Cyber Security Tips and Virus Bombs with Greg Scott

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be talking with Greg Scott all about cybersecurity tips and his books Virus Bomb and Bullseye Breach. Greg Scott is a cybersecurity professional and published author. In his day job, he helps the world's largest open source software company support the world's largest telecom companies. Nights and weekends he looks for ways to poison truck GPS signals, make cell phone bombs, blow up buildings and mount cyber attacks. He might be on several government watch lists, so he recommends that dedicated law enforcement professionals monitor his Internet movements. Buy copies and buy copies of his novels Bullseye, Anatomy of an Electronic Break in and Virus Bomb. For Everyone in the Departments Before It's Too Late really has a unique perspect security and a great way of educating and teaching people about it. Really excited to have them on the show. You don't want to miss this episode. Check it out. It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you can start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com Apple Security.

Hey Greg, welcome to the Guild.

Thanks for having me.

I love the bio.

I like that intro.

So before I get into it, is anything I missed in your bio that you want the Guild to know about?

Oh yeah, yeah, that's a fine bio. I inject some humor in it because there's just so much to do with security and there's a whole lot of serious issues and little bit of humor helps to keep people's attention. So that's. Yeah, the bio is great. Keep for all those dedicated law enforcement professionals who spend their time watching my Internet movements. You need to read my manifestos to take over the world before it's too late. Get a copy for everyone in your department.

So speaking about getting a copy for everyone in your department, I just want to dive into a little bit about your books. Why did you Write novels Or did you feel like you wanted to write novels about security and cyber attacks?

Yeah. Why novels? And why not write how to stuff?

Yeah, yeah.

Because we are awash in how to books. There's tons and tons and tons of them and they're filled with great information and nobody reads any of it. And so that's part of why we keep making the same mistakes over and over and over again. Because the public doesn't know how this stuff works. That's part of it. That's not all of it. But I read my share of how to books and I went through the CISSP material. The books are like 3 or 4 inches thick and I couldn't stay awake through a lot of it because it was just so dry. And what I noticed was the passages that had personal stories, those woke me up. And so I thought, I'm going to write myself a how to book. And so I started Bullseye Breach and I thought, I'm going to start Bull Breach off with a story and I'm going to make up a fictional world because then I can control the narrative. And pretty soon the fiction took over. And it occurred to me that if people read the fiction and like it, then they'll be, they'll want to read the how to stuff. And there's plenty of good how to stuff out there. What's the sense in me writing yet another how to book? So I chose to continue with fiction.

Nice. So if someone was to pick up these books, say Virus Bomb or Bullseye Breach and they actually read it, would they actually pick up tools or techniques on how to approach their security issues?

Yeah. Oh yeah, they would. In Bullseye Breach, a fictional retailer in Minneapolis named Bullseye Stores loses 40 million customer credit card numbers to some overseas attackers. These credit card numbers are just flying out the store every day through intermediate FTP sites. And so a group of creative people in Minneapolis see this stuff going on and they're fighting bureaucrats and stuff like that who have their head in the sand and they come way to fight back. That I think real retailers could use. If you could poison that stream of credit card numbers flying out the door to attackers. You screw up the attackers reputations who are selling this stuff and then maybe you disrupt that market. Yeah, they could learn some techniques and then they could also learn some traditional defense tactics. You can do some network monitoring and you can see this traffic flying to places that doesn't make sense. And there's other things you could do. You could respond to events and that kind of thing. So yeah, they could. And for. Especially with Bullseye Breach, they could learn some stuff. With Virus Bomb, they could learn some things not to do too. You know, when you have a computer that's sending traffic to a Tor proxy, to an IP address of a Tor proxy, that ought to raise some eyebrows. And so there's. Yeah, both. You could learn tactics from both. Absolutely.

Nice. Now, actually, I'll be honest. I just started reading Virus Bomb. I noticed it's on Scribe, which is a service that allows you to read unlimited things within a month. And I just read the first few pages and I think it mentioned something about the trucking industry.

Yep.

Like I said, I haven't read the whole book yet, so I don't know, is this evolved around Iot and how maybe that makes exploits easier for attackers to get into nowadays while people realizing it?

No.

Okay.

No, it's not in Virus Bomb, I won't spoil it for you, but I'll give you some teasers. In Virus Bomb, Jerry Barclay. Well, Jerry Barclay is the main character in both Virus Bomb and Bullseye Breach. They're both in the same fictional world. They're independent stories. Jerry Barkley is a middle aged, bald headed IT contractor from Minnesota. He's never worked for any government agencies. He's not a former Secret Service agent or anything like that, but he does know his way around security and he's a patriot. And he's a little bit quirky, but he knows a lot more about what's going on than people give him credit for. And he uncovers this cyber attack that's hitting the trucking industry, and turns out that it's hitting the trucking. Well, I won't give that away, but it's hitting the trucking industry and there's a foreign. A hostile foreign government in the middle of it. And then once he uncovers that, nobody wants to believe him because, you know, he doesn't work for the government, so nobody thinks he knows how to do anything. And life gets considerably more complicated for Jerry as things get worse and worse and worse for the country until finally a crisis hits and people start to take him seriously and he can do something about the problem. And if Jerry hadn't acted, millions of people could have died and possibly we could have gone to World War Three. A lot of people think that story is just outlandish. You normal people don't get involved in these kind of global, international things, but normal people kind of do these days because we're all connected to each other across the Internet. So somebody like me really could see a nasty international cyber attack against the United States. And if we don't act, nobody else will be in a position to do so. And that includes all the so called high powered people across the federal government. And you know, the government plays a role in cybersecurity, but they don't play the only role. There's a whole lot of private industry stuff and there's a whole lot of individual people stuff too. I'm drifting a little bit, but I tell people, if you want to look at the most powerful person in the whole world for cybersecurity, just hold up a mirror.

Yeah, so I've been watching, I've been binging on a few of your content that you have. You have a lot of content on your blog and you talk about caring a lot. So. And it seems basic, but how do you actually get, you know, people to care about security and also how to get your companies to care about security?

Isn't that the million dollar question? Care and share to be prepared. You've probably read that model in a million different. Well, here's my answer to that. How do I get people to care? This is my answer to that question. I write really, really, really good novels and then market them like crazy to get people to read them. That's my answer. Read my books and then that'll help you care because you'll see some of the consequences of what happens when people don't care. And the consequences are really bad, you know, in the real world. Consequences of not caring. Ask Kathleen Archuleta. She was the head of the United States Office of Personnel Management. She lost her job because we let the Chinese steal secrets about every single federal employee, including people who applied for security clearances. Now the Chinese know everything that the federal government knows about people who applied for security clearances. Do you think there might be some blackmail and extortion going on from that? Or ask Target. You know Target lost a bazillion credit card numbers in 2013 sold at home Depot. So did a whole bunch of other retailers. And then politics. Well, the Democrats lost a whole bunch of their emails to WikiLeaks. And that you can make the argument that that helped cost them the election in 2016. And we'll keep it on both sides of the aisle here. If you stayed in the Trump Hotel during the right periods, the odds are pretty good that your credit card number is up for sale inside of an underground credit card Carter form. So persuading people to care, look at the consequences. Just pick up, go to Google and search for data breach on any given day and just read a few of the stories. Those could be you, those could be your business, your company, and they probably will be sooner or later. But how do you persuade people of that? You know, you can lead a horse to water, but you can't make them drink. So they say, so keep leading horses to water and hope a few of them drink. That's the. Read my book. That's the short and simple answer.

Absolutely. But I think for some reason people think about security, they think about companies. So companies need a harden their system so people don't break in. But I was reading really recently, maybe a few weeks ago, that TikTok, there's a spying app by China on it. And I'm not picking on China, but it just seems like people need to be more aware of these things. So do you see more of these type of exploits going into individual places rather than companies to get people more aware of why security is so important?

They're all over. These exploits are all over. And they take a bazillion different forms. Twitter just recently, Twitter, just two weeks ago, somebody invaded Twitter and hijacked the accounts for a whole bunch of high profile people and sent tweets out in their names. Hey, I'm feeling generous today. Send me $1,000 worth of Bitcoin and I'll send you $2,000 back. They made $117,000 from that exploit. Just one of many. There are so many different variations of attacks out there. There's nobody that can keep track of all of it. And we don't have to be sitting ducks for this stuff. There are common sense steps that every individual and every company can take to at least minimize the attack surface and reduce the odds of one of these attacks happening. And just keep your patches up to date is one thing. When the updates come along, apply the updates. That's one thing. Teach your people about spam and phishing schemes. It's amazing to me that people still fall for this stuff. Teach people not to listen to CEO fraud appeals. Hey, here's an email from the CEO. Please transfer a million dollars to this offshore company account. Thanks. Signed your CEO. But really it came from some attacker someplace. Vigilant. Teach people about vigilance. Teach people some of these tactics and also practice your response when an attack comes so when you get hit, you're ready. Ransomware is a huge thing these days. Ransomware is when an attacker somehow invades your system, scrambles all your files, and now your files are useless. And so your only recovery is either pay the ransom or recover from backups. So if you want to prepare yourself for such an attack, and there are lots of high profile ones to read about, make sure you have good backups and practice restoring everything from bare metal a few times so that when it happens, you're ready and you don't have to spend millions of dollars scrambling. There's all kinds of stuff people could do if they would just do it. But get your head out of the sand and look around you first and then prepare yourself.

Absolutely. So, Craig, in one of your other videos, you did talk about patching and you said you had a client and you spent a lot of time patching the system and it turned out they were upset with you for taking so much time because you were doing patching. So it seems trivial, like patching. But like, why is patching so critical? And how would you, after you said you think you failed that client because you weren't able to persuade them why patching was important. If you were to go back there, is there a way you could persuade them? Or is it just that sometimes just them being hacked is the only way they're going to learn?

There are some people who have to learn lessons the hard way. I remember that situation really well. Their server had trouble patching and I chased it down. There were some of all the bizarre reasons for a patch not to go in. There was some conflict with a font. Can you believe that? A conflict with a font that messed up a security patch. I probably spent eight hours chasing that down. And that cost some hourly time and they didn't want to spend the hourly money to do that. And how do I persuade somebody that doesn't know what servers do? There's a whole public awareness campaign that needs to happen because so many people, and this customer was maybe typical. So many people think that they buy a computer or they buy a server for their business, they bring it in, they set it up and it's static, it's there, it's done. Just run it, run it, run it, run it, run it for the next 10 years until it wears out and it's time to get the next one. It's a piece of equipment. It's like a car or a forklift. And the message is just like a car. Just like you have to change oil in a car, just like you have to maintain a forklift, you've got to maintain this IT equipment. And security is an arms race. The bad guys come up with attacks, the good guys need to come up with defenses, and the bad guys spend all night long probe all day long probing these systems for weaknesses, and they search for software bugs. They spend all night long collaborating with each other to make tomorrow's probes better. They find a bug, they exploit it, the vendor fixes a bug. And you've got to apply those patches. If you don't apply those patches, you're just leaving yourself wide open. How do you persuade people of that? I've shown packet traces, but you show the packet traces, they're just numbers that fly across the screen. They don't mean anything. I've talked about it till I'm blue in the face. I've sat people down and explained these things, but I haven't found the key yet to make this message popular. I'm still working on it. And you know what? That's my failure. I'm the one. I'm the security professional. I'm supposed to educate people about how this stuff works. It's my failure that I haven't found the key to getting that done yet. But I'm going to keep working on it.

Well, I think you're doing a great job of your blog because another thing that opened up my eyes, as you said, one way to learn how to secure things or to secure your stuff is actually to look at how the bad guys secure their stuff. Can you talk a little bit more about that?

Yeah.

You know, there was a forum for a long. There was an underground attacker forum for a long time called I forgot it's something ozo. So.

I can't. I get my fiction names and my real world names mixed up. I think it was Linoso. So it was named after an island in the Mediterranean. And it was the forum that some of the credit card attackers used until it got popular and people found out about it. They've since moved on. They use the Somalian domain name registry. So that's the domain name registry for Somalia. So they paid Somalia money to register that domain name and they ran their underground forum. So if you want to get in there, you have to have a reputation for attacking other places and that has to be verified by somebody else who's already a member of that group. And then you'll be assigned a username and a password and they'll log every IP address for that where you come from. So if you come from a different IP address, that raises eyebrows. The bad guys who really, really, really don't want law enforcement to infiltrate them come up with some really, really, really creative ways to secure themselves. And so it would be if learn how they do that stuff and adopt their Tactics turn the tables on these guys. Absolutely.

Great. Is there any actual things that someone could do with the, that you would recommend for how to maybe secure their hardware and then secure their software? Any like things that like is a must, that if you do, you probably would save yourself 80% of common attacks. Besides patching?

Yeah. Oh yeah, There's a bunch of things, believe it or not. The firewall, it starts with a firewall we read in the literature. Now, because everybody's putting their stuff in the cloud, our boundaries are not so much boundaries anymore, they're just kind of there. But I disagree with that. In my model, security starts at the firewall because that appliance is between your private network and the outside world. Everything that comes into your network goes through that firewall. Now you've got stuff stored in some cloud server someplace cool. Put it behind your own firewall system inside that cloud service. That firewall can be a virtual machine. It can be software pretending to be hardware. But everything that goes inside your network goes through that appliance. So now you can put stuff inside that appliance to watch the traffic in and out and look for patterns. And if it sees a bad pattern, notify the right people. That's one thing you can do. Now another thing you can do, and these are common sense tips that have been around for 20, 30, 40 years, but another thing you can do is put good antivirus systems on all your, on all your cell phones and desktops, laptops, all your devices. When I browse a website, I invite this traffic in. So it's going to come right through the firewall because I invited it in. And so I need another layer of protection on that device. So antivirus will help with that. Another thing you can do, another thing organizations can do is outbound web filtering. There's appliances out there and there's software out there that tracks evil websites and websites with objectionable content. And so there's different schemes you can apply to filter which websites your people can touch and which sites they cannot touch. There's ways to regulate that by category and by content and by a whole bunch of other different criteria. So you, you could do outbound web filtering. There's all kinds of tech tools you could apply to make your system safer. And there's a whole bunch of training you should do too. Because no matter how many tech tools we apply, there is no substitute for good old fashioned human judgment. So train your people to apply good human judgment to this stuff. So many people, so many decision makers want one silver bullet. Tell me the most important thing I need to do to secure my stuff because I only. I don't have a whole lot of time here. So just tell me one thing I need to do. When people tell me that, I fall back to care and share to be prepared, that's another level of perspective. Deeper. Because they did ask for one thing. But if you want to break down that one thing into the actual actionable steps, there's a bazillion things and they're all important. You got to get all these things right. And we hear this in terrorism all the time. But it's true in cybersecurity too. You have to get a whole bunch of things right because attackers only have to get one thing right. All these pieces and all these layers add up to a good security posture.

Absolutely, Greg. And I believe you also said that winning in cybersecurity includes not only technology but also psychology. So talking about training then, how do you teach human judgment? Is there a training program or trainings that you like to recommend for folks to get everyone up to speed beyond the tools to think? Okay, maybe start thinking at a higher level about security.

I've seen some webinars and seminars that I liked. I don't have any specific recommendations. You know, maybe I'll put one on. One tactic I've seen that's effective is take people through a scenario. I saw one and I don't remember who put this on now, but I saw one presenter interact with an audience and he spent so much time showing how identity theft works and how social engineering works and how you can persuade people to do something stupid. And then he turned to an audience member, an audience member and he said, here, let me see your purse. I want to look at something. And she gave him her purse in front of the whole audience. And so he started taking stuff out of her purse. And he smiled and he said, I got you, didn't I? She said, yes, you did.

So examples that maybe have some humor with a message behind the humor, those seem to be effective. And it's true, by the way, IT support and IT security, it's about 50% technology and about 50% psychology. That is true. So use some good attention getting presentation tactics. I think that would be effective. I have to search for examples of presentation companies though. I know there's lots of them out there. I don't have any one specific one to recommend.

Great. So I think another thing people struggle with is, like I said in the pre show, I'm a beginner to security, but when I hear about exploits it seems like a lot of companies don't even know like until months after someone's been in their network for months. So are there any telltale signs to know that you're being hacked or you've been hacked?

There's a perfect arms race example right there. There are some. Sometimes your systems slow down for no apparent reason. Why is a system running so slow all of a sudden? Maybe you might want to look at some of the traffic going in and out to see where it's headed. Or maybe systems just start to start to behave differently. Maybe your system start to see pop ups that you didn't used to see. Watch for differences in behavior that don't have an apparent explanation. So you're a user, you're watching for that stuff. I'm an attacker, I know you're a user gonna be watching for that stuff. I'm gonna slow down my attacks. I'm gonna hide dormant inside your system and just watch for a while until it's time to pounce. And when I pounce, I'm gonna make it too late for you. That can happen, but it doesn't happen very often. The good news is most of the time attackers just aren't that smart. Most of the attackers out there use tools and use code that's written by somebody else and they, they apply this stuff. Most of the time they're not that smart. So if your users can be that smart and watch for differences, you can weed out most of the attacks and see how I'm catching that with most. And sometimes and almost, there's no such thing as perfect security. But you can sure reduce the odds of an attack just by applying some common sense and watching for differences. So there are things you can do.

So Greg, I know the biggest rage or the biggest buzz is AI. Artificial intelligence and software development and testing is any way or anything you could see where AI being able to detect these type of anomalies and maybe bubble it up because it seems like something that would be nice to have. Is that a user case you see happening going forward?

AI has its place. You saw my blog post about the Amazon review. I posted a friend's novel and the Amazon AI caught it and flagged it and said it was terrible and rejected it. So here's, here's the scoop about AI. I can go buy AI that detects, that does all this pattern detection and the attackers can also go by the same AI that knows about my AI that's detecting patterns and so they change the pattern. It's a never ending arms race And I'm sure AI is going to get smarter and smarter and smarter and better and better and better. And it's going to be a valuable tool. And it already is a valuable tool. But don't depend on it. Don't think that it's the ultimate can be all to end all. Here's an AI test for all your listeners. We all get robocalls. We all get calls from computers that are pretending to be people. I get calls like that all the time. And lately I get this giggly female voice and it says, oh, please excuse me, I'm working on getting my headset. Sorry about the delay. Well, you know what that is? It's. It's some engineer somewhere figured out a way to lie their way through the delay when all the automation kicks in and starts sending their automated pitch. It's supposed to sound like a person. If you want to fool AI, ask it this simple, stupid question. Say, hey, hey, hey, John over there. And wherever you are, what's the name of the sport where tall guys try to stuff a ball into a basket? Well, sorry, tall people try to stuff a ball into a basket. Ask an AI voice recognition that question and then just watch the answer and laugh. So AI has a long way to go before it's not so easy to fool valuable tool. Don't depend on it 100%.

Great. And Greg, I know you just came up with the virus bomb, maybe 2019, so maybe this might be too early, but are there any new books that you're working on or any type of subject matter you've been interested in that you think make for a great novel?

Oh, yeah. Virus bomb was two years in the making. I published in 2018, but I started working on that book in 2015. It took a long time to get that book written and published. And I have a work in progress right now. I'm working on book number three right now. In Bullseye Breach, there was a credit card. There's a credit card business issue. And virus bomb, the stakes are way higher because there's global terrorism involved. Book number three, we've got some human traffickers doing some really, really, really bad stuff. And book number three has a different. Jerry Barclay's not the main character in book number three. Jesse Johnson's the main character in book number three, and you'll like her. I've got a write up on Jesse Johnson, where she came from on my website if you. Anybody who's read Bullseye Breach has already met Jesse Johnson. She's gonna get challenged to her limit in book Number three, that's a ways away yet. That's still. I don't have all the plot figured out yet, but I'm working on it.

So how does news influence your novels? Or they do it all like security news? Have you ever been writing a novel and then all of a sudden something broke in the news? You're like, oh my gosh, I need to work this into my story somehow.

Yeah, absolutely. Let's see. And yeah, and virus bomb. Brian Cox. Brian Cox is a character and you would have read about him in the second chapter. He's probably five or ten pages away yet for you. Brian Cox is a young man who lives in Sioux Falls, South Dakota. His dad works for a big bank that with headquarters in South Dakota. He moved with his family from New York City to Sioux Falls, South Dakota because his dad got a promotion at this big bank. Well, there aren't any Muslims in Sioux Falls, South Dakota or anywhere near him. And he's a devout Muslim. He gets picked on mercilessly because he gets picked on mercilessly and because he's a 17 year old that makes dumb 17 year old decisions, he makes some really, really, really dumb decisions that have some far reaching consequences. And so Brian Cox. There are some young men in Minneapolis that directly influence how I portrayed Brian Cox in real news. I think it was 18 young men in Minneapolis, for whatever reason decided to go join some of these Muslim terrorist organizations. Some of them got on, some of them made it to, made it overseas to airplanes, some of them got caught at airports, some of them got caught before they went away. Most of them lived to regret it. A few of them died. And that's just gut wrenching sad. So yeah, that news directly influenced Brian Cox's character. You don't like how Brian Cox turns out, but he goes through a journey to get there and he goes through a journey with some gut wrenching sadness, but he comes out the other end hopeful.

Okay, Greg, before we go, is there one piece of actual advice you can give to someone to help them with their security testing efforts? What's the best way to find contact you or get our hands on your novels?

The best way to contact me is for the public is right through my website. There's a contact me form. I get a lot of spam and I get a ton of spam in that contact form. So when you contact me, put a subject line that'll get my attention. Write something custom and you know, something personal so I know that it's a real person that wrote it and not some, not Automation and the. The novels are available anywhere. You can buy books. You can buy my novels. The best way to get Bullseye Breach. Well, the best way to get everything, just go through my website and find it. Bullseye Breach was self published in 2015 and there's a fulfillment house right here in Minneapolis and that's where Amazon and all the other retailers, that's where all the books are that this fulfillment house right here. So just buy it right here. That's the easiest way. Virus Bomb is different. Virus Bomb went through Morgan James Publishing and that's a New York publisher. Virus Bomb. Buy it from anywhere. Anywhere. You can buy books at retail. But if you want me to come speak at your event or something like that, that would be really cool too. I can bring a bunch of copies with me and we can do an event and we can one of these days when we don't have to, we don't have to do super social distancing. We can do an event and I can bring books and I can do autographs and stuff like that. And I can do those. Well, I can do both of those direct if we need to. So that's the best way.

Thank you Greg for security awesomeness. For links to everything of value we covered in this episode, head on over to testguild.com S27. And while you're there, make sure to click on the Try it Today link under the exclusive sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in application security. So that's it for this episode of the Test Guild Security Podcast. I'm Joe. My mission is to help you succeed with creating end to end full stack security testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.