Security Confidential S11 E4 Phillip Wylie

Manoj Tandon (00:01.109)
Hello everyone, this is your host, Manoj Tandon. Welcome to another episode of Dark Rhino Security, Security Confidential. Today we are honored to have Philip Wylie join us. Philip is a great guy, but in addition to being a great guy, he’s a ethical hacker. He’s on the offensive side of cybersecurity. He is an educator, a mentor, an author, a frequent public speaker.

His passions outside the technical side of cybersecurity are sharing resources, professional networking, and bringing people together. And that’s a little bit about what this program’s trying to do as well. He’s also a fellow podcaster. He is the host of the Hacker Factory podcast, which is hopefully gonna make it easier on my voice because he can do all the talking. And he’s got a new podcast as well, the Philip Wiley Show. Welcome to the program. Thank you for joining us, Philip.

Phillip Wylie (00:46.102)
Hehehehe.

Phillip Wylie (00:56.13)
Thank you. It’s an honor to be joining and always great to meet fellow podcasters, you know, cause there’s not as many of us as there is security folks, at least for in the security arena, but it’s kind of interesting. I noticed on my Twitter lately, I’m getting more follows from podcasters, which is kind of exciting, you know, because to be able to expand your, your network outside of just the security realm, it’s always good to connect with different people in different types.

Manoj Tandon (01:19.005)
Yeah, and you know, the more podcasters you connect with, you’ll get just a much larger audience. It’s like, because as soon as you share, you’re sharing with all of them. And that helps all of us out.

Manoj Tandon (01:36.257)
So, Philip, tell us, I got to know, I know AutoCAD, back in the day when I started as an engineer, I remember the guys in the CAD room, they were integral to engineering. And you started there and you’ve been a bouncer. And now you’re in cybersecurity and specifically you’re on the offensive side of CyberSec. So.

Like give us a little bit on your dossier here, your background.

Phillip Wylie (02:07.486)
Yeah. So if you want to hear my origin story, I’ll give you the, the, the long version because that’s where some of the bouncer stuff comes into play. So when I graduated high school back in 84, I didn’t know what I didn’t want to do for a career. And so I’ve been lifting weights ever since 1980 and got into competing and powerlifting in 1984. And some of my classmates told me, yeah, you should be a pro wrestler because in our area, the Dallas Fort Worth area,

Manoj Tandon (02:16.065)
Please.

Phillip Wylie (02:33.802)
The Von Erich family was very famous. Wrestling was very popular here. That was really around the time that the WWF was starting to take off now WWE. And so I thought, yeah, I’ll give it a shot. I didn’t have no other plans. And so I went to wrestling school and started wrestling. And so the bouncer part came into play because I couldn’t work full time. Wrestling. I really, you know, you have to kind of, uh, you know, gain the experience and. You know, get the

the viewers and the promoters to like you, to promote you where you can work full time because you hear some of the documentaries, uh, some of the really known pro wrestlers like, uh, Steve Austin, for instance, that guy, you hear one of his documentaries, he slept in his truck at times or slept in on the car on the side of the road, uh, would buy some food to last for a few days until he got paid from the next gig he did on the weekend. So it was a tough life that they, that they had. So, uh, to be able to make a living. I worked as a bouncer.

Manoj Tandon (03:16.649)
Oh man.

Phillip Wylie (03:31.634)
Uh, I wrestled maybe once a week. And then one of the interesting stories during that time that I share is during my wrestling days, I was working as a bouncer at a nightclub and I had the opportunity or the cup, the, the nightclub actually had an, a special event because they had bands that came in to the nightclub on Thursdays through Saturdays, but they really wasn’t worth the expense to, to bring in a band on Sunday, she didn’t know what the crowd was going to be like, so they had special events, so they brought in a wrestling bear, a 750 pound.

Manoj Tandon (03:56.001)
Okay.

Phillip Wylie (04:01.634)
bear and I wrestled the bear.

Manoj Tandon (04:04.222)
You… was it D. Claude?

Phillip Wylie (04:07.754)
Yes, it’s declawed. But it wasn’t muzzled, though it wasn’t muzzled. But it was declawed. 7 or 50 pound bear.

Manoj Tandon (04:09.062)
Okay, I was gonna say…

Manoj Tandon (04:16.801)
And how did you do or what was that experience like?

Phillip Wylie (04:21.226)
It’s interesting to hear because the guy that owned the bear, uh, told me that I did better against the bear than anyone else. And, and I don’t know if you remember Joe Kleko, these the play for the New York jets, I believe was alignment. And he said that Joe Kleko had wrestled the bear and I actually did better than he did. So, uh, that was kind of the best part to come out of it, but I didn’t beat the bear. Uh, you had to take the bear down, but the bear didn’t take me down, but I would definitely say he did a better job against me.

Manoj Tandon (04:32.957)
Yeah. Yeah.

Phillip Wylie (04:51.118)
Uh, it’s kind of interesting. I got pictures of me wrestling the bear and you can see where he’s got his, his paw around my leg, trying to sweep my leg. Cause the other guys that was wrestling the bear, they would, they were standing up upright, they weren’t getting into like a lineman stance or wrestling stance. So there he was able to easily take them down. So when it came up my turn, I got down into like a wrestling stance to get my legs out away from the bear, you know, to kind of put my center gravity and optimal.

uh, position to prevent him from taking me down. But it’s an interesting experience. Uh, I, I did the best against the bear. So I want a bar tab and I want a t-shirt and the T the T-shirt said I wrestled Samson, the bear and lost.

Manoj Tandon (05:31.993)
Oh my, I can’t imagine the physical power of a bear. It’s gotta be mind boggling. I mean, 750 pounds, that… Humans aren’t designed to take that kind of… Ha ha ha ha.

Phillip Wylie (05:45.694)
Yeah. It was effortless too, because these bears are so big and strong. It’s like he really doesn’t have to do much effort to move you around. And one of the ways I describe it is it’s like kind of like a parked car, you know, a parked car, a smaller car, you can kind of push it a little bit, but just barely. And that’s kind of like this bear is like he had the parking brake on. I couldn’t couldn’t move that bear.

Manoj Tandon (06:08.545)
I, you know, I can, I can’t imagine. The closest thing that came to you, I don’t know if you ever watched Mythbusters, but they had, and they did an episode of Shark Week where they were like, there was this myth that people could punch their way out of a shark attack. And they set this whole thing up with this mechanical contraption. People couldn’t do anything against that. I mean, 2,000 pound animal.

and you think you’re gonna punch it and it’s gonna be like, I’ll let you go. No, if it lets you go, you had an angel watching you. That’s all I could say, because I just can’t imagine, in the animal kingdom, humans, we’re not the strongest or fastest.

Phillip Wylie (06:42.647)
Hehehe

Phillip Wylie (06:57.771)
No.

Manoj Tandon (07:01.382)
So that’s, man, I got to tell you, my hat’s off to you. I don’t know that I would have gotten in the ring. I, for any amount of money, much less a t-shirt and some beer.

Phillip Wylie (07:02.3)
But for

Phillip Wylie (07:06.814)
Yeah. People ask me, why did you, yeah. Yeah. People always ask me, why did you do that? But I was like 20, 21 years old and guys, some guys, maybe not all guys, but a lot of us do really stupid things when we’re young and that was kind of one of mine.

Manoj Tandon (07:24.993)
Wow, that’s incredible though. That’s a story. That is a story. Wow. And then, so then how did this transition happen? How did you go from Mr. Bear to a world-class InfoSec guy speaking at Blackhat? That’s so…

Phillip Wylie (07:39.188)
Yeah. Ha ha ha.

Phillip Wylie (07:43.306)
Yeah. What happened there was I got married and I wasn’t making much wrestling. So I needed a job that had, you know, healthcare benefits and had a more conducive lifestyle because you know, with the wrestling thing, you just don’t know whether you’re going to make it or not, and then having to work as a bouncer and so I worked several different jobs I’ve worked in retail sales, which was probably one of the most, one of the jobs that I did before I got it into an actual profession that I enjoyed.

Uh, because I’m kind of a competitive person and I like helping people. So I did pretty well in jewelry sales. I was either number one or number two each month in the jewelry store. And I worked manual labor jobs. I worked in construction, plumbing, electrical. I worked roofing houses, building, putting up fences. And I hated all that stuff, especially the construction stuff. But you know, the job in the jewelry store.

this Lebanese family, the Nassers, they had a chain of jewelry stores called Nasser Brothers. And they thought, well, if we had something that was more of an American name, maybe we could have like a big nationwide chain. So they asked me if I would wanna work for them. And they were interested in moving me into assistant manager role. But one of the things that happened was the manager of the store, the person that we always trade off first and second place selling.

Uh, he was more interested in her being the, uh, the assistant manager and she was well qualified. So it wasn’t anything, any wrongdoing there. But one of the things that come to the conclusion is I really have to find a role somewhere, a job, a trade that, that I can succeed regardless of politics or preference. And, you know, we run into that in cybersecurity, there are some politics, but you can still make decent money. It beats it’s compared to the politics of working in a restaurant or retail store.

Manoj Tandon (09:27.457)
Sure.

Phillip Wylie (09:35.23)
has a lot more effect on you than in the real world. You know, you can still make a good living. So one day I was watching television and saw a commercial for a trade school. They were teaching AutoCAD and always liked to draw. And I took some drafting classes in high school and I thought maybe this is a better career for me. So I went to the trade school. And at that point, this was like in 90, 92 or 93, I believe it was like 93. I finished school like the beginning of 94. I was in school for a year.

But before that, I had no exposure to computers. I was probably like one of the worst students in my class with computers. But by the time I got through the class, got out in the field working as a drafter, my skills computer-wise was better than some of my colleagues. Whenever new versions of AutoCAD came out, I was able to figure out the new features quicker. I was able to figure out Windows 95. I was able to get Novell Network printing to work properly through Windows 95.

And some companies I worked for, they had IT staff, but maybe they were two hours in another city. And one of the places I worked at, they had, uh, one of the accountants, one of the people in accounting would work on the computers if there was any problems. He was kind of the onsite IT guy and he couldn’t figure out how to get Nobel network printing to work on windows 95 and I was able to figure it out. And he was kind of offended that I was able to figure it out. And he referred to me as a hacker. So that was the first documented time. Someone called me a hacker before.

I actually got into pen testing.

Manoj Tandon (11:07.981)
And Novell Networks. Now that definitely, I know exactly what that was because that was an era in which I grew up in computing, but I don’t know that a lot of our audience might remember who those guys were and it was a big, it was a big deal back.

Phillip Wylie (11:23.566)
Yes. Yeah. Microsoft is really one that kind of, uh, put them out of business. Cause once they came out with their directory services, make it easier to manage Microsoft environments. That’s when it was kind of game over for Novell.

Manoj Tandon (11:24.649)
and

Manoj Tandon (11:38.465)
So InfoSec is a huge area, right? I mean, we have so many specializations. What’s your passion and what’s driving you in this as an ethical hacker? Like what’s the motivation here?

Phillip Wylie (11:55.734)
Kind of the challenge, it’s really fun to hack things. And even after so many years of doing it, whenever I get a shell to a system, get command line access is still a big thrill. It’s a lot of fun. You’re just able to, and it’s kind of like one of the things you’re able to do that not everyone can do, but if you’re someone that likes puzzles and like a challenge, it’s a lot of fun, you know, because before I even got into that, my IT days, because when I transitioned out of AutoCAD, I went into sysadmin work, then network security, application security.

And then offensive security, but a lot of times in my free time, I would play around learning things on, on the computer. So that was one of the kind of, one of the draws is when, whenever I had free time, I would like on work on these different, uh, hacking training courses and stuff and, and trying to learn. So it’s like people that are really drawn to a challenge. It’s, it’s very interesting. I think it’s, it’s interesting though, that it’s probably not as big a part of the industry, but it’s one of the industry, part of the industry that draws a lot of newcomers they see.

the hacking thing, it looks really cool. And so they’re kind of intrigued to want to get into that. And so it’s kind of, you know, a lot of people are kind of like that until sometimes they get in the role, we’ll see what it’s like. And some people don’t like it as well as they thought they would.

Manoj Tandon (13:09.365)
So have you ever encountered an environment that you could just not get into?

Phillip Wylie (13:16.902)
Yes. Yes.

Manoj Tandon (13:18.142)
Really?

Manoj Tandon (13:21.801)
Dave, that must be, I was gonna say, well, cause we’ve always, like where there’s a will, there’s a way that certainly holds true in our industry. If you look for enough vulnerabilities, you may even eventually find something that gets you somewhere. So it’s interesting to hear these.

Phillip Wylie (13:21.93)
Yeah, that gets pretty common.

Phillip Wylie (13:42.67)
Yeah. There’s a lot. Yeah. So that’s one of the frustrating things for people are one of the things as you’re, as a pen tester you get. And this is really, you see that a lot with web app, pen tests, application pen tests, a lot of cases you can find some vulnerabilities, maybe they’re not exploitable, but some of the things that they, they do is maybe they reveal sensitive data, you know, data that you don’t want exposed in some of those cases, you may not be able to actually get control of the system.

And that’s a lot of times with web app pen testing, you don’t always get control of the system, although it’s still important to test all the controls, finding the vulnerabilities, but not all the vulnerabilities lead to, to exploitation or a foothold. And it’s getting a lot more difficult because when I started in 2012, you know, you go into an environment, you’re pretty much sure that you’re going to be able to gain a foothold because back then the MS 08 06 7 vulnerability through Microsoft.

was a very popular one. You went into an environment, it was vulnerable to that. You had access to that system pretty easily. Use it running Metasploit.

Manoj Tandon (14:43.573)
You know, when you look at even today, SQL injection is such a fundamental way to attack a web app or a web front end. It’s still pervasive. You’re right in that you may not gain control of the system, but I got the data.

which is equivalently as good.

Phillip Wylie (15:03.211)
Yes.

Phillip Wylie (15:06.558)
Yeah. And one of the things people overlook, you see a lot of pen testers, they, they’re so eager to get domain admin, a route, get all this high level of access. At the end of the day, it’s about the crown jewels. So you’re trying to find the sensitive data. And once, you know, a pen tester gets experienced, they get to learn this because there may be an S3 bucket exposed on the internet with all this valuable customer data, credit card information. You could be in an internal environment. You may app.

Manoj Tandon (15:07.18)
So

Phillip Wylie (15:34.258)
you know, access an application, they don’t have proper access controls on it. And you’re able to gain access to credit card numbers or social security numbers when you shouldn’t. That’s the important stuff. That’s the critical information.

Manoj Tandon (15:44.353)
That just happened to somebody. It was in the news yesterday. That exact scenario, they had an S3 bucket that was wide open to the world. I won’t go over to my computer and look it up, but I remember reading it this morning. It was in my inbox.

Phillip Wylie (16:03.571)
Yeah, those are common type of things that you’re seeing.

Manoj Tandon (16:05.717)
So what are we getting wrong? Like when you look at, these are foundational things that leaving open access to critical information or maybe not testing your application front ends on the web for SQL injection, typical queries that people would do. I mean, the list go, vulnerability management, I guess in a nutshell.

Why is it that after all this time as an industry, we’re still not getting it right?

Phillip Wylie (16:38.302)
I think the biggest, the biggest problem is it’s one of the most misunderstood areas of information security. You go talk to a security manager, people in the security department, they understand endpoint protection. They understand firewalls, how it blocks, you know, certain activities that you don’t want to see. They understand that, but when it comes to the pentesting piece, they don’t understand it, they see these vulnerabilities and it’s so that this doesn’t sound critical. So when you’re performing a pen test, if you’re able to exploit that vulnerability,

and provide some type of post-exploitation, you’re able to show the value and the impact. And I think the biggest thing is it’s not understood. And I think the target’s not being thoroughly tested because one of the things has kind of hurt the industry. It really built the pen testing interest industry, but PCI testing for the data security standard. What’s happened there is maybe there’s only a hundred IPs in scope for PCI.

But there’s other things that you need to consider. You need to test the whole environment because what if someone gets a foothold internally, maybe they can gain access to a system that someone has access to that environment. So the scope of the pen tests have become too narrow. They used to do more full scope pen testing once upon a time, they were doing things like social engineering, physical building assessments or pen testing buildings to see if people could access it because you can have really tight security environments but if someone’s able to walk into a data center.

data center, access a keyboard, someone is logged in as admin, you don’t have to be a lead hacker to be able to do that. And so making sure you’re covering all the bases and thoroughly testing stuff. Sometimes companies are too busy trying to get stuff out of scope for PCI to get the checkbox. And I’d say at the end of the day, the checkbox security is a big problem. So you really need to make sure you’re secure, not just PCI compliant. The threat actor is you can show them your PCI compliant.

And they’re just going to laugh at you because that doesn’t mean, doesn’t guarantee that you’re secure. Yes.

Manoj Tandon (18:33.441)
It doesn’t mean anything. So then what’s the point of the regulation? And believe me, this is a topic we’ve had on this show multiple times is, and if I was to summarize our outcome at least, and this is just my personal opinion, that good compliance has very little to do with good security. But if you have really good security, compliance will be a natural outcome of it. You know, you won’t have to work at the compliance part because you would have…

done everything anyways that would have required. But in having said that, what you’re saying I agree with completely, how do we change that mindset? I mean, there is a lot, it’s pervasive, especially in management to check the box. Get me my PCI compliance, get me SOC 2 type 1, get me HIPAA, et cetera, certification.

Phillip Wylie (19:03.381)
Yes.

Manoj Tandon (19:30.997)
Check, check, check.

Manoj Tandon (19:35.593)
when it should really be about what’s the outcome that you’re really looking for is not a compromise of your critical data or whatever your crown jewels are. Your thoughts, Philip, how do we change that?

Phillip Wylie (19:44.243)
Yes.

Phillip Wylie (19:50.858)
I think the biggest thing is education. So, and this is on, this is on all levels. This is, you know, management, not saying that the board needs to understand how a pen test works, but the people that are overseeing the security programs need to understand that the importance to make sure that you’re testing the overall environment. It’s not just about PCI test externally, internally. Uh, one of the nice things about the new PCI standard, I think believe 4.0 just recently came out. Before they required one pen test per year. Now they’re requiring two.

And I don’t think two’s enough. I think we really need to be doing some type of continuous testing. Internally and externally, uh, we need to be doing social engineering, including phishing. There’s a lot of these nice applications that you can do these phishing campaigns internally. But what they do is they really check to see if someone’s clicking on a link, not testing what happens if they click on the link. So we really need to get to, uh,

Also, I’m not saying to do away with that. That’s good for awareness, but also have some actual phishing campaigns in there. So what happens if someone clicks on it? Are they, you’re able to inject malware, take control of the system, get control of the environment, because threat actors, the most common methods they use is phishing emails. They send a phishing email out with a malware payload, or they try to get someone to call them so they can further social engineer them. But the human element, you just have to make sure that that’s secure.

do that with security awareness. And I think one of the things too, is don’t punish people when they mess up. I say we use a reward system, reward people for good security awareness and hygiene. That way people are gonna strive to do better if you get people disgruntled and they think they’re going to get in trouble because they clicked on something wrong, they’re not gonna report it. The company’s a higher likelihood of breach. And it just doesn’t help the overall morale. So if you’re trying, if you’re rewarding them, you’re gonna help them. So I think that needs to be done.

Uh, some type of continuing, uh, pen testing, make sure you’re doing that on a continuous basis. Things like purple teaming is a good way to improve the security maturity of your company because you perform a pen test or vulnerability scans, you remediate those items. And this takes a cycle. This is like you do a test, you remediate. Sometimes this can take months to conclude, but if you go in and perform a purple team operation, you’re basically getting the offensive team and the defenders together.

Phillip Wylie (22:15.906)
the offensive team is executing tools and the defenders are trying to detect it, trying to figure out how to detect and block those activities. So if you can take at least some of the tools out of the hands of threat actors, you’re eliminating certain classes of possible threat actors. So like script kiddies are really relying on some of these tools, but if you allow them to, or disallow using something like Mimikatz, which dumps passwords and clear text.

you disable that, that’s one tool you’re taking out of the hands. We also have to consider that there’s insider threats. So eliminating these possible tool usage on employee desktops is a good way to reduce your attack vectors. Then also things like make sure you’re blocking certain websites on internet because a lot of times threat actors will, will host malware in the cloud. So they send out a link, someone clicks on it. They go to connect to it. So making sure that people in the environment can’t download hacking tools.

Maybe the pen test team may need to do that, but you need to make it a lot more difficult so that way if a threat actor gets a foothold in your environment, they’re not easily able to download these different tools. So doing the purple team operations is a good way to speed up the maturity because it can kind of move a little bit quicker than remediation of the vulnerabilities. Once you take some of those tools out of the hands of the different levels of threat actors, then you’re going to improve your.

environment and then also add in like if you don’t have a bug bounty program, have one, some kind of a disclosure program, because there’s cases that, uh, maybe innocently bug bounty hunters could be using your website. Maybe they bank with you or they use your service and they get on there. They may see something that’s a red flag that they need to report. And if it’s hard to find someone to report that to, sometimes they’re not going to put a lot of effort into trying to run down the person that they need to report that to. So make that easy.

to be disclosed to your organization and even consider like bug bounty programs because the continuous pen testing method is something that helps. With a bug bounty, you can have people watching and testing your site, your external websites, 365 days a year, 24 hours a day. And sometimes they refer to it as crowdsource pen testing. So it’s more than one or two. You’ve got these people that specialize in these different areas and some of them are trying to make money. But at the same time too, when you’ve got someone

Phillip Wylie (24:36.982)
all these specialists from around the world, examine your website, looking for these vulnerabilities, it’s gonna help your security posture.

Manoj Tandon (24:43.929)
You know, one thing interesting in this area that we saw from a policy position in the state of Ohio, the secretary of state’s office, I want to say, they actually put it out on their website that you can go ahead and try and hack them. And if you get in, there will be no charges filed against you as long as you share what it was, how you did it.

and they encourage people, go ahead. If you think you can get in, try and get in. We’re not gonna criminally prosecute anyone that does. Just share what it was so that we can patch the vulnerability, right?

Manoj Tandon (25:32.253)
I think they’re a little avant-garde in that approach. I’ve seen a lot of vulnerabilities at the local state municipal levels. They don’t follow that and…

There’s a lot of things pending out there. And this concept that you propose, I love the word crowdsource pen testing. That could be a thing if people would consider doing it that way, you know, opening it up. Put a bug bounty or not penalize people for finding.

Phillip Wylie (26:02.902)
Yeah, that’s where you see some of these.

Phillip Wylie (26:07.694)
Sure. Yeah. Give them, you know, give them credit for it. And you know, they, if they, they do that, some bug bounty programs have like a hall of fame. So they give people credit that found bugs. So it’s kind of something for someone to put on a resume. But one of the things I’d say is when you’re doing these programs, be respectful of the bug bounty hunters. Cause one of the things I’ve seen and some of the laws are getting better with that because recently one of the laws, the computer.

fraud and wiretapping act or something was updated because it really didn’t provide any protection. And people a lot of times were scared to find these vulnerabilities. There is a case where there were some researchers found a vulnerability in a drone several years ago. They had a bug bounty program and they reported the bug to the company and the company come back and tried to sue them and file charges against them. And they had a bug bounty. So you really can’t do that because once you lose the respect of the hacking community and these bug hunters.

they’re not gonna help you. It’s just kind of a bad thing. They’re gonna find something that would keep quiet. So we need to make sure that we offer ways to disclose this. I would say do some type of bug bounty, even just kind of give them credit because this is something that there’s people that will start out doing bug bounty, trying to get into a full-time professional pen testing position and they need things to put on the resume. So if you have like some kind of way to validate for people to confirm they found this bug.

that they could put on their resume, then it’s kind of a win-win because some people are just needing those type of things in a resume to help further their career.

Manoj Tandon (27:40.313)
You know, it’s an interesting concept you bring up. I think we have deficiencies in the law for sure that are preventing movement in the right direction as you want, as you’re suggesting. I’ll give you a classic example. I know there’s several law firms, most law firms do not want…

Manoj Tandon (28:08.893)
They do care about cybersecurity, so I don’t want this to come across as they don’t care. But they’re very fearful of someone independently finding vulnerabilities, or just doing a, like if you just went there and said, hey, you know what, I’m Philip, I’m very well known, I’d like to just check your environment, and I’ll do it gratis just to prove how well you guys are.

they get all jiggy about it because if you find something and it’s very likely that you will, then they’re under the laws in which they operate, they have to disclose and that hurts them, right? So they’re like, we’re better off actually not knowing.

Phillip Wylie (28:50.509)
Yes.

Manoj Tandon (28:57.181)
and take the risk and let the insurance carrier cover the risk if something goes south and let the PR firm cover the risk if something goes south. That if we get all proactive about this, then we’ll have proactive disclosures and those disclosures will materially hurt us.

Phillip Wylie (29:19.582)
Yes. And unfortunately that’s too much of what happened. Someone doesn’t want to disclose and it’s not even so much of it’s disclosed. People know about it. They don’t want to have to fix it.

Manoj Tandon (29:28.829)
Yeah, they don’t, because that involves money typically, in some way, shape or form, right? And they don’t want to fix it. So there is, it’s a tough problem. I think certainly from a governmental policy position, our lawmakers could maybe act, maybe not in this environment, they won’t, but ideally they would act in the right direction to.

Phillip Wylie (29:33.133)
Mm-hmm.

Manoj Tandon (29:56.641)
clear up some of these flaws that are there with our modern technology. And when these laws were written, none of these technologies existed. So it’s not having a positive effect. And I wanted to ask you about the, I don’t know if you saw, but the Biden administration’s promoting this whole hack back kind of approach. What are your thoughts on, I don’t know if you’ve laid your eyes on that.

legislation at all or that directive and what are your thoughts as a hacker?

Phillip Wylie (30:32.962)
heard about it, but I don’t know the details. But one of the things I would say that companies have to be careful of the hack back thing is say your company. You’re a consumer products company and you’re being attacked by nation state. And you try to hack back. If you upset the nation state, you may be putting yourself in a worst case scenario. And most of the thing is pen testers, offensive security professionals, usually are trained in cyber warfare. So if you’re going to get into the hack back thing,

Manoj Tandon (30:53.631)
Yeah.

Phillip Wylie (31:02.114)
then you really need to be recruiting people with a cyber warfare background because there’s a difference between trying to, you know, pen test the site, trying to gain a foothold, trying to hack into it. And then there’s another thing that you’re trying to actively protect against. Then you’re attacking the other, uh, person. So when you get aggressive, you know, I would think that they’re going to fight back harder. You may be asking for, you know, I think for most cases, I don’t think it’s a good thing for, for companies to do. I would say go through the proper measures of trying to block what’s going on.

Uh, you know, report it to the FBI, whoever to, you know, your local law enforcement to handle that type of thing. Because I think sometimes as an individual trying to hack back a small company, it can be worse for you.

Manoj Tandon (31:44.621)
Oh, I would agree with you completely. And then the question becomes also, if you’re hacking back, it may be legal from our perspective, but is it legal in the country where you, who you are hacking back to? And do you have any travel plans to go through such a country? And what happens? You know, there’s all kinds of things that this thing brings up, but there should be.

Phillip Wylie (32:07.649)
Yep.

Manoj Tandon (32:14.322)
I mean…

Manoj Tandon (32:17.969)
Maybe it’s done at the FBI’s level. Why don’t we go after some of these actors? And I’m pretty sure we do. We probably do. But make their life miserable. And that’s the one thing that as a company might be difficult to do with the hack back.

Phillip Wylie (32:40.982)
Yeah, I definitely think I like your idea of FBI, some government agency providing the hack back because then all of a sudden they’re the one attacking. It’s coming from a different source. So it’s going to put less, less pressure on you doing it that way. I think.

Manoj Tandon (32:55.517)
Yeah, and you’ll avoid all the legalities that, to go with it. So on the offensive, go ahead, I’m sorry.

Phillip Wylie (33:00.714)
Anything? Yeah, one of the things you have to think about too is verifying who’s actually attacking you because attackers will use proxies, so they’re coming from a different source IP address. You may think it’s some other nation state and it’s not. It could be coming from within your country. So you may end up accidentally, inadvertently attacking someone innocent. So that’s some of the other things you have to think about.

Manoj Tandon (33:26.401)
Attribution is probably one of the most difficult things in cybersecurity. And I don’t know that we have it right. In fact, I’m going to just say I don’t think we have it right. I think it’s a very difficult thing to firmly say.

and somebody hacked you, unless you have the human intelligence side of that equation, in which case, as an individual, you won’t. That requires a lot of other resources to pull that off.

to verify who did it. But you’re right, I think that happened with Sony, didn’t it? It was, the Sony hack was supposed to be North Korea and I think it ultimately came out that they didn’t do it.

Phillip Wylie (34:08.598)
Hmm. Yeah, I can definitely see the case because a lot of cases threat actors aren’t going to use their, they do things to go undetected, but a lot of cases they’re trying to hide where they’re coming from, you know, going through some type of Tor network or using a proxy, you know, periodically changing the IP addresses to prevent getting caught and blocked because what happens there, even if they’re not really worried about being detected.

Once that IP is exhausted and blocked by the firewall, then they can switch to another IP address and continue their attacks.

Manoj Tandon (34:43.669)
So on that, and I think you mentioned, you know, looking at bad DNSs, this gets to threat intel. What’s the role of threat intel in a good vulnerability management program? Where does it fit?

Phillip Wylie (34:58.294)
Yeah, definitely think that’s, that’s good to have there because one of the things with the good threat intelligence, you’re able to see what type of, uh, attackers are going to, to target your organization. So some of these APTs, you’re able that are going after certain, maybe someone in the energy sector. So kind of knowing what the enemies look like, you’re able to go through the type of attacks they’re doing, make sure that you prioritize remediating, providing any kind of security protect against those types of attacks.

And then, you know, get, you know, uh, using good threat intelligence feed, you know, maybe even have like a threat intelligence group that keeps on top of that. I worked at a company where we had a really good, uh, team that dealt with threat intelligence and threat hunting. So when these things, they were actually kind of monitoring some APTs that were coming after the company and were able to proactively block these, these APTs because they knew what methods they were. They’re able to identify the APTs from the, from the threat intelligence.

Manoj Tandon (36:02.457)
I want to get your opinion on, since I believe you in your past life also built some vulnerability managed programs and asset Intel is kind of a big deal as part of that, because a lot of companies have a hard time understanding what assets are in play even, depending on the size of the company or what they have on the network. Is there any approaches that you’ve seen that work better than others?

Phillip Wylie (36:22.325)
Yes.

Manoj Tandon (36:31.093)
to determine that.

Phillip Wylie (36:34.126)
Sure, I think this is one of these type of things that you need to take kind of an automated approach. So one of the things you hear a lot about now is external attack surface management. People, and this is not just pen testing, this is kind of monitoring what assets you have exposed to the internet. Because you know, now with the cloud, people are able to spin infrastructure up so quickly. They’re using microservices for marketing campaigns. Maybe they don’t take those services down. So a lot of cases, you don’t know what all’s out there. One company that I worked for,

I was a red team lead and we were doing, uh, we did all the internal network pen testing and the red team operations, which more of the adversary emulation. But we outsourced the web app pen testing. And when it came time to perform this pen test, we had like half a million dollars to use in funding so we didn’t lose it. And so we had some pen testing done. And so it was like a big fire drill for the dev development people to go through and find all the URLs so they could be.

So this is such a huge problem at all levels, things that are externally exposed. You need to focus on those first and internally. There’s a tool out there that used that HD more. I think it’s run zero or something like that, that that’s an internal tool for managing your internal assets. And I think Exonius has a similar tool, too. So you need something like that you can keep track of. And some of these tools.

Manoj Tandon (37:48.929)
Okay.

Phillip Wylie (38:01.81)
other than a lot of deep details, I would think a lot of them would probably connect with the configuration management databases to keep track of these different systems, you know, what’s on those systems and have an idea. So definitely that’s one of the first things, because you can’t protect something or assess the security of something that you don’t know about. And, you know, back in my sysadmin days, shadow IT back then was someone building a server over in the marketing team or the accounting team, they needed some

app that ran on Microsoft access, but they didn’t have time to go through the proper channels and they just built that internally. Now it’s a little bit harder to detect. So, uh, this is definitely, you need to make sure that we’re monitoring what’s our environment, because when you have people building, building out infrastructure servers or applications that aren’t security properly, it’s going to make the whole company as a whole vulnerable, not just that particular application or server.

Manoj Tandon (38:59.317)
Switch gears to ransomware before we run out of time. I wanted to get your opinion on that too. It continues to grow in spite of everybody, there’s all this awareness in the media being out there. Is there some silver bullets that you can throw out there that might help people? How do they make a dent in this and not become victims?

Phillip Wylie (39:22.102)
Yeah, one of the things the first, before I forget about it, uh, the CESA’s side has a, a page on their stop ransomware. They have some good tips there, but one of the things, one of the good things, some of the things you need to watch out for in a lot of cases, most of the time it’s usually some kind of social engineering or phishing attack. Someone’s sending an email. There was a recent, uh, ransomware attack in the city of Dallas about a month ago. And it was the Royal ransomware and they figured the foothold was gained through.

social engineering, because typically that malware, they either take advantage of exposed network security vulnerabilities, like leveraging a remote desktop protocol. That was one of the ways in, but they got into social engineering. So one of the things we need to do is look at those areas, make sure that we’re doing, mentioned earlier, you know, doing social engineering assessments, going past the canned phishing campaigns and actually have a pen tester run these campaigns to see.

what happens because if someone clicks on something, then you need to put things in place that there’s some email products out there. If you click on a link, it protects the URL. So putting in things like this, that stops the attacker. If they do, if someone clicks on the wrong link, make sure you’re performing, you know, these physical security assessments, social engineering, and then also thoroughly pentesting your environment, because some of these environments are, are leveraging vulnerabilities that they exploit. They get a foothold in the environment.

And they’re using some of these vulnerable applications to get or services to get further footholds in the environment. So this is another thing with your proper internal segmentation and things like zero trust, because then if someone has access to one system, try to prevent them from getting access to multiple systems. Because what’s happening too, is these threat actors are using what they refer to as low bins living off the land binaries and it’s legitimate.

uh, softwares and administrative tools on these systems. So threat actors are getting access and they don’t necessarily have to have, uh, their hacking tools in the environment. They’re leveraging stuff that exists in that environment. So some of the things like I was mentioning, like the purple teaming, going through, making sure people can’t execute certain type of tools, make sure that your PowerShell version you’re using is the latest version and disallowed downgrading because sometimes attackers will perform downgrade attacks.

Phillip Wylie (41:47.638)
which allows them to use some of the tools. If you’re not able to downgrade sometimes it eliminates some of those tools. So just make sure that you’re thoroughly testing your environments, you know, because like I said, these threat actors, ransomware gangs, they’re going to use these different tools and stuff to exploit these vulnerabilities in your environment. So make sure that you’re staying up to date on your patches, you know, you’re staying patched. And…

We take care of that. And I think you’re going to reduce your risk. You may not totally eliminate it, but you’re going to reduce your risk.

Manoj Tandon (42:23.489)
Fantastic advice, Philip. Switching gears here a little bit, I wanna make sure we get in a little bit of time for all the wonderful things you’re doing out there. What’s the future of the podcasts that you’re working on? Which direction are you going here? You have two of them now, right? So tell us a little bit about, let the audience know what they are and what they’re about and what your plans are with them, if you don’t mind.

Phillip Wylie (42:40.754)
Yes.

Phillip Wylie (42:49.986)
So, so the hacker factory podcast is through ITSP magazine and it’s mainly focused on helping people get started in cybersecurity. So I have people coming on sharing their stories of how they got started and their advice. And with the new podcast, the Philip Wiley show, I’ll still have some of those same formats. But one of the things I’m also doing is sprinkling in some more technical information. So on a past podcast, ITSP magazine, I had someone from Spectrops.

do a presentation or present their research on some Active Directory certificate service vulnerability that came out. So having more people share some of their research, you know, have some technical stuff on there too. So, uh, there’s something there for, for all the listeners. And I do a lot of free workshops and it’s kind of a way to, with the Philip Wiley show, it’s a way to make it interact more interoperable with.

the free workshops and stuff I do. So some of the things I offer too, is not only a weekly podcast. Recently I did a webinar on starting a career as a penetration tester. Some of these conferences I teach workshops at, it’s not always recorded or streamed. So part of my goal is to do these streams so anyone can access it and record it so they can get access to that later on. So really the Philip Wiley show is kind of bringing all these things together under one brand.

Manoj Tandon (44:15.509)
Fantastic. What about any appearances you’ll be making? I know you were you were at Black Hat, right? Or you were a keynote speaker at Black Hat.

Phillip Wylie (44:26.298)
I will be a keynote speaker at Black Hat Middle East in Africa. That’s in November in Riyadh, Saudi Arabia.

Manoj Tandon (44:27.433)
You will be.

Manoj Tandon (44:32.965)
Oh, wonderful. What else? Anything you’d like to plug out there, please. The floor is yours.

Phillip Wylie (44:35.267)
and yeah

Sure, there’s also, yeah, also I’ll be at beside San Antonio coming up on, I believe the eighth, the ninth of June coming up there. I’m teaching a web app pen testing workshop there. And then the June 20th through 22nd, I’ll be in London at InfoSecurity Europe teaching an API pen testing course.

Manoj Tandon (45:08.605)
You don’t like staying home much. Or are you just leaving Texas for the hot weather? Ha ha.

Phillip Wylie (45:11.338)
Yeah, this is kind of, yeah, that that’s a, that’s a good idea of a, yeah, it’s, this is kind of my hobby too. So I’m passionate about it. So going to conferences is what I like to do to have fun. So like last year, um, the employer I was working for sent me to black hat Europe in London. So I was there. And so for me, I did enjoy the sightseeing and stuff, but I was more excited about going to attend black hat in, in London. So

Manoj Tandon (45:40.033)
That’s fantastic, Philip, and you’re doing great work. We appreciate having folks like you in the industry that are willing to pass along their knowledge and guidance. If someone wants to reach out to you, what’s probably the best way for them to do it?

Phillip Wylie (45:55.318)
Probably the best way is through LinkedIn. So I monitor my messages pretty closely there. So I do a lot of mentoring. Sometimes I’ll do Zoom calls with people if they need help beyond just messaging. So that’s one of the best ways to reach me. I’m also active on Twitter. And then my domain name, my website is thehackervactory.com. I mean, actually thehackermaker.com. So you go to thehackermaker.com, you can find links to my YouTube channel, previous conference talks, recordings of that. And…

Manoj Tandon (45:57.173)
Okay.

Phillip Wylie (46:24.423)
in guest appearances on different podcasts.

Manoj Tandon (46:27.177)
Fantastic. Well, it’s been a pleasure having you here, Philip. Thank you for taking the time with us and hope to have you back sometime.

Phillip Wylie (46:35.042)
Sure, it’d be an honor. Thanks for inviting me and I enjoyed the discussion.

Manoj Tandon (46:39.229)
Likewise, we’ll take you again soon.

Phillip Wylie (46:44.066)
Thank you, you too.