Security Engineering Expert & Leader Mike Takahashi on Creativity in Red Teaming

It's easy to think of security as like, this is a checklist of things I need to do, like I need to cover every avenue, but really the things I should be focused on are the weakest points. And a hacker is going to tell you what the weakest points are because they're going to show you exactly this is how you exploit it. There's no better proof than that.

Welcome to the Ahead of the Breach podcast where we are dedicated to empowering security experts and practitioners with the knowledge, insights and actionable strategies to lead the future of cybersecurity. Here's your host, Casey Camilleri, CEO and founder of Sprocket Security. Now let's dive into today's episode.

Welcome to the Head of the Breach podcast. I'm Casey Camilleri. This is a podcast where we talk everything about offensive security. And today we have Mike Takahashi. He's director of Security Engineering and he's come from many diverse roles he's in the past such as red teamer, bug hunter, pen tester, freelance hacker, and most recently working on some generative AI research. Welcome, Mike.

Thanks for having me.

Yeah, so when I was looking up some of your research in the past, you've done a lot with like Google Dork.

Yeah, it's so funny that you mentioned that. So I consider it pretty simple. Like a Google Dork, you're just doing a Google search. It doesn't seem like magic, but for some reason it's very popular anytime I post anything about Google Dorks. I think it's such low hanging fruit and it's very approachable. Like anyone can do it. Anyone can do a Google search. You'd be surprised what you can find out there. Like what's actually indexed in Google. I've found so many vulnerabilities that are literally just laying in Google. Like is it one search query away? You have to go kind of deep so you have to use these targeted search queries. But you'd be amazed how much low hanging fruit is there just from doing a couple Google search.

Well, yeah, if you don't have the opportunity to identify an endpoint or a system or whatever, you're not going to find any vulnerabilities related to it at all. And so Google Door can uncover some of that for you, right?

Exactly. Like you'll find forgotten endpoints that no one even remembers existed. Like they spun up some demo site or some sort of API that's exposed, but no one knows it's there. Except Google crawled it at some point because it's linked somewhere. Esoterically and normally you don't see these things because they don't show up to the top findings or the top links. But if you use the right query and you narrow it down, it'll go very deep into the queries and then you'll find these like golden nuggets and it takes five minutes. I have a Google dorking tool where you basically input a domain and it will auto populate a list of links.

Oh sweet. So do you just like then copy and paste those into the browser then?

So my workflow is I put my target information in there and then I open every single one in a new tab. Sometimes Google will think you're a robot, so you have to get through those captchas. But once you do that, you can just quickly review every finding and typically the real findings will jump out at you. They'll be very obvious.

Nice. What are your like top two favorite?

Oh, top two favorites. Like anything with PHP extension tends to be a goldmine. Like someone makes some script somewhere and they just forget about it.

Okay.

Also like APIs all the time API documentation or just like forgotten API endpoints.

Yeah, that's cool. So I mean you've also done a lot of bug hunting in the past, so obviously this is part of your methodology and bug hunting. Can you explain like your past experience and current experience with bug bounties both as maybe a hunter and then you also mentioned that you manage a program as well.

Definitely. So I've always been into security ever since I was young. I didn't know when I was young that there were these opportunities to do like ethical hacking. Once I discovered bug bounty and ethical hacking I went head first into it. I spent all my time and that's actually how I got started in security. So I spent all of my off time doing bug bounty and just trying every different technique I could find out. And eventually I was able to find some vulnerabilities, I reported them and that started my trajectory into cybersecurity. That's something I recommend to a lot of young people that are trying to get into cybersecurity. Like okay, where do I start? How do I get experience? The best proof you can have is to actually hack something. Like that's what I always say, just go hack something.

That's so true. I can totally relate to that because it's such a learn by doing thing. And that's why like the certs and the training that actually has really hands on I think is the best training out there. Even portswigger's Academy that They have.

That's one of the best ones. I always recommend that.

Yeah. Do you. That's a really great one. You spend a lot of time in Burp because web app is kind of your specialty, Right. You know, do you have any tips and tricks for using Burp?

Yes. So I use a lot of extensions, so AuthAnalyzer is a big one. I feel like a lot of people miss this one. So I feel that a lot of people, they manually test these broken access controls and like, indirect object references that are very high impact, but they don't put it through a tool. So if you put it through AuthAnalyzer, it will actually build a matrix of all the different account types that you have and all the different HTTP requests, API endpoints, and it will build a whole matrix of where the requests worked and on what accounts. And then you can say, okay, I have a regular account and an admin, and this request worked on both, even though it shouldn't. And you just immediately find out these vulnerabilities.

So that's super helpful if you have an app with multiple roles, right?

Exactly. And you might have hundreds of API endpoints or something like that, and it's very hard to manually test all those, but you can just easily test all of them all at once.

And that's great because you can actually do, you know, not just test the git, you can test the post.

Exactly, right, Exactly.

You've been doing a lot of research in kind of gen AI and things like that. Tell us a little bit about that.

Yeah. So ever since ChatGPT hit the world, I've spent a lot of time there, both for making my own processes more efficient, but also what implications it has on security, which now we're seeing. It has a lot of implications. You have misinformation, you have phishing. You can easily craft any number of different kinds of phishing emails. A lot of deepfakes going on, like both the visual and the audio. You hear about all these situations where, like, someone was called and made it sound like their son and like, essentially social engineered them out of money. There was also a situation where an entire zoom call full of people was all deep faked and of all employees. And these tools are just getting better every single day. So it's interesting to see all the different ways that offensive teams can use them.

What do you think we should do about that, though? Because, you know, like, if this was a virtual podcast, right? Like, how would I know? I'm talking to you, Mike. You could be deep begging.

That's A really good question. It's very hard because same thing with defending against phishing. If you don't think to look for it, you're not going to notice the signs. And as these models get better, maybe there are no human noticeable signs. I don't have a great answer to that right now. Something that I've done in some of the organizations I work with is we check other channels. So same with like a phishing email. Maybe you go in Slack and say, hey, is this really you? Like the calendar invite was weird or something is a little odd about this Zoom meeting. Like just want to confirm something like that, like some other channel where you can backtrack.

Yeah, I think we're going to probably go down this route where we're going to have to have like extreme validation, you know, back in the days, you know, using PHP SIGs essentially to sign our emails. Right. We're going to have to like start signing our virtual.

Exactly.

And say like, hey, here's a stamp of, you know that I'm talking to the real mic.

Exactly.

Validation. Right.

Yeah, it's pretty wild. There's also a lot of other implications of this gen AI. So as you know, all these different companies are trying to spin up LLM integrations, chatbots and it's being so rushed that a lot of oversights that are happening and for example with prompt injections. So a lot of the times that these LLMs are implemented, they're trusted as a system. Like this is our system that we're running, so we trust the output of this thing. But actually you shouldn't trust it because it's essentially an extension of user input because it's so easily tricked. Like it's almost like having a child or something. Like you can trick it so easily with these different prompts. Like you can just tell it to ignore all its instructions or tell it to do something completely different. And then what makes it even worse is whatever access that gen model has or LLM, then you can now exploit other vulnerabilities. So you might have a SQL injection, broken access control, cross site scripting. Like anything that the LLM has access to, you can now trick the LLM to then exploit all these other types of vulnerabilities.

Yeah, and it's really crazy because I feel like a lot of these even like everyone has a chatbot, right on their site, you know, but over the time I think the backend engines have been swapped out. Right. And so it's like, oh, we've always had this chatbot there. Right. But the Tech service has changed, changing, you know, the way it handles the user input, like you're saying is changing. So it's like you test something that you tested like three years ago, thinking it doesn't change, but really the vendors changed underneath the hood. It provides some risk. So definitely cool. Besides prompt injection and other things like that, what else in AI? I hear that you're going to be at the AI village this year at defcon.

Yeah, so it's a pretty popular village. Last year was the first time they had a Generative AI Red Team competition essentially. So what you do is you would hack these different, basically like a ctf. But now you're trying to trick an LLM to do different things, like say things it's not supposed to, things like that. And this year they're having a completely different format. So it's going to be more around how do you report these things? And they're trying to crowdsource essentially like all these different exploits to LLMs and prompt injections. So I'll be participating in the Generative Red team number two.

Nice. So when you're going through that, do you like actually have like a payload list that you use?

Yes. So it's interesting. It's a little bit different from a traditional web app. So typically with a web app it responds the same way every time. So if you can give it a full list of payloads, you can fuzz it and you can predictably know how it's going to respond to each one. LLMs are different because they're probabilistic. So every time you send it it could respond in a completely different way. So one of the techniques is actually just brute force. You can just try the same payload over and over again and it might work 5% of the time.

Oh really?

Yeah, I have seen that many times and also I've recently. So in preparation for the generative renting exercise, I've compiled like a list of all these different techniques. So basically like you can obscure your prompts, you can just put special characters in between the letters or you can use an emoji instead of a word.

Okay.

And that's enough. That little bit of obfuscation can be enough. And there's like a whole list of like psychological based attacks. Like you can basically trick the LLM into thinking that you're the LLM and it's the user, or you can tell it like you're the authority figure and it has to follow you. There's all these like very odd techniques that you wouldn't think would work for some reason to work in these.

Okay, so I can imagine that order of, like how you test these things could be important then, right? Because you could actually. Then, you know, obviously, if you ask it, if you're tricking it into thinking it's something that's not right, you know, you might want to stage it. Right. With exactly some, I guess, payloads is what I'm going to call them. But like, you want to have an order of operations essentially. Like you can literally do the same things and maybe a different order and have a whole different outcome, right?

Yeah. I have a tool I haven't released yet that basically is like an LLM buzzer. So you send it all these payloads, but I have it set up so that you send it many times and then you gather statistics because you need to know. It's essentially, how often will each payload work? Some of them will work 100% of the time, some of them might work 5% of the time. It's good to gather these statistics and have an understanding of how easy is it to hack. The only problem is, at the end of the day, you can't actually fully defend against these things. Like, mathematically, you can't have an absolute defense against prompt injection. So you have to accept some level of risk that if someone wants to send you an adversarial prompt, you have to accept that consequence and just keep the LLM in a box where they can't exploit other vulnerabilities.

Got it, Got it. So if I'm implementing that, that's something that, as a defender, I want to make sure that you can't break out of it, or you definitely leverage those.

And try to hack it as much as possible. Like try all, all the different techniques and see what works.

You gotta let us know when you release that tool definitely how to use it. So is it important to, like, figure out what it's using behind the scenes? Like, is that important or it doesn't matter?

It does. So the various models are more susceptible to certain techniques. So it does help. And you can actually fingerprint them. So you can prompt it to say, what model are you?

And it will tell you, oh, literally, it's that easy.

Like, it's baked into the training of the model for most of them at least. It's kind of funny that you can do that. But it doesn't matter too much because if you're going to try every technique, some of them are going to work. And what really works, a silver bullet, is combining multiple techniques. So you can like Layer the technique. So you can use like multiple different kinds of obfuscation or different trickery. Yeah.

Take us through your day to day, your day job, you know, what are you doing as a security engineer?

So my full time job is director of security engineering and manage the red team, the blue team and the application security teams. So basically just keeping up to tabs, managing the projects, making sure that we're prioritizing the right types of security controls that we're implementing. And my mindset is very like offense first because of my background. So I tend to prioritize anything that's related to either a real incident or a red team exercise. So if a red team exercise was able to bypass some sort of protection, like the focus always starts there and just make it harder for the red team or a real criminal hacker whenever possible.

I think that's so important. And the reason being is, you know, you see so many, even CISOs and other high up directors running security and they forget about that adversarial approach to, you know, like let's lead with offense. How can we actually be compromised? In what fashion? Or learn from the real threats that they have out there. I think that's kind of forgotten sometimes because we get buried in clients work. Right. You know, it's like, oh, I gotta do this, gotta do that. And then really it's like it should really come down to like what are the real adversaries are gonna be doing exactly.

Like it's easy to think of security as like this is a checklist of things I need to do. Like I need to cover every avenue. But really the things I should be focused on are the weakest points. And a hacker is gonna tell you what the weakest points are. Cause they're gonna show you exactly. This is how you exploit it. Like there's no better proof than that. Yeah.

What I like when we deliver our findings and reports is that like it's not ambiguous in any fashion. We did it like we actually exploited like argue the risk. Right.

Yeah.

Whereas you have like an audit. Right. You know, it could be like, well theoretically this could happen. This, you know, it's like no, this happened.

Yeah. And I found that even with execs, like they get it like if you show it visually and you explain it like everyone gets it. If you're actually hacked yourself with like an internal exercise, like there's no harder proof than that. And it tends to garner a lot of support once you can demonstrate those things.

Yeah. So essentially in your day to day, you leading these red. The red team, making sure they're using the latest and greatest techniques and things like that. And then you take that information and use it to prioritize what you guys should be working on.

Exactly.

Okay. And so do you work closely with a blue team then as well?

Yeah, definitely. So we technically have a blue team, a red team, and AppSec team, but I like to look at all the teams as a little bit purple. So even the blue team has some, like, offensive security experience. The AppSec team is very purple, which blur the lines a little bit. Like, I try to give a lot of space for creativity and experimentation because that's just what you need to do to keep up with the landscape. Like, it's changing so quickly. We have to try everything.

Yeah. Where do you think things are going in the next few years, just from offensive tester perspective?

It's interesting. I've seen demos of these, like, AI pen testers, and I don't know yet that the models are there to, like, fully replace pen testers yet, but I think that eventually, at least some of the manual processes can be automated, like the AI tools. So that'll be interesting. As the techniques are constantly evolving, there's still going to be, I think, a lag between when these techniques are automated and when they're not. Like, this is just a constant battle that happens in offensive skills.

Yeah. I feel like we've been doing this for, like, 25, 30 years of, like, hey, we're going to automate this next thing. And sure, by the time you automate the next thing, there's a new thing in tech that we didn't even think about. Right. Yeah. And so it's kind of like, oh, Web three is here. Right. You know, we're going to automate the testing of Web3. You know, like, oh, AI is taking off. Oh, we need to automate this. And so. And then you look back on the methodologies and the things you're doing. Like, 20 years ago, we've already automated that pretty well, you know, and then there's some things that we just can never automate, too. Definitely. Right?

Definitely.

Yeah.

It's going to be a constant arms race. And I think that it also is just going to speed up. Like, you can write custom malware very quickly. You can iterate on all your different code very easily. Like, there's certain parts of the workflow that these things speed up, so the time to exploitation just, like, constantly gets shorter and shorter.

Yeah. Even in our own social engineering that we're doing, it's using AI to basically say, all right, I'm targeting Mike. He works at this type of software tech company and, you know, look at his background or his online profile and tailor this email to fish him to do X, you know, and so use, like, all the industry acronyms. You know, it'll tailor it. And it's just awesome because at scale, we can do that to every single individual. So now it's kind of hard to basically say, look for the spelling mistakes. No, there's no spelling mistakes. It uses the industry acronyms. You know, like, it talks and looks just like the person I would be communicating with. Right. And so things get a little hard, but, like, that's an area where, like, AI is helping the attacker. But, you know, we can also use AI to help as a defender as well.

Exactly, exactly.

Yeah. So that's cool research, Mike. If anyone wants to follow you in the work that you're doing, how can they do so.

So I'm very active on Twitter. Toxec, T A K S, E C. I'm also on LinkedIn. Mike Takahashi, Medium Toxec. I have toxic.com has all my links so people can check it out. I also make, like, a lot of, like, hacker AI art and videos and things like that. So I'm into the hacker aesthetic also, not just the actual hacking. And yeah, go check it out. I post everything I can online, so that's awesome, Mike.

It's been a great conversation. Appreciate it.

Perfect. Thank you.

Cool.

Thank you for listening to another episode of the Ahead of the Breach podcast. If you enjoyed today's episode, please leave us a review on Apple Podcasts or Spotify. If you're interested in exploring how Sprocket is shaping the future of offensive security, be sure to check out our website@sprocketsecurity.com thank you again for joining us. See you on the next episode.