Ethical Hacking: Understanding Ethical Hacking with Dale Meredith

Welcome to the Test Guild Security Podcast, where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security podcast. Today we'll be talking with Dale Meredith, all about ethical hacking, understanding ethical hacking, pen testing, and a whole bunch more. Dale has been a certified ethical hacker instructor, EC Console for the past 15 years, and as a Microsoft Certified trainer for over 20 years. He also has an additional seven years as a senior IT manager with experience working as a CTO for a popular ISP provider. Dale's expertise is in explaining difficult concepts and ensuring his students have an actual knowledge of the course material that he's presenting. He's also a pluralsight author with multiple courses. I think I counted about 35, all on things like penetration testing and ethical hacking. You really don't want to miss this episode. Check it out.

It's no secret that the number and complexity of applications are growing. But what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher, and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security, and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you can start security applications in a single day, including custom code, open source or commercial components, and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security.

Hey, Dale. Welcome to the Guild.

Hey, Joe, how's it going?

Great, great. Great to have you on the show, Dale. Before we get into it, is there anything I missed in your bio that you want to share with the Guild?

I enjoy long walks on the beach. No, that was a good summary. Thank you.

Awesome, awesome. All right, so you have a lot of courses on pluralsight, and I thought we'd start off by focusing in on ethical hacking. Okay, so at a really high level, what is ethical hacking?

So, you know, it's kind of funny, every time I do some traveling, like, I'll be sitting on an airplane and somebody will say, so you start that conversation up right with the person next to you, and they're like, so what do you do for a living? I'm like, well, I'm an ethical hacker. And they're like, what? I know that sounds really bizarre, an ethical hacker, but how I look at it or how I try to explain it is it's very similar to A criminal profiler. What we're doing is we're teaching security professionals how to think like a hacker so that they can determine or they know what's coming at them. And the things we teach them are the exact same techniques and tools that hackers will use. We actually like to refer to them as attackers because hacking is just simply getting something to do or operate in a way that it wasn't meant to be done. And so that's why we say ethical hacking is. Because hacking isn't necessarily bad itself, but the attack is what's hard.

Great. Now, during that conversation, I'm sure people have something in their mind of what a hack is. And I don't know if. Does Hollywood overplay it? So how scared should people be about security hacks? Should they be worried?

Hollywood does overplay it quite a bit, usually. It's just they get it wrong. It's not that they show things that you're like, what? And at least from my perspective, I think often that's not possible. There's a couple of Hollywood shows that do seem to get it right, but we should be very concerned in the aspect of there's so many things that one, we as individuals have a tendency of giving up knowingly. Then there's the second part of that, and that is sometimes because we're so used to doing that, we end up giving up information we don't mean to give up. And sometimes that is done through applications. When it comes to applications, I have a love hate relationship for apps. No offense to any app developers out there, but a majority of my pen test engagements that I do, I end up finding issues within the code itself that allows for different attack vectors to come in. And that puts not only your company in jeopardy, but it also puts your customer base in jeopardy.

Absolutely. Actually, in your course, you showed something called the Live Cyber Threat Map. I'm looking at it now. I think it's up to 16 million just for today. How many of these hacks, I guess, are preventable or should be preventable? I guess the question is, how many of these hacks do you think we should be worried about when we're coding and developing software?

It really does depend on attackers motivation because they might look at some business, you know, Billy Bob's Garage as an example, and look that their site is accessible, and then may be thinking, you know what, that's not really a great target for me to go after, but there are other attackers that will look at that and say, hey, I can turn that into a botnet. Or you Know, bring that person's or those resources into a botnet. So we should always be thinking, well, I phrase it this way again, when I teach people how to be ethical hackers, we should always be thinking of when we see especially like new technology. We're like, oh, that's really cool. Yeah, but what can an attacker use that for? So again, we always have to be on the, in my book, we have to be on the defense as of right now. Hopefully that'll change one day. But I don't think so. Not for a long, long time.

So, Dale, you know, there are a lot of tools out there that can help you metasploit. They have built in exploits you can run. I guess the difference between an ethical hacker and a hacker also maybe the code of ethics. I mean, can you just talk a little bit about some main points of the code? Ethics as ethical hacker you should abide by.

Yeah. So there's a couple things that we need to be concerned about. And I always try to teach this to my students or viewers. And that is, it's a slogan that I've come up with. And that is just because you can doesn't mean you can. Again, we utilize the same tools even on own network. You shouldn't necessarily use these tools. In fact, my courses are really focusing on building up, I call it a hack lab, which are just virtual machines that people can practice their skill set on that environment. We should never be, even if, again, even if we work for the company itself, we should never be doing anything without getting permission. And when it comes to permission, there's also the aspect of the scope. And what I mean by that is just because you have permission to check out the marketing department's domain or their area doesn't mean that you can then pivot into the sales folks. And we also don't try to prove our prowess by hacking some company's website and then sending them an email and say, hey, look, I just hacked you. There's a lot of federal and local laws and you know, black hats as we refer to folks that are doing things illegally and we want to be more white hats, which means we use the same techniques, we just do it with permission and we report everything that we see.

Great. So, you know, it seems like there's a lot to learn. I think one way of learning that people necessarily don't go towards is a certification. And I think when you started one of your videos on certification, so you don't necessarily have to do the certification, but you can use it almost for learning just in general. So I guess what's the some of the reasons why someone may want to go and get a certification on ethical hacking right now?

The ethical hacking certification from EC Council, they refer to as ceh, a Certified Ethical Hacker. It's one of the hottest certifications right now. And it's for two reasons. One, because they've been at it for so long. But two, they actually have, once you meet that certification, they have an exam that you can take that you have to not only prove that you know the information, but you do it in a virtualized environment. So it's no longer a multiple choice question. And this allows employers to verify that. Yeah, Dale knows what he's talking about or Dale can because he's passed this particular exam. A lot of times certification gets a real bad rap for itself because in the old days it used to be all multiple choice questions. And let's face it, you know, anybody can figure out multiple choice questions given enough time. And that's what I'm really enjoying about the latest things that are coming out. As far as the exams, not only EC Council is doing this, but even CompTIA, which they have their certification for security plus as well as pen test plus, they're getting ready to switch those over to those type of exams.

So you also mentioned that the exam is hard. So my question is how hard and do you know what the pass fail rate is and how much time someone needs to put into the exam in order to get a passing grade?

The exam itself is hard in the aspect of there's so many things that are covered. It is a three hour exam and the multiple times that I've taken different versions of that particular exam, I mean I've been around since version 5 and we're up to version 10 now and matter of fact version 11 is supposed to be coming out in 2021. The exam itself, it's hard because there's so much information, whether it's Metasploit or look at this code or this SQL injection, this tool. There's a lot of misconception about the tools as well. They do cover a lot of tools, but you're not necessarily test on the actual syntax of the tools. They just want you to be aware of what the different tools do. So I don't know about the pass fail ratio. At least I can only speak to what I experienced back in the pre Covid days when I would teach in live classroom environments. I would typically see with my students probably a 70% pass ratio. But it depends on how much time that they put in for studying. Everything that you need to pass the exam is either in the courseware from EC Council or in the courses that I teach with pluralsight.

So I come from a software development testing background and I guess my view is not popular. I believe anyone that does testing should do all sorts of testing, including security testing. So for someone that's a software tester, do you think this certificate is appropriate for them, the certification or would it be more towards you? Definitely should be in the security. A security type role.

Wow, Joe, you and I are going to be best friends because that's exactly what I think. As far as anybody that's involved with developing applications applications or testing applications. Yes, security is the number one thing that we see as far as breaches are concerned is typically based off of weak design. As far as applications are concerned, whether that's the front end or whether they're allowing things to pass back to the back end. You know, SQL injections are still, I'm still amazed of how popular those are and how many are still being utilized today. So I think it's imperative that anybody that's involved in the development process should at least have a basic understanding so that when they're creating the app, they're doing their code, they remember to remove comments or remember to check the source of any, I don't know, GitHub repository that they pull from that they make sure that it's not, you know, the plugin isn't doing something extra behind the scenes. We need to be on guard all the time because again, the developers themselves, they're the ones that it can make or break a company as far as an application is concerned and it not being locked down correctly.

So I know you have a whole other course on secure software development, but does this particular certification have anything in it to teach someone what maybe some secure software development practices might be?

The Certified Ethical Hacking series doesn't really get into it that much, but the CySA plus series, which is Cyber Security Analyst, that particular certification comes from Comptia. That one does focus in a little bit more on the development side of things. And like you said, I've got a course there on developing secure software and we've got other courses there. I'm sorry, this sounds like a plug and you can edit this out if you want later, Joe, but pluralsight's got a ton of courses when it comes to secure code. Not just what I've got, but other authors are out out there doing similar types of courses. But the Pen Test plus series that I'M actually wrapping up here by end of June. We also get into that secure code option or the secure code concept of input, validation code, signing hidden elements, having hard coded credentials, all that type of stuff are all the no nos that we have to be careful with.

So I'm also a really big believer in tools. I love tools. Maybe I focus too much in on them, but I know you also have a course on selecting the right tools for your red team oper. Are there any tools you think anyone that's doing security testing should be aware of?

So the red team tools course that we did, I had an opportunity to do that with Aaron Rosman and he's more of a blue team guy. I'm more of the red team guy. We kind of focus in on some really interesting tools that have just recently come to light. As far as what I would have in my utility belt as far as tools are concerned, the basic or I should say the industry standard ones, things like Kali gives you almost everything you need for testing. But I'm a big fan of using the metasploitable virtual machines which are boxed, that are set up, that are extremely vulnerable to different types of attacks that again, that we're going to test those in a virtualized environment to see how these tools can be utilized or not utilized. And the tools themselves are always evolving and newer things are always coming out. And it's kind of a hard one to say. These are the, you know, specific tools that I use every single time my utility belt has changed up probably umpteen times since I got into this whole business. Because again, new things come out a lot the time. Just be aware, always be learning and making sure that you're aware of what's out there as far as tools are concerned. Because I guarantee what we call tools, attackers also call tools and they're using them for devious purposes.

This course covers a lot of different things. It's very long. One of them is common security threats and attack vectors. So for someone that's maybe new to security, once again, are there any common security threats or attack vectors that they need to know about about or they should know as a foundational piece before they go really deep dive into this.

So as far as the different threats and attack vectors that are out there, back in the old days, the attacker would just simply, you know, hardcore go after a particular box. One of the ones that you got to be really careful with. We talk about this quite a bit. It's the human aspect. It is much, much easier as a black hat to get into a network infrastructure by using social engineering attack. Because one, you can't determine if I'm really being devious because I send you an email or send you a fish of sort. It's very hard to track down the individuals at that point. There's typically no IP addresses associated to it. So we're seeing a lot more focus on the human side of things as far as the different threats and attack vectors that are out there. Anytime that we put something on that's exposed to the public side of our network connections or to the Internet itself, you have to look at that as a possible attack vector. So we have to be extremely careful about what we put out there. There's so many stories, historical stories, of companies that have been breached because they thought, oh, hey, we'll make this data available out there for our employees. And they had, I guess, no concept or no idea that other people could see it as well. So again, there's so many different threats, even from the physical aspect and even the natural aspect. I mean, here in Utah, you know, right in the middle of this whole Covid thing, we had an earthquake. And it's like, yeah, that's actually a threat to a business. You know what systems go down, lightning, you know, not having those physical things in place that can disrupt or even destroy data. And that's what's important about our resources, or I should say our infrastructures today, is we always have this tendency of thinking about somebody evil from the outside trying to get in. Well, guess what? Most hacks take place, or there's a lot of attacks that we're starting to see take place caused by internal users. Sometimes they know what they're doing, sometimes they don't. Again, I go back to that social engineering side of things. They. They don't realize that clicking on a link to see the funny cat video actually exposes the network. So those are the most common that we see as well. As matter of fact, one of my pet peeves as far as the attack vectors, how to reduce those is when you read about these different breaches, a lot of times we'll see that they didn't update their operating system either on servers or the operating system on routers or switches. And I'm a big fan or I'm a big proponent of, you make sure everything is up to date. Not just the desktops, not just the servers, but anything on the network itself. Whether, again, that's a router or switch, you got to keep those things updated.

So this may seem like a weird question, but how do you plan for the unknowns. You just mentioned earthquakes. We're going through COVID 19, these black swan type of events that could expose a security breach or a security hole that may not have been known about before that particular thing happened. Is there any way of preparing for unknown type security things?

The best suggestion I can give for companies or for individuals in this field is that you just gotta have, you have to have a sit down and everybody brainstorm about the possibilities. Even though you might not have something in place for COVID 19, you might have a plan that's in place that is similar to what we're experiencing. You know, where everybody has to work remote right now. I guarantee, by the way, side note here, Joe, I guarantee in about six months we're going to hear about a ton of breaches that were caused because of COVID 19. People working from remote locations and things not being secured down. Typically the cycle's about four to six months after something is discovered or happens. So that's my prediction of the year, is that we'll see that come out. But there's some basic knowns. I mean, we can go through and say, okay, what happens when a hard drive goes out? What are we doing in that particular aspect? What's our protocol as far as going through and recovering from that? But we need to expand that out to natural disasters. A lot of people don't think it's ever going to happen and then, you know, it ends up happening to them. And I would actually consider Covid a kind of a natural disaster that's taking place, a worldwide natural disaster. Because this is, well, maybe it's not natural, maybe I want to take that one back. But the same concept goes back to into play as far as we may have a plan in place for a natural disaster that might fit the mapping of what we should be doing with the COVID 19 environment. So it's a brainstorming session and you don't have it one time. You should have these brainstorming sessions like every quarter. Because again, things change in this digital format. This digital world, it's changing rapidly. So don't think that because you had the meeting once that you're good to go. Keep an open dialogue, even create those individuals that are using Slack. Create a Slack channel where people can share, you know, hey, I just heard about this. Do we have something in play here? So that would be my personal suggestion, is just make sure that you're open to a communication channel that everybody can talk to and share ideas with.

So one of the things you mentioned and that I really enjoyed about the course is this. Create a lab to hack safely. Could these labs be used to do some what if scenarios people could play in almost like a playground?

Yeah, absolutely. And what's beautiful is that you can do this anywhere from, you know, creating the virtual environment or these environments on your local system. Like what I do in mine. I have a laptop with a bazillion terabytes of hard drive space, it feels like, and tons of ram. And so wherever I go, I can have an experiment. Even when I'm traveling, I'll jump on a plane, read something, and I'll fire up my virtual machines and see if I can do it. But you can also host these systems in the cloud. A lot of companies are doing cloud environments, and so our goal is to duplicate the network infrastructure. Not machine, you know, one to one, machine to machine. But, you know, if we're using SQL in our environment, try to fire up an SQL server and try to duplicate how the app is talking on the back end of it so that we can see if, you know, there's any vulnerabilities in that test environment, we can make those changes in the production world.

And, Dale, you do have a lot of courses on pen testing, and I think when people think of security, that's the first thing they think of. So any quick best practices for people that may want to get into pen testing?

You know, I think for pen testing, you have to have a passion for security. If somebody wants to get into that world, you have to have a passion and you have to have the ethics. It always comes back to ethics, because a lot of times as a pen tester, we're exposed to things that the company may or may not want us to know about. Or in one particular pen test that I was involved with, the gentleman who hired us, we discovered materials on his system that were inappropriate and illegal, and we had to report him to the authorities. He was the guy that hired us. So you have to have that strong line of, these are my ethics, and I won't be deterred by that. We also have the responsibility that when we find something that is critical, we have to report it immediately. We don't hold them for ransom saying, you know, we're going to charge you X amount more because we found this. Again, we're there to help the companies not try to prove our security muscles. The engagement itself should prove that. But you really have to have a passion because you are continually learning. It is not like being a plumber, you know, when you're a plumber you learn how to weld and solder and how to make a right angle and different angles and stuff, but it's the same thing day after day. In this world, especially with pen testing, you've got to be extremely fluid, so you can flex to any type of new attack vector that comes out and simulate it, or you can immediately help people protect themselves.

Okay, Dale, before we go, is there one piece of actual advice you can give someone to help them with their security testing efforts and what's the best way to find or contact you?

I think the advice I would give is kind of in the aspect what we talked about previously, and that is don't stay stagnant in your learning. Make sure that you are always moving forward. Because again, attackers, they may be using similar concepts, but they're looking at it from a different perspective at this point, especially as newer technologies come out. So that would be my biggest recommendation, is stay very fluid in your learning and don't think that just because your environment. I get this a lot. Individuals are like, well, our environment is set up in such a way that we're okay. We don't need to worry about it. And then a new device or a new service or new application gets introduced and everything gets thrown out the window. So again, be very, I would say be very fluid in your learning. So as far as contacting me, you can reach me on all my socials, LinkedIn. I'm just simply Dale Meredith. I do have a website and Instagram that I focus in for families. That's one actually one of my biggest passions is that everything I learned, I sit there and think, man, if families only knew. And so I've got an Instagram account that's called Dale Dumbsit down or Dumbs it down, where we try to make sure that people are aware of some of the things they can do to protect their families from a security perspective. And of course, you can also reach me at pluralsight. If you happen to have an account there. You can reach out to me there. And I think that's about my phone number is. No, I'm kidding.

Thank you, Dale, for your security testing. Awesomeness links to everything of value we covered in this episode. Head on over to Tuskill, test guild.com forward/s20. And while you're there, make sure to click on the Try Today link under the exclusive sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in application security. So that's it for this episode of the Test Guild Security podcast. I'm Joe and my mission is to help you succeed creating end to end full stack testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild.com for full show notes, amazing blog articles, and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.