Zero Day, Zero Warning: Inside the Discovery That Could Have Crippled the Internet

1
00:00:01,200 --> 00:00:05,490
So when I first started looking at
it, the approach that I try to take is
2
00:00:05,550 --> 00:00:09,060
assume that there's an issue with pseudo.
3
00:00:09,450 --> 00:00:13,950
When I started looking at it, I'm
like, I told myself I'm going to find
4
00:00:14,070 --> 00:00:18,630
a vulnerability in pseudo magical
things happen when you keep pushing.
5
00:00:19,020 --> 00:00:20,880
So, especially in this case.
6
00:00:21,450 --> 00:00:25,830
So when I found it, I
kind of did a double take.
7
00:00:25,830 --> 00:00:27,660
I'm like, there's no way that just worked.
8
00:00:29,325 --> 00:00:32,174
In the world of technology,
heroes are everywhere.
9
00:00:32,715 --> 00:00:37,425
They're overcoming disruption, delivering
sustainable outcomes, and fearlessly
10
00:00:37,425 --> 00:00:39,855
forging the future to solve what's next.
11
00:00:40,725 --> 00:00:45,285
Join me, ed McNamara as we meet the
people and businesses driving change
12
00:00:45,285 --> 00:00:47,025
in our constantly disruptive world.
13
00:00:48,015 --> 00:00:51,885
This is Innovation Heroes, a
podcast brought to you by SHI.
14
00:00:54,780 --> 00:00:55,500
12 years.
15
00:00:55,890 --> 00:01:00,180
That's how long a vulnerability quietly
sat inside the code that powers almost
16
00:01:00,210 --> 00:01:01,650
every Linux system on the planet.
17
00:01:02,250 --> 00:01:05,459
Undiscovered, unpatched, just waiting.
18
00:01:06,630 --> 00:01:10,860
It was buried in pseudo A command most
users never think twice about, but one
19
00:01:10,860 --> 00:01:14,009
that could controls who gets access
to the deepest parts of a machine.
20
00:01:14,759 --> 00:01:16,950
Root privileges system-wide control.
21
00:01:17,475 --> 00:01:18,495
In the wrong hands.
22
00:01:18,555 --> 00:01:21,945
It could have meant millions of
compromised devices, servers,
23
00:01:22,005 --> 00:01:23,835
routers, critical infrastructure.
24
00:01:24,465 --> 00:01:29,865
No password required, no log left behind,
but it didn't land in the wrong hands.
25
00:01:30,105 --> 00:01:32,655
It landed in the hands of
researchers at Stratoscale.
26
00:01:33,255 --> 00:01:37,095
Today on Innovation Heroes were
joined by Rich Merch and Quentin
27
00:01:37,095 --> 00:01:40,125
Rhodes Herrera from Strata Scale's
Cybersecurity Research Unit.
28
00:01:40,545 --> 00:01:44,985
The team that discovered and
responsibly disclosed not one but two
29
00:01:45,015 --> 00:01:46,875
zero day vulnerabilities in pseudo.
30
00:01:47,625 --> 00:01:50,775
Including one that has been hiding
in plain sight for over a decade.
31
00:01:51,615 --> 00:01:55,545
We'll unpack how they found it, what
could have gone wrong, and what this
32
00:01:55,545 --> 00:02:00,105
discovery tells us about the future of
proactive security and the power of human
33
00:02:00,105 --> 00:02:03,255
curiosity in an era of automated defense.
34
00:02:04,065 --> 00:02:05,775
Rich Quentin, welcome to the show.
35
00:02:07,185 --> 00:02:08,115
Thank you, Eric, for having
36
00:02:08,115 --> 00:02:08,414
us.
37
00:02:08,805 --> 00:02:09,104
Thank you.
38
00:02:09,990 --> 00:02:11,190
Absolutely Rich.
39
00:02:11,220 --> 00:02:13,050
I want to get right to
the moment of discovery.
40
00:02:13,050 --> 00:02:16,860
You found a vulnerability in pseudo
that's been there for over 12 years.
41
00:02:17,550 --> 00:02:19,470
How did you even begin looking there?
42
00:02:19,530 --> 00:02:21,720
What tipped you off that
something might be wrong?
43
00:02:23,850 --> 00:02:28,200
So when I first started looking at
it, the approach that I try to take is
44
00:02:28,200 --> 00:02:31,740
assume that there's an issue with pseudo.
45
00:02:32,190 --> 00:02:33,450
So when I first looked at it.
46
00:02:34,365 --> 00:02:37,725
You know, if we're, you know, pseudo
has been around for 30 plus years.
47
00:02:37,725 --> 00:02:41,595
It's mature, it's been researched,
and there's been issues in the past.
48
00:02:41,985 --> 00:02:44,685
The best top researchers in the world
have found issues with this in the
49
00:02:44,685 --> 00:02:47,085
past, but it's overall fairly stable.
50
00:02:47,925 --> 00:02:53,325
So when I started looking at it, I'm
like, I told myself I'm going to find
51
00:02:53,325 --> 00:02:59,415
a vulnerability in pseudo, um, no idea,
but I have to keep that open mind.
52
00:02:59,565 --> 00:03:02,655
And that's probably one
of the main takeaways for.
53
00:03:03,105 --> 00:03:06,765
Other people that work in offensive
security and enjoy vulnerability
54
00:03:06,765 --> 00:03:11,535
research is sometimes you have to
let your guard down and just assume
55
00:03:12,165 --> 00:03:17,175
that something is there, because
oftentimes we can get in our own way.
56
00:03:17,685 --> 00:03:18,795
So that's the approach I took.
57
00:03:19,215 --> 00:03:21,585
I literally said to myself, I'm
gonna find a vulnerability in
58
00:03:21,585 --> 00:03:23,565
pseudo, and I started looking.
59
00:03:24,269 --> 00:03:27,750
Do you have to be a pessimist by nature,
I mean, it's not like it's a shipwreck
60
00:03:27,750 --> 00:03:29,130
where they're like, yep, we lost one.
61
00:03:29,130 --> 00:03:32,429
It went down in this general area,
like you're, you're searching for
62
00:03:32,429 --> 00:03:34,079
something that might not be there.
63
00:03:34,079 --> 00:03:36,209
So do you need to be
pessimistic by nature?
64
00:03:36,269 --> 00:03:37,500
How would you describe yourself?
65
00:03:38,010 --> 00:03:41,820
Yes, you do, because, you know,
we, we deal with, you know,
66
00:03:41,850 --> 00:03:45,869
pseudo or even, you know, software
that's developed by companies like
67
00:03:45,869 --> 00:03:47,459
Microsoft and other big companies.
68
00:03:47,940 --> 00:03:50,760
It's easy to say, well, you know,
it's been around a long time.
69
00:03:51,495 --> 00:03:55,455
It's, it's, well, you know,
assessed and like in the case of
70
00:03:55,455 --> 00:03:57,945
pseudo, uh, they have automation.
71
00:03:57,945 --> 00:04:00,885
So basically every commit gets
analyzed by static analyzers.
72
00:04:01,455 --> 00:04:05,385
They do various, uh, fuzz techniques
and different things like that to where
73
00:04:05,385 --> 00:04:08,265
they're, they're constantly, you know,
getting that coverage on the code.
74
00:04:09,195 --> 00:04:12,040
Um, but there are
limitations with that and.
75
00:04:13,320 --> 00:04:15,359
Uh, this is where the
human comes into play.
76
00:04:15,570 --> 00:04:20,039
And so when I started looking
at it, pseudo is pretty complex
77
00:04:20,039 --> 00:04:21,209
from a code perspective.
78
00:04:21,209 --> 00:04:26,340
It's like 130,000 plus
lines, so it is open source.
79
00:04:26,610 --> 00:04:30,000
Um, and having access to
the source definitely helps.
80
00:04:30,450 --> 00:04:34,200
But the approach that I took was
focused on the dynamic testing.
81
00:04:34,440 --> 00:04:35,700
And so what that means is.
82
00:04:36,135 --> 00:04:39,705
Instead of reviewing the source
code, which is, you know, complex and
83
00:04:39,705 --> 00:04:43,095
thousands and thousands of lines, I
actually just run the application.
84
00:04:43,545 --> 00:04:48,045
And the focus of this research was,
uh, on the lesser used options.
85
00:04:48,885 --> 00:04:51,285
And most people are familiar with pseudo.
86
00:04:51,285 --> 00:04:55,905
If they've used Linux before or even Unix,
uh, I guarantee that the options that,
87
00:04:56,355 --> 00:05:01,155
uh, we found issues in probably they have
never used or maybe even never heard of.
88
00:05:01,155 --> 00:05:02,290
I've seen comments of that online.
89
00:05:03,015 --> 00:05:06,945
Even seasoned people that have been
doing this type of work for many years
90
00:05:07,395 --> 00:05:08,865
didn't even know these options existed.
91
00:05:09,645 --> 00:05:12,825
Um, so that was really
the focus of the research.
92
00:05:12,915 --> 00:05:17,685
And, uh, when I found the first
vulnerability, I am basically,
93
00:05:17,685 --> 00:05:21,285
when I'm going through the dynamic
testing, I'm using debuggers and
94
00:05:21,285 --> 00:05:24,075
tracing utilities and things like
that, and I kind of work backwards.
95
00:05:24,765 --> 00:05:29,235
So I look for interest in functionality
or behavior or maybe error messages.
96
00:05:29,535 --> 00:05:33,690
And then I. Once I kind of hone in
on something, I'll take that and then
97
00:05:33,690 --> 00:05:37,110
cross-reference it with the source code
and then kind of work backwards from there
98
00:05:37,110 --> 00:05:42,330
so I can kind of quickly find where I'm at
in the source code and then see how it's
99
00:05:42,330 --> 00:05:47,400
actually being handled in the source code
and kind of continue along that process.
100
00:05:48,180 --> 00:05:51,450
And it's, it can be a
very frustrating process.
101
00:05:51,870 --> 00:05:57,780
Uh, you definitely hit walls and
kind of the, you know, how I've
102
00:05:57,780 --> 00:05:59,289
succeeded in offensive security is.
103
00:06:00,539 --> 00:06:05,940
Is trying harder and getting past
those balls, uh, because magical things
104
00:06:05,940 --> 00:06:12,030
happen when you keep pushing and,
you know, eventually things work out.
105
00:06:12,030 --> 00:06:13,140
In this case it did.
106
00:06:14,550 --> 00:06:18,390
And when those things eventually
work out, you have to go and tell
107
00:06:18,390 --> 00:06:21,060
someone else and you've gotta
be really sure about it, right?
108
00:06:21,060 --> 00:06:21,780
So, yes.
109
00:06:22,785 --> 00:06:25,665
Quentin, what was your reaction
when Rich came to you with the news?
110
00:06:26,085 --> 00:06:28,125
You know, was there disbelief at first?
111
00:06:28,365 --> 00:06:31,485
Um, what, what did validating
this vulnerability look
112
00:06:31,485 --> 00:06:32,775
like from your perspective?
113
00:06:33,525 --> 00:06:35,055
Yeah, definitely disbelief.
114
00:06:35,085 --> 00:06:39,614
You know, I think Rich hit the nail on
the head of when we look at different
115
00:06:39,614 --> 00:06:44,625
software out there, we expect to see
and, and be able to find vulnerabilities
116
00:06:44,625 --> 00:06:47,835
and close source software and, and
definitely software that maybe doesn't
117
00:06:47,835 --> 00:06:50,414
have the reach and the customer base that.
118
00:06:50,485 --> 00:06:54,445
Pseudo has, not only is it open source
and it goes through rigorous testing,
119
00:06:54,595 --> 00:06:57,985
but it's also leveraged in every
Unix system on earth for the most
120
00:06:57,985 --> 00:06:59,905
part, which is millions of devices.
121
00:06:59,905 --> 00:07:03,715
So when he called me, I was actually
traveling to New York at the time for, for
122
00:07:03,715 --> 00:07:07,975
business and, and I walked into the hotel
and I was actually just really shocked
123
00:07:07,975 --> 00:07:11,785
that something so simple what he found.
124
00:07:12,150 --> 00:07:17,220
That has just been lurking for,
you know, 12 years and no one
125
00:07:17,220 --> 00:07:18,960
has ever discovered before.
126
00:07:19,170 --> 00:07:22,980
You know, I was really shocked that
something that is scrutinized as heavily
127
00:07:22,980 --> 00:07:25,320
as pseudo is had an issue like this.
128
00:07:25,320 --> 00:07:31,080
And I think it underscores really the fact
that almost every technology on earth has
129
00:07:31,080 --> 00:07:33,750
some underlying issues there waiting to be
130
00:07:33,750 --> 00:07:34,410
discovered.
131
00:07:35,505 --> 00:07:38,235
Yeah, I think my laptop just
demonstrated that while we were getting
132
00:07:38,235 --> 00:07:39,705
ready for this podcast, actually.
133
00:07:40,065 --> 00:07:43,725
But, um, in, in your line of
work, like you have to be right
134
00:07:43,785 --> 00:07:45,105
when you go public, right?
135
00:07:45,105 --> 00:07:49,275
So, um, you know, how do, how does
the, the team culture work in teams of
136
00:07:49,455 --> 00:07:51,195
terms of validating each other's work?
137
00:07:51,195 --> 00:07:55,095
And then is there, like, you know, is
there ever a time when you're like, okay,
138
00:07:55,095 --> 00:07:59,235
like we're, I don't know if you take a
vote, do you, do you, like, is there, is
139
00:07:59,235 --> 00:08:02,385
there a vetting process before you're,
like, before we tell anybody else?
140
00:08:02,385 --> 00:08:04,275
Because we are literally, um.
141
00:08:04,335 --> 00:08:07,575
Rich, you're our strato scale's
principal security researcher.
142
00:08:07,575 --> 00:08:10,875
It's like your, your entire
reputation is built on like this.
143
00:08:10,995 --> 00:08:14,924
This has to be something that,
um, number one, I'm right about.
144
00:08:15,044 --> 00:08:19,305
And number two, I can't just like go, go
tweet about this and, and tell the entire
145
00:08:19,305 --> 00:08:20,865
world that there's a vulnerability there.
146
00:08:20,865 --> 00:08:25,365
Like, you know, how do you guys work
through like, yes, it is time to go
147
00:08:25,395 --> 00:08:30,135
outside of the two of us, into our team,
into our organization, and then beyond,
148
00:08:30,135 --> 00:08:31,275
like, how does, how does that work?
149
00:08:33,120 --> 00:08:35,820
Yeah, I think for the most part, I mean,
rich and I have been working together,
150
00:08:36,090 --> 00:08:40,740
so for a very long time now, I think well
over 10 years doing this type of work
151
00:08:40,740 --> 00:08:43,770
here and, and in other entities as well.
152
00:08:44,100 --> 00:08:47,790
Uh, for us it's, it's definitely
once it's discovered, we have
153
00:08:47,790 --> 00:08:49,170
to do some level of validation.
154
00:08:49,170 --> 00:08:51,570
So Rich calling me to have
a second pair of eyes.
155
00:08:52,079 --> 00:08:56,340
What this is that he found is very
important to make sure that what
156
00:08:56,340 --> 00:08:58,260
we're looking at is actually real.
157
00:08:58,380 --> 00:09:02,340
I have found, and Rich has found
vulnerabilities that work in very
158
00:09:02,340 --> 00:09:06,990
edge cases, but in the most part
will fail and don't really rise
159
00:09:06,990 --> 00:09:08,819
to the severity that this does.
160
00:09:08,910 --> 00:09:12,300
And so having a second pair of
eyes that understands kind of
161
00:09:12,300 --> 00:09:15,540
what we're actually trying to
accomplish is extremely important.
162
00:09:16,050 --> 00:09:19,170
And then on top of that, looking at the
impact that something like this has.
163
00:09:19,350 --> 00:09:23,880
So looking at how many customers
actually use pseudo or, or whatever the
164
00:09:23,880 --> 00:09:28,890
technology may be, how easy it is, it is
it to exploit who are we working with?
165
00:09:28,890 --> 00:09:32,730
If it's open source, is it maintained
by, you know, a group of dedicated
166
00:09:32,730 --> 00:09:36,180
developers, or is it maintained
or is it no longer maintained?
167
00:09:36,210 --> 00:09:37,170
We often find.
168
00:09:37,445 --> 00:09:40,325
Vulnerabilities and software
that is no longer it's end of
169
00:09:40,325 --> 00:09:41,885
life, it's not being supported.
170
00:09:42,185 --> 00:09:45,905
And so we take all of that into
consideration when we look at reaching
171
00:09:45,905 --> 00:09:50,075
outwardly to the vendors and to the,
to the owners and maintainers of the
172
00:09:50,075 --> 00:09:53,975
code, to make sure that we understand
what really is the risk to their
173
00:09:53,975 --> 00:09:55,805
customer base, to our customer base.
174
00:09:55,865 --> 00:10:00,275
And, and just overall at any and
everybody on earth that is leveraging
175
00:10:00,275 --> 00:10:02,855
the technology, what is the exposure?
176
00:10:02,915 --> 00:10:04,805
And then from there, working with.
177
00:10:04,815 --> 00:10:08,745
Very closely with the vendor, the
maintainer, to help them patch
178
00:10:08,745 --> 00:10:10,485
as well as validate the patch.
179
00:10:10,815 --> 00:10:14,365
And, and I, rich can definitely go into,
you know, some history where we have.
180
00:10:14,715 --> 00:10:19,575
N maybe not found the vulnerability
in, you know, last couple years
181
00:10:19,575 --> 00:10:23,745
I think it was, we found, uh, F
five reported a vulnerability.
182
00:10:23,745 --> 00:10:27,825
Rich in, in some, another researcher
actually dug into the patch and found
183
00:10:27,825 --> 00:10:32,685
bypasses to that patch and were able to
essentially recreate the vulnerability
184
00:10:32,685 --> 00:10:34,545
after they released patch code.
185
00:10:34,545 --> 00:10:39,105
And we work very closely with F five
in, in order to address those issues.
186
00:10:39,285 --> 00:10:42,165
So it's really validating that whatever
the vendor is about to put out.
187
00:10:42,400 --> 00:10:46,900
Actually mitigates the risk to their,
or to their clients and to our clients.
188
00:10:47,230 --> 00:10:51,520
And then responsibly disclosing that
publicly because if we found it, you know,
189
00:10:51,520 --> 00:10:52,840
we're not the smartest people on earth.
190
00:10:52,840 --> 00:10:55,030
There's someone else that's
also looking at the same thing,
191
00:10:55,030 --> 00:10:56,230
they may have already found it.
192
00:10:56,470 --> 00:11:00,070
And so responsibly disclosing that
in coordination with the vendor
193
00:11:00,070 --> 00:11:02,350
is al. It is just as critical.
194
00:11:02,530 --> 00:11:05,560
So we don't want to provide too much
information that makes it very easy.
195
00:11:05,560 --> 00:11:09,160
Although with the innovation of AI and
everything else, like weaponization
196
00:11:09,160 --> 00:11:10,750
of vulnerabilities is really quick.
197
00:11:11,110 --> 00:11:11,620
Um.
198
00:11:12,180 --> 00:11:16,319
But we, uh, we wanna provide enough detail
to arm companies to really mitigate and
199
00:11:16,319 --> 00:11:18,420
reduce the risk as much as possible.
200
00:11:20,280 --> 00:11:24,060
Rich, I I'd imagine that, um, you
know, from a lay person's perspective,
201
00:11:24,060 --> 00:11:28,500
the fact that it's still there means
that you might have made a discovery.
202
00:11:28,500 --> 00:11:30,270
That's gotta be the fact
that it hasn't been patched.
203
00:11:30,270 --> 00:11:32,610
The fact that it, it is
still there, number one.
204
00:11:32,849 --> 00:11:36,405
Number two, if it is still there, do you
ever think to yourself, like, there it.
205
00:11:37,095 --> 00:11:40,785
Me and a bad actor might be the only
people that know about this right now.
206
00:11:40,785 --> 00:11:41,805
It's like that's, I don't know.
207
00:11:41,805 --> 00:11:44,895
To me that seems like a pretty exciting
thing when you have that Eureka Bowman.
208
00:11:44,895 --> 00:11:45,105
Is it?
209
00:11:45,105 --> 00:11:45,705
Is that fair?
210
00:11:46,425 --> 00:11:46,935
Oh, definitely.
211
00:11:46,935 --> 00:11:47,265
Yeah.
212
00:11:47,385 --> 00:11:53,325
So especially in this case, so
when I found it, like I kind
213
00:11:53,325 --> 00:11:56,055
of did a double take, I'm like,
there's no way that just worked.
214
00:11:56,445 --> 00:12:00,645
Like, and then, you know, part
of the process I go through is
215
00:12:00,645 --> 00:12:04,605
validating that it's actually real
double checking and triple checking.
216
00:12:05,190 --> 00:12:09,090
And even after doing that, I, I
still could not believe that I
217
00:12:09,090 --> 00:12:10,230
had found something in pseudo.
218
00:12:11,010 --> 00:12:16,860
Um, and that's when I had reached out to
Quentin to disclose the, the false, false
219
00:12:16,920 --> 00:12:20,070
vulnerability to him and kind of walked
him through it and have him validate it.
220
00:12:20,640 --> 00:12:23,610
And that's, you know, when we go
through this process, I've reported
221
00:12:23,670 --> 00:12:26,760
lots of vulnerabilities over the
years, and the last thing I want to
222
00:12:26,760 --> 00:12:30,720
do is, is waste, you know, vendor's
time, open source or not, right.
223
00:12:32,205 --> 00:12:37,755
Really the find, oftentimes finding
the actual issue is, can be quick.
224
00:12:38,295 --> 00:12:42,165
Um, but going through that process
of validating and, and making sure
225
00:12:42,165 --> 00:12:45,555
that it's a legit vulnerability
and it's not something you maybe
226
00:12:45,555 --> 00:12:48,915
made a, a change to the test
environment that induced the issue.
227
00:12:48,915 --> 00:12:51,285
So truly important to
go through that process.
228
00:12:51,285 --> 00:12:53,535
Otherwise, you end up wasting time.
229
00:12:54,435 --> 00:12:57,344
Yeah, I, when, when I was reading
about, um, your, your discovery,
230
00:12:57,344 --> 00:13:00,435
I'm like, man, that's like finding
another star or another galaxy.
231
00:13:00,435 --> 00:13:02,925
It's like, like how, how the,
how, how did you do that?
232
00:13:02,925 --> 00:13:04,185
How did you know that it was new?
233
00:13:04,185 --> 00:13:05,895
But like, we'll save
that for another time.
234
00:13:05,895 --> 00:13:07,964
Um, so let's, let's get
into the impact, right?
235
00:13:07,964 --> 00:13:12,045
Like for those who aren't familiar,
you know, what exactly does pseudo
236
00:13:12,045 --> 00:13:15,495
do in Linux system and what would
it mean if an attacker had exploited
237
00:13:15,495 --> 00:13:17,324
this before a, a patch was released?
238
00:13:17,895 --> 00:13:18,135
Sure.
239
00:13:18,165 --> 00:13:23,415
So pseudo is really the primary, uh,
utility used to delegate privileges.
240
00:13:23,790 --> 00:13:27,300
So if we think in like a business
or enterprise type environment, you
241
00:13:27,300 --> 00:13:31,080
know, before you know, it used to
be either root or you're a user.
242
00:13:31,530 --> 00:13:33,900
If you have the root password,
you have full access system.
243
00:13:34,200 --> 00:13:36,480
Well, from a security standpoint,
that doesn't work very well
244
00:13:36,630 --> 00:13:38,130
for large environments.
245
00:13:38,670 --> 00:13:43,350
So if you need to delegate privileges
to like your developers or database
246
00:13:43,350 --> 00:13:47,400
administrators, you can give them
access with very fine control
247
00:13:47,580 --> 00:13:49,890
over what exactly they can run.
248
00:13:49,920 --> 00:13:51,900
And you don't have to
disclose the route password.
249
00:13:52,275 --> 00:13:53,385
So essentially that's what it does.
250
00:13:53,385 --> 00:13:54,495
You write policies.
251
00:13:54,795 --> 00:13:57,615
There's also an audit component,
so every command you execute
252
00:13:57,615 --> 00:13:58,785
through pseudo is logged.
253
00:13:58,935 --> 00:14:03,105
So you can review the history, but
essentially that's what pseudo is used
254
00:14:03,105 --> 00:14:07,245
for, is to control and delegate access
to minimize the amount of privileges
255
00:14:07,335 --> 00:14:10,575
that you have to give out to the,
to the users and the, the business.
256
00:14:11,565 --> 00:14:16,065
And this wasn't just one zero day, it was
two, and the second was even more severe.
257
00:14:16,455 --> 00:14:19,995
Um, can you walk us through what made
these vulnerabilities so dangerous
258
00:14:19,995 --> 00:14:21,495
and, and how widespread are they?
259
00:14:22,380 --> 00:14:22,650
Sure.
260
00:14:22,859 --> 00:14:27,329
So the, the second one was found the, the
day after, uh, I found the first one and
261
00:14:27,329 --> 00:14:31,050
disclosed it to Quentin, and it was found
actually pretty quickly because I was
262
00:14:31,050 --> 00:14:33,510
focusing on options that are lesser used.
263
00:14:34,260 --> 00:14:38,010
And the, the, what makes the second
one more impactful is you don't
264
00:14:38,010 --> 00:14:41,939
need a pseudo rule configured, you
just need access to the machine.
265
00:14:42,510 --> 00:14:47,369
So, for example, the first vulnerability
dealt, dealt with the host option.
266
00:14:47,790 --> 00:14:52,170
For that to be successfully exploited,
you have to have an actual configuration
267
00:14:52,170 --> 00:14:57,209
set, which you, you could find in like
an enterprise environment, but most
268
00:14:57,209 --> 00:14:58,709
environments may not have that set.
269
00:14:59,310 --> 00:15:03,780
The second one, you don't need,
uh, pseudo privileges at all.
270
00:15:03,839 --> 00:15:06,870
You just need to have access to
the machine, and that's what made
271
00:15:07,140 --> 00:15:11,729
that one definitely more impactful
because all you need is access to
272
00:15:11,729 --> 00:15:13,229
the box and you can run pseudo.
273
00:15:13,709 --> 00:15:16,469
And these were logic bugs, so.
274
00:15:17,550 --> 00:15:23,100
You could just write, you could run the
exploit and in exit to the full access to
275
00:15:23,100 --> 00:15:29,130
the system where maybe you have no access
to the system and particularly shared
276
00:15:29,130 --> 00:15:34,560
environments or basically any environment
where users can log into or have the
277
00:15:34,560 --> 00:15:39,870
ability to log into those systems could
be completely compromised with, with.
278
00:15:40,290 --> 00:15:41,370
By leveraging pseudo
279
00:15:41,760 --> 00:15:44,219
and rich, you mentioned that
this discovery was partly
280
00:15:44,219 --> 00:15:45,750
instinct, partly research.
281
00:15:46,079 --> 00:15:48,810
Um, what was the actual
method you used to find it?
282
00:15:48,810 --> 00:15:51,120
You know, we've got a, we've got,
you know, a business audience,
283
00:15:51,120 --> 00:15:52,560
but we also got an IT audience.
284
00:15:52,560 --> 00:15:56,310
So when you were testing, like how did
it go from curiosity to confirmation?
285
00:15:56,310 --> 00:15:58,770
Like for a real tech
technical audience out there?
286
00:15:58,770 --> 00:16:00,120
What, what was that process?
287
00:16:01,410 --> 00:16:01,680
Sure.
288
00:16:01,739 --> 00:16:03,239
I, I kind of touched on that earlier.
289
00:16:03,449 --> 00:16:07,620
So the way I typically focus is on, on
dynamic testing where I'm actually running
290
00:16:07,620 --> 00:16:09,689
the application and running the commands.
291
00:16:10,455 --> 00:16:14,444
Sometimes I'll hook up a debugger
like GDB, um, or use trace
292
00:16:14,444 --> 00:16:16,245
utilities like the SRA command.
293
00:16:16,665 --> 00:16:18,944
And I'm really looking
for interesting behavior.
294
00:16:18,944 --> 00:16:22,485
So this is a, a command
line driven application.
295
00:16:22,605 --> 00:16:26,205
So I'm passing it parameters,
turning different options on, and
296
00:16:26,205 --> 00:16:28,455
then observing the behavior of that.
297
00:16:28,785 --> 00:16:34,064
If I add an option or put a spec,
specific value add, what changes
298
00:16:34,125 --> 00:16:35,235
is there a different change?
299
00:16:35,595 --> 00:16:38,355
And essentially I'm looking
to see if, can I influence?
300
00:16:38,775 --> 00:16:39,974
The application in some way.
301
00:16:40,935 --> 00:16:46,214
And the, the more impactful, uh, uh,
issue with the change route was, it
302
00:16:46,214 --> 00:16:49,905
wasn't as simple as like you could just
run to command and then see the, see it,
303
00:16:50,115 --> 00:16:52,214
see that there's interesting behavior.
304
00:16:52,214 --> 00:16:53,805
It was actually a multi-step process.
305
00:16:54,435 --> 00:16:58,305
So if you're just slimy looking at it
from that perspective, you would miss it.
306
00:16:58,574 --> 00:17:02,625
And I think that's partly the reason
why other, you know, researchers
307
00:17:02,625 --> 00:17:05,895
have missed it because it wasn't as
straightforward as the first issue.
308
00:17:06,690 --> 00:17:08,550
And it took several steps.
309
00:17:08,550 --> 00:17:12,240
And then basically when I'm looking at
an application and I see interesting
310
00:17:12,240 --> 00:17:15,810
behavior by interesting behavior,
that could be, oh, maybe I get a
311
00:17:15,810 --> 00:17:20,010
permission denied, or maybe I see it
open a file or do something like that.
312
00:17:20,010 --> 00:17:22,829
And then I say, okay, what
can I do to influence that?
313
00:17:23,069 --> 00:17:23,790
Can I change it?
314
00:17:23,790 --> 00:17:25,500
Can I point to something that I control?
315
00:17:26,280 --> 00:17:27,660
So you kind of go through this process.
316
00:17:27,660 --> 00:17:28,295
It's not a checklist.
317
00:17:28,980 --> 00:17:32,850
It's, it's kind of unknown and
that's one of the main things I
318
00:17:32,850 --> 00:17:36,930
like about this type of work is it's
the discovery aspect of it and the
319
00:17:36,930 --> 00:17:39,030
learning aspect of it is really fun.
320
00:17:39,570 --> 00:17:44,040
It can be frustrating and I could
have easily just not found anything.
321
00:17:44,040 --> 00:17:48,480
But as you go through this process,
you learn a lot of techniques, you
322
00:17:48,480 --> 00:17:51,900
learn more about the application
itself, and you can apply those
323
00:17:51,900 --> 00:17:55,410
same type of ideas and techniques
to other applications in the future.
324
00:17:55,920 --> 00:17:57,205
So one of the things we like to say.
325
00:17:58,320 --> 00:18:01,889
You know, failing is actually a good
thing because when you're failing
326
00:18:01,889 --> 00:18:02,969
you're, you're really learning.
327
00:18:03,179 --> 00:18:07,860
And this, you know, podcast is
talking about example of a success,
328
00:18:08,129 --> 00:18:10,290
but I fail more often than I succeed.
329
00:18:10,679 --> 00:18:11,730
But that's okay.
330
00:18:11,735 --> 00:18:12,990
'cause that's part of the process.
331
00:18:13,379 --> 00:18:13,889
Yeah, no.
332
00:18:13,965 --> 00:18:15,120
A a, absolutely.
333
00:18:15,179 --> 00:18:19,020
And, uh, I, I, I was, when you were
talking, I was thinking of that Dennis
334
00:18:19,020 --> 00:18:22,740
Hopper line from the movie speed when he
is like, he's like, you're, you're not
335
00:18:22,740 --> 00:18:25,770
reaching your potential 'cause you're
stopping the bomb from reaching it.
336
00:18:25,770 --> 00:18:27,990
And I think you would disagree
with that a hundred percent.
337
00:18:27,990 --> 00:18:28,260
Right?
338
00:18:28,260 --> 00:18:32,370
So because that, and, and, and
you, you do, um, you know, just,
339
00:18:32,370 --> 00:18:35,550
just need to succeed a few times
to make a huge difference here.
340
00:18:35,939 --> 00:18:37,590
Um, but we'll turn to Quentin now.
341
00:18:37,860 --> 00:18:41,290
Um, you, you mentioned this is why you
invest in offensive security, like.
342
00:18:41,700 --> 00:18:45,240
How does Stratoscale use this kind of
research to stay ahead of criminal actors?
343
00:18:45,630 --> 00:18:49,890
Uh, and what role does it play in,
in s i's cybersecurity offering and
344
00:18:49,890 --> 00:18:51,720
by the sound of things beyond SHI?
345
00:18:52,260 --> 00:18:53,070
Yeah, absolutely.
346
00:18:53,070 --> 00:18:57,090
So offensive security research
really highlights for us, like
347
00:18:57,090 --> 00:19:00,300
what emerging threats that we
really need to pay attention to.
348
00:19:00,300 --> 00:19:03,870
What type of vulnerabilities are out there
that we need to get ahead of from our.
349
00:19:04,379 --> 00:19:05,639
Uh, for our clients, right?
350
00:19:05,639 --> 00:19:09,179
If we look at offensive security,
it's supposed to be the proactive
351
00:19:09,179 --> 00:19:13,889
aspect of cybersecurity, where we're
identifying vulnerabilities and,
352
00:19:13,889 --> 00:19:19,620
and, and exploits before criminal
criminals leverage that it's, it's nec
353
00:19:19,830 --> 00:19:23,909
a necessity because if we're always
trying to respond to the vulnerabilities
354
00:19:23,909 --> 00:19:25,199
that others have found, or it's.
355
00:19:25,440 --> 00:19:28,590
Being exploited in the wild by
criminals, we're already kind of
356
00:19:28,590 --> 00:19:30,330
behind the eight ball for our clients.
357
00:19:30,660 --> 00:19:34,260
And so with us doing our own research,
not just in offensive security, but
358
00:19:34,260 --> 00:19:37,680
in vulnerability space and the threat
intelligence space, we can start
359
00:19:37,680 --> 00:19:41,370
making informed decisions on behalf of
our clients, on how they can further
360
00:19:41,520 --> 00:19:45,690
protect their organizations, their
client data, their employee data, um,
361
00:19:45,690 --> 00:19:50,160
as well as, you know, non clients,
other organizations within the world.
362
00:19:50,910 --> 00:19:55,050
So for us, it's, it's very important that
we take the research that like Rich and
363
00:19:55,050 --> 00:19:59,550
others find, and adding the, that data
into our threat intelligence service,
364
00:19:59,550 --> 00:20:03,750
into our vulnerability management service
and or even our, our modern SOC service.
365
00:20:03,750 --> 00:20:05,460
How do we feed that data back?
366
00:20:05,460 --> 00:20:09,510
So we're proactively helping
clients secure their infrastructure
367
00:20:09,510 --> 00:20:10,740
as quickly as possible.
368
00:20:10,830 --> 00:20:14,220
And that's what our goal is for,
you know, SHI large and, and as you
369
00:20:14,220 --> 00:20:16,380
said, really beyond that as well.
370
00:20:16,420 --> 00:20:20,050
How can we give back to the community
and, and help the community get better?
371
00:20:20,380 --> 00:20:23,260
And the open source, you know,
example like pseudo, you know,
372
00:20:23,260 --> 00:20:24,550
working with that developer.
373
00:20:24,550 --> 00:20:27,700
We're not just helping SHI
clients, we're helping every
374
00:20:27,700 --> 00:20:29,560
organization that leverages pseudo.
375
00:20:29,890 --> 00:20:33,220
Um, or if we're looking at vulnerabilities
in any other closed source vendor,
376
00:20:33,220 --> 00:20:34,930
we're helping them protect.
377
00:20:35,050 --> 00:20:38,950
And in some cases we end up actually
helping advise them on how they can
378
00:20:38,950 --> 00:20:42,700
look for that in other aspects of
their applications or source code.
379
00:20:42,700 --> 00:20:45,520
There's been multiple zero days
that Rich and I have found where.
380
00:20:45,705 --> 00:20:49,155
The vendor has taken it upon themselves
to start looking at all of their products
381
00:20:49,245 --> 00:20:52,935
to see where other vulnerabilities
may exist so that they can close it.
382
00:20:52,965 --> 00:20:55,335
I personally think they do it because
they're tired of hearing from,
383
00:20:55,575 --> 00:20:59,325
from us, but, um, it, it really
helps, you know, their underlying
384
00:20:59,325 --> 00:21:01,215
client base become more secure.
385
00:21:01,935 --> 00:21:04,785
And so for us, like, like you said,
StrataScale is gonna continuous
386
00:21:04,785 --> 00:21:09,375
SHI is gonna continuously invest
in research and in uncovering
387
00:21:09,495 --> 00:21:12,495
these types of threats before they
become weaponized by criminals.
388
00:21:13,665 --> 00:21:15,735
Yeah, they're, they're tired of
hearing from you and you guys
389
00:21:15,735 --> 00:21:18,584
are loving every second of, uh,
of, of making these discoveries.
390
00:21:18,584 --> 00:21:21,524
So, uh, I'll, I'll take that 'cause you
guys are on our side, so I really, I
391
00:21:21,524 --> 00:21:24,854
really like the sound of that actually,
Quentin, you mentioned, you noted
392
00:21:24,854 --> 00:21:29,475
that the, the window between discovery
and weaponization is about 15 days.
393
00:21:29,685 --> 00:21:31,995
You know, how do you manage
that timeline responsibly?
394
00:21:31,995 --> 00:21:34,989
You know, especially knowing that,
that criminals are watching the,
395
00:21:35,054 --> 00:21:37,429
the same blogs and the same pieces
of information that are out there.
396
00:21:37,770 --> 00:21:39,120
Yeah, absolutely.
397
00:21:39,270 --> 00:21:40,830
I mean, number one, right?
398
00:21:40,830 --> 00:21:44,250
Working very closely with the
vendor to coordinate disclosure,
399
00:21:44,250 --> 00:21:46,920
coordinate patch, you know, discovery.
400
00:21:46,920 --> 00:21:49,920
If the the patch of they're
implementa implementing is actually
401
00:21:49,920 --> 00:21:51,450
valid, are their workarounds.
402
00:21:51,450 --> 00:21:54,870
So really working hand to hand with
them to make sure that when we do
403
00:21:54,870 --> 00:22:00,000
publicly announce this, their clients
have a foolproof way of mitigating or.
404
00:22:00,055 --> 00:22:02,305
Completely eliminating
the risk through a patch.
405
00:22:02,485 --> 00:22:03,415
So that's kind of core.
406
00:22:03,415 --> 00:22:04,405
That's the number one.
407
00:22:04,645 --> 00:22:06,985
Number two is really holding
that information tight
408
00:22:06,985 --> 00:22:08,125
before that point, right?
409
00:22:08,125 --> 00:22:12,625
So making sure that individuals that have
found it, there's a need to know basis.
410
00:22:12,805 --> 00:22:16,645
We use kind of that TLP or the
traffic like protocol, uh, methodology
411
00:22:16,645 --> 00:22:20,845
in order to contain kind of what
we found so that we can control.
412
00:22:21,125 --> 00:22:24,545
You know, who knows about it and, and
making sure that we're not inadvertently
413
00:22:24,545 --> 00:22:26,375
disclosing information ahead of time.
414
00:22:26,645 --> 00:22:29,885
But in the vaccine, we actually
are starting to look at mitigation.
415
00:22:29,885 --> 00:22:33,455
So when this one came out,
the, the contributor or the
416
00:22:33,455 --> 00:22:36,335
maintainer of pseudo is, is one
individual from my understanding.
417
00:22:36,335 --> 00:22:36,545
So.
418
00:22:36,685 --> 00:22:38,335
There's only so much one person can do.
419
00:22:38,335 --> 00:22:41,845
So you know, rich and I were looking
at are there other ways that we can
420
00:22:41,845 --> 00:22:46,855
actually mitigate the risk and inform our
clients if for some reason this were to
421
00:22:46,855 --> 00:22:49,284
get out before a patch was implemented.
422
00:22:49,284 --> 00:22:53,274
So we looked at different methods and
and techniques to help them mitigate
423
00:22:53,274 --> 00:22:55,825
or detect this type of of abuse.
424
00:22:55,825 --> 00:22:59,065
So I think that's also almost
equally as important as working
425
00:22:59,065 --> 00:23:00,264
with the vendor of getting a patch.
426
00:23:00,264 --> 00:23:04,405
Like are there ways that we can
implement threat detections or.
427
00:23:04,765 --> 00:23:08,815
Uh, mitigation strategies to
prevent clients from being abused.
428
00:23:08,845 --> 00:23:12,205
'cause someone else probably has
known about this in some capacity
429
00:23:12,385 --> 00:23:14,185
and probably have held onto it.
430
00:23:14,185 --> 00:23:17,725
And, and we're really sad when
Rich found it and, and notified the
431
00:23:17,725 --> 00:23:19,705
vendor that it needs to be patched.
432
00:23:20,425 --> 00:23:23,365
And so for us, like really working
with our clients hand in hand in making
433
00:23:23,365 --> 00:23:27,565
sure that they can be as prepared as
possible if they were to fall victim.
434
00:23:29,610 --> 00:23:32,820
Yeah, they were really sad when the,
the Joshua password was removed.
435
00:23:32,850 --> 00:23:33,180
Right.
436
00:23:33,240 --> 00:23:36,150
I always love that scene where
it's gonna type Joshua in and
437
00:23:36,150 --> 00:23:37,260
stop missiles from flying.
438
00:23:37,260 --> 00:23:37,710
But anyway.
439
00:23:37,710 --> 00:23:42,090
Well, my, my movie Obsession Aside,
um, what's the bigger takeaway
440
00:23:42,090 --> 00:23:43,920
here for IT leaders and CISOs?
441
00:23:43,920 --> 00:23:47,580
Like is it about faster patching,
better threat intelligence, um, or
442
00:23:47,640 --> 00:23:51,540
is it something deeper about the,
the nature of cybersecurity today?
443
00:23:51,570 --> 00:23:52,635
I'm not sure who wants to take that one.
444
00:23:53,880 --> 00:23:54,300
Yeah, I can take
445
00:23:54,300 --> 00:23:55,170
a little bit of that.
446
00:23:55,170 --> 00:23:58,650
I think for the most part, we have to
look beyond just automation, right?
447
00:23:58,650 --> 00:24:02,340
There are a lot of great automated tools
out there that will find vulnerabilities,
448
00:24:02,520 --> 00:24:06,480
you know, potential areas of risk and
misconfiguration that absolutely work.
449
00:24:06,810 --> 00:24:11,130
But really at the end of the day, there
are work, you know, business logic, flaws
450
00:24:11,130 --> 00:24:15,330
and other very hard to find issues that
none of these tools are gonna pick up.
451
00:24:15,330 --> 00:24:18,750
So I think from a CISO's perspective
or, or the business's perspective,
452
00:24:18,960 --> 00:24:22,620
understanding that and investing the
time and money appropriately, so.
453
00:24:22,780 --> 00:24:26,080
Investing in automation, but
also taking the time to upskill
454
00:24:26,080 --> 00:24:29,590
your individuals, giving them the
opportunity to, to research on their
455
00:24:29,590 --> 00:24:33,790
own, dig in and leverage the community
to source threat intelligence and
456
00:24:33,790 --> 00:24:35,770
emerging, emerging areas of risk.
457
00:24:35,770 --> 00:24:36,910
Very, very important.
458
00:24:36,940 --> 00:24:40,510
'cause tools aren't gonna solve all of our
problems as much as I would hope it does.
459
00:24:40,870 --> 00:24:44,185
Um, so we, we, we have to be
aware of that, and I think.
460
00:24:44,840 --> 00:24:50,060
On top of that, we, we really need to
have a better, uh, community around
461
00:24:50,060 --> 00:24:51,710
cybersecurity, better discussions.
462
00:24:51,710 --> 00:24:54,500
And there are a lot of these, like
SANS has a bunch, there's a lot of
463
00:24:54,500 --> 00:24:57,350
organizations that have meetups, and
I think it's really important for
464
00:24:57,350 --> 00:24:59,160
companies to partake in some of those.
465
00:24:59,740 --> 00:25:03,639
The amount of information you can get
through community in the cybersecurity
466
00:25:03,639 --> 00:25:08,710
world through research or even just
individuals giving a TED talk at, at
467
00:25:08,710 --> 00:25:11,889
some random meetup is really impactful.
468
00:25:11,889 --> 00:25:16,450
I've been at random meetups in Dallas
where they, there was a researcher
469
00:25:16,450 --> 00:25:20,980
dropping a zero day right live in front
of us that had major impact to the world.
470
00:25:21,370 --> 00:25:23,950
Um, and so part, you know,
participating in the community
471
00:25:23,950 --> 00:25:25,129
and, and really digging in and.
472
00:25:25,600 --> 00:25:29,709
And building a network that can help
you stay ahead of the threat actors.
473
00:25:29,740 --> 00:25:31,449
'cause they're just, they're
doing the same thing we're doing.
474
00:25:31,449 --> 00:25:35,020
They're researching new threats, they're
weaponizing those threats and they're
475
00:25:35,020 --> 00:25:36,550
using it for their criminal activity.
476
00:25:36,550 --> 00:25:40,570
So we need to do the same and we need
to have a network that allows us to talk
477
00:25:40,570 --> 00:25:42,280
and disclose information amongst us.
478
00:25:43,185 --> 00:25:46,665
Let me just say that from a, a
Stratoscale and SHI perspective, so
479
00:25:46,665 --> 00:25:50,745
I've been at SHI for 28 years now, and,
and I, I just wanna say that like we're
480
00:25:50,745 --> 00:25:54,735
extremely proud to have you guys who
are doing this kind of, um, kind of
481
00:25:54,945 --> 00:25:59,685
discoveries, like under our umbrella
because that is simply my opinion.
482
00:25:59,865 --> 00:26:03,255
And there might be an IT guy in
Stratoscale or SHI is gonna hate me
483
00:26:03,255 --> 00:26:06,465
for saying, it's like, I don't know
that this would've happened, you know?
484
00:26:06,465 --> 00:26:10,725
But before you guys, um, you know,
joined, um, how does it benefit?
485
00:26:11,430 --> 00:26:15,570
You know, the, the, the work that the
two of you are doing, like within the
486
00:26:15,570 --> 00:26:20,370
stratoscale, um, organization within
the, the, the SHI like umbrella.
487
00:26:20,370 --> 00:26:22,680
I mean, you've been making
these discoveries before,
488
00:26:22,680 --> 00:26:24,659
but is it, is it different?
489
00:26:24,659 --> 00:26:27,690
Are there advantages, you know,
to, to doing this, you know, within
490
00:26:28,020 --> 00:26:29,970
an organization like Stratoscale?
491
00:26:30,105 --> 00:26:34,209
Um, and, and you know, which is a.
Wholly owned subsidiary of SHI like,
492
00:26:34,239 --> 00:26:38,139
um, you know, and, and feel free to
comment with, you know, like your boss
493
00:26:38,139 --> 00:26:39,520
is listening or, or anything like that.
494
00:26:40,659 --> 00:26:42,459
But how, how is it doing that here?
495
00:26:42,459 --> 00:26:44,649
Is that, is that a, a
good benefit to you guys?
496
00:26:44,649 --> 00:26:48,459
And is it a great benefit to,
you know, our, you know, tens of
497
00:26:48,459 --> 00:26:49,600
thousands of customers out there?
498
00:26:50,550 --> 00:26:50,760
Yeah,
499
00:26:50,760 --> 00:26:51,390
absolutely.
500
00:26:51,415 --> 00:26:54,780
I, I think there's a significant
value and benefit to doing it here
501
00:26:54,780 --> 00:26:56,460
at Stratoscale and SHI at large.
502
00:26:56,460 --> 00:27:00,335
I mean, we've Rich and I've done this
before, prior organizations and, and
503
00:27:00,340 --> 00:27:04,890
we've struggled to get focused at times on
research and really pushing the boundary.
504
00:27:04,890 --> 00:27:05,550
But for.
505
00:27:05,845 --> 00:27:09,445
Individuals like us, you know, really
moving the needle forward in, in
506
00:27:09,445 --> 00:27:11,455
cybersecurity is very important, right?
507
00:27:11,455 --> 00:27:15,475
Staying ahead of criminals, innovating
where we can to help defend our, you
508
00:27:15,475 --> 00:27:19,765
know, organizations that we shop at in,
or that our, our clients or that our,
509
00:27:19,765 --> 00:27:21,625
our kids go to their school, right?
510
00:27:21,625 --> 00:27:25,105
Looking at how we can defend all
of that is, is very important
511
00:27:25,105 --> 00:27:26,305
in pushing the needle forward.
512
00:27:26,485 --> 00:27:28,080
And so here at SHI, I mean, we have.
513
00:27:28,965 --> 00:27:33,195
You know, the, the plethora of
information around our supported
514
00:27:33,195 --> 00:27:37,274
OEMs, our vendors, our client base,
understanding where they're at and on
515
00:27:37,274 --> 00:27:41,054
their journey in cybersecurity, all of
that information as well as the very
516
00:27:41,054 --> 00:27:43,064
talented individuals in a, in a company.
517
00:27:43,064 --> 00:27:47,235
The size and experience of SHI
has definitely paid a lot of
518
00:27:47,235 --> 00:27:50,925
dividends to our research and
where we focus, it's an open doors.
519
00:27:50,925 --> 00:27:55,605
It's given us access to things that
normally are very hard to get access to,
520
00:27:55,665 --> 00:27:58,095
you know, as maybe a smaller organization.
521
00:27:58,815 --> 00:28:03,075
And so, and, and also, you know, being the
cybersecurity division of SHI Stratoscale
522
00:28:03,075 --> 00:28:06,585
allows us to really push that innovation
that's very important to us forward.
523
00:28:06,764 --> 00:28:09,855
How can we stay ahead as much
as possible to criminals?
524
00:28:09,855 --> 00:28:13,185
I don't think we ever will stay fully
ahead, but how do we at least get neck
525
00:28:13,185 --> 00:28:18,000
to neck and start identifying issues
That will definitely pose risks later on.
526
00:28:18,075 --> 00:28:21,764
So there's a lot of valid or
value, you know, doing this
527
00:28:21,764 --> 00:28:23,325
within STRATOSCALE and SHI.
528
00:28:23,725 --> 00:28:26,245
Um, and I think we're just, you know,
obviously we're gonna continue to
529
00:28:26,245 --> 00:28:29,365
invest in that and grow it because I
think there's tangentially a lot of
530
00:28:29,365 --> 00:28:33,925
value to our clients by doing this and
a lot of differentiation to how we're
531
00:28:33,925 --> 00:28:35,605
actually helping our clients secure.
532
00:28:37,014 --> 00:28:37,254
Rich.
533
00:28:37,254 --> 00:28:37,825
Anything to add
534
00:28:37,825 --> 00:28:37,915
to
535
00:28:37,915 --> 00:28:38,185
that?
536
00:28:39,595 --> 00:28:44,004
Yeah, and one of the things that I
really enjoy about this type of research
537
00:28:44,004 --> 00:28:45,295
is I get to share it with people.
538
00:28:45,990 --> 00:28:48,419
Um, not only the world,
but also internal teams.
539
00:28:48,510 --> 00:28:51,510
And, you know, when I discover
something like this, you know,
540
00:28:51,510 --> 00:28:54,570
they'll, they get the information,
uh, uh, slightly ahead of time.
541
00:28:54,570 --> 00:28:58,080
And, but also I get to show them the
techniques and the process, which is
542
00:28:58,080 --> 00:29:01,679
really the, the more important part
of it, because they can use that,
543
00:29:01,770 --> 00:29:03,600
you know, in their, their roles too.
544
00:29:03,600 --> 00:29:06,210
So that's the part that
I really enjoy of it.
545
00:29:06,210 --> 00:29:09,330
And it's nice to have the support
from leadership to be able to do this.
546
00:29:09,330 --> 00:29:14,580
And it's fun, but it's also very
rewarding from, from that perspective.
547
00:29:16,155 --> 00:29:20,175
What's the reaction been when, when
you guys went out to the, I mean,
548
00:29:20,175 --> 00:29:24,315
you, you followed the protocols, you
know, it was, it was validated to me.
549
00:29:24,315 --> 00:29:28,965
It's, it's, it's really big news, but
it's, it's, it's even bigger within
550
00:29:28,995 --> 00:29:32,385
the community of people you know, who
do what you do, you know, what was the
551
00:29:32,385 --> 00:29:34,575
reaction, um, when you went public?
552
00:29:35,565 --> 00:29:38,865
So, uh, I was definitely keeping
an eye on that and had different
553
00:29:38,865 --> 00:29:40,695
conversations with a variety of people.
554
00:29:41,115 --> 00:29:45,195
So it was very interesting to see
kind of the community response to it.
555
00:29:45,975 --> 00:29:49,995
And it was overall, you know,
very positive and they were
556
00:29:49,995 --> 00:29:52,845
very, very interested to see,
you know, the research and they
557
00:29:52,845 --> 00:29:54,375
appreciate, you know, being shared.
558
00:29:55,125 --> 00:29:59,235
And also another kind of cool thing
to observe as other researchers
559
00:29:59,235 --> 00:30:02,115
were taking the work and kind
of making their own spin on it.
560
00:30:02,115 --> 00:30:03,735
So that was pretty cool to see.
561
00:30:03,735 --> 00:30:06,765
And they're also kind of doing
their own detailed analysis and that
562
00:30:06,765 --> 00:30:07,930
was kind of like across the board.
563
00:30:08,925 --> 00:30:12,015
There was some content
creators that were covering it.
564
00:30:12,285 --> 00:30:16,035
Um, so it was a pretty neat, you
know, overall experience and it's
565
00:30:16,035 --> 00:30:17,355
nice to interact with the community.
566
00:30:17,355 --> 00:30:19,875
I got to meet some people
through that process.
567
00:30:20,415 --> 00:30:25,635
So, um, this is definitely, you know,
well received and definitely had, you
568
00:30:25,635 --> 00:30:29,175
know, a decent amount of visibility of,
you know, because of, of it being pseudo.
569
00:30:30,255 --> 00:30:32,805
And it's always nice
when someone can take.
570
00:30:33,345 --> 00:30:35,085
Work that I did and learned from that too.
571
00:30:35,085 --> 00:30:39,585
And that's kind of the other
rewarding side for it for me, is to
572
00:30:39,585 --> 00:30:42,855
see, you know, the manifestations
of my own work and seeing my
573
00:30:42,855 --> 00:30:45,855
name, you know, on their websites.
574
00:30:46,395 --> 00:30:46,905
Definitely.
575
00:30:46,995 --> 00:30:47,564
Interesting.
576
00:30:48,945 --> 00:30:49,304
Yeah.
577
00:30:49,395 --> 00:30:50,024
Pretty cool.
578
00:30:50,715 --> 00:30:54,585
Um, one, one last thing For anyone
listening who wants to work in
579
00:30:54,585 --> 00:30:58,845
cybersecurity or, or break into,
you know, adversarial operations,
580
00:30:58,845 --> 00:31:00,284
you know, what, what's your advice?
581
00:31:00,284 --> 00:31:02,715
You know, how did each of you
get into, into your field?
582
00:31:02,715 --> 00:31:05,415
And, and I suspect I know the
answer, but what's, what's the
583
00:31:05,415 --> 00:31:08,715
single biggest characteristic you
need to have to do what you do?
584
00:31:09,570 --> 00:31:10,060
I'll go first.
585
00:31:11,430 --> 00:31:13,200
So I got into this field.
586
00:31:13,230 --> 00:31:18,060
I, my, my core background is it,
uh, I've been a system admin.
587
00:31:18,120 --> 00:31:19,380
I'm still a system in today.
588
00:31:19,380 --> 00:31:20,730
That's, that's what I love to do.
589
00:31:21,030 --> 00:31:23,250
I run servers, I do
all kinds of tinkering.
590
00:31:23,820 --> 00:31:28,470
So that well positioned me to
get into offensive security.
591
00:31:28,800 --> 00:31:33,270
I didn't really know that at the time, but
when the opportunity came up, it wasn't
592
00:31:33,270 --> 00:31:34,890
something I was actively looking for.
593
00:31:34,890 --> 00:31:37,920
Someone had actually forwarded me the
opportunity and said, Hey, this looks.
594
00:31:39,105 --> 00:31:39,735
Right up your alley.
595
00:31:39,735 --> 00:31:43,365
So I kind of followed that
path and it worked out.
596
00:31:43,455 --> 00:31:47,985
And then I realized how much my,
my admin and IT background helped
597
00:31:48,855 --> 00:31:52,995
in security because at the end of
the day, security is all about it.
598
00:31:53,264 --> 00:31:58,395
So having experience in it or
development, uh, will definitely help.
599
00:31:58,510 --> 00:32:03,284
But, um, the cool thing about
cybersecurity is I've seen many
600
00:32:03,284 --> 00:32:04,905
people have a variety of backgrounds.
601
00:32:05,534 --> 00:32:06,825
So it's not, that's one path.
602
00:32:06,825 --> 00:32:08,835
It's a common path, but
there's many other paths.
603
00:32:09,284 --> 00:32:10,544
So it's not the only path.
604
00:32:10,695 --> 00:32:14,534
And the, the key for me, and I go
through a lot of interviews for
605
00:32:14,534 --> 00:32:19,245
offensive security, is what I'm
looking for is that passion and the
606
00:32:19,245 --> 00:32:24,135
drive and, you know, showing that,
you know, because in this line of
607
00:32:24,135 --> 00:32:25,995
work, we often don't know the answer.
608
00:32:25,995 --> 00:32:27,825
We don't know necessarily what to do.
609
00:32:27,825 --> 00:32:29,685
It's not a checklist, like I said before.
610
00:32:30,284 --> 00:32:31,425
It's something you learn.
611
00:32:31,665 --> 00:32:34,784
And that's really the key thing
is, is having that passion, showing
612
00:32:34,784 --> 00:32:40,034
the learning and doing, you know,
the various things like training.
613
00:32:40,364 --> 00:32:43,754
Uh, there's so many free options
and low cost options these days, so
614
00:32:44,114 --> 00:32:48,314
there's really a lot of information
out there, which can be overwhelming.
615
00:32:48,945 --> 00:32:51,524
Um, but that's the main takeaway
for me is it's, it's a, it's
616
00:32:51,524 --> 00:32:53,054
a constant learning process.
617
00:32:53,294 --> 00:32:56,324
So if you wanna break into
cybersecurity, it's, it's about the
618
00:32:56,324 --> 00:32:59,685
learning and showing that passion,
and eventually you'll get your break.
619
00:33:00,524 --> 00:33:01,635
Quentin, you have the last word.
620
00:33:02,594 --> 00:33:05,054
Yeah, I definitely
agree with what he said.
621
00:33:05,145 --> 00:33:07,514
I mean, the drive and the
passion is super critical.
622
00:33:07,514 --> 00:33:12,764
For offense security, more specifically,
I got into it because I was, you know,
623
00:33:12,764 --> 00:33:17,655
running a, a little security team and PPCI
compliance came across my desk of like,
624
00:33:17,655 --> 00:33:21,375
Hey, we have to meet this standard, and
pen testing was part of it, and I just
625
00:33:21,375 --> 00:33:25,334
fell in love with the puzzle aspect of pen
testing and, and adversarial operations.
626
00:33:25,635 --> 00:33:27,584
It's, it's just a giant challenge, which.
627
00:33:27,750 --> 00:33:32,130
Really fit my, my love for
puzzles, uh, really, really
628
00:33:32,130 --> 00:33:33,450
nicely in a professional way.
629
00:33:33,780 --> 00:33:37,230
And the way I got in though is,
is through the drive of learning.
630
00:33:37,230 --> 00:33:40,320
Like I would work eight hours, nine
hours a day at the office, and then I
631
00:33:40,320 --> 00:33:43,980
would come home and do another four to
five hours of just studying offensive
632
00:33:43,980 --> 00:33:46,020
security, understanding what I was doing.
633
00:33:46,145 --> 00:33:47,495
Going through coursework.
634
00:33:47,764 --> 00:33:51,455
And so when I look for those who,
you know, wanna get into the space or
635
00:33:51,455 --> 00:33:55,985
already in the space for, for working
on the team, like I look for that drive.
636
00:33:55,985 --> 00:34:00,275
Do they have the drive to continuously
learn and fail and, and pick themselves
637
00:34:00,275 --> 00:34:04,445
up from failure and, and really learn
from that and grow, uh, because you will
638
00:34:04,445 --> 00:34:08,255
fail more times than not in PIN testing,
uh, which is good for clients, right?
639
00:34:08,255 --> 00:34:09,574
If they want us to fail.
640
00:34:10,379 --> 00:34:13,409
Uh, and as well as the passion,
like you have to have a passion.
641
00:34:13,439 --> 00:34:16,889
'cause you can only bang your head
against the death so many times before it
642
00:34:16,889 --> 00:34:19,409
becomes almost punishment at that time.
643
00:34:19,409 --> 00:34:22,949
So having the passion to see it
through and continually drive
644
00:34:22,949 --> 00:34:26,790
on and learn, like that's very,
very, very critical and important.
645
00:34:27,060 --> 00:34:27,839
And pen testing.
646
00:34:28,575 --> 00:34:32,655
We're often coming across technology we've
never seen before, come across maybe don't
647
00:34:32,655 --> 00:34:36,285
deal with quite a lot, so we have to do
a lot of research and, uh, we have to
648
00:34:36,285 --> 00:34:38,205
do it in a very limited amount of time.
649
00:34:38,235 --> 00:34:42,345
And so being able to, you know,
have a passion and drive to do
650
00:34:42,345 --> 00:34:43,615
that is, is very, very important.
651
00:34:46,035 --> 00:34:49,815
Passion drive, and you guys
have far surpassed the 10,000
652
00:34:49,815 --> 00:34:52,515
hours to become experts in this
field by the sound of things.
653
00:34:52,515 --> 00:34:56,835
So that's, uh, that I'll, I'll throw out
that other one in there, um, as well.
654
00:34:57,195 --> 00:35:00,975
Today we heard the inside story of a
zero day vulnerability that could have
655
00:35:00,975 --> 00:35:05,550
changed everything, but didn't, thanks
to the kind of expert ethical research
656
00:35:05,550 --> 00:35:10,395
happening inside Stratoscale, it's a
reminder that cybersecurity isn't just
657
00:35:10,395 --> 00:35:12,885
about tools or alerts, it's about people.
658
00:35:13,290 --> 00:35:17,129
People who are curious enough to
poke, bold enough to dig and smart
659
00:35:17,129 --> 00:35:18,600
enough to disclose responsibly.
660
00:35:19,589 --> 00:35:23,250
A huge thanks to Rich Merch and
Quentin Rhodes Herrera for joining
661
00:35:23,250 --> 00:35:24,629
us and sharing their story.
662
00:35:25,290 --> 00:35:27,690
If you wanna learn more about
these vulnerabilities or the
663
00:35:27,690 --> 00:35:30,870
work Stratoscale is doing, check
out the links in the show notes.
664
00:35:31,440 --> 00:35:35,190
I should mention again that Stratoscale
is a wholly owned subsidiary of SHI.
665
00:35:35,490 --> 00:35:36,975
So if you are an SHI customer.
666
00:35:37,305 --> 00:35:40,634
Or prospect listening to this
and wanna learn more, reach
667
00:35:40,634 --> 00:35:41,565
out to your account team.
668
00:35:42,345 --> 00:35:45,765
Until next time, stay safe,
stay curious, and stay ahead.
669
00:35:45,975 --> 00:35:46,964
I'm Ed McNamara.
670
00:35:47,355 --> 00:35:48,645
This is Innovation Heroes.