WEBVTT
00:00:04.080 --> 00:00:07.440
Hello and welcome to another episode of Cyber Hackcast.
00:00:07.519 --> 00:00:10.560
I'm joined by my BBFF, Michael Farnum.
00:00:11.359 --> 00:00:12.320
What's up, Phil?
00:00:12.720 --> 00:00:13.199
How much?
00:00:13.359 --> 00:00:14.000
How are you doing?
00:00:14.240 --> 00:00:15.039
I'm good, man.
00:00:15.199 --> 00:00:16.000
I'm good.
00:00:16.239 --> 00:00:17.679
Does Jacob know what that means?
00:00:17.760 --> 00:00:21.280
Does Jacob Jacob probably he doesn't know unless he's watched the podcast?
00:00:21.519 --> 00:00:24.719
But yeah, BBFF stands for Bald Best Friend Forever.
00:00:24.800 --> 00:00:31.519
So Sam Van Ryder, the co-founder of CybersecCon and Cybersec Events, is his BFF.
00:00:31.600 --> 00:00:33.439
So I'm his BBFF.
00:00:34.320 --> 00:00:35.439
Fantastic.
00:00:36.159 --> 00:00:38.000
Slightly less hair than you have, Jacob.
00:00:38.159 --> 00:00:40.880
So we're not the follow, we're the follically challenged.
00:00:42.159 --> 00:00:44.640
Well, only part of this is follically challenged.
00:00:44.799 --> 00:00:48.240
Around here is a choice, but this is definitely not a choice.
00:00:48.479 --> 00:00:52.399
Yeah, it's definitely good to shave it off because man, I just couldn't do the horseshoe thing.
00:00:52.479 --> 00:01:01.840
I that one of the gyms where I used to work out at, there was a guy in there that had the horseshoe thing going on and is kind of grown out, made me think of Terry Bradshaw Top Sugar.
00:01:01.920 --> 00:01:02.479
Oh my gosh.
00:01:02.799 --> 00:01:03.840
No, thank you.
00:01:04.159 --> 00:01:10.079
So any any dude losing hair that yeah, I would advise to trim it down really short or shave it.
00:01:10.400 --> 00:01:11.599
Just get it done.
00:01:11.840 --> 00:01:15.760
I've always said I wanted a I wanted a mohawk, but it would like end right here.
00:01:16.000 --> 00:01:17.760
Yeah, it'd be kind of starting back over here.
00:01:18.000 --> 00:01:24.000
Yeah, kind of it could be like the Road Warriors because they kind of did the thing where they had it on one of them had it on the sides, the hair on the sides.
00:01:24.239 --> 00:01:25.280
Yeah, do that.
00:01:25.439 --> 00:01:25.760
Yeah.
00:01:26.000 --> 00:01:30.879
Or you could just grow it out and have a skulllet like Hulk Hogan while we're talking about wrestling stuff.
00:01:31.920 --> 00:01:33.439
May he rest in peace.
00:01:33.599 --> 00:01:34.079
Yeah.
00:01:35.040 --> 00:01:35.519
Oh god.
00:01:35.760 --> 00:01:43.200
So yeah, so pretty excited to have my coworker Jacob Krell joining us today, but we'll get into his details a little later on.
00:01:43.359 --> 00:01:57.280
But he's got a really interesting talk that he did on death of the CTF, and we get to kind of learn how he's kind of experienced, you know, using some of these techniques to do CTFs and how it's kind of affected CTFs as a whole.
00:01:58.239 --> 00:02:05.280
So before we get into things, I guess we should announce that we do have the official date set for Cyber HackCon.
00:02:05.439 --> 00:02:10.400
So it's gonna be Thursday, February 25th at the Irving Convention Center.
00:02:10.879 --> 00:02:14.960
Different convention center this year, but a nice facility with lots of space.
00:02:15.199 --> 00:02:16.800
Tickets are coming soon.
00:02:17.039 --> 00:02:20.479
Pricing for regular attendee tickets is 250 bucks.
00:02:20.800 --> 00:02:22.800
VIP pass is$350.
00:02:23.439 --> 00:02:30.080
And disc code for listeners of this podcast for regular ticket only is Hackcast 15.
00:02:30.479 --> 00:02:30.639
Yeah.
00:02:30.879 --> 00:02:35.039
H-A-K-C-A-S-T 15 lowercase, I think.
00:02:35.120 --> 00:02:36.000
I think it does matter.
00:02:36.080 --> 00:02:37.520
I think it's case sensitive.
00:02:37.759 --> 00:02:40.879
So go get that 15% off.
00:02:41.039 --> 00:02:41.680
I think that is.
00:02:41.759 --> 00:02:43.919
I think that's what the 15 stands for.
00:02:44.240 --> 00:02:47.280
We've got sponsorships selling right now as well.
00:02:47.439 --> 00:02:58.400
So for any organizations who want to sponsor it, this is a hackerslash practitioner conference, a bunch of techie geeky stuff going on, cool CTFs, a lot of cool villages.
00:02:58.719 --> 00:03:06.639
There'll be a lot of people that are influencing decisions on what tools get bought in their organizations or what services get bought in their organizations.
00:03:06.719 --> 00:03:08.319
So definitely worth your time.
00:03:08.719 --> 00:03:23.360
All of the cyberhackcon talks from the May event that we had, the first one, and from the cyber hack contract at CybersecCon are now on Cybersec Media.
00:03:23.439 --> 00:03:24.960
So go check all of those out.
00:03:25.120 --> 00:03:29.439
And that's including Jacob's talk at CybersecCon.
00:03:29.680 --> 00:03:33.520
And so we'll have a link to that in the show notes.
00:03:33.759 --> 00:03:38.639
And for the one in February, the call for papers is going to be opening very soon.
00:03:38.719 --> 00:03:41.280
So November 1st through December 15th.
00:03:41.439 --> 00:03:45.840
We're going to extend that a little bit because we know there's holidays going on in there.
00:03:45.919 --> 00:03:49.520
So yeah, go get your papers ready.
00:03:49.680 --> 00:03:52.960
And we like deep tech track talks.
00:03:53.120 --> 00:03:55.199
That's what it's all about is digging in.
00:03:55.360 --> 00:03:57.759
Doesn't have to be technical per se.
00:03:57.840 --> 00:04:01.360
If it's a I think we like weird talks too, Phil, right?
00:04:01.599 --> 00:04:02.639
Like crazy talks.
00:04:02.800 --> 00:04:05.919
Anything that's off the, you know, not just the norm of stuff.
00:04:06.159 --> 00:04:10.400
And also add to that as well, it's cyber hackcom, but it's a practitioner conference.
00:04:10.479 --> 00:04:13.280
So it doesn't necessarily have to be a red team or hacking talk.
00:04:13.360 --> 00:04:15.360
It could be something blue team related.
00:04:15.520 --> 00:04:18.959
One of the topics I don't see enough out there is like detection engineering.
00:04:19.040 --> 00:04:31.839
This is a very important subject that we just don't see enough of things that can arm the defenders to help them do a better job against threat actors, especially now in an AI-powered world where it's getting easier for the threat actors.
00:04:33.279 --> 00:04:36.319
Yeah, the detection engineering is that's a really good point.
00:04:36.480 --> 00:04:45.680
Talking to any of the AI and agentic sock companies out there, a lot of them forget about the detection engineering part of it.
00:04:45.839 --> 00:04:52.959
And that's actually an important part of not just the technical part of a security operations center, but the financial part of it.
00:04:53.040 --> 00:05:04.480
Because if your detections aren't cleaned up over time, you may have a bunch of ingestion on things that you have no reason to be even looking at because that detection may not even be good anymore.
00:05:04.639 --> 00:05:07.519
So definitely a part of the whole economy of a SOC.
00:05:07.759 --> 00:05:08.879
So that's a great point.
00:05:09.199 --> 00:05:13.360
Just kind of a subject to share, real quick, it kind of short, but it's kind of off topic.
00:05:13.519 --> 00:05:23.439
But thinking of endpoint detection and stuff, Dave Kennedy's binary defense, their new product, Night Beacon, actually creates detection rules within their endpoint detection detection.
00:05:23.759 --> 00:05:24.240
That's cool.
00:05:24.560 --> 00:05:25.040
That's good.
00:05:25.199 --> 00:05:26.319
They didn't forget about it.
00:05:26.480 --> 00:05:27.120
That's a good thing.
00:05:27.439 --> 00:05:27.839
That's good.
00:05:27.920 --> 00:05:28.319
Yep.
00:05:28.879 --> 00:05:30.000
Feedback loop.
00:05:30.160 --> 00:05:40.399
So I guess we're gonna go to break and then we'll be back with Jacob Krell sharing his history as well as talking about his talk, Death of the CTF.
00:05:40.800 --> 00:05:44.399
And we're back, and today we're joined by Jacob Krell.
00:05:44.959 --> 00:05:53.600
Jacob's got a really interesting story, and also he had a really interesting talk that he did at CybersecCon on Death of the CTF.
00:05:53.759 --> 00:06:04.480
But before we dig into the details of your talk, Jacob, if you wouldn't mind kind of sharing your background, kind of how you got started, how you got interested in cybersecurity and more specifically offensive security.
00:06:04.720 --> 00:06:06.240
Yeah, thanks for having me on.
00:06:06.319 --> 00:06:09.360
Unfortunately, I don't think I can join the BFS club.
00:06:09.439 --> 00:06:11.759
I think my hair's a little too long for that one.
00:06:12.000 --> 00:06:14.079
But what it's kind of a funny story.
00:06:14.240 --> 00:06:19.120
What really got me interested in cybersecurity as a whole was watching Matrix for the first time.
00:06:19.360 --> 00:06:39.279
And for whatever reason, the idea of chasing the white rabbit, this this elusive target that's an ever-moving target, kind of manifested itself in hacking to me as kind of a skill set to learn and something I could dedicate a significant portion of my life to in pursuit of that is rewarding and keeps kind of growing the more you learn about it.
00:06:39.519 --> 00:06:41.680
So that's kind of broadly how I got started.
00:06:41.920 --> 00:06:49.920
Then I took some time to pursue some certifications like the OSEC OSCP and a lot of the uh Conkeya certifications.
00:06:50.079 --> 00:06:52.959
I've got a whole wall of the certifications behind me.
00:06:53.120 --> 00:06:55.279
At this stage, I'm kind of like a collector of them.
00:06:55.439 --> 00:06:58.639
I think uh playing Pokemon as a kid kind of kind of rubbed off on me.
00:06:58.800 --> 00:07:04.560
So they're pace very well at the top, like the same rows.
00:07:04.879 --> 00:07:08.560
It's like it's very well organized, got some mo CD going on there.
00:07:08.639 --> 00:07:09.279
I like it.
00:07:09.600 --> 00:07:10.720
It took me a while to do that.
00:07:10.800 --> 00:07:11.680
I'm gonna be honest with you.
00:07:11.759 --> 00:07:16.079
There's many pencil marks and erasures on that wall if you zoom in and zoom in close to it.
00:07:16.160 --> 00:07:19.199
So I'd gave up halfway through the first row.
00:07:19.519 --> 00:07:20.720
Like I'm done with this.
00:07:21.519 --> 00:07:26.240
But so after kind of that initial spark, I did a lot of learning on hack the box.
00:07:26.319 --> 00:07:32.160
Doing the CTFs, I think, helped a lot because it was just kind of a practical application of the skills.
00:07:32.240 --> 00:07:33.519
And I would go through with write-ups.
00:07:33.680 --> 00:07:37.279
Zero XGF had fantastic write-ups for every one of the boxes.
00:07:37.360 --> 00:07:53.920
And shout out to him because he basically taught me my methodology just by going through a write-up a day on uh hack the box fishing and just getting that pounded in of you know, start with an Nmap, W fuzz for virtual hosts, you know, and just kind of the order of how you can do things.
00:07:54.240 --> 00:07:59.439
Then from there, I just I made write-ups and posted those onto Twitter, on onto X.
00:07:59.759 --> 00:08:06.480
And my current employer, Michael Bell, saw that and reached out to me and offered if I wanted to interview and then come work for him.
00:08:06.720 --> 00:08:17.279
So really it was just kind of that pursuit of technical learning and that visibility with it and kind of showing and outputting something, doing the boxes is one thing, like learning from them is is another.
00:08:17.360 --> 00:08:23.600
But then the final kind of thing is make a public artifact, like a write-up or something that other people can use to learn from that.
00:08:23.839 --> 00:08:27.600
I think is is kind of uh a big deal and kind of what helped me get into the industry.
00:08:27.920 --> 00:08:50.399
Yeah, what I find inspiring about your story, among many things, is just the fact that you were working on your education and you were sharing on X and you got discovered and someone interviewed you for a job that the experience you had was all basically education level, opposed to some folks that maybe they did have some a little bit of experience or worked in a different area.
00:08:50.480 --> 00:08:57.919
But I think it's really cool that you're able to get a job without experience outside of hack the box and some of the different educational solutions.
00:08:58.000 --> 00:09:03.440
So I think that kind of gives people hope that there is the possibility that they can learn enough.
00:09:03.600 --> 00:09:17.360
And the cool thing about it is I'm sure you learned enough that when you're going through the interview, you can explain how to do different types of do your methodology for the pen testing, how you discovered certain vulnerabilities and describe those which are huge.
00:09:17.600 --> 00:09:17.840
Yeah.
00:09:18.000 --> 00:09:26.080
And to piggyback off of kind of something you said there, it's not so much that the experience is one way that you can set yourself out as a candidate.
00:09:26.159 --> 00:09:43.840
And what I kind of experienced going through that process of looking for a job myself and kind of getting discovered that way is if you can identify yourself as like this is the person from hack the box, you know, kind of build an identity for yourself and do some personal branding that really helps you stand out in applicant pools because then you're differentiated, right?
00:09:44.000 --> 00:09:48.559
HR departments and people trying to hire get so many applicants that they need kind of something to center in on.
00:09:48.799 --> 00:09:54.080
And for me, that just happened to be the hack the box write-ups and you know, demonstrated I could be a penetration tester.
00:09:54.159 --> 00:09:55.360
That's just one way to do it, right?
00:09:55.440 --> 00:09:59.759
You can also have experience traditionally, which is, you know, usually the traditional way of doing it.
00:09:59.840 --> 00:10:08.080
But I think the big thing is having that wedge that proves that, hey, I can actually demonstratably do this, and I'm kind of different from the other applicants.
00:10:08.399 --> 00:10:20.879
We've had that conversation on here in another one's other podcasts and other venues where we're uh in other forums where we talked about people trying to break into cybersecurity and asking how they get noticed, how they get jobs.
00:10:20.960 --> 00:10:25.039
And one of the things we always say is you know, write up your experience that you have.
00:10:25.519 --> 00:10:26.879
I mean, you didn't necessarily do that.
00:10:26.960 --> 00:10:39.440
I mean, I'm sure you put some of that stuff on your resume, but like you were actively going out and really showing what you've done versus just being on hack the box and showing that I've done hack the box challenges.
00:10:39.600 --> 00:10:41.440
You were going, I think, the extra mile.
00:10:41.600 --> 00:10:49.440
And I think that's a a great example for anybody trying to break in to see that as like this is this is not just doing that.
00:10:49.600 --> 00:10:51.360
This is not just putting this on my resume.
00:10:51.600 --> 00:10:59.120
This is actively going out and trying to explain why I did this, how I did this, what I did, what I learned from it.
00:10:59.200 --> 00:11:01.360
And that's a lesson a lot of people need to learn.
00:11:01.600 --> 00:11:02.080
100%.
00:11:02.559 --> 00:11:08.159
You got to be in it for the will of the game a lot, too, especially if you're gonna come up through a unique way like I did.
00:11:08.399 --> 00:11:14.720
I wasn't writing the write-ups, you know, purely as a resume at him, like, oh, I put 50 write-ups on my resume.
00:11:14.960 --> 00:11:18.080
It was more of I'm gonna do this because then I learn from doing it.
00:11:18.159 --> 00:11:18.399
Yeah.
00:11:18.559 --> 00:11:24.960
I learn how to do the reporting skills, I learn how to communicate the technical concepts in simple terms that someone can follow along with.
00:11:25.120 --> 00:11:31.600
And a lot of this is soft skills that aren't just like, I know how PowerShell works, or you know, something like that.
00:11:31.840 --> 00:11:34.879
It's being able to communicate those technical concepts effectively.
00:11:35.279 --> 00:11:42.720
Doing it for the reason of learning is, in my opinion, much better long term than for the reason of just here's another resume, and I'm yourself into pad my resume.
00:11:43.200 --> 00:11:52.320
Something else that's paid off for you too is the passion for it, because you see so many cases nowadays, people have heard that you know, cybersecurity pays a lot of money.
00:11:52.399 --> 00:12:00.240
So a lot of people get into it for purely money motivation, but it seems like you know, someone like yourself is really driven by the passion.
00:12:00.399 --> 00:12:05.519
You don't get 30 some eyed certs just because you're wanting the money.
00:12:05.600 --> 00:12:08.720
It's because you know you're passionate and motivated about what you're doing.
00:12:09.039 --> 00:12:10.000
Exactly, 100%.
00:12:10.399 --> 00:12:13.759
And I mean, you can see my little wrong side work pence I've got over here.
00:12:13.919 --> 00:12:18.080
I got this recently and and I didn't don't didn't know anything about electronics, right?
00:12:18.240 --> 00:12:22.799
But I go to DEF CON every year and I'm like, there's so much of the space around electrical engineering electronics.
00:12:22.879 --> 00:12:24.879
I want to learn this so I can kind of know what's going on.
00:12:25.120 --> 00:12:29.360
I think part of that is I just don't like to not know things that other people are knowing things that know things.
00:12:29.440 --> 00:12:31.039
So it's kind of like a stubbornness.
00:12:31.200 --> 00:12:33.120
But so I I mean I'm starting from zero.
00:12:33.200 --> 00:12:34.559
I've just got a little breadboard, right?
00:12:34.639 --> 00:12:37.759
And I bought a little wiring kit off Amazon for 30 bucks with components.
00:12:38.080 --> 00:12:44.000
And I've just been having the AI write me a little curriculum and and guide me along, and I'll take pictures of the breadboard and be like, Am I doing this right?
00:12:44.159 --> 00:12:44.879
What am I doing wrong?
00:12:45.039 --> 00:12:47.919
And use the AI as like a tutor to kind of teach me how to go through it.
00:12:48.080 --> 00:12:50.320
So and then that opens up so many paths, right?
00:12:50.399 --> 00:12:57.759
Because now if I want to go do actual hardware hacking or like a physical penetration test on a system or something like that, I actually have the experience of doing that.
00:12:57.919 --> 00:12:59.919
And the biggest thing is documenting it, right?
00:13:00.000 --> 00:13:07.279
I haven't quite gotten to that point, but having some kind of an artifact that points to, hey, I've done this, here's proof that I've done this, which kind of comes back to that first point I was making earlier.
00:13:07.679 --> 00:13:18.639
Yeah, that we're starting to do that with our the nonprofit partner that we have, Cyberset Careers, where we're partnering with Houston City College on teaching a technical user group.
00:13:18.879 --> 00:13:25.759
And I've told them, like, cybersecurity is you know great to know, but look, let's start with the networking side of things.
00:13:25.919 --> 00:13:34.320
Let's start with IPv4, let's IPv6, let's start with routing concepts because some people get tired of me saying this.
00:13:34.399 --> 00:13:47.759
But I've seen master's degree students come out with learning how to just be an analyst, and they don't have the full scope and of experience, obviously, but they don't have the skill set that they need.
00:13:47.919 --> 00:13:51.039
So if you can't get that from college, you've got to go.
00:13:51.200 --> 00:13:58.240
And I'm not saying every university is that way, but I see a lot of them that are just teaching theory and not giving you real good experience.
00:13:58.480 --> 00:14:05.120
And honestly, the young man that's helping us run this is saying the same thing, and he's going to college.
00:14:05.200 --> 00:14:10.399
And Houston City College is actually one of the better ones for teaching you actually real experience.
00:14:10.639 --> 00:14:13.759
So, yeah, you you've got to do this on your own.
00:14:13.919 --> 00:14:17.120
I'll I'll frack me, I'll say it till I'm blue in the face.
00:14:17.279 --> 00:14:21.200
Like you, this field demands curiosity.
00:14:21.440 --> 00:14:31.039
In the past, you could probably be successful, and you definitely can in IT by working a nine to five job, staying in your cubicle, then going home and not doing anything after.
00:14:31.200 --> 00:14:38.879
I mean, you could have a career, but in cybersecurity, and now even to get in the field, you've got to take it that next step.
00:14:39.039 --> 00:14:40.320
You just have to.
00:14:40.480 --> 00:14:49.519
And if you're not willing to do that, I mean, I again, I've been called a gatekeeper a million times, but this is not the field for you if you're not.
00:14:49.679 --> 00:14:53.200
I mean, honestly, like if you can't put that time and effort into it.
00:14:53.440 --> 00:15:01.279
And if I if I may just piggyback off of that last little point you said, I think gatekeeping to some extent is good because you've got to remember what we're dealing with here.
00:15:01.360 --> 00:15:02.399
We're security.
00:15:02.559 --> 00:15:06.799
Like no, you would want a gatekeeping for your physical security guard.
00:15:06.879 --> 00:15:09.039
You know, you want gatekeeping for your army members.
00:15:09.200 --> 00:15:14.159
A lot of these guys in the field are ex-military guys, you know, like defending critical infrastructure.
00:15:14.399 --> 00:15:18.799
You do want to gatekeep to some extent because it's a very mission critical.
00:15:18.960 --> 00:15:19.759
Like, look at pilots.
00:15:19.840 --> 00:15:21.519
Like you need gatekeeping in some professions.
00:15:21.600 --> 00:15:26.960
And I think this is one of them where some level of gatekeeping is correct just because of the criticality of the work.
00:15:27.200 --> 00:15:27.519
Yep.
00:15:27.679 --> 00:15:27.919
Yeah.
00:15:28.159 --> 00:15:34.159
If you're gonna go work in a nuclear facility, you probably need to be really good at what you're doing.
00:15:34.399 --> 00:15:35.200
So yeah.
00:15:35.440 --> 00:15:36.879
So yeah, it's a negative term.
00:15:37.039 --> 00:15:44.960
I get the negative use of the term, but it is in this case, you need to have some kind of filtering there of people who aren't gonna want to do it.
00:15:45.120 --> 00:15:59.679
So yeah, I think they definitely need to know what it is up front because you take some of these certifications, you know, because I'm not gonna name names on one of the organizations that came out several years ago of all these millions of jobs that were unfilled.
00:15:59.759 --> 00:16:03.600
In some cases, these are people just trying to sell certifications.
00:16:03.679 --> 00:16:05.039
So you have to battle that.
00:16:05.120 --> 00:16:16.399
So you do need some realism blended in there so people can kind of learn the pros and cons and understand before they get into something that they're gonna end up totally hating.
00:16:16.960 --> 00:16:19.120
Oh man, we could preach on that for a while.
00:16:19.200 --> 00:16:20.399
Yeah, let's not name names.
00:16:20.559 --> 00:16:22.240
Yeah, names will come after us.
00:16:22.399 --> 00:16:28.559
But that particular organization I think you talk about is fairly litigious, if that's the same one I'm thinking about.
00:16:28.639 --> 00:16:36.080
So yeah, probably the same one because even even Ira Winkler did like a write-up or post on them at some point around that time.
00:16:36.240 --> 00:16:36.480
Yeah.
00:16:36.799 --> 00:16:37.120
Yep.
00:16:37.279 --> 00:16:37.600
Nope.
00:16:37.679 --> 00:16:39.759
I've got stories around that myself.
00:16:40.000 --> 00:16:40.320
Yeah.
00:16:40.559 --> 00:16:50.320
Well, speaking of passion and doing hack the box and that kind of thing, let's use that as a segue, Jacob, to talk about your talk.
00:16:50.480 --> 00:16:58.000
So you talked about, I want to say it's a little bit of a clickbaity title on purpose because I don't think that was correct.
00:16:58.320 --> 00:17:01.120
Ultimately, your conclusion that CTFs are dead.
00:17:01.200 --> 00:17:06.400
But you said that you know, the death of the CTF, especially in this AI world.
00:17:06.640 --> 00:17:08.079
Definitely want to dig into it.
00:17:08.160 --> 00:17:11.279
Give us your rundown of why you made that talk.
00:17:11.599 --> 00:17:11.920
Yeah.
00:17:12.079 --> 00:17:24.640
So a kind of thousand-foot view of all of this is as we were saying, I went through and I grind out a lot of these hack the box challenges in machines to the point where I was pushing like top 20 globally.
00:17:24.880 --> 00:17:28.640
And it was around this time that AI was becoming really prevalent.
00:17:28.720 --> 00:17:36.640
Like before you could ask it questions and you could look up information, but then it kind of entered the agentic phase where you just give it the problem and it just spits out the flag.
00:17:36.880 --> 00:17:42.000
So you would see first blood times on all these machines in five minutes, 10 minutes, you know.
00:17:42.079 --> 00:17:46.799
And it's like if you're doing this manually, that's enough time to run a scan and you know look at it.
00:17:46.960 --> 00:17:49.119
You're not solving the whole machine that quickly.
00:17:49.440 --> 00:18:07.440
So it became very apparent that this was becoming more about, at least at like the level pushing for top bloods at like the global, you know, like winning competition levels about agency engineering and who can build the best AI harnesses and stuff like that, which is a different skill set than traditional CTS, right?
00:18:07.519 --> 00:18:12.240
It's not cybersecurity knowledge, it's not hands-on keyboard operator knowledge and stuff like that.
00:18:12.799 --> 00:18:16.640
And so that led me down the path of okay, well, can I quantize this?
00:18:16.799 --> 00:18:23.759
Can I actually put like numbers to this theory and prove this theory that I have that the solve times are getting shorter and shorter because of AI?
00:18:24.000 --> 00:18:26.160
So then that led me down to okay, how can I do this?
00:18:26.240 --> 00:18:37.039
And I thought, okay, well, I can take the first blood times because that was kind of what originally led me to notice like everything's getting solved so quickly because these first blood times every week are five minutes, five minutes, three minutes, two minutes going down.
00:18:37.279 --> 00:18:43.440
So unfortunately, hack the box has a policy where I can't scrape their site to TOS.
00:18:43.599 --> 00:18:54.240
Luckily, Zo XDF, to my knowledge, and if you do, I'm sorry, don't hate me, don't sue me, doesn't have such copyright protections, without anti-crawls protections on his write-ups.
00:18:54.319 --> 00:19:06.000
So I was able to pull the first blood times from his historical write-ups and ingest that into research and then do statistical research over time because his site also stores like the metadata of when the machine was released, stuff like that.
00:19:06.079 --> 00:19:08.079
Like is it a Windows machine, a Linux machine?
00:19:08.240 --> 00:19:19.119
So I was able to do statistical analysis on all that and find that over the eight years of machines that were in the data set, it was decreasing by like 16.5% year over year to solve times.
00:19:19.279 --> 00:19:19.519
Wow.
00:19:19.759 --> 00:19:21.599
And that's statistically, yeah.
00:19:21.920 --> 00:19:27.359
And so it was like a six-fold decrease in a decade or something like that, to the point where it becomes trivial to solve.
00:19:27.440 --> 00:19:31.519
It's essentially going from doing like long division by hand to using a calculator.
00:19:31.839 --> 00:19:35.279
So, and that accelerates when AI was released.
00:19:35.359 --> 00:19:44.799
I picked a date of I think it was 2022 just to kind of symbolize ChatGPT release, you know, AI release, because when you're doing research like that, you kind of just got to make these benchmarking points.
00:19:44.880 --> 00:19:45.920
So that was one of them I used.
00:19:46.000 --> 00:20:00.799
Another one was agentic AI usage, and that's where it like really picks up because once an agentic AI comes into the field, it can do research on its own and it can pull web results, look up so many machines at the CTFs are like finding this one write-up on this one technique that was posted one time.
00:20:01.039 --> 00:20:05.359
And the AI is really good at that when it's crawling 10,000 sites a minute, you know.
00:20:05.680 --> 00:20:13.440
So I did that, and then from that analysis, like I said, I found it was decreasing by so much, I kind of drew some conclusions from it.
00:20:13.599 --> 00:20:24.240
And the conclusions I drew were one, it's gonna be nearly impossible to keep competitive hacking alive in an online environment because you can't really regulate AI usage.
00:20:24.720 --> 00:20:30.880
I mean, you'd have to instrument so heavily, it's just not really feasible something like hack the box to effectively stop it.
00:20:31.039 --> 00:20:34.160
They can put it in TOS, but people are still-I mean, look at video games.
00:20:34.240 --> 00:20:38.640
People cheat at video games all the time, and you know, they get banned for that.
00:20:38.799 --> 00:20:53.839
And and two, the only way you're gonna really preserve that competitive element of traditional hacking, hacking as a competition, hands-on keyboard stuff, is in a live setting where you can monitor keyboard use and actually see their screens and be like, okay, they're not using AI.
00:20:54.160 --> 00:20:58.079
So that was kind of two of those conclusions from the competitive standpoint.
00:20:58.720 --> 00:21:06.079
From the general industry kind of standpoint, I also looked at like the trends of AI usage over time.
00:21:06.160 --> 00:21:12.240
And it kind of went from, you know, machines were helping in 2024 to in 2025 the the machines were winning.
00:21:12.319 --> 00:21:13.279
I think they have these days more.
00:21:13.519 --> 00:21:18.640
So 2023, 2024, and then 2025, the machines are starting to win CPS straight up.
00:21:18.799 --> 00:21:23.279
Like there's a drag OS competition where it was winning until they paused it purposefully.
00:21:23.359 --> 00:21:25.279
So it probably would have won that competition out, right?
00:21:25.519 --> 00:21:27.279
And that's like OS technologies, right?
00:21:27.359 --> 00:21:29.759
That's not like simple stuff.
00:21:30.000 --> 00:21:33.359
And it's just it has so many innate advantages.
00:21:33.519 --> 00:21:37.839
Like I said, like that being able to web crawl 10,000 pages at once, it doesn't get tired.
00:21:38.079 --> 00:21:42.720
It can read huge, I mean you can instantly read a config file and go, there's the vulnerability.
00:21:42.880 --> 00:21:48.640
Here's a set of source code, here's that unsafe exec stand, you know, and it can just do that instantly.
00:21:48.880 --> 00:21:58.079
So it kind of makes it where the human element is more about how you can design the system to solve these so quickly that it becomes not competitive, like I was saying.
00:21:58.799 --> 00:21:59.119
So
00:22:00.480 --> 00:22:02.799
Do you know Hutch, Justin Hutchins?
00:22:03.200 --> 00:22:04.000
Sounds familiar.
00:22:04.160 --> 00:22:05.119
There's a lot of names.
00:22:05.519 --> 00:22:07.599
He wrote, he's got a book on the AI art.
00:22:07.839 --> 00:22:09.279
Is it the Art of Deception?
00:22:09.599 --> 00:22:10.720
I think I've got it up here.
00:22:10.960 --> 00:22:11.519
Something like that.
00:22:11.759 --> 00:22:12.000
Yeah.
00:22:12.160 --> 00:22:12.319
Yeah.
00:22:12.799 --> 00:22:16.079
So he does all of our CTFs for all of our events.
00:22:16.319 --> 00:22:16.559
Okay.
00:22:16.720 --> 00:22:21.200
And he's like he spent a ton of time writing the CTF for Cyber Hack on.
00:22:21.279 --> 00:22:24.880
And I know you couldn't make the original show, but he spent a ton of time writing.
00:22:25.119 --> 00:22:29.200
And then he checks out the agenda and he saw your talk.
00:22:29.759 --> 00:22:33.359
And so he immediately stayed up till like, I don't know, what did he say, Phil?
00:22:33.519 --> 00:22:35.200
Like one or two in the morning or something.
00:22:35.359 --> 00:22:36.240
Yeah, something like that.
00:22:36.400 --> 00:22:46.319
Yeah, the day before rewriting the CTF and putting a bunch of false flags that he knew that AI would look for.
00:22:46.880 --> 00:22:48.400
And language of deception.
00:22:48.480 --> 00:22:49.440
Thank you, August.
00:22:49.599 --> 00:22:55.440
And it got me to thinking, like, because I saw this in another podcast somewhere.
00:22:55.599 --> 00:23:02.880
He was talking about in not just in competitive hacking, but in like real-world red teaming penetration tests, that kind of stuff.
00:23:03.279 --> 00:23:31.200
Because AI is picking up the pace of those in a very similar, you know, of solving and finding vulnerabilities in this very similar fashion as into the CTFs where you're finding the flags, that deception tech is starting to come back into favor because AI falls for deception, at least now, right now, more than humans do, because humans can pick up on some of those nuances, at least experienced penetration testers.
00:23:31.440 --> 00:23:46.240
So it makes me wonder is there at least an extension of CTFs where they can be built to kind of take advantage of the weaknesses of how AI attacks these CTFs.
00:23:46.640 --> 00:23:50.079
Because he even created like a uh almost like a wall of shame.
00:23:50.160 --> 00:23:55.440
It actually became a everybody was trying to get on the wall of shame to see how fast AI could solve it.
00:23:55.519 --> 00:23:56.960
But does that make sense what I'm asking?
00:23:57.039 --> 00:23:57.359
Like that.
00:23:58.960 --> 00:24:00.240
I I I think it does.
00:24:00.319 --> 00:24:04.880
And if I if I unpack it a little bit, I think it's kind of a two-fold answer I want to give.
00:24:05.039 --> 00:24:06.799
Like you can certainly build around it, right?
00:24:06.880 --> 00:24:08.720
We're all using the same Chat GPT.
00:24:08.799 --> 00:24:11.920
You can plug in your CTF into ChatGPT and you can see what it does.
00:24:12.079 --> 00:24:13.839
And you can do that five minutes.
00:24:13.920 --> 00:24:15.359
You know, you want to do it really completely.
00:24:15.440 --> 00:24:18.640
You can do it three minutes across different models and see how all the different models look.
00:24:19.279 --> 00:24:22.240
And then you you can implement defenses and stuff around it.
00:24:22.480 --> 00:24:29.200
As far as can you like operationalize that and make a creative CTF around that as part of solving it?
00:24:29.359 --> 00:24:30.240
I'm sure you can.
00:24:30.400 --> 00:24:32.480
I don't make CTFs, I'm not smart enough for that.
00:24:32.559 --> 00:24:34.799
I just solve them a lot of the times with AI.
00:24:34.960 --> 00:24:40.880
So but in the enterprise, I I definitely think honey pots are underutilized.
00:24:41.039 --> 00:24:44.880
I like to kind of think in in my little sci-fi world coming from the matrix and stuff.
00:24:44.960 --> 00:24:51.680
Like in any of these sci-fi movies, anytime they go into the into the mainframe, right, as they call it, there's always like defense people there, right?
00:24:51.759 --> 00:24:54.960
Like there's these defender programs, AI is coming after them.
00:24:55.119 --> 00:24:56.559
And we don't really see any of that.
00:24:56.640 --> 00:25:02.720
We have like human responders, but there's not any kind of like active defense components of networks.
00:25:02.799 --> 00:25:05.920
And I think that's kind of where AI is going to bring us into that next technology.
00:25:06.240 --> 00:25:08.799
And I think honey pots are going to kind of be the first step of that.
00:25:09.039 --> 00:25:15.519
Like if your EDR sees someone's coming into these S and B shares, maybe it quickly spools up a honeypot share, right?
00:25:15.599 --> 00:25:20.160
And then it and then it can you know put prompt injection in that share, like you were saying, or something.
00:25:20.240 --> 00:25:20.480
I don't know.
00:25:20.559 --> 00:25:21.680
Like the sky's the limit there.
00:25:21.759 --> 00:25:30.240
But I definitely think it's going to go towards more active detection, away from kind of the passive detection that way if that we're currently running in in broadcast.
00:25:30.640 --> 00:25:31.039
Interesting.
00:25:31.920 --> 00:25:32.799
Bill is a pen tester.
00:25:33.039 --> 00:25:34.799
What do you how do you see that?
00:25:34.960 --> 00:25:41.200
Like if something you see an active defense, it's almost like a not an active, it's an active detection, but almost like an active defense.
00:25:41.599 --> 00:25:43.359
Yeah, it's kind of interesting in the scenarios.
00:25:43.440 --> 00:25:49.519
If you're having a pen test done, then you may want to deactivate those until the test is done.
00:25:49.680 --> 00:25:52.799
But what's interesting is kind of back to Dave Kennedy.
00:25:52.880 --> 00:26:10.400
He was doing a keynote at Hack SpaceCon one year, and he said anytime that they've seen anytime there's been deception used in an environment when they're doing a red team engagement, that a lot of cases they were caught because of the deception.
00:26:10.559 --> 00:26:17.359
And this is someone that's even experienced around that, a very highly skilled team, and how it even affects them.
00:26:18.160 --> 00:26:18.480
Yeah.
00:26:18.799 --> 00:26:31.519
I mean, you're moving so fast on a lot of these engagements, especially with AI, that all you would have to do is make it something that as the operator in the environment, you know it's not real, but it looks real, right?
00:26:31.839 --> 00:26:38.079
So maybe you just add one to a PDF document name or something, and then it gets picked up by crawlers or scanners, right?
00:26:38.559 --> 00:26:44.000
That's more of like a just a detection deception method, right, than a full-on like stop the attack method.
00:26:44.160 --> 00:26:48.799
But I definitely think honey pots and and more deception text a good word.
00:26:48.880 --> 00:26:52.319
I think that's a good word to kind of describe where I think it's going to where it's going to go.
00:26:52.640 --> 00:26:53.039
Yeah.
00:26:53.359 --> 00:27:14.319
I remember being enamored the first time I saw deception technology where it wasn't a full-blown digital twin, but then it was before AI, but you had the ability to even create almost like another extension of your environment with similar names, similar naming structure.
00:27:14.480 --> 00:27:22.240
Like you can go in and do an analysis of what your infrastructure look like and create something very, very similar to that.
00:27:22.480 --> 00:27:25.599
I mean, deception tech can get really, really tricky.
00:27:25.759 --> 00:27:28.319
Like it's really hard to determine that it's something else.
00:27:28.480 --> 00:27:32.880
I mean, even to the point now with AI, that can get spun up even quicker.
00:27:33.039 --> 00:27:48.400
Like if it sees something, even with you combine that with cloud infrastructure and the ability to quickly spin something up in a dynamic fashion where it's like, oh, and then it's like somebody's in there going, it's like all of a sudden this other box pops up in their scans.
00:27:48.480 --> 00:27:50.720
It's like, oh man, that looks like a really juicy target.
00:27:50.799 --> 00:27:51.359
Let me go over here.
00:27:51.440 --> 00:27:57.279
I mean, there's a lot of stuff you could do there, if as long as you know which real and what's not yourself.
00:27:57.599 --> 00:28:03.839
And what's interesting on that point is that's kind of one of the structural advantages of a defender against an attacker, right?
00:28:03.920 --> 00:28:07.599
Is you know what your environment is and the attacker doesn't coming into it.
00:28:07.680 --> 00:28:07.839
Yeah.
00:28:08.000 --> 00:28:17.759
But what I've found too is in loads of organizations, they don't actually know what they have and a full complete inventory of like S-bombs and everything.
00:28:17.920 --> 00:28:22.640
So I think that's a a a big gap too, is is to defend it, you need to know what it is.
00:28:22.720 --> 00:28:31.200
And we've just had so much IT sprawl over the past decades and decades that a lot of the times there's these old things that just were added one time that no one knows about, you know.
00:28:33.279 --> 00:28:36.640
Yeah, some people don't have any clue what the hell's going on in their own environment.
00:28:36.799 --> 00:28:37.039
Yeah.
00:28:37.279 --> 00:28:42.640
Well, Phil, I think we're getting to the end of this thing, but I love this conversation.
00:28:42.960 --> 00:28:44.720
Yeah, it's it's been a great conversation.
00:28:44.799 --> 00:28:52.799
I've always been interested in seeing what what Jacob's doing with the automation, even taking things further, you know, doing pen testing and stuff.
00:28:52.880 --> 00:28:59.200
He actually did a video where he showed how to build a harness for for doing pen testing using AI.
00:28:59.359 --> 00:29:01.039
So pretty cool, pretty cool topic.
00:29:01.200 --> 00:29:03.759
Interesting to see how things are going these days.
00:29:04.000 --> 00:29:06.960
Well, Jacob, appreciate you being on, man.
00:29:07.119 --> 00:29:07.759
This is good stuff.
00:29:08.000 --> 00:29:08.640
Thank you for having me.
00:29:08.880 --> 00:29:09.359
Yeah, thanks.
00:29:09.599 --> 00:29:09.839
Very much.
00:29:10.240 --> 00:29:14.079
Hopefully, some of some of it was insightful and interesting to viewers.
00:29:14.400 --> 00:29:15.119
It was good.
00:29:15.359 --> 00:29:18.480
Well, thanks everyone for joining, and we'll see you on the next episode.
00:29:18.640 --> 00:29:21.759
Make sure to share, like, and subscribe.
00:29:21.920 --> 00:29:32.240
And then also, if you're watching this on YouTube, you know, put some comments in there so that way the algorithm picks up and it's able to share this information with others that could get some use from it.
00:29:32.400 --> 00:29:33.039
So thanks.
00:29:33.359 --> 00:29:36.240
This has been a Cyber Tech Media production.
00:29:36.480 --> 00:29:41.039
Cyber Hackcast is hosted by Michael Farnum and Philip Wiley.
00:29:41.279 --> 00:29:44.960
It's directed by Bill Brenner, produced by Lauren Anders.
00:29:45.200 --> 00:29:47.200
Our music is by Kike Gut.
00:29:47.599 --> 00:29:56.640
The views and opinions expressed in this show are those of the speakers and do not necessarily reflect the views or positions of any entities they represent.
00:29:57.119 --> 00:30:03.680
This show is for informational purposes only and is not render or offer to render personalized device.
00:30:04.400 --> 00:30:16.000
Subscribe now to miss an episode.com cybersecond.
00:00:04.080 --> 00:00:07.440
Hello and welcome to another episode of Cyber Hackcast.
00:00:07.519 --> 00:00:10.560
I'm joined by my BBFF, Michael Farnum.
00:00:11.359 --> 00:00:12.320
What's up, Phil?
00:00:12.720 --> 00:00:13.199
How much?
00:00:13.359 --> 00:00:14.000
How are you doing?
00:00:14.240 --> 00:00:15.039
I'm good, man.
00:00:15.199 --> 00:00:16.000
I'm good.
00:00:16.239 --> 00:00:17.679
Does Jacob know what that means?
00:00:17.760 --> 00:00:21.280
Does Jacob Jacob probably he doesn't know unless he's watched the podcast?
00:00:21.519 --> 00:00:24.719
But yeah, BBFF stands for Bald Best Friend Forever.
00:00:24.800 --> 00:00:31.519
So Sam Van Ryder, the co-founder of CybersecCon and Cybersec Events, is his BFF.
00:00:31.600 --> 00:00:33.439
So I'm his BBFF.
00:00:34.320 --> 00:00:35.439
Fantastic.
00:00:36.159 --> 00:00:38.000
Slightly less hair than you have, Jacob.
00:00:38.159 --> 00:00:40.880
So we're not the follow, we're the follically challenged.
00:00:42.159 --> 00:00:44.640
Well, only part of this is follically challenged.
00:00:44.799 --> 00:00:48.240
Around here is a choice, but this is definitely not a choice.
00:00:48.479 --> 00:00:52.399
Yeah, it's definitely good to shave it off because man, I just couldn't do the horseshoe thing.
00:00:52.479 --> 00:01:01.840
I that one of the gyms where I used to work out at, there was a guy in there that had the horseshoe thing going on and is kind of grown out, made me think of Terry Bradshaw Top Sugar.
00:01:01.920 --> 00:01:02.479
Oh my gosh.
00:01:02.799 --> 00:01:03.840
No, thank you.
00:01:04.159 --> 00:01:10.079
So any any dude losing hair that yeah, I would advise to trim it down really short or shave it.
00:01:10.400 --> 00:01:11.599
Just get it done.
00:01:11.840 --> 00:01:15.760
I've always said I wanted a I wanted a mohawk, but it would like end right here.
00:01:16.000 --> 00:01:17.760
Yeah, it'd be kind of starting back over here.
00:01:18.000 --> 00:01:24.000
Yeah, kind of it could be like the Road Warriors because they kind of did the thing where they had it on one of them had it on the sides, the hair on the sides.
00:01:24.239 --> 00:01:25.280
Yeah, do that.
00:01:25.439 --> 00:01:25.760
Yeah.
00:01:26.000 --> 00:01:30.879
Or you could just grow it out and have a skulllet like Hulk Hogan while we're talking about wrestling stuff.
00:01:31.920 --> 00:01:33.439
May he rest in peace.
00:01:33.599 --> 00:01:34.079
Yeah.
00:01:35.040 --> 00:01:35.519
Oh god.
00:01:35.760 --> 00:01:43.200
So yeah, so pretty excited to have my coworker Jacob Krell joining us today, but we'll get into his details a little later on.
00:01:43.359 --> 00:01:57.280
But he's got a really interesting talk that he did on death of the CTF, and we get to kind of learn how he's kind of experienced, you know, using some of these techniques to do CTFs and how it's kind of affected CTFs as a whole.
00:01:58.239 --> 00:02:05.280
So before we get into things, I guess we should announce that we do have the official date set for Cyber HackCon.
00:02:05.439 --> 00:02:10.400
So it's gonna be Thursday, February 25th at the Irving Convention Center.
00:02:10.879 --> 00:02:14.960
Different convention center this year, but a nice facility with lots of space.
00:02:15.199 --> 00:02:16.800
Tickets are coming soon.
00:02:17.039 --> 00:02:20.479
Pricing for regular attendee tickets is 250 bucks.
00:02:20.800 --> 00:02:22.800
VIP pass is$350.
00:02:23.439 --> 00:02:30.080
And disc code for listeners of this podcast for regular ticket only is Hackcast 15.
00:02:30.479 --> 00:02:30.639
Yeah.
00:02:30.879 --> 00:02:35.039
H-A-K-C-A-S-T 15 lowercase, I think.
00:02:35.120 --> 00:02:36.000
I think it does matter.
00:02:36.080 --> 00:02:37.520
I think it's case sensitive.
00:02:37.759 --> 00:02:40.879
So go get that 15% off.
00:02:41.039 --> 00:02:41.680
I think that is.
00:02:41.759 --> 00:02:43.919
I think that's what the 15 stands for.
00:02:44.240 --> 00:02:47.280
We've got sponsorships selling right now as well.
00:02:47.439 --> 00:02:58.400
So for any organizations who want to sponsor it, this is a hackerslash practitioner conference, a bunch of techie geeky stuff going on, cool CTFs, a lot of cool villages.
00:02:58.719 --> 00:03:06.639
There'll be a lot of people that are influencing decisions on what tools get bought in their organizations or what services get bought in their organizations.
00:03:06.719 --> 00:03:08.319
So definitely worth your time.
00:03:08.719 --> 00:03:23.360
All of the cyberhackcon talks from the May event that we had, the first one, and from the cyber hack contract at CybersecCon are now on Cybersec Media.
00:03:23.439 --> 00:03:24.960
So go check all of those out.
00:03:25.120 --> 00:03:29.439
And that's including Jacob's talk at CybersecCon.
00:03:29.680 --> 00:03:33.520
And so we'll have a link to that in the show notes.
00:03:33.759 --> 00:03:38.639
And for the one in February, the call for papers is going to be opening very soon.
00:03:38.719 --> 00:03:41.280
So November 1st through December 15th.
00:03:41.439 --> 00:03:45.840
We're going to extend that a little bit because we know there's holidays going on in there.
00:03:45.919 --> 00:03:49.520
So yeah, go get your papers ready.
00:03:49.680 --> 00:03:52.960
And we like deep tech track talks.
00:03:53.120 --> 00:03:55.199
That's what it's all about is digging in.
00:03:55.360 --> 00:03:57.759
Doesn't have to be technical per se.
00:03:57.840 --> 00:04:01.360
If it's a I think we like weird talks too, Phil, right?
00:04:01.599 --> 00:04:02.639
Like crazy talks.
00:04:02.800 --> 00:04:05.919
Anything that's off the, you know, not just the norm of stuff.
00:04:06.159 --> 00:04:10.400
And also add to that as well, it's cyber hackcom, but it's a practitioner conference.
00:04:10.479 --> 00:04:13.280
So it doesn't necessarily have to be a red team or hacking talk.
00:04:13.360 --> 00:04:15.360
It could be something blue team related.
00:04:15.520 --> 00:04:18.959
One of the topics I don't see enough out there is like detection engineering.
00:04:19.040 --> 00:04:31.839
This is a very important subject that we just don't see enough of things that can arm the defenders to help them do a better job against threat actors, especially now in an AI-powered world where it's getting easier for the threat actors.
00:04:33.279 --> 00:04:36.319
Yeah, the detection engineering is that's a really good point.
00:04:36.480 --> 00:04:45.680
Talking to any of the AI and agentic sock companies out there, a lot of them forget about the detection engineering part of it.
00:04:45.839 --> 00:04:52.959
And that's actually an important part of not just the technical part of a security operations center, but the financial part of it.
00:04:53.040 --> 00:05:04.480
Because if your detections aren't cleaned up over time, you may have a bunch of ingestion on things that you have no reason to be even looking at because that detection may not even be good anymore.
00:05:04.639 --> 00:05:07.519
So definitely a part of the whole economy of a SOC.
00:05:07.759 --> 00:05:08.879
So that's a great point.
00:05:09.199 --> 00:05:13.360
Just kind of a subject to share, real quick, it kind of short, but it's kind of off topic.
00:05:13.519 --> 00:05:23.439
But thinking of endpoint detection and stuff, Dave Kennedy's binary defense, their new product, Night Beacon, actually creates detection rules within their endpoint detection detection.
00:05:23.759 --> 00:05:24.240
That's cool.
00:05:24.560 --> 00:05:25.040
That's good.
00:05:25.199 --> 00:05:26.319
They didn't forget about it.
00:05:26.480 --> 00:05:27.120
That's a good thing.
00:05:27.439 --> 00:05:27.839
That's good.
00:05:27.920 --> 00:05:28.319
Yep.
00:05:28.879 --> 00:05:30.000
Feedback loop.
00:05:30.160 --> 00:05:40.399
So I guess we're gonna go to break and then we'll be back with Jacob Krell sharing his history as well as talking about his talk, Death of the CTF.
00:05:40.800 --> 00:05:44.399
And we're back, and today we're joined by Jacob Krell.
00:05:44.959 --> 00:05:53.600
Jacob's got a really interesting story, and also he had a really interesting talk that he did at CybersecCon on Death of the CTF.
00:05:53.759 --> 00:06:04.480
But before we dig into the details of your talk, Jacob, if you wouldn't mind kind of sharing your background, kind of how you got started, how you got interested in cybersecurity and more specifically offensive security.
00:06:04.720 --> 00:06:06.240
Yeah, thanks for having me on.
00:06:06.319 --> 00:06:09.360
Unfortunately, I don't think I can join the BFS club.
00:06:09.439 --> 00:06:11.759
I think my hair's a little too long for that one.
00:06:12.000 --> 00:06:14.079
But what it's kind of a funny story.
00:06:14.240 --> 00:06:19.120
What really got me interested in cybersecurity as a whole was watching Matrix for the first time.
00:06:19.360 --> 00:06:39.279
And for whatever reason, the idea of chasing the white rabbit, this this elusive target that's an ever-moving target, kind of manifested itself in hacking to me as kind of a skill set to learn and something I could dedicate a significant portion of my life to in pursuit of that is rewarding and keeps kind of growing the more you learn about it.
00:06:39.519 --> 00:06:41.680
So that's kind of broadly how I got started.
00:06:41.920 --> 00:06:49.920
Then I took some time to pursue some certifications like the OSEC OSCP and a lot of the uh Conkeya certifications.
00:06:50.079 --> 00:06:52.959
I've got a whole wall of the certifications behind me.
00:06:53.120 --> 00:06:55.279
At this stage, I'm kind of like a collector of them.
00:06:55.439 --> 00:06:58.639
I think uh playing Pokemon as a kid kind of kind of rubbed off on me.
00:06:58.800 --> 00:07:04.560
So they're pace very well at the top, like the same rows.
00:07:04.879 --> 00:07:08.560
It's like it's very well organized, got some mo CD going on there.
00:07:08.639 --> 00:07:09.279
I like it.
00:07:09.600 --> 00:07:10.720
It took me a while to do that.
00:07:10.800 --> 00:07:11.680
I'm gonna be honest with you.
00:07:11.759 --> 00:07:16.079
There's many pencil marks and erasures on that wall if you zoom in and zoom in close to it.
00:07:16.160 --> 00:07:19.199
So I'd gave up halfway through the first row.
00:07:19.519 --> 00:07:20.720
Like I'm done with this.
00:07:21.519 --> 00:07:26.240
But so after kind of that initial spark, I did a lot of learning on hack the box.
00:07:26.319 --> 00:07:32.160
Doing the CTFs, I think, helped a lot because it was just kind of a practical application of the skills.
00:07:32.240 --> 00:07:33.519
And I would go through with write-ups.
00:07:33.680 --> 00:07:37.279
Zero XGF had fantastic write-ups for every one of the boxes.
00:07:37.360 --> 00:07:53.920
And shout out to him because he basically taught me my methodology just by going through a write-up a day on uh hack the box fishing and just getting that pounded in of you know, start with an Nmap, W fuzz for virtual hosts, you know, and just kind of the order of how you can do things.
00:07:54.240 --> 00:07:59.439
Then from there, I just I made write-ups and posted those onto Twitter, on onto X.
00:07:59.759 --> 00:08:06.480
And my current employer, Michael Bell, saw that and reached out to me and offered if I wanted to interview and then come work for him.
00:08:06.720 --> 00:08:17.279
So really it was just kind of that pursuit of technical learning and that visibility with it and kind of showing and outputting something, doing the boxes is one thing, like learning from them is is another.
00:08:17.360 --> 00:08:23.600
But then the final kind of thing is make a public artifact, like a write-up or something that other people can use to learn from that.
00:08:23.839 --> 00:08:27.600
I think is is kind of uh a big deal and kind of what helped me get into the industry.
00:08:27.920 --> 00:08:50.399
Yeah, what I find inspiring about your story, among many things, is just the fact that you were working on your education and you were sharing on X and you got discovered and someone interviewed you for a job that the experience you had was all basically education level, opposed to some folks that maybe they did have some a little bit of experience or worked in a different area.
00:08:50.480 --> 00:08:57.919
But I think it's really cool that you're able to get a job without experience outside of hack the box and some of the different educational solutions.
00:08:58.000 --> 00:09:03.440
So I think that kind of gives people hope that there is the possibility that they can learn enough.
00:09:03.600 --> 00:09:17.360
And the cool thing about it is I'm sure you learned enough that when you're going through the interview, you can explain how to do different types of do your methodology for the pen testing, how you discovered certain vulnerabilities and describe those which are huge.
00:09:17.600 --> 00:09:17.840
Yeah.
00:09:18.000 --> 00:09:26.080
And to piggyback off of kind of something you said there, it's not so much that the experience is one way that you can set yourself out as a candidate.
00:09:26.159 --> 00:09:43.840
And what I kind of experienced going through that process of looking for a job myself and kind of getting discovered that way is if you can identify yourself as like this is the person from hack the box, you know, kind of build an identity for yourself and do some personal branding that really helps you stand out in applicant pools because then you're differentiated, right?
00:09:44.000 --> 00:09:48.559
HR departments and people trying to hire get so many applicants that they need kind of something to center in on.
00:09:48.799 --> 00:09:54.080
And for me, that just happened to be the hack the box write-ups and you know, demonstrated I could be a penetration tester.
00:09:54.159 --> 00:09:55.360
That's just one way to do it, right?
00:09:55.440 --> 00:09:59.759
You can also have experience traditionally, which is, you know, usually the traditional way of doing it.
00:09:59.840 --> 00:10:08.080
But I think the big thing is having that wedge that proves that, hey, I can actually demonstratably do this, and I'm kind of different from the other applicants.
00:10:08.399 --> 00:10:20.879
We've had that conversation on here in another one's other podcasts and other venues where we're uh in other forums where we talked about people trying to break into cybersecurity and asking how they get noticed, how they get jobs.
00:10:20.960 --> 00:10:25.039
And one of the things we always say is you know, write up your experience that you have.
00:10:25.519 --> 00:10:26.879
I mean, you didn't necessarily do that.
00:10:26.960 --> 00:10:39.440
I mean, I'm sure you put some of that stuff on your resume, but like you were actively going out and really showing what you've done versus just being on hack the box and showing that I've done hack the box challenges.
00:10:39.600 --> 00:10:41.440
You were going, I think, the extra mile.
00:10:41.600 --> 00:10:49.440
And I think that's a a great example for anybody trying to break in to see that as like this is this is not just doing that.
00:10:49.600 --> 00:10:51.360
This is not just putting this on my resume.
00:10:51.600 --> 00:10:59.120
This is actively going out and trying to explain why I did this, how I did this, what I did, what I learned from it.
00:10:59.200 --> 00:11:01.360
And that's a lesson a lot of people need to learn.
00:11:01.600 --> 00:11:02.080
100%.
00:11:02.559 --> 00:11:08.159
You got to be in it for the will of the game a lot, too, especially if you're gonna come up through a unique way like I did.
00:11:08.399 --> 00:11:14.720
I wasn't writing the write-ups, you know, purely as a resume at him, like, oh, I put 50 write-ups on my resume.
00:11:14.960 --> 00:11:18.080
It was more of I'm gonna do this because then I learn from doing it.
00:11:18.159 --> 00:11:18.399
Yeah.
00:11:18.559 --> 00:11:24.960
I learn how to do the reporting skills, I learn how to communicate the technical concepts in simple terms that someone can follow along with.
00:11:25.120 --> 00:11:31.600
And a lot of this is soft skills that aren't just like, I know how PowerShell works, or you know, something like that.
00:11:31.840 --> 00:11:34.879
It's being able to communicate those technical concepts effectively.
00:11:35.279 --> 00:11:42.720
Doing it for the reason of learning is, in my opinion, much better long term than for the reason of just here's another resume, and I'm yourself into pad my resume.
00:11:43.200 --> 00:11:52.320
Something else that's paid off for you too is the passion for it, because you see so many cases nowadays, people have heard that you know, cybersecurity pays a lot of money.
00:11:52.399 --> 00:12:00.240
So a lot of people get into it for purely money motivation, but it seems like you know, someone like yourself is really driven by the passion.
00:12:00.399 --> 00:12:05.519
You don't get 30 some eyed certs just because you're wanting the money.
00:12:05.600 --> 00:12:08.720
It's because you know you're passionate and motivated about what you're doing.
00:12:09.039 --> 00:12:10.000
Exactly, 100%.
00:12:10.399 --> 00:12:13.759
And I mean, you can see my little wrong side work pence I've got over here.
00:12:13.919 --> 00:12:18.080
I got this recently and and I didn't don't didn't know anything about electronics, right?
00:12:18.240 --> 00:12:22.799
But I go to DEF CON every year and I'm like, there's so much of the space around electrical engineering electronics.
00:12:22.879 --> 00:12:24.879
I want to learn this so I can kind of know what's going on.
00:12:25.120 --> 00:12:29.360
I think part of that is I just don't like to not know things that other people are knowing things that know things.
00:12:29.440 --> 00:12:31.039
So it's kind of like a stubbornness.
00:12:31.200 --> 00:12:33.120
But so I I mean I'm starting from zero.
00:12:33.200 --> 00:12:34.559
I've just got a little breadboard, right?
00:12:34.639 --> 00:12:37.759
And I bought a little wiring kit off Amazon for 30 bucks with components.
00:12:38.080 --> 00:12:44.000
And I've just been having the AI write me a little curriculum and and guide me along, and I'll take pictures of the breadboard and be like, Am I doing this right?
00:12:44.159 --> 00:12:44.879
What am I doing wrong?
00:12:45.039 --> 00:12:47.919
And use the AI as like a tutor to kind of teach me how to go through it.
00:12:48.080 --> 00:12:50.320
So and then that opens up so many paths, right?
00:12:50.399 --> 00:12:57.759
Because now if I want to go do actual hardware hacking or like a physical penetration test on a system or something like that, I actually have the experience of doing that.
00:12:57.919 --> 00:12:59.919
And the biggest thing is documenting it, right?
00:13:00.000 --> 00:13:07.279
I haven't quite gotten to that point, but having some kind of an artifact that points to, hey, I've done this, here's proof that I've done this, which kind of comes back to that first point I was making earlier.
00:13:07.679 --> 00:13:18.639
Yeah, that we're starting to do that with our the nonprofit partner that we have, Cyberset Careers, where we're partnering with Houston City College on teaching a technical user group.
00:13:18.879 --> 00:13:25.759
And I've told them, like, cybersecurity is you know great to know, but look, let's start with the networking side of things.
00:13:25.919 --> 00:13:34.320
Let's start with IPv4, let's IPv6, let's start with routing concepts because some people get tired of me saying this.
00:13:34.399 --> 00:13:47.759
But I've seen master's degree students come out with learning how to just be an analyst, and they don't have the full scope and of experience, obviously, but they don't have the skill set that they need.
00:13:47.919 --> 00:13:51.039
So if you can't get that from college, you've got to go.
00:13:51.200 --> 00:13:58.240
And I'm not saying every university is that way, but I see a lot of them that are just teaching theory and not giving you real good experience.
00:13:58.480 --> 00:14:05.120
And honestly, the young man that's helping us run this is saying the same thing, and he's going to college.
00:14:05.200 --> 00:14:10.399
And Houston City College is actually one of the better ones for teaching you actually real experience.
00:14:10.639 --> 00:14:13.759
So, yeah, you you've got to do this on your own.
00:14:13.919 --> 00:14:17.120
I'll I'll frack me, I'll say it till I'm blue in the face.
00:14:17.279 --> 00:14:21.200
Like you, this field demands curiosity.
00:14:21.440 --> 00:14:31.039
In the past, you could probably be successful, and you definitely can in IT by working a nine to five job, staying in your cubicle, then going home and not doing anything after.
00:14:31.200 --> 00:14:38.879
I mean, you could have a career, but in cybersecurity, and now even to get in the field, you've got to take it that next step.
00:14:39.039 --> 00:14:40.320
You just have to.
00:14:40.480 --> 00:14:49.519
And if you're not willing to do that, I mean, I again, I've been called a gatekeeper a million times, but this is not the field for you if you're not.
00:14:49.679 --> 00:14:53.200
I mean, honestly, like if you can't put that time and effort into it.
00:14:53.440 --> 00:15:01.279
And if I if I may just piggyback off of that last little point you said, I think gatekeeping to some extent is good because you've got to remember what we're dealing with here.
00:15:01.360 --> 00:15:02.399
We're security.
00:15:02.559 --> 00:15:06.799
Like no, you would want a gatekeeping for your physical security guard.
00:15:06.879 --> 00:15:09.039
You know, you want gatekeeping for your army members.
00:15:09.200 --> 00:15:14.159
A lot of these guys in the field are ex-military guys, you know, like defending critical infrastructure.
00:15:14.399 --> 00:15:18.799
You do want to gatekeep to some extent because it's a very mission critical.
00:15:18.960 --> 00:15:19.759
Like, look at pilots.
00:15:19.840 --> 00:15:21.519
Like you need gatekeeping in some professions.
00:15:21.600 --> 00:15:26.960
And I think this is one of them where some level of gatekeeping is correct just because of the criticality of the work.
00:15:27.200 --> 00:15:27.519
Yep.
00:15:27.679 --> 00:15:27.919
Yeah.
00:15:28.159 --> 00:15:34.159
If you're gonna go work in a nuclear facility, you probably need to be really good at what you're doing.
00:15:34.399 --> 00:15:35.200
So yeah.
00:15:35.440 --> 00:15:36.879
So yeah, it's a negative term.
00:15:37.039 --> 00:15:44.960
I get the negative use of the term, but it is in this case, you need to have some kind of filtering there of people who aren't gonna want to do it.
00:15:45.120 --> 00:15:59.679
So yeah, I think they definitely need to know what it is up front because you take some of these certifications, you know, because I'm not gonna name names on one of the organizations that came out several years ago of all these millions of jobs that were unfilled.
00:15:59.759 --> 00:16:03.600
In some cases, these are people just trying to sell certifications.
00:16:03.679 --> 00:16:05.039
So you have to battle that.
00:16:05.120 --> 00:16:16.399
So you do need some realism blended in there so people can kind of learn the pros and cons and understand before they get into something that they're gonna end up totally hating.
00:16:16.960 --> 00:16:19.120
Oh man, we could preach on that for a while.
00:16:19.200 --> 00:16:20.399
Yeah, let's not name names.
00:16:20.559 --> 00:16:22.240
Yeah, names will come after us.
00:16:22.399 --> 00:16:28.559
But that particular organization I think you talk about is fairly litigious, if that's the same one I'm thinking about.
00:16:28.639 --> 00:16:36.080
So yeah, probably the same one because even even Ira Winkler did like a write-up or post on them at some point around that time.
00:16:36.240 --> 00:16:36.480
Yeah.
00:16:36.799 --> 00:16:37.120
Yep.
00:16:37.279 --> 00:16:37.600
Nope.
00:16:37.679 --> 00:16:39.759
I've got stories around that myself.
00:16:40.000 --> 00:16:40.320
Yeah.
00:16:40.559 --> 00:16:50.320
Well, speaking of passion and doing hack the box and that kind of thing, let's use that as a segue, Jacob, to talk about your talk.
00:16:50.480 --> 00:16:58.000
So you talked about, I want to say it's a little bit of a clickbaity title on purpose because I don't think that was correct.
00:16:58.320 --> 00:17:01.120
Ultimately, your conclusion that CTFs are dead.
00:17:01.200 --> 00:17:06.400
But you said that you know, the death of the CTF, especially in this AI world.
00:17:06.640 --> 00:17:08.079
Definitely want to dig into it.
00:17:08.160 --> 00:17:11.279
Give us your rundown of why you made that talk.
00:17:11.599 --> 00:17:11.920
Yeah.
00:17:12.079 --> 00:17:24.640
So a kind of thousand-foot view of all of this is as we were saying, I went through and I grind out a lot of these hack the box challenges in machines to the point where I was pushing like top 20 globally.
00:17:24.880 --> 00:17:28.640
And it was around this time that AI was becoming really prevalent.
00:17:28.720 --> 00:17:36.640
Like before you could ask it questions and you could look up information, but then it kind of entered the agentic phase where you just give it the problem and it just spits out the flag.
00:17:36.880 --> 00:17:42.000
So you would see first blood times on all these machines in five minutes, 10 minutes, you know.
00:17:42.079 --> 00:17:46.799
And it's like if you're doing this manually, that's enough time to run a scan and you know look at it.
00:17:46.960 --> 00:17:49.119
You're not solving the whole machine that quickly.
00:17:49.440 --> 00:18:07.440
So it became very apparent that this was becoming more about, at least at like the level pushing for top bloods at like the global, you know, like winning competition levels about agency engineering and who can build the best AI harnesses and stuff like that, which is a different skill set than traditional CTS, right?
00:18:07.519 --> 00:18:12.240
It's not cybersecurity knowledge, it's not hands-on keyboard operator knowledge and stuff like that.
00:18:12.799 --> 00:18:16.640
And so that led me down the path of okay, well, can I quantize this?
00:18:16.799 --> 00:18:23.759
Can I actually put like numbers to this theory and prove this theory that I have that the solve times are getting shorter and shorter because of AI?
00:18:24.000 --> 00:18:26.160
So then that led me down to okay, how can I do this?
00:18:26.240 --> 00:18:37.039
And I thought, okay, well, I can take the first blood times because that was kind of what originally led me to notice like everything's getting solved so quickly because these first blood times every week are five minutes, five minutes, three minutes, two minutes going down.
00:18:37.279 --> 00:18:43.440
So unfortunately, hack the box has a policy where I can't scrape their site to TOS.
00:18:43.599 --> 00:18:54.240
Luckily, Zo XDF, to my knowledge, and if you do, I'm sorry, don't hate me, don't sue me, doesn't have such copyright protections, without anti-crawls protections on his write-ups.
00:18:54.319 --> 00:19:06.000
So I was able to pull the first blood times from his historical write-ups and ingest that into research and then do statistical research over time because his site also stores like the metadata of when the machine was released, stuff like that.
00:19:06.079 --> 00:19:08.079
Like is it a Windows machine, a Linux machine?
00:19:08.240 --> 00:19:19.119
So I was able to do statistical analysis on all that and find that over the eight years of machines that were in the data set, it was decreasing by like 16.5% year over year to solve times.
00:19:19.279 --> 00:19:19.519
Wow.
00:19:19.759 --> 00:19:21.599
And that's statistically, yeah.
00:19:21.920 --> 00:19:27.359
And so it was like a six-fold decrease in a decade or something like that, to the point where it becomes trivial to solve.
00:19:27.440 --> 00:19:31.519
It's essentially going from doing like long division by hand to using a calculator.
00:19:31.839 --> 00:19:35.279
So, and that accelerates when AI was released.
00:19:35.359 --> 00:19:44.799
I picked a date of I think it was 2022 just to kind of symbolize ChatGPT release, you know, AI release, because when you're doing research like that, you kind of just got to make these benchmarking points.
00:19:44.880 --> 00:19:45.920
So that was one of them I used.
00:19:46.000 --> 00:20:00.799
Another one was agentic AI usage, and that's where it like really picks up because once an agentic AI comes into the field, it can do research on its own and it can pull web results, look up so many machines at the CTFs are like finding this one write-up on this one technique that was posted one time.
00:20:01.039 --> 00:20:05.359
And the AI is really good at that when it's crawling 10,000 sites a minute, you know.
00:20:05.680 --> 00:20:13.440
So I did that, and then from that analysis, like I said, I found it was decreasing by so much, I kind of drew some conclusions from it.
00:20:13.599 --> 00:20:24.240
And the conclusions I drew were one, it's gonna be nearly impossible to keep competitive hacking alive in an online environment because you can't really regulate AI usage.
00:20:24.720 --> 00:20:30.880
I mean, you'd have to instrument so heavily, it's just not really feasible something like hack the box to effectively stop it.
00:20:31.039 --> 00:20:34.160
They can put it in TOS, but people are still-I mean, look at video games.
00:20:34.240 --> 00:20:38.640
People cheat at video games all the time, and you know, they get banned for that.
00:20:38.799 --> 00:20:53.839
And and two, the only way you're gonna really preserve that competitive element of traditional hacking, hacking as a competition, hands-on keyboard stuff, is in a live setting where you can monitor keyboard use and actually see their screens and be like, okay, they're not using AI.
00:20:54.160 --> 00:20:58.079
So that was kind of two of those conclusions from the competitive standpoint.
00:20:58.720 --> 00:21:06.079
From the general industry kind of standpoint, I also looked at like the trends of AI usage over time.
00:21:06.160 --> 00:21:12.240
And it kind of went from, you know, machines were helping in 2024 to in 2025 the the machines were winning.
00:21:12.319 --> 00:21:13.279
I think they have these days more.
00:21:13.519 --> 00:21:18.640
So 2023, 2024, and then 2025, the machines are starting to win CPS straight up.
00:21:18.799 --> 00:21:23.279
Like there's a drag OS competition where it was winning until they paused it purposefully.
00:21:23.359 --> 00:21:25.279
So it probably would have won that competition out, right?
00:21:25.519 --> 00:21:27.279
And that's like OS technologies, right?
00:21:27.359 --> 00:21:29.759
That's not like simple stuff.
00:21:30.000 --> 00:21:33.359
And it's just it has so many innate advantages.
00:21:33.519 --> 00:21:37.839
Like I said, like that being able to web crawl 10,000 pages at once, it doesn't get tired.
00:21:38.079 --> 00:21:42.720
It can read huge, I mean you can instantly read a config file and go, there's the vulnerability.
00:21:42.880 --> 00:21:48.640
Here's a set of source code, here's that unsafe exec stand, you know, and it can just do that instantly.
00:21:48.880 --> 00:21:58.079
So it kind of makes it where the human element is more about how you can design the system to solve these so quickly that it becomes not competitive, like I was saying.
00:21:58.799 --> 00:21:59.119
So
00:22:00.480 --> 00:22:02.799
Do you know Hutch, Justin Hutchins?
00:22:03.200 --> 00:22:04.000
Sounds familiar.
00:22:04.160 --> 00:22:05.119
There's a lot of names.
00:22:05.519 --> 00:22:07.599
He wrote, he's got a book on the AI art.
00:22:07.839 --> 00:22:09.279
Is it the Art of Deception?
00:22:09.599 --> 00:22:10.720
I think I've got it up here.
00:22:10.960 --> 00:22:11.519
Something like that.
00:22:11.759 --> 00:22:12.000
Yeah.
00:22:12.160 --> 00:22:12.319
Yeah.
00:22:12.799 --> 00:22:16.079
So he does all of our CTFs for all of our events.
00:22:16.319 --> 00:22:16.559
Okay.
00:22:16.720 --> 00:22:21.200
And he's like he spent a ton of time writing the CTF for Cyber Hack on.
00:22:21.279 --> 00:22:24.880
And I know you couldn't make the original show, but he spent a ton of time writing.
00:22:25.119 --> 00:22:29.200
And then he checks out the agenda and he saw your talk.
00:22:29.759 --> 00:22:33.359
And so he immediately stayed up till like, I don't know, what did he say, Phil?
00:22:33.519 --> 00:22:35.200
Like one or two in the morning or something.
00:22:35.359 --> 00:22:36.240
Yeah, something like that.
00:22:36.400 --> 00:22:46.319
Yeah, the day before rewriting the CTF and putting a bunch of false flags that he knew that AI would look for.
00:22:46.880 --> 00:22:48.400
And language of deception.
00:22:48.480 --> 00:22:49.440
Thank you, August.
00:22:49.599 --> 00:22:55.440
And it got me to thinking, like, because I saw this in another podcast somewhere.
00:22:55.599 --> 00:23:02.880
He was talking about in not just in competitive hacking, but in like real-world red teaming penetration tests, that kind of stuff.
00:23:03.279 --> 00:23:31.200
Because AI is picking up the pace of those in a very similar, you know, of solving and finding vulnerabilities in this very similar fashion as into the CTFs where you're finding the flags, that deception tech is starting to come back into favor because AI falls for deception, at least now, right now, more than humans do, because humans can pick up on some of those nuances, at least experienced penetration testers.
00:23:31.440 --> 00:23:46.240
So it makes me wonder is there at least an extension of CTFs where they can be built to kind of take advantage of the weaknesses of how AI attacks these CTFs.
00:23:46.640 --> 00:23:50.079
Because he even created like a uh almost like a wall of shame.
00:23:50.160 --> 00:23:55.440
It actually became a everybody was trying to get on the wall of shame to see how fast AI could solve it.
00:23:55.519 --> 00:23:56.960
But does that make sense what I'm asking?
00:23:57.039 --> 00:23:57.359
Like that.
00:23:58.960 --> 00:24:00.240
I I I think it does.
00:24:00.319 --> 00:24:04.880
And if I if I unpack it a little bit, I think it's kind of a two-fold answer I want to give.
00:24:05.039 --> 00:24:06.799
Like you can certainly build around it, right?
00:24:06.880 --> 00:24:08.720
We're all using the same Chat GPT.
00:24:08.799 --> 00:24:11.920
You can plug in your CTF into ChatGPT and you can see what it does.
00:24:12.079 --> 00:24:13.839
And you can do that five minutes.
00:24:13.920 --> 00:24:15.359
You know, you want to do it really completely.
00:24:15.440 --> 00:24:18.640
You can do it three minutes across different models and see how all the different models look.
00:24:19.279 --> 00:24:22.240
And then you you can implement defenses and stuff around it.
00:24:22.480 --> 00:24:29.200
As far as can you like operationalize that and make a creative CTF around that as part of solving it?
00:24:29.359 --> 00:24:30.240
I'm sure you can.
00:24:30.400 --> 00:24:32.480
I don't make CTFs, I'm not smart enough for that.
00:24:32.559 --> 00:24:34.799
I just solve them a lot of the times with AI.
00:24:34.960 --> 00:24:40.880
So but in the enterprise, I I definitely think honey pots are underutilized.
00:24:41.039 --> 00:24:44.880
I like to kind of think in in my little sci-fi world coming from the matrix and stuff.
00:24:44.960 --> 00:24:51.680
Like in any of these sci-fi movies, anytime they go into the into the mainframe, right, as they call it, there's always like defense people there, right?
00:24:51.759 --> 00:24:54.960
Like there's these defender programs, AI is coming after them.
00:24:55.119 --> 00:24:56.559
And we don't really see any of that.
00:24:56.640 --> 00:25:02.720
We have like human responders, but there's not any kind of like active defense components of networks.
00:25:02.799 --> 00:25:05.920
And I think that's kind of where AI is going to bring us into that next technology.
00:25:06.240 --> 00:25:08.799
And I think honey pots are going to kind of be the first step of that.
00:25:09.039 --> 00:25:15.519
Like if your EDR sees someone's coming into these S and B shares, maybe it quickly spools up a honeypot share, right?
00:25:15.599 --> 00:25:20.160
And then it and then it can you know put prompt injection in that share, like you were saying, or something.
00:25:20.240 --> 00:25:20.480
I don't know.
00:25:20.559 --> 00:25:21.680
Like the sky's the limit there.
00:25:21.759 --> 00:25:30.240
But I definitely think it's going to go towards more active detection, away from kind of the passive detection that way if that we're currently running in in broadcast.
00:25:30.640 --> 00:25:31.039
Interesting.
00:25:31.920 --> 00:25:32.799
Bill is a pen tester.
00:25:33.039 --> 00:25:34.799
What do you how do you see that?
00:25:34.960 --> 00:25:41.200
Like if something you see an active defense, it's almost like a not an active, it's an active detection, but almost like an active defense.
00:25:41.599 --> 00:25:43.359
Yeah, it's kind of interesting in the scenarios.
00:25:43.440 --> 00:25:49.519
If you're having a pen test done, then you may want to deactivate those until the test is done.
00:25:49.680 --> 00:25:52.799
But what's interesting is kind of back to Dave Kennedy.
00:25:52.880 --> 00:26:10.400
He was doing a keynote at Hack SpaceCon one year, and he said anytime that they've seen anytime there's been deception used in an environment when they're doing a red team engagement, that a lot of cases they were caught because of the deception.
00:26:10.559 --> 00:26:17.359
And this is someone that's even experienced around that, a very highly skilled team, and how it even affects them.
00:26:18.160 --> 00:26:18.480
Yeah.
00:26:18.799 --> 00:26:31.519
I mean, you're moving so fast on a lot of these engagements, especially with AI, that all you would have to do is make it something that as the operator in the environment, you know it's not real, but it looks real, right?
00:26:31.839 --> 00:26:38.079
So maybe you just add one to a PDF document name or something, and then it gets picked up by crawlers or scanners, right?
00:26:38.559 --> 00:26:44.000
That's more of like a just a detection deception method, right, than a full-on like stop the attack method.
00:26:44.160 --> 00:26:48.799
But I definitely think honey pots and and more deception text a good word.
00:26:48.880 --> 00:26:52.319
I think that's a good word to kind of describe where I think it's going to where it's going to go.
00:26:52.640 --> 00:26:53.039
Yeah.
00:26:53.359 --> 00:27:14.319
I remember being enamored the first time I saw deception technology where it wasn't a full-blown digital twin, but then it was before AI, but you had the ability to even create almost like another extension of your environment with similar names, similar naming structure.
00:27:14.480 --> 00:27:22.240
Like you can go in and do an analysis of what your infrastructure look like and create something very, very similar to that.
00:27:22.480 --> 00:27:25.599
I mean, deception tech can get really, really tricky.
00:27:25.759 --> 00:27:28.319
Like it's really hard to determine that it's something else.
00:27:28.480 --> 00:27:32.880
I mean, even to the point now with AI, that can get spun up even quicker.
00:27:33.039 --> 00:27:48.400
Like if it sees something, even with you combine that with cloud infrastructure and the ability to quickly spin something up in a dynamic fashion where it's like, oh, and then it's like somebody's in there going, it's like all of a sudden this other box pops up in their scans.
00:27:48.480 --> 00:27:50.720
It's like, oh man, that looks like a really juicy target.
00:27:50.799 --> 00:27:51.359
Let me go over here.
00:27:51.440 --> 00:27:57.279
I mean, there's a lot of stuff you could do there, if as long as you know which real and what's not yourself.
00:27:57.599 --> 00:28:03.839
And what's interesting on that point is that's kind of one of the structural advantages of a defender against an attacker, right?
00:28:03.920 --> 00:28:07.599
Is you know what your environment is and the attacker doesn't coming into it.
00:28:07.680 --> 00:28:07.839
Yeah.
00:28:08.000 --> 00:28:17.759
But what I've found too is in loads of organizations, they don't actually know what they have and a full complete inventory of like S-bombs and everything.
00:28:17.920 --> 00:28:22.640
So I think that's a a a big gap too, is is to defend it, you need to know what it is.
00:28:22.720 --> 00:28:31.200
And we've just had so much IT sprawl over the past decades and decades that a lot of the times there's these old things that just were added one time that no one knows about, you know.
00:28:33.279 --> 00:28:36.640
Yeah, some people don't have any clue what the hell's going on in their own environment.
00:28:36.799 --> 00:28:37.039
Yeah.
00:28:37.279 --> 00:28:42.640
Well, Phil, I think we're getting to the end of this thing, but I love this conversation.
00:28:42.960 --> 00:28:44.720
Yeah, it's it's been a great conversation.
00:28:44.799 --> 00:28:52.799
I've always been interested in seeing what what Jacob's doing with the automation, even taking things further, you know, doing pen testing and stuff.
00:28:52.880 --> 00:28:59.200
He actually did a video where he showed how to build a harness for for doing pen testing using AI.
00:28:59.359 --> 00:29:01.039
So pretty cool, pretty cool topic.
00:29:01.200 --> 00:29:03.759
Interesting to see how things are going these days.
00:29:04.000 --> 00:29:06.960
Well, Jacob, appreciate you being on, man.
00:29:07.119 --> 00:29:07.759
This is good stuff.
00:29:08.000 --> 00:29:08.640
Thank you for having me.
00:29:08.880 --> 00:29:09.359
Yeah, thanks.
00:29:09.599 --> 00:29:09.839
Very much.
00:29:10.240 --> 00:29:14.079
Hopefully, some of some of it was insightful and interesting to viewers.
00:29:14.400 --> 00:29:15.119
It was good.
00:29:15.359 --> 00:29:18.480
Well, thanks everyone for joining, and we'll see you on the next episode.
00:29:18.640 --> 00:29:21.759
Make sure to share, like, and subscribe.
00:29:21.920 --> 00:29:32.240
And then also, if you're watching this on YouTube, you know, put some comments in there so that way the algorithm picks up and it's able to share this information with others that could get some use from it.
00:29:32.400 --> 00:29:33.039
So thanks.
00:29:33.359 --> 00:29:36.240
This has been a Cyber Tech Media production.
00:29:36.480 --> 00:29:41.039
Cyber Hackcast is hosted by Michael Farnum and Philip Wiley.
00:29:41.279 --> 00:29:44.960
It's directed by Bill Brenner, produced by Lauren Anders.
00:29:45.200 --> 00:29:47.200
Our music is by Kike Gut.
00:29:47.599 --> 00:29:56.640
The views and opinions expressed in this show are those of the speakers and do not necessarily reflect the views or positions of any entities they represent.
00:29:57.119 --> 00:30:03.680
This show is for informational purposes only and is not render or offer to render personalized device.
00:30:04.400 --> 00:30:16.000
Subscribe now to miss an episode.com cybersecond.
