that rant just felt good. Good. So that's awesome. That's really cool. So even though you kept getting rejected, you held out, I mean, you probably had the luxury to hold out. Maybe not everybody has a luxury to hold out for nine months for a full-time job, but you held out, you held your ground and you're like, I am getting a security job. None of this like infrastructure and or whatever and security. Yeah.

[35:21] Syntax: Yeah, yeah. And I mean, during that time, I worked part time as an Uber driver. Okay. I worked part time in a liquor store. Okay. Which was actually a lot of fun. But, you know, I was doing a lot of kind of part time things. I also did a couple of like 1099. I did a 1099 pen test. I did some 1099 networking stuff. Anything to keep me afloat. I also lived in New Mexico, which has one of the lowest costs of living in the country. So that helped. I had a really wonderful partner who was working full time, who really helped kind of support me both with rent, you know, and I was giving everything I could and moral support being like, you can do this thing. And yeah, it was just that perseverance being like, no.

[36:15] Syntax: And there were several times where I'm like, you know, I should just settle. I can get, you know, a sysadmin job at a bank, like in a heartbeat, but it wasn't what I wanted to do. And I knew I would hate it. And yeah, she kept telling me, no, like you would hate it and you'd be miserable. Like, hang on, follow this dream. You know, and I knew that my resume looked not the best because I had these weird holes of five years when I was younger because I was racing motorcycles and owning a motorcycle shop. And then at this point, it had been like six months of me not working at And nothing being pure security and working for myself, which come to find out some employers don't like to see that you own your own business on your resume.

[37:03] Syntax: That is very true. And I asked one of them why. And they had told me that they don't like to hire entrepreneurs because they just assume that you're going to work just long enough that you can start your own business again.

[37:15] Ayman Elsawah: Hmm.

[37:16] Syntax: And they don't want that competition and they don't want that limited run. They want someone who's going to, you know, potentially work for them for 40 years and retire. And so that was hard too. I still recommend everyone, you know, if you're young, like work for yourself, you know, Even if it's doing odd jobs on the side, work for yourself. You learn so much having to do your own taxes and budgets and everything. I learned more about my clients because I owned my own business. I knew that their priority wasn't security, even though my priority was security because that's what I do. Their priority isn't security. Security to them is a bill that they have to pay because it's a thing they have to do.

[38:04] Syntax: Or else they'll end up on the news or they'll end up losing a bunch of money. It's not what they want to do. And owning my own business for a while, I realized, I'm like, oh... Oh, now I understand, you know, that sometimes we're not the priority. Yeah. Even though we should be, in my opinion. Right. Of course.

[38:25] Ayman Elsawah: Yeah. That's really cool. So there's a lot to unpack there. So you persevered and, you know, you got some odd jobs. Really awesome that you had a supportive partner, not only financially, but actually emotionally. And because I think, frankly, the emotional part is even more important sometimes than the financial. Yeah. But yeah, we need to live, of course. But, you know, the thing is you kept hacking. Yeah. You kept applying, kept researching. Yeah. You presented. I did. And that's what really got you the job, right? Yeah. You didn't like kind of just like sit back and wait for, you know, somebody to answer your resume calls, right?

[39:02] Syntax: Yeah. I kept doing CTFs. Mm-hmm. Now, is it bug bounties? I wish bug bounties were way bigger when I was looking for work because I would have done that. Do bug bounties. There's so many good bug bounty programs out there. Anyone can get in and do these bug bounties. Just showing, you're like, hey, look, I got a paycheck from Synac or HackerOne or whatever. Even if it was $20, you know, that's something to be like, look, I did a thing. Like I did a thing on this thing. I can do this. And yeah, I think that is a really great way, especially if you're wanting to look at red team stuff to kind of break in is do a bug bounty. And, you know, you'll learn a ton from the communities, you know, with HackerOne and Synac, which are the two that I'm kind of familiar with.

[39:59] Syntax: Both of them have really good communities where you can actually talk to other bug bounty people.

[40:04] Ayman Elsawah: Wow, that's cool.

[40:06] Syntax: And yeah, I really wish that they were around back when I was kind of out of a job because I would have just sat in my corner for 16 hours a day doing bug bounties. Yeah.

[40:17] Ayman Elsawah: Yeah, it's become so much so democratized. You know, security is so much more accessible than, you know, back in the day for both of us. So it's just wildly amazing. I mean, you know, YouTube is a godsend, right? So anytime something is broken in my house, I go in anything I want to learn. I should go to YouTube first.

[40:33] Syntax: Yeah, I did that. This weekend with my car, I had an issue with my car and I'm like, YouTube, how do I fix this thing? Exactly. And there was like 14 videos. I'm like, oh, that's how I do it. That's easy.

[40:46] Ayman Elsawah: Yeah, it's awesome. Cool. So any fun hacker stories that you could talk about, you know, from your travels?

[40:52] Syntax: Oh, man. And that's hard because a lot of the stuff that I do now, I can't really talk about. Let's see. I think I told you this one off air, but I'll tell it again. So this happened today. I get in this morning and there's a bunch of people outside because there's a conference room next to my office. And I kind of poke my head out and I'm like, hey, what's going on? And they're like, oh, there's this big training for this app. And I giggle and I'm like, oh, I am abusing that app this week. And they just kind of look at me funny. And I giggle and this lady walks up and she's like, well, I'm really glad that you are and it's not someone else. I'm like, oh, well, you know, that's a really good way to look at it.

[41:38] Syntax: And she's like, oh, hi, my name is, and she introduces herself. She's like, I'm the CISO for this project. I'm like, oh, hi, I'm just going to roll back in here. Was really good and she was actually happy that we were doing it she knew that it was going on and she was happy to actually meet some of the testers too but yeah that was definitely like me putting my foot in my mouth that's funny yeah that's really good and i also want to say that so my partner was very supportive to me so about three or four months ago She decided that she wanted to kind of pivot into infosec. And so I was like, here, here's all these books, do this thing, like learn everything. And I'm super happy to say that Tuesday, because it's a weird short week, the Tuesday week,

[42:29] Syntax: Was her first day doing incident response for a company. So she has now pivoted into infosec from marketing, actually. It's amazing. And I was, yeah, super happy. And it felt good to kind of like pay it forward because she helped me so much during this time when I was pivoting into it to help her get into it.

[42:50] Ayman Elsawah: That's awesome. I'd love to have her on the show one day. Get her journey from marketing to incident response. You don't see that often, right?

[42:58] Syntax: And it's social media marketing, which is a weird, weird animal in itself. Okay.

[43:04] Ayman Elsawah: So you spend most of your time, you know, not only if you're hacking, but you have to kind of educate folks all the time, right?

[43:10] Syntax: Yeah. We do a lot of education kind of through defending our findings because there's a lot of like dev departments that come to us and they're like, Why is this an issue? Why do we need to encode special characters? You know, why do we need to do these things? Exactly. And we really have to spell out, well, if you don't do this, then we can do this, which leads to this, which leads to this. And there's a lot of times where you can kind of hear over the phone that like jaw drop of, is that really how that works? Yeah. And we've started including videos in our reports. Nice. So we write the report, but we also show a video of like, look, I do this and then this and I type this in here and I hit enter and owned.

[44:03] Syntax: Sweet. And, you know, they say a picture is worth a thousand words. Right. Well, this is a thousand words or 30 pictures a second at a thousand words.

[44:13] Ayman Elsawah: That's a lot of words. Right. That's awesome. So what's some parting advice for someone to get into the pen testing field, particularly like your juniors, for example, what's their background that you know, or like, what's some parting advice for folks on getting in?

[44:29] Syntax: So I think the best advice that I can give. Is just stick with it. You absolutely have to have that perseverance because people are going to say no. That first place that you apply is never the place that you start. Like I said, I have a folder full of hundreds of rejection letters that I kind of kept because that was motivation. I'm like, well, I'm not a good fit for these guys, but maybe I'm a good fit for this one. Or this is why I got rejected. I'm going to work on that thing. And just keep doing it. Stay passionate. I hack all day long for a living, but then I come home and I do a CTF.

[45:09] Ayman Elsawah: Nice.

[45:10] Syntax: Or I'm super excited since I've moved out east. There's a bar about 45 minutes from me that every other week they do hacker trivia. Really? Yeah. Yeah, I go out there and I have a beer and I play Hacker Trivia and hang out with other people. And there are a lot of people who are like, oh, yeah, I'm a sysadmin, but this sounded fun. So I'm going to come do this thing. And I've watched those people come to Hacker Trivia and just get better and better and then get jobs in infosec. But I think it really is stay passionate, you know, do the fun things, you know, do the CTFs, do the hacker trivia, go to conferences, because that is, I think, one of the best things. B-Sides is super challenging. Inexpensive and well worth every penny.

[45:59] Syntax: And B-sides are everywhere. You know, go to conferences, just live it for a while and you'll learn. Even when you think you're just having fun hanging out with friends at a conference doing a weird crypto challenge, you're still learning and you're still making these connections. And yeah, just stick with it. You know, don't ever get disheartened. I know it's hard, especially getting rejection letter after rejection letter. Yeah. But yeah, stick with it and it'll come around. That's awesome.

[46:31] Ayman Elsawah: Well, Brandon, aka Syntax, thank you so much. Yeah. Yeah. Thank you so much for sharing your story. I think a lot of people can learn from it and I found it very inspiring myself and look forward to talking again sometime in the future.

[46:45] Syntax: Yeah, definitely. Thank you. And I hope to catch some coffee with you at DEF CON coming up. Absolutely.

[46:51] Ayman Elsawah: Yes, definitely looking forward to that.

[46:52] Syntax: Cool. Thanks a lot, Brandon. Thank you. Thank you. Bye-bye.

[46:57] Ayman Elsawah: Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.