On Episode 83 of The Edge of Innovation, we’re talking with hacker and security expert, Adriel Desautels of Netragard about what’s new in the cybersecurity world!
Tag: hacking
Cybersecurity: For Better or For Worse?
On Episode 61 of The Edge of Innovation, we’re talking with security expert Adriel Desautels, founder and CEO of Netragard, about whether cybersecurity is getting better or worse.
The Farce of Cybersecurity
On Episode 60 of The Edge of Innovation, we’re talking with security expert Adriel Desautels, founder and CEO of Netragard, about the farce of cybersecurity!
Show Notes
Find Adriel Desautels on Twitter
Find Adriel Desautels on LinkedIn
Follow Adriel Desautels’ Blog on Netragard
“Is Your Data Safe From Hackers?”
“This Year, Why Not Take Your Data Seriously”- Netragard’s Guide to Finding a Vendor
“Cars: The Next Hacking Frontier?”
“How to Find a Genuine Penetration Testing Firm”
“What Is Penetration Testing? Here’s the Right Definition”
“Is Your Data Safe From Hackers?”
“How To Hack A Company With A Trojan Mouse”
Bitdefender’s Website Where You Can Buy Bitdefender, recommended by Adriel Desautels
The Hands Off! Mac Update Download recommended by Adriel Desautels can be found here
VMware Fusion, also recommended by Adriel Desautels, can be found here
“Honeypots: The Sweet Spot in Network Security” – An article about Honeypots
The Frank Abagnale movie, “Catch Me If You Can”
Link to SaviorLabs’ Free Assessment
Sections
Internet Security is a Farce
Security Technologies That Work
Traditional Hackers: How They Think
Why Internet Security Matters to Small Businesses Too
I Feel Safe! And Why You Shouldn’t
Listen & Learn: Making the Right Decisions About Security
Tech Surface Mapping
Security Testing: Be Proactive
Why Patching is Critical
Authenticate Files
The Farce of Internet Security
Internet Security is a Farce
Paul: Hello, everyone. I’m Paul Parisi here with the Edge of Innovation, and our guest today is Adriel Desautels from Netragard.
Adriel: The security industry as a whole and the businesses that are being “protected” I mean, it’s really just a farce. People have this understanding of businesses having good security or they entrust them to have good security. “Oh, this business won’t be hacked. I trust them with my credit card.”
On what grounds? You know, why do you trust them? I mean, is there any reason to trust them? There isn’t. It’s just because they said they could do it. They’re a big business. They have a lot of money. They have a lot of financial power. They have a lot of exposure, so we trust them. The reality is that none of these businesses are really secure. I mean, we have yet to encounter a business like an Equifax or like a Home Depot or any of these retail shops that we couldn’t breach with relative ease. You know, the businesses that tend to be more challenging to breach, we still get in. But the businesses that tend to be more challenging to breach are the ones that have to do with storage. Storage of information because they’re really required to care about it, or communication, to a degree. You know, they’re required to care about it. But businesses that serve the consumer they’re generally really vulnerable.
The vulnerability is partially their fault. I mean, Equifax’s case, gross negligence, the word just keeps coming into my head. But it’s also the fault of the security industry. And here’s why.
The majority of vendors that do provide penetration testing services and security services, they sell snake oil. Right?
A case in point. Antivirus solutions. If antivirus solutions really worked, if they really prevented malware and ransomware and all this and that, there would be no malware or ransomware. They only work partially, but they market themselves as saying, “Hey, you know, we solved this problem.”
Intrusion prevention systems. They don’t prevent intrusions. They just prevent what is detectable. And by the way, what is detectable are most of the commercial, off-the-shelf tools that are used by penetration testing firms. So, they buy technology to protect their networks, and then they go and they hire a vendor, a commercial vendor, who doesn’t have real hackers on staff. They effectively have glorified script kids on staff. They use third-party tools. This other vendor comes in and tests the security of their network, but the defensive technology that they bought is designed specifically to defeat the commercial technology that’s being used to test them. So they pass with flying colors.
Hacker Joe comes along. Hacker Joe is not going to use any of these commercial, off-the-shelf tools. I don’t know about you, but I’ve never seen a hacker use a commercial scanner to breach a network. Hacker Joe is going walk right in the front door and then just like all the businesses, thousands of the businesses that have been breached, they’re going to say, “Well, I don’t get it. How were we breached? We tested all the time.”
Well the reason why you were breached is because you didn’t get a real test. The reason why you were breached is because you didn’t do what was actually required to make you secure. So kind of rewinding and going back into people, people assume that these businesses are doing the right thing, and they’re not.
Part of the reason why they’re not doing the right thing is because some of them just simply don’t care. They’re focused on budget. They’re focused on just the political aspect of security. The other part is, they really do care, but what they’re being told and taught by the security industry is just a bunch of marketing fud. Right? You have to do it this way. You have to do it that way. But these things are not actually effective.
Security Technologies That Work
Adriel: I mean, in our experience, there are only — what? I think there are three technologies out there that have ever slowed us down or even given us a run for our money. One of them is produced by a company called Cylance. So Cylance is a business that we’ve followed for a while. We have no affiliation with them, but their technology works, and it’s a brand new way of doing things. It works very well.
The second one is Carbon Black, Bit9. And I know that Carbon Black and Cylance look at themselves as competitors, but I look at them and I say, wow, these guys really complement each other. Those two technologies alone make the job of breaching a system with malware or exploits very, very, very difficult, almost impossible.
So then that leaves you with the social avenue, social engineering. Well the third thing that you can do is you can deploy internal honey pots but low interaction, not high interaction. That’s a waste of time. Low interaction honey pots. Things that are just there to detect a breach, detect lateral movement.
You deploy those three solutions or two of those three solutions, you’re going to make the job of a hacker, like my team, the guys on my team, very difficult. But most people don’t have that. What most people have is they might have Carbon Black. They might have a Cylance technology, or they might have a honey pot. When you have one of those solutions open or just one of those solutions deployed, we’re going to leverage those other gaps. So, yeah, a lot of depth for a simple question.
Traditional Hackers: How They Think
Paul: Well, no, absolutely. So let me ask you this. So for a traditional hacker, if they hit these things, unless they’re being paid to go after a certain company, are they just going to give up and move to the next target?
Adriel: Yeah. So traditional hackers these days, it’s not like in the ’80s and the ’90s anymore. Hacking the scene has become much more criminalistic and much more about making a buck. And so you’ve got to think about making money as efficiently as you can with as little risk as possible.
So as a hacker, if you go and you breach a network, and you notice that they have these kinds of things deployed, you’re going to think, “Well, why would I go after this retail company when I could just go after this retail company, because they don’t have it?” You know? And then you still get your pay out. You maybe charge a little bit more per credit card, or maybe you sell the network to somebody else that wants to use the resources of the network to do something. But you, you can still find a way to make your money off of that kind of a breach, and you don’t have to spend quite as much time doing it.
A great example of a soft network would be the Equifax network. Or even Target, the way that Target handled their breach was, was just as silly. And actually, speaking of technologies, that have proven to really miss things that are sold as end-all-be-all solutions, FireEye. FireEye was used by both Target and by Equifax. And FireEye, in their favor, they did notify Target about a lot of the activity that was going on. Didn’t prevent it but they notified them, and Target didn’t really do much of anything about it. But they completely seem to fail at detecting a known vulnerability or at the stress vulnerability, which affected Equifax.
So, how can you be this incredible solution that does everything and, and fail like that? You can’t.
Why Internet Security Matters to Small Businesses Too
Paul: So let me peel this back a little bit. So we’ve been talking about businesses and we’re talking about some fairly big businesses that are doing lots of volume in dollars. I mean, Target is a huge company. Equifax is a huge company. How do you apply this methodology or this thought process to small- to medium-sized businesses, somebody with 50 employees or 100? And does it matter? Because I’m sure I’ve heard from them that, “Oh, it doesn’t matter. I’m a small guy. They’re not going to go after me.”
Adriel: Yeah, it doesn’t matter at all. We hear that all the time and then months later they come back to us because they’ve been breached. In fact, there is a hotel chain that I can’t name. They came to us. They said, “Hey, you know we need to have the test.”
And we said, “Great. Here’s the price for the test.”
And they said, “Sorry, that’s way too much money.”
And we know it was not a lot of money. And then they went and they found another vendor to deliver a test, and they said, “Hey, we found this other vendor that will do this test for us for $5,000.” It was a $5,000 test.
And we said, “That is many, many times less than what you should be paying given the volume of work that has to be done to test you properly. But, okay.”
About four months after their test had completed, they suffered a breach, and they made the news. And we reached back out to them, and they refused to respond to us because it was you an “I told you so,” but they were of the mindset where they didn’t think that they would be breached because it had never happened before. They had no indication that it was going to happen, so they felt safe.
I remember them saying, “We’re using antivirus technology. We’re using intrusion preventions systems.” They felt safe. They shouldn’t have felt safe.
I Feel Safe! And Why You Shouldn’t
Paul: Who is it in the organization that is spouting this “I feel safe”? Is it the CEO? Is it the CFO? Is it the lower levels, VPs of technology? Who is saying that? Who believes that?
Adriel: It really depends. In some businesses, it’s the C-level executives. In other businesses, it’s the security staff that are feeding false information to the C-level executives because they’re concerned about their jobs. They have this fear of losing their jobs. So in many cases, there is this ego. There is this ego. You get a kind of game going on where it’s “Well, I’ve got to look good, and I can’t afford to admit this because if I admit this then, that’s a big problem.”
In other cases, it is executives that, frankly, just view security as a nuisance. They don’t understand what security is. They look at it, and they say, “Well, you know, I don’t want to spend all this money because we could put this money someplace else and a breach will not happen to us. It’s never happened before. There is no indicator that anything like this is going to happen. I’m not overly stressed out it,” you know.
Paul: Okay. Well that’s a gamble. That is definitely a gamble. So now when someone articulates that, what is your counter to that? Because, okay, it’s never happened before. I mean, it sounds good on the surface. It’s like, “Well, I’m a small company. I’ve got 50 employees. It’s never happened before. It’s not going to happen.” I can say that it’s not going to happen. It’s not going to happen. It’s not going to happen, but how do we bring them back into a more realistic view of things?
Adriel: You can’t. And that’s the hardest thing. I mean, we have tried. We have spent hundreds of thousands of dollars in marketing campaigns and all sorts of things trying to educate people. Not market, but trying to really provide people with good information about this, and it just doesn’t sink in. We have had detailed conversations with businesses that have later suffered breaches, saying, “This is what you need to do. Here is why you need to do it. Here are the measurements. Here are the metrics that show the workload. This is your exposure.” We break it all down for them in the sales process. We show them exactly what it is that’s going to happen during engagement, what things cost, and they just, they still… It doesn’t matter how much you teach them, they don’t care until it happens. And it’s truly unfortunate.
Listen & Learn: Making the Right Decisions About Security
Of the few customer we have that really do care, they either cared from the get-go because they understood the risk associated with it or they came in saying, “You know what? I don’t know what I don’t know and I want to know. I want to learn.” And when they come in with that kind of a mentality, and they say, “I want to learn,” we can provide them with the truth. And we can provide them with facts and evidence and information. And if they’re willing with listen to that and learn from that, then they can begin to make right decisions with their own security.
Paul: We were talking about different companies. So let’s talk about the 50-user company. They don’t have the deep pockets that somebody else might have, a Target or somebody like that. So what do you do? What do you there? They’re a typical business. They’re a manufacturer. They manufacture semiconductors, let’s say. And they have 50 employees. And they’re United-States-based. They have one office, one building where they build the things, ship them from, etc. And what are you going to say to them?
Adriel: So for them, we would give them the fact sheet. Say, “Hey, let us come in, and let us diagnose the work load. Let us see how much work actually has to be done.” So we get in. We literally diagnose their entire infrastructure, which is a long process. But we do this because we want to make sure that it’s an accurate quote that we provide them with. And then we say, “Hey, based on…”
Paul: By diagnose, what do you mean by diagnose? I mean, you don’t take a stethoscope and put it up to each computer. Do you inventory the computers or what? Tell me about that.
Adriel: So that’s kind of our secret sauce.
Paul: Okay. No, that’s fair.
Adriel: Yep. And the reason why… I’ll tell you right now. The reason why we don’t talk about it, it’s not because we’re afraid of talking about it. It’s because what we’ve found historically is that the competitors that do the vetted scans will say anything.
Paul: Of course. Oh, yeah. I’ve seen that.
Adriel: If we come in and if we explain this, they’re just going to say, “Hey, we do this,” and it’s going to… The track for actually doing it and then, you know…
Paul: Of course.
Adriel: But, but the analogy that I can give or the example or what I can tell you is, when we’re done with the diagnostics, after we’ve actually come in and we’ve done this work, we generally know more about our customers network than they do. We know about literally everything that really exists in that environment that we’re looking at. And we’re able to do really good sampling and really good reduction of your sampling of work to come up with pricing that is not necessarily competitive with what everybody else is doing, but with pricing that is very real based on what actually has to be done.
Interestingly enough, in our experience, our prices often come in less than some of the larger companies and, obviously, more than the scanner shops. But they come in less. An example. We were doing work with a part of the government of Trinidad. And they had received quotes from other vendors, and their quotes were all based off of this understanding that they have 64 external IP addresses. And the quotes were coming in anywhere from $100,000 to $60,000. The best competing quote that they had as far as price was concerned was actually a $60,000 quote from a firm here that sells in Massachusetts that sells scanning software, and they also do penetration testing. And we came in, and we looked at them, and we said, “Well, yeah. You’re about 11 grand.” And we gave them a proposal for 11 grand, and they immediately they came back. They said, “No, you made a huge mistake.”
We said, “How did we make a mistake?”
They said, “Well all these other vendors are coming in at this price, and you’re coming in here? And our budget is this, but you’re coming in at a fraction of our budget.”
And I said, “Well, you know, there’s no mistake. It’s because you have, of those 64 IPs, 11 are actually running. Right? And these 11 map out in this specific way, so here’s the work load.”
And they took a step back, and they said, “Okay. This makes sense. So why is everybody else charging us so much?”
And my answer was, “Well they’re charging you because you told them you have 64 IPs.’
And they said, “Well, yeah. But they asked us all kinds of questions about our environment.”
And I said, “They did that to look good. They don’t actually use that information. They just say 64 IPs times a dollar value, a dollar per IP and a number per IP, and there’s your price.”
They kind of stepped back again. They said, “So, you know, we’re basically being tested to have a whole bunch of non-existent things tested? Or being charged to have a whole bunch of non-existent things tested?”
And I said, “Yeah.” That equates to like zero seconds worth of work, and you’re paying the money for it, you know.
And so, so, you know.
Tech Surface Mapping
Paul: Fascinating. Okay. So we’re talking about a small business. You’d come in and you would do your discovery, I guess. You had a word for it. What do you call it?
Adriel: Tech surface mapping.
Paul: Okay. And so you would then give the small business a quote, and they would choose to do it, and then you would come in and find all the exploits, hopefully. So you do that. And you deliver your report, and then their network goes on and things change. Do you have to do that again?
Adriel: It depends on the customer. So almost all — I’d say 95% of our customers are multi-year customers. And so what ends up happening is you engage us. You engage us on year one. We come in. We deliver the test. We deliver a free re-test after you’ve fixed everything. We maintain you throughout the year, with basic checkups, effectively.
Paul: Well that’s nice.
Adriel: Then when you come in on year two, we do the same thing. We measure your progress. So you do repeat the process because networks change. Networks evolve. But through the multi-year, you actually end up, very quickly, as we have seen, reducing your overall risk and exposure profile because you’re continuously being exposed to something very real. So yes, it’s something that they come back, and they do repeatedly.
Security Testing: Be Proactive
Paul: Would you say you’re doing security assessment, security testing? Would that be fair, what Netragard does?
Adriel: Yeah, I wouldn’t say assessment.
Paul: Okay. Security testing.
Adriel: Yeah.
Paul: But it sounds like you’ve thought about it. And it doesn’t sound like you have one test and you’re done. It sounds like you have to have proactive, continuing testing.
Adriel: Absolutely. And it’s because of the rate at which new vulnerabilities surface. So when you look at Windows for example, six months ago, you could have fully-patched Windows system as of six months ago. That fully-patched Windows system, from six months ago is not going to be up to par today. And it’s because vulnerabilities, really what are they? They’re programmatic errors, programmatic mistakes. So when developers make software, they make a mistake, or they rush through something because they need to meet a specific deadline.
When they make this mistake, the mistake is something that we can exploit or something that we can leverage to facilitate penetration. As systems grow older, those mistakes become uncovered more and more. Researchers spend time looking at systems, finding these mistakes. All computer systems will always have mistakes. All software is fallible. And so if you patched something six months ago, and then you give hackers another six months to look at finding new system flaws, new vulnerabilities, new mistakes, they’re going to find them. They’re going to uncover new ones. And if you don’t patch currently, you don’t maintain your current patches, you’re not going to be eliminating those current mistakes.
So security is something that is continually evolving. It’s something that you need to continually test. Like penetration testing, you need to do. But you also need to stay up to snuff with regards to the defenses and the latest kinds of attacks that are coming in, and not just the attacks that you hear about in the news, but the attacks that are really focused on you. Because the attacks that you hear about on the news or you read about in articles and things like that, those are generic. Those are attacks that have affected a large number of people. But every single network is different, and I could tell you first-hand, every single network that we breach is breached differently. So you have to also understand how it is that you’re going to be breached. And you do that, again, by continually doing realistic threat penetration testing but also paying attention to what’s going on in your environment.
So yeah, it’s a continual process.
Why Patching is Critical
Paul: Okay. So it sounds like basically we sort of wandered a little bit into how you protect yourself here. You said patching is, is critical. Is that true? So I’m thinking about the ordinary person, home user or a small business user. What do they need to pay attention to?
Adriel: Well, patching is probably the number one thing. If you look at, I think it was the Verizon data breach incident report from 2015, maybe 2014, when it actually used to be a really good report, they pushed out some nice numbers on that. And it was 99.98% of all breaches back then were attributed to the exploitation of known vulnerabilities that had been in public domain for over a year. 0.01% were attributable to zero day exploitation. 0.01%.
So when you look at those numbers, it tells you a lot. I mean that’s very telling. It says, hey, people just aren’t patching. And we know people aren’t patching. A bit of another tangent but ridiculous story, our infrastructure —water, power, all that — they are afraid to patch because they think that if they patch, it’s going to render a system unstable.
I remember having a debate with this guy. I won’t give his last name. His first name was Jake, and he runs a major water treatment facility, is responsible for the security of this facility. I said, “Jake,” I said, “You’re running systems —Windows 95, Window NT still. You need to make sure that you do something and mitigate this. Get newer systems, update, patch, whatever.”
And he said, “No, no.” He said, “I can’t afford to patch.”
I said, “Why not?”
He said, “Because patching might make something unstable, and if it makes something unstable, nobody has water, or people get poisoned. I can’t patch.”
And I said, “Well, yeah, but anybody can just walk in the front door with these vulnerabilities, and they can do the damage that way anyways.”
And he said, “Yeah, but to me that’s less of a risk than patching because I’ve never had that happen before.”
Paul: Wow.
Adriel: So it’s scary. But, but patching is something that has to happen.
Paul: How do you counter, the person who says, “But doesn’t it automatically patch?”
Adriel: You can’t because you’re dealing with emotions.
Paul: Well no. Is that true? Doesn’t the system automatically patch itself?
Adriel: Some of them do, but they disable that. A lot of people disable that.
Paul: Okay. So, in a Windows world… I know in Windows 10 they’ve need it a lot harder to disable that. But I know in Windows 7 you’d go to somebody’s machine — I’ve done that helping somebody out and looking at it and say, “Oh, you’ve got 342 patches that haven’t been installed.” So that is true. That rings true. Microsoft’s trying to do that. I know that I’ve seen many times when I boot up my Mac, it says, “Oh, you’ve got five updates you have to install.”
And I sit there, and I say, “Well, I don’t use iMovie. Should I install the patch or not?”
Adriel: Yeah, absolutely. If it’s installed on your computer, you should absolutely install the patch. iMovie is a great example of a helper application. Maybe I send you a file somehow. You never use iMovie, but this file requires iMoive to open it. And you say, “Oh, I trust this source,” because I built up a good trust relationship with you. When you click on the file, the file may be a specially crafted file that will exploit an old vulnerability in iMovie, and then I’ve hacked your system.
So we call any application that exists on your computer, it can be used to open something that is sent to you. We call those helper applications. And those applications are major targets. A great example is Adobe Acrobat. You look at the zero day market, and you look at Adobe Acrobat, you can sell an ideal Acrobat vulnerability for 2—, $300,000. There, it’s worth quite a bit of money, and it’s quite a valuable target. So, yes, patch everything if you can.
Paul: Okay. So patch everything.
Authenticate Files
Paul: What else should I do? Is there something else I should be doing? Now you said we built up a trust relationship. You send me a movie. Should I open it? Or you send me an Acrobat file. Should I open it?
Adriel: No. You should authenticate and it seems kind of weird to hear people say this, or to hear me say this. Everybody says, “What do you mean?” But if somebody sends you a file, and you don’t have some kind of a cryptographic signature or some way of authenticating that that person is who they say they are, don’t open the file. If you have a friend that sends you something, send them a text message, a side channel through your phone. Send them a text message and say, “Hey, did you just send this to me?”
And if they say, “Yes,” then go ahead. It’s safer because you verified that it came from a trusted source. But if I know that that’s your friend, and I’m Hacker Joe, I might pretend to be your friend and send the file just to breach your system.
Likewise, there’s malware out there that will mimic friends. Way back in the day the ILOVEYOU worm. That was a great one. It didn’t use any exploitation other than exploiting humans. But it was a basic piece of malware that sent a love letter from you to the people in your contact list, using Microsoft Notebook. And I forget the scale of the infection but it was millions, and it was because people would receive those emails from a trusted source. They wouldn’t verify that this content was real. They would open the attachment and boom. They would be infected with ILOVEYOU, and then they’d send it to the next 40-some-odd people on their list, and it just kept on going.
Paul: Interesting. Alright.
There’s a lot of stuff, we could do this a couple more times I’m sure. We’ve been talking with Adriel Desautels of Netragard. He’s a security expert. And we’ve been exploring security and penetration testing and security testing and all of the different things that coalesce to mean security, what is security and what isn’t security. There will be a tremendous amount of links that will be in our shownotes, that I think will be worth looking at. Many of the articles that Adriel mentioned and many of the sites and of course a link to Netragard as well, and ways to contact Adriel.
So Adriel thank you very much for your time. We really appreciate it! It’s really been fascinating and I think a lot of people will learn a lot today and I really look forward to doing it again.
Adriel: My pleasure, any time.
Paul: Thank you Adriel.
The Art of Hacking: Cybersecurity With Adriel Desautels
On episode 59 of The Edge of Innovation, we’re talking with Adriel Desautels, founder and CEO of Netragard, about hacking and cybersecurity!
Staying Security Smart
Today on the Edge of Innovation, we discuss how to be put safeguards on your computer to be safe from hacking.
Introduction
Jacob: Thanks for listening to this episode of the Edge of Innovation. Today we are going to be talking about how to protect yourself from hacking. We want to just go through some of the basic, basic ideas of how to protect yourself from hacking because, it’s… If it isn’t on your radar, it should be. And if you haven’t been the victim of it, you could be. So, Paul, could you talk us through. We’re talking about these four steps for how to protect yourself from hacking.
And the first one you laid out for us is getting a good antivirus software.
Paul: Well, yeah. I mean, let’s step back a little bit. I mean, you are in a world, you know, where you drive around in your car and you observe bad actors, and you avoid people that are speeding, and you do all these different things. You wear a seatbelt. You clean your windows, you know. You do all these proactive things to protect yourself. You make sure your kids are strapped in, etc. And we have to do a lot of that in, in the digital world.
Some bottom line things. First of all, the easiest way, most effective way to prevent hacking or prevent yourself from being hacked is to not use the internet. Don’t connect your computer to the internet. That’s called air-gapped, to make sure that there’s no wires running into your computer. I know how absurd that sounds, but you make a value judgement that it is worth the value I get out of it and balance that with the risk that is the potential that is there. And you do that every single day.
So, you know, in the PC world, we’ve had to deal with antivirus or viruses for a long time. The Mac world is no longer a safe haven. You need to have, antivirus on your computer. So I’m going to ask you, Jacob. You’ve got a Mac. Do you have antivirus?
Jacob: I will confess. I do not have antivirus. I have lived under the delusion of Apple is better and not prone to getting hacked.
Paul: See? Now that’s an interesting… You said delusion. But it’s really an illusion because what it is, is that the market share of Apple computers is lower than that of PCs. So if you’re a malicious person, and whatever their motivation is for doing this, are you going to go after, the market that has 10 computers or the market that has 1,000 computers?
Well, if I’m going to… If I’m going to try and hack in and steal your, your music, let’s say. I’m going to go after the 1,000 people. That is why there is more viruses on, PCs than there are on Macs. Now, as Macs have become more mature and, market penetration and saturation is… You know, more people buy Macs. Well, that’s… There’s a bunch of people I can go after over there if I’m a malicious actor. So that old-time, limited commodity doesn’t exist.
I can tell you that, you know, if you go and get an Atari 800, there are very few viruses that are going to be written for the Atari 800. And the same thing for Linux. You know, there’s not a lot of viruses. There are, because a lot of hackers use it, and a lot of people use that. So, but, you know, you could go and get an, NeXT box. One of the old NeXT boxes from Steve Jobs’s company, NeXT. But you could use, you know, an effective way is to use an OS that isn’t very popular. And that gets into, you know, something we’ll talk about in just a second. Virtual machines.
So, antivirus and antimalware. They are two separate things.
One of the things that you get if you buy one of these suites, is a lot of stuff you don’t really need. They’ll get like browser protection and all these if things that can really slow your machine down. So you need to be diligent in choosing that.
We recommend, for Macs, Intego, which is a very good antivirus and network security product. Or, Kaspersky or ESET. And the, the reason we recommend those on the Mac side is because they don’t take a lot of performance out of the machine. Now, you might say, “Well, alright. So I’ve installed all those.” And you can get these things that occur which are, uh, popup storms, and then you go to a site and this popup, this popup, this popup. And the leap is, “Oh, I’ve got a virus.”
Well, no. Not necessarily. You could go to a website that just pops up a lot of different things. And it’s very hard to get control of that because they’re popping up the things so fast, and you think you’ve got a virus. It has nothing to do with that. It’s like if you turned on a television, and they were playing four programs in four corners and it’s like, “Okay. That’s the way it is.” And they kept opening new programs. Well, you’d switch the channel. Go to a different website, and then you don’t have that anymore.
And, uh, the other concept, if you really want to be secure, how can you do that? Well, you could use a separate computer. Or you could use a virtual computer. So virtual machines, Windows 10, Professional comes with Hyper-V, which is a virtualization technology. On the Mac, you can use, VMware, Workstation, or VMware Player or, Parallels… What’s Parallels called? Parallel is on the Mac. I forget what it’s called. But, uh, I think it might be just called Parallels.
On the Mac you can use, VMware Workstation or VMware player or Parallels to install another copy of an operating system. And then, basically, just use that as a throwaway operating. So if it gets hacked, you basically can delete it.
Uh, and isolation is generally very good between a computer and the VM. There is also open source stuff. You can get VirtualBox, which is probably what most people will use.
One of the things we’ve been toying around with here is creating a virtual box, machine that you can download, which is actually a Linux based machine that is hardened and has just a browser installed. So you could literally double click on that. It would open up into a browser, and you’re completely protected.
There are companies out there that offer that. One’s called Browser in a Box, which is also very good, and we’re thinking of doing the same, similar thing as Browser in a Box. So, but it’s, subtly removed. And it’s, it’s a little bit of a hassle. And that friction makes people not do that. But if you ask the questions “How do you protect yourself?” Antivirus, antimalware. If you really want to be protected, use a separate machine or a virtual machine. And then just be diligent.
You have to be aware of what you’re doing. Don’t install things. Don’t download things.
You know, we, in our IT practice, we can put in policies for companies that prevent users from installing things. Well, then they complain, “Hey, I can’t do what I want. I can’t get my job done.” So there’s that, that balance that you have to strike, and but those are critical things. You know, now, up until recently, the, there was malware that would — or antivirus — that would try and, you know, get your credit card number. You know, and honestly, if I’m a malware person, should I go after you to get your credit card and try and deal with all the anomalies on your machine? That’s a lot of work. It’s a lot easier for me to hack into Target and get a million credit card numbers.
So, how do you get around that? Well, you know, most of the credit card companies out there have one-time use credit cards, which you can go to their website and say, “I want a credit card number for today, right for now.” And it expires with one use.
Jacob: Interesting. I didn’t know that.
Paul: So yeah. It’s really cool. You can do that, and if you’re concerned and you have a website that you’re like, “I’m not too sure about this website.” Or, and really, what you’re making a judgement on is whether their IT people are diligent in protecting their data. So, Target is a pretty big company. They should be pretty diligent, but they got caught. They got into a problem. So, you know, but you can go in. They have browser plugins where you can generate a new credit card number, use that there. That’s also a way to avoid that being stolen and used somewhere.
So that’s, that’s another thing you can do is sort of these one-time use credit card numbers.
Paul: So, the four things are antivirus, antimalware, virtual machine, and diligence. On the PC, what I use is Microsoft Defender antivirus that’s built into Windows 10, and I do use Malwarebytes Anti-Malware, their professional version, not their free version. And I find that the combination of those and not doing stupid things have kept me from, getting hacked in that way.
Now, the other thing that’s out there now that wasn’t out there a few years ago is ransomware. And ransomware is… Usually, they trick you into downloading and running an installer or something. What they do is then they encrypt your data, and you can can’t decrypt it. So encryption is basically scrambling the data is a way that makes it so that you can’t read it. And unless you have a key to decrypt it, to unscramble, it’s useless. And so they will actually say, you know, for $300, we’ll give you the encryption, decryption key.
People have actually paid it, and they do do that. The question… I was talking about this with somebody yesterday, is why in the world would they give to the decryption key? I mean, you know, just give me the $300 and so, you know. So how do you avoid being a, affected by ransomware? And the answer to that is good backups.
So, the problem with backups is most of them aren’t good. You know, not intrinsically good. Nothing is good. But, what I mean by that is first of all, the test of a backup is can I restore it. So, let’s say you have an external hard drive, and you back up your data to it. Alright. So every night, you have five files on your computer, a list of birthdays, your book that you’re writing and three others. And every night at 11:00, it copies that data over to the hard drive. So you did that on Monday. On Tuesday, it copies it over again.
So if I had been infected with ransomware between Monday and Tuesday, I had a known good copy over on my hard drive. And now they’ve encrypted on my internal hard drive. I copy the encrypted over the normal version. I’ve now lost the normal version. So now you say, “Well, gee. I have to have multiple backups.” And in a data center, we would do a daily backup that are separate. So I would have a backup from Monday, a backup from Tuesday, a backup from Wednesday, and then a weekly backup, and then a monthly backup. And I’d keep four weeks, and I’d keep five days or seven days of backups.
So… And I have to be able to test those to make sure I can actually read them. So it’s important, if you have a backup scheme, to isolate that backup from your system. Because here’s the problem. If you get a Ransomware, it goes and encrypts your hard drive. Well, your backup is connected. It’s going to encrypt that.
Okay, so now I’ve got an encrypted backup, which I can’t use. So now I have to have something that is disconnected. I use Backblaze. Backblaze provides backup over the internet, you know, in the cloud, unlimited for $50 a year. It sounds like a sales pitch, but very easy to use. And what’s nice about it is they also provide versioning. So my book, I had chapter one in my book on Monday. I backed that. It backs up to Backblaze. It’s in the cloud. On Tuesday morning, I write chapter one and extend it to chapter two. One file. And then it backs up to the clouds. Now I have two versions.
If I dial in and say I want the one from Monday… Now Wednesday comes. I get ransomwared, and it backs up to the cloud. Now I have three versions. Well, great. I can go back to Tuesday and get the most recent version.
Jacob: And does that work for multiple machines or is it…
Paul: You buy a license per machine. So it will…one of the nice things is it does support external hard drives as well, which is a nice feature and it’s unlimited. So, it’s a very nice service, very affordable, and a very viable way to do it. You know, and a very simple web interface. Do you say, “I want to get these files back,” and then you can download them and do that.
If your whole machine fails and you’re going to need, you know, 50 gigabytes back, they have an option where they will send you a thumb drive or a hard drive on it. And, they even make it so that, I think, if you return the hard drive, you can get a credit back for it.
So those, those are the things you want to do. You want to be aware that your backup is good and, the Backblaze is one of the best ways to do it.
Jacob: Wow. That’s great. Well, thanks for talking us through four ways or four plus ways of how to do…how to protect yourself from being hacked. I think it’s super helpful. And it’s certainly something that we all need to be attentive to and, diligent, vigilant about and, I certainly repent of having no security systems on my computer.
Paul: Well let’s to the what next time we talk, we’ll see if you have one at that point.