On Episode 85 of The Edge of Innovation, we’re talking with hacker and security expert, Adriel Desautels of Netragard, about whether there is any hope for computer security.
Tag: #penetrationtesting
Cybersecurity: For Better or For Worse?
On Episode 61 of The Edge of Innovation, we’re talking with security expert Adriel Desautels, founder and CEO of Netragard, about whether cybersecurity is getting better or worse.
The Farce of Cybersecurity
On Episode 60 of The Edge of Innovation, we’re talking with security expert Adriel Desautels, founder and CEO of Netragard, about the farce of cybersecurity!
Show Notes
Find Adriel Desautels on Twitter
Find Adriel Desautels on LinkedIn
Follow Adriel Desautels’ Blog on Netragard
“Is Your Data Safe From Hackers?”
“This Year, Why Not Take Your Data Seriously”- Netragard’s Guide to Finding a Vendor
“Cars: The Next Hacking Frontier?”
“How to Find a Genuine Penetration Testing Firm”
“What Is Penetration Testing? Here’s the Right Definition”
“Is Your Data Safe From Hackers?”
“How To Hack A Company With A Trojan Mouse”
Bitdefender’s Website Where You Can Buy Bitdefender, recommended by Adriel Desautels
The Hands Off! Mac Update Download recommended by Adriel Desautels can be found here
VMware Fusion, also recommended by Adriel Desautels, can be found here
“Honeypots: The Sweet Spot in Network Security” – An article about Honeypots
The Frank Abagnale movie, “Catch Me If You Can”
Link to SaviorLabs’ Free Assessment
Sections
Internet Security is a Farce
Security Technologies That Work
Traditional Hackers: How They Think
Why Internet Security Matters to Small Businesses Too
I Feel Safe! And Why You Shouldn’t
Listen & Learn: Making the Right Decisions About Security
Tech Surface Mapping
Security Testing: Be Proactive
Why Patching is Critical
Authenticate Files
The Farce of Internet Security
Internet Security is a Farce
Paul: Hello, everyone. I’m Paul Parisi here with the Edge of Innovation, and our guest today is Adriel Desautels from Netragard.
Adriel: The security industry as a whole and the businesses that are being “protected” I mean, it’s really just a farce. People have this understanding of businesses having good security or they entrust them to have good security. “Oh, this business won’t be hacked. I trust them with my credit card.”
On what grounds? You know, why do you trust them? I mean, is there any reason to trust them? There isn’t. It’s just because they said they could do it. They’re a big business. They have a lot of money. They have a lot of financial power. They have a lot of exposure, so we trust them. The reality is that none of these businesses are really secure. I mean, we have yet to encounter a business like an Equifax or like a Home Depot or any of these retail shops that we couldn’t breach with relative ease. You know, the businesses that tend to be more challenging to breach, we still get in. But the businesses that tend to be more challenging to breach are the ones that have to do with storage. Storage of information because they’re really required to care about it, or communication, to a degree. You know, they’re required to care about it. But businesses that serve the consumer they’re generally really vulnerable.
The vulnerability is partially their fault. I mean, Equifax’s case, gross negligence, the word just keeps coming into my head. But it’s also the fault of the security industry. And here’s why.
The majority of vendors that do provide penetration testing services and security services, they sell snake oil. Right?
A case in point. Antivirus solutions. If antivirus solutions really worked, if they really prevented malware and ransomware and all this and that, there would be no malware or ransomware. They only work partially, but they market themselves as saying, “Hey, you know, we solved this problem.”
Intrusion prevention systems. They don’t prevent intrusions. They just prevent what is detectable. And by the way, what is detectable are most of the commercial, off-the-shelf tools that are used by penetration testing firms. So, they buy technology to protect their networks, and then they go and they hire a vendor, a commercial vendor, who doesn’t have real hackers on staff. They effectively have glorified script kids on staff. They use third-party tools. This other vendor comes in and tests the security of their network, but the defensive technology that they bought is designed specifically to defeat the commercial technology that’s being used to test them. So they pass with flying colors.
Hacker Joe comes along. Hacker Joe is not going to use any of these commercial, off-the-shelf tools. I don’t know about you, but I’ve never seen a hacker use a commercial scanner to breach a network. Hacker Joe is going walk right in the front door and then just like all the businesses, thousands of the businesses that have been breached, they’re going to say, “Well, I don’t get it. How were we breached? We tested all the time.”
Well the reason why you were breached is because you didn’t get a real test. The reason why you were breached is because you didn’t do what was actually required to make you secure. So kind of rewinding and going back into people, people assume that these businesses are doing the right thing, and they’re not.
Part of the reason why they’re not doing the right thing is because some of them just simply don’t care. They’re focused on budget. They’re focused on just the political aspect of security. The other part is, they really do care, but what they’re being told and taught by the security industry is just a bunch of marketing fud. Right? You have to do it this way. You have to do it that way. But these things are not actually effective.
Security Technologies That Work
Adriel: I mean, in our experience, there are only — what? I think there are three technologies out there that have ever slowed us down or even given us a run for our money. One of them is produced by a company called Cylance. So Cylance is a business that we’ve followed for a while. We have no affiliation with them, but their technology works, and it’s a brand new way of doing things. It works very well.
The second one is Carbon Black, Bit9. And I know that Carbon Black and Cylance look at themselves as competitors, but I look at them and I say, wow, these guys really complement each other. Those two technologies alone make the job of breaching a system with malware or exploits very, very, very difficult, almost impossible.
So then that leaves you with the social avenue, social engineering. Well the third thing that you can do is you can deploy internal honey pots but low interaction, not high interaction. That’s a waste of time. Low interaction honey pots. Things that are just there to detect a breach, detect lateral movement.
You deploy those three solutions or two of those three solutions, you’re going to make the job of a hacker, like my team, the guys on my team, very difficult. But most people don’t have that. What most people have is they might have Carbon Black. They might have a Cylance technology, or they might have a honey pot. When you have one of those solutions open or just one of those solutions deployed, we’re going to leverage those other gaps. So, yeah, a lot of depth for a simple question.
Traditional Hackers: How They Think
Paul: Well, no, absolutely. So let me ask you this. So for a traditional hacker, if they hit these things, unless they’re being paid to go after a certain company, are they just going to give up and move to the next target?
Adriel: Yeah. So traditional hackers these days, it’s not like in the ’80s and the ’90s anymore. Hacking the scene has become much more criminalistic and much more about making a buck. And so you’ve got to think about making money as efficiently as you can with as little risk as possible.
So as a hacker, if you go and you breach a network, and you notice that they have these kinds of things deployed, you’re going to think, “Well, why would I go after this retail company when I could just go after this retail company, because they don’t have it?” You know? And then you still get your pay out. You maybe charge a little bit more per credit card, or maybe you sell the network to somebody else that wants to use the resources of the network to do something. But you, you can still find a way to make your money off of that kind of a breach, and you don’t have to spend quite as much time doing it.
A great example of a soft network would be the Equifax network. Or even Target, the way that Target handled their breach was, was just as silly. And actually, speaking of technologies, that have proven to really miss things that are sold as end-all-be-all solutions, FireEye. FireEye was used by both Target and by Equifax. And FireEye, in their favor, they did notify Target about a lot of the activity that was going on. Didn’t prevent it but they notified them, and Target didn’t really do much of anything about it. But they completely seem to fail at detecting a known vulnerability or at the stress vulnerability, which affected Equifax.
So, how can you be this incredible solution that does everything and, and fail like that? You can’t.
Why Internet Security Matters to Small Businesses Too
Paul: So let me peel this back a little bit. So we’ve been talking about businesses and we’re talking about some fairly big businesses that are doing lots of volume in dollars. I mean, Target is a huge company. Equifax is a huge company. How do you apply this methodology or this thought process to small- to medium-sized businesses, somebody with 50 employees or 100? And does it matter? Because I’m sure I’ve heard from them that, “Oh, it doesn’t matter. I’m a small guy. They’re not going to go after me.”
Adriel: Yeah, it doesn’t matter at all. We hear that all the time and then months later they come back to us because they’ve been breached. In fact, there is a hotel chain that I can’t name. They came to us. They said, “Hey, you know we need to have the test.”
And we said, “Great. Here’s the price for the test.”
And they said, “Sorry, that’s way too much money.”
And we know it was not a lot of money. And then they went and they found another vendor to deliver a test, and they said, “Hey, we found this other vendor that will do this test for us for $5,000.” It was a $5,000 test.
And we said, “That is many, many times less than what you should be paying given the volume of work that has to be done to test you properly. But, okay.”
About four months after their test had completed, they suffered a breach, and they made the news. And we reached back out to them, and they refused to respond to us because it was you an “I told you so,” but they were of the mindset where they didn’t think that they would be breached because it had never happened before. They had no indication that it was going to happen, so they felt safe.
I remember them saying, “We’re using antivirus technology. We’re using intrusion preventions systems.” They felt safe. They shouldn’t have felt safe.
I Feel Safe! And Why You Shouldn’t
Paul: Who is it in the organization that is spouting this “I feel safe”? Is it the CEO? Is it the CFO? Is it the lower levels, VPs of technology? Who is saying that? Who believes that?
Adriel: It really depends. In some businesses, it’s the C-level executives. In other businesses, it’s the security staff that are feeding false information to the C-level executives because they’re concerned about their jobs. They have this fear of losing their jobs. So in many cases, there is this ego. There is this ego. You get a kind of game going on where it’s “Well, I’ve got to look good, and I can’t afford to admit this because if I admit this then, that’s a big problem.”
In other cases, it is executives that, frankly, just view security as a nuisance. They don’t understand what security is. They look at it, and they say, “Well, you know, I don’t want to spend all this money because we could put this money someplace else and a breach will not happen to us. It’s never happened before. There is no indicator that anything like this is going to happen. I’m not overly stressed out it,” you know.
Paul: Okay. Well that’s a gamble. That is definitely a gamble. So now when someone articulates that, what is your counter to that? Because, okay, it’s never happened before. I mean, it sounds good on the surface. It’s like, “Well, I’m a small company. I’ve got 50 employees. It’s never happened before. It’s not going to happen.” I can say that it’s not going to happen. It’s not going to happen. It’s not going to happen, but how do we bring them back into a more realistic view of things?
Adriel: You can’t. And that’s the hardest thing. I mean, we have tried. We have spent hundreds of thousands of dollars in marketing campaigns and all sorts of things trying to educate people. Not market, but trying to really provide people with good information about this, and it just doesn’t sink in. We have had detailed conversations with businesses that have later suffered breaches, saying, “This is what you need to do. Here is why you need to do it. Here are the measurements. Here are the metrics that show the workload. This is your exposure.” We break it all down for them in the sales process. We show them exactly what it is that’s going to happen during engagement, what things cost, and they just, they still… It doesn’t matter how much you teach them, they don’t care until it happens. And it’s truly unfortunate.
Listen & Learn: Making the Right Decisions About Security
Of the few customer we have that really do care, they either cared from the get-go because they understood the risk associated with it or they came in saying, “You know what? I don’t know what I don’t know and I want to know. I want to learn.” And when they come in with that kind of a mentality, and they say, “I want to learn,” we can provide them with the truth. And we can provide them with facts and evidence and information. And if they’re willing with listen to that and learn from that, then they can begin to make right decisions with their own security.
Paul: We were talking about different companies. So let’s talk about the 50-user company. They don’t have the deep pockets that somebody else might have, a Target or somebody like that. So what do you do? What do you there? They’re a typical business. They’re a manufacturer. They manufacture semiconductors, let’s say. And they have 50 employees. And they’re United-States-based. They have one office, one building where they build the things, ship them from, etc. And what are you going to say to them?
Adriel: So for them, we would give them the fact sheet. Say, “Hey, let us come in, and let us diagnose the work load. Let us see how much work actually has to be done.” So we get in. We literally diagnose their entire infrastructure, which is a long process. But we do this because we want to make sure that it’s an accurate quote that we provide them with. And then we say, “Hey, based on…”
Paul: By diagnose, what do you mean by diagnose? I mean, you don’t take a stethoscope and put it up to each computer. Do you inventory the computers or what? Tell me about that.
Adriel: So that’s kind of our secret sauce.
Paul: Okay. No, that’s fair.
Adriel: Yep. And the reason why… I’ll tell you right now. The reason why we don’t talk about it, it’s not because we’re afraid of talking about it. It’s because what we’ve found historically is that the competitors that do the vetted scans will say anything.
Paul: Of course. Oh, yeah. I’ve seen that.
Adriel: If we come in and if we explain this, they’re just going to say, “Hey, we do this,” and it’s going to… The track for actually doing it and then, you know…
Paul: Of course.
Adriel: But, but the analogy that I can give or the example or what I can tell you is, when we’re done with the diagnostics, after we’ve actually come in and we’ve done this work, we generally know more about our customers network than they do. We know about literally everything that really exists in that environment that we’re looking at. And we’re able to do really good sampling and really good reduction of your sampling of work to come up with pricing that is not necessarily competitive with what everybody else is doing, but with pricing that is very real based on what actually has to be done.
Interestingly enough, in our experience, our prices often come in less than some of the larger companies and, obviously, more than the scanner shops. But they come in less. An example. We were doing work with a part of the government of Trinidad. And they had received quotes from other vendors, and their quotes were all based off of this understanding that they have 64 external IP addresses. And the quotes were coming in anywhere from $100,000 to $60,000. The best competing quote that they had as far as price was concerned was actually a $60,000 quote from a firm here that sells in Massachusetts that sells scanning software, and they also do penetration testing. And we came in, and we looked at them, and we said, “Well, yeah. You’re about 11 grand.” And we gave them a proposal for 11 grand, and they immediately they came back. They said, “No, you made a huge mistake.”
We said, “How did we make a mistake?”
They said, “Well all these other vendors are coming in at this price, and you’re coming in here? And our budget is this, but you’re coming in at a fraction of our budget.”
And I said, “Well, you know, there’s no mistake. It’s because you have, of those 64 IPs, 11 are actually running. Right? And these 11 map out in this specific way, so here’s the work load.”
And they took a step back, and they said, “Okay. This makes sense. So why is everybody else charging us so much?”
And my answer was, “Well they’re charging you because you told them you have 64 IPs.’
And they said, “Well, yeah. But they asked us all kinds of questions about our environment.”
And I said, “They did that to look good. They don’t actually use that information. They just say 64 IPs times a dollar value, a dollar per IP and a number per IP, and there’s your price.”
They kind of stepped back again. They said, “So, you know, we’re basically being tested to have a whole bunch of non-existent things tested? Or being charged to have a whole bunch of non-existent things tested?”
And I said, “Yeah.” That equates to like zero seconds worth of work, and you’re paying the money for it, you know.
And so, so, you know.
Tech Surface Mapping
Paul: Fascinating. Okay. So we’re talking about a small business. You’d come in and you would do your discovery, I guess. You had a word for it. What do you call it?
Adriel: Tech surface mapping.
Paul: Okay. And so you would then give the small business a quote, and they would choose to do it, and then you would come in and find all the exploits, hopefully. So you do that. And you deliver your report, and then their network goes on and things change. Do you have to do that again?
Adriel: It depends on the customer. So almost all — I’d say 95% of our customers are multi-year customers. And so what ends up happening is you engage us. You engage us on year one. We come in. We deliver the test. We deliver a free re-test after you’ve fixed everything. We maintain you throughout the year, with basic checkups, effectively.
Paul: Well that’s nice.
Adriel: Then when you come in on year two, we do the same thing. We measure your progress. So you do repeat the process because networks change. Networks evolve. But through the multi-year, you actually end up, very quickly, as we have seen, reducing your overall risk and exposure profile because you’re continuously being exposed to something very real. So yes, it’s something that they come back, and they do repeatedly.
Security Testing: Be Proactive
Paul: Would you say you’re doing security assessment, security testing? Would that be fair, what Netragard does?
Adriel: Yeah, I wouldn’t say assessment.
Paul: Okay. Security testing.
Adriel: Yeah.
Paul: But it sounds like you’ve thought about it. And it doesn’t sound like you have one test and you’re done. It sounds like you have to have proactive, continuing testing.
Adriel: Absolutely. And it’s because of the rate at which new vulnerabilities surface. So when you look at Windows for example, six months ago, you could have fully-patched Windows system as of six months ago. That fully-patched Windows system, from six months ago is not going to be up to par today. And it’s because vulnerabilities, really what are they? They’re programmatic errors, programmatic mistakes. So when developers make software, they make a mistake, or they rush through something because they need to meet a specific deadline.
When they make this mistake, the mistake is something that we can exploit or something that we can leverage to facilitate penetration. As systems grow older, those mistakes become uncovered more and more. Researchers spend time looking at systems, finding these mistakes. All computer systems will always have mistakes. All software is fallible. And so if you patched something six months ago, and then you give hackers another six months to look at finding new system flaws, new vulnerabilities, new mistakes, they’re going to find them. They’re going to uncover new ones. And if you don’t patch currently, you don’t maintain your current patches, you’re not going to be eliminating those current mistakes.
So security is something that is continually evolving. It’s something that you need to continually test. Like penetration testing, you need to do. But you also need to stay up to snuff with regards to the defenses and the latest kinds of attacks that are coming in, and not just the attacks that you hear about in the news, but the attacks that are really focused on you. Because the attacks that you hear about on the news or you read about in articles and things like that, those are generic. Those are attacks that have affected a large number of people. But every single network is different, and I could tell you first-hand, every single network that we breach is breached differently. So you have to also understand how it is that you’re going to be breached. And you do that, again, by continually doing realistic threat penetration testing but also paying attention to what’s going on in your environment.
So yeah, it’s a continual process.
Why Patching is Critical
Paul: Okay. So it sounds like basically we sort of wandered a little bit into how you protect yourself here. You said patching is, is critical. Is that true? So I’m thinking about the ordinary person, home user or a small business user. What do they need to pay attention to?
Adriel: Well, patching is probably the number one thing. If you look at, I think it was the Verizon data breach incident report from 2015, maybe 2014, when it actually used to be a really good report, they pushed out some nice numbers on that. And it was 99.98% of all breaches back then were attributed to the exploitation of known vulnerabilities that had been in public domain for over a year. 0.01% were attributable to zero day exploitation. 0.01%.
So when you look at those numbers, it tells you a lot. I mean that’s very telling. It says, hey, people just aren’t patching. And we know people aren’t patching. A bit of another tangent but ridiculous story, our infrastructure —water, power, all that — they are afraid to patch because they think that if they patch, it’s going to render a system unstable.
I remember having a debate with this guy. I won’t give his last name. His first name was Jake, and he runs a major water treatment facility, is responsible for the security of this facility. I said, “Jake,” I said, “You’re running systems —Windows 95, Window NT still. You need to make sure that you do something and mitigate this. Get newer systems, update, patch, whatever.”
And he said, “No, no.” He said, “I can’t afford to patch.”
I said, “Why not?”
He said, “Because patching might make something unstable, and if it makes something unstable, nobody has water, or people get poisoned. I can’t patch.”
And I said, “Well, yeah, but anybody can just walk in the front door with these vulnerabilities, and they can do the damage that way anyways.”
And he said, “Yeah, but to me that’s less of a risk than patching because I’ve never had that happen before.”
Paul: Wow.
Adriel: So it’s scary. But, but patching is something that has to happen.
Paul: How do you counter, the person who says, “But doesn’t it automatically patch?”
Adriel: You can’t because you’re dealing with emotions.
Paul: Well no. Is that true? Doesn’t the system automatically patch itself?
Adriel: Some of them do, but they disable that. A lot of people disable that.
Paul: Okay. So, in a Windows world… I know in Windows 10 they’ve need it a lot harder to disable that. But I know in Windows 7 you’d go to somebody’s machine — I’ve done that helping somebody out and looking at it and say, “Oh, you’ve got 342 patches that haven’t been installed.” So that is true. That rings true. Microsoft’s trying to do that. I know that I’ve seen many times when I boot up my Mac, it says, “Oh, you’ve got five updates you have to install.”
And I sit there, and I say, “Well, I don’t use iMovie. Should I install the patch or not?”
Adriel: Yeah, absolutely. If it’s installed on your computer, you should absolutely install the patch. iMovie is a great example of a helper application. Maybe I send you a file somehow. You never use iMovie, but this file requires iMoive to open it. And you say, “Oh, I trust this source,” because I built up a good trust relationship with you. When you click on the file, the file may be a specially crafted file that will exploit an old vulnerability in iMovie, and then I’ve hacked your system.
So we call any application that exists on your computer, it can be used to open something that is sent to you. We call those helper applications. And those applications are major targets. A great example is Adobe Acrobat. You look at the zero day market, and you look at Adobe Acrobat, you can sell an ideal Acrobat vulnerability for 2—, $300,000. There, it’s worth quite a bit of money, and it’s quite a valuable target. So, yes, patch everything if you can.
Paul: Okay. So patch everything.
Authenticate Files
Paul: What else should I do? Is there something else I should be doing? Now you said we built up a trust relationship. You send me a movie. Should I open it? Or you send me an Acrobat file. Should I open it?
Adriel: No. You should authenticate and it seems kind of weird to hear people say this, or to hear me say this. Everybody says, “What do you mean?” But if somebody sends you a file, and you don’t have some kind of a cryptographic signature or some way of authenticating that that person is who they say they are, don’t open the file. If you have a friend that sends you something, send them a text message, a side channel through your phone. Send them a text message and say, “Hey, did you just send this to me?”
And if they say, “Yes,” then go ahead. It’s safer because you verified that it came from a trusted source. But if I know that that’s your friend, and I’m Hacker Joe, I might pretend to be your friend and send the file just to breach your system.
Likewise, there’s malware out there that will mimic friends. Way back in the day the ILOVEYOU worm. That was a great one. It didn’t use any exploitation other than exploiting humans. But it was a basic piece of malware that sent a love letter from you to the people in your contact list, using Microsoft Notebook. And I forget the scale of the infection but it was millions, and it was because people would receive those emails from a trusted source. They wouldn’t verify that this content was real. They would open the attachment and boom. They would be infected with ILOVEYOU, and then they’d send it to the next 40-some-odd people on their list, and it just kept on going.
Paul: Interesting. Alright.
There’s a lot of stuff, we could do this a couple more times I’m sure. We’ve been talking with Adriel Desautels of Netragard. He’s a security expert. And we’ve been exploring security and penetration testing and security testing and all of the different things that coalesce to mean security, what is security and what isn’t security. There will be a tremendous amount of links that will be in our shownotes, that I think will be worth looking at. Many of the articles that Adriel mentioned and many of the sites and of course a link to Netragard as well, and ways to contact Adriel.
So Adriel thank you very much for your time. We really appreciate it! It’s really been fascinating and I think a lot of people will learn a lot today and I really look forward to doing it again.
Adriel: My pleasure, any time.
Paul: Thank you Adriel.
Also published on Medium.
The Art of Hacking: Cybersecurity With Adriel Desautels
On episode 59 of The Edge of Innovation, we’re talking with Adriel Desautels, founder and CEO of Netragard, about hacking and cybersecurity!