Security Confidential S8 E6 Derek Scheller

Manoj Tandon
Welcome to another episode of Dark Rhino Security Confidential. Today, we are honored to have Derek Scheller join us. I’m personally grateful to have somebody in my neck of the woods join us. It’s not that often that we get somebody here locally in the Pittsburgh region. But also, Derek’s a great guy. He’s a military veteran and has over 10 years of experience in the info-sec and IT fields. He is the founder, content creator, and podcast host of Cyber Warrior Studios. Please check him out; he’s got some great podcasts. I can tell you I personally love his Walk in the Woods series. Catch him—we’ll put the links in the show notes for that. He’s also a senior consultant at CSO. Welcome to the show, Derek. Thank you for joining us today.

Derek Scheller
Yeah, definitely. It’s good to be here.

Manoj Tandon
So, I’ll tell you what, there’s a lot to discuss. You’ve got a heck of a background. I guess for our audience, give us your origin story. I mean, we know you were in the military and somehow you’ve ended up in the cybersecurity world, and an offensive one at that.

Derek Scheller
I can go back years, or I could go back as an adult. Either way, it is kind of interesting because, you know, it’s funny—we talk about career transitions being a big thing these days, with people trying to get out of whatever industry and get into IT or cybersecurity. I didn’t have that problem. From the age of seven, I was fixing computers, and then in high school, I started working at Best Buy selling computers. I had been fixing computers for years, so it was one of those things where I loved it.

I wasn’t your hacker initially. I knew about “punters”—you figure I grew up around America Online and getting kicked off your dial-up and everything like that. My buddies used to torment me with punters, which was essentially just a bomb that killed your connection. I was interested but never did the research.

And so in 2004, when I joined the Air Force—because I was in the Air Force initially in the Air National Guard—I had gone through and done all the training. I literally did everything from networking to system administration to help desk. You name it, I did it.

I was sitting in my apartment; I was going to college, sitting in my apartment one day, and I was like, “You know…” Wireless had just come out. WEP was still around, and I think it was 802.11b, and maybe G was out. I was like, “I bet you there’s a way to break into this. I will almost guarantee there’s an easy way to break into this.”

And so I did the research. My original breaking into anything and doing anything offensively was breaking into wireless networks using Aircrack. People are lucky these days; they have things like Reaver and Wifite and all the simple tools that just do it for you. No, no, no. You had to actually go through, find the network, decide whether or not you could get in, and do all the hard work. WPS wasn’t even around yet to make it easy.

So I did that, learned that, and really started delving more and more into BackTrack Linux. That was my—besides Ubuntu, which I used religiously for a while—BackTrack was my first offensive distribution. For anybody who doesn’t know, that was the predecessor to Kali Linux. It was designed by Offensive Security.

And so I used BackTrack, started doing all the research into Linux I could; I wanted to know everything there was about it. In the Guard, I became the pen tester for my unit and started playing with their Aruba system and things like that. This was before Cyber Command even existed.

Manoj Tandon
I was going to say, did you spend any time with Cyber Command at all?

Derek Scheller
No, no. Before “Cyber” even existed in the Air Force, I was helping with wireless pen testing. Then I picked up the security AFSC as it came out.

Then I transferred over to active duty Army because, funny enough, I had a degree for Computer Information Systems for over a year and I didn’t know it, because the school never mailed me my diploma. I didn’t find out until I went back.

So, I got my degree as I was leaving for the Army. I went in the Army and I was supposed to go work for Cyber Command. I actually got in—I was going to get in as a 25 Bravo for Signal, but I ended up getting in as a 1190 Romeo because by the time they processed all my medical paperwork and did everything for all the injuries I’d already had previously, I couldn’t get in as a Bravo anymore.

So I got in as a Romeo, which was basically a jack of all trades. I fixed computers, did networking, did satellite, and broadcast engineering. The actual MOS is broadcast engineering, but as a 25 Romeo, you do everything.

When I was stationed at Army Television, I decided, “You know what? I’m tired of doing this. I want to do security. I want to get out.” I had already been working at home, and this is the kicker: for anybody out there that wants to talk about getting into cybersecurity or IT and you don’t know anything, especially about cybersecurity, I took an hour or two every night to work on learning.

I would build labs, I would do Hack The Box, I would do TryHackMe; I would do everything I could to perfect my craft because it was something I knew I wanted to do in life.

As I was about to get out, my buddy came to me because I said, “Look, I’m going to let my contract expire after Army Television.” I’m like, “Okay, I’m done.” He said, “Hey, there’s this MOS—if you do it, you’ll get a promotion,” and I was told I’d either be stationed at Fort Meade or Fort Gordon, so I’d be with ARCYBER.

I was like, “Bet.” I was kicking it around at first, but then I was like, “You know what? All right, I get promoted and I get to do what I love. All right, cool, no problem.”

Plus, there were a bunch of SANS certs involved, so I had to renew my contract to take it. I did that. I reenlisted, took it, and they came back and they said, “Hey, you’re going to Fort Riley, Kansas.” Okay, you suck.

So, I went through and I took the 25 Delta MOS. I got my GSEC, my GCED, and GCIH. I took the course for Python Coder, but at the time, the certification wasn’t out, so I took the beta cert after I had already graduated from the school.

Manoj Tandon
Okay.

Derek Scheller
But because I was going to Fort Riley—well, gotta love the military—they basically said, “Hey, we have civilians that do your job for you. You can do what you want on the tactical systems like our satellite systems that we work on.”

We had a tactical network, but as far as actually doing security work or working with a SIEM or anything like that, I was SOL. I was like, “Oh, fun.”

Manoj Tandon
So they kind of reneged on their deal?

Derek Scheller
Yeah, yeah, yeah. I was one of the few that actually sent two emails to the Sergeant Major of the Army. No, I didn’t stop at the lower level; I went to the highest enlisted authority that I could go to.

The first one, I was definitely just complaining. I had no solutions; I was complaining because I had one of the highest scores in the school and I was going to a place where I was not going to be allowed to do my job.

And then the second one I wrote, I actually got a call from the ARCYBER Sergeant Major. He gave me a call and he said, “Hey, tell me about this email.” And I told him, I said, “Yeah, I don’t know what you’re doing.”

He said, “I have this conversation all the time with our amazing Army.” He said, “Have you ever wanted to go offensive security?” I said that was the whole point of me taking this job. And he said, “All right, put in a packet. I’ll get it approved.”

I said, “All right.” This was in 2016, after I’d already deployed and came back and did everything. Then I find out that I have degenerating discs in my neck, a bulging disc in my back, jacked up shoulders, jacked up knees, and everything else. And they said, “Hey, we’re going to med-board you,” basically meaning they’re going to retire me or separate me. It ended up being retirement.

But I was like, “Okay, I am playing this ‘I can get you here or do this,’ maybe possibly…” It was never official. So I said, “You know what? I can make more money outside and actually get to do what I love. So I’m out. See you later.”

I took the retirement in 2017. I am on my fourth company since retiring, but I’ve been with CSO since 2020. I’ve been doing content creation and cybersecurity ever since I retired.

I retired in 2017 and tried starting a business that failed. I stood up my content creation. Originally, it was under Sheller Cybersecurity; it was named after my company. I rebranded and changed everything because I shut down that company and just made it a content creation company at that point.

That’s where Cyber Warrior Studios came from, because I wanted to do more than just technical videos. I wanted to do more than just the standard tutorials. For me, kind of like this podcast, it’s about giving back to the community in a way that allows people to have a voice.

That’s how I came up with Security Happy Hour; that’s how I came up with Motivation Monday, and Tech Tuesday. Like I said, it’s just technical content; it’s there, and I do it on occasion. But I love those two shows.

Then, about two months ago, give or take, I was in a conversation with Hacker Valley Media—good old Chris Cochran and Ronald Eddings.

Manoj Tandon
We had them on the show—we had Ron on the show.

Derek Scheller
Yeah, yeah. I was talking to them and I said, “You know, I think I want to do another podcast.” Because of the journey I’ve been taking in my life and the path that I’ve been walking lately, I came up with an idea. I was like, “All right, I’m going to do this based on how I feel you can better your life and give a different perspective on things based on my beliefs.”

And so I was kicking around a few names and we came up with Walk With Me. Then John de Leon from Hacker Valley’s Discord server did all the intro and outro music for me, and it kind of took off from there. Episode five, which I released today, was actually the first episode where I did not go to Hacker Valley for assistance on the script—to say, “Hey, does this sound right? Does this look good?” It’s the first one I did by myself.

Manoj Tandon
I started off in the intro with it. I said that’s one of my favorites. I like the concept. I really enjoyed it; it was really well done.

Derek Scheller
Thanks. It is definitely a passion project of mine. Everything I do, with the exception of my full-time job, is an expense. For me, I pay for Adobe, I pay for the host of my podcast on Buzzsprout—I pay for all these different things. For me, it’s a passion of mine. It’s my ability to give back to the community.

And I feel with Motivation Monday and Walk With Me, it allows me to escape cybersecurity to do something outside of the realm of, “Oh, you have to be technical; you have to do that.” No, I don’t. I can take my name and explain how Cyber Warrior relates to everything I’m doing.

Manoj Tandon
I have a couple questions on that. Regarding Cyber Warrior—and I like it; going through some of the content, it’s a very appropriate name—but why not Cyber Strategist?

Derek Scheller
Unlike some people who get their handles from others—they’re in a community long enough and people just call them whatever and that’s what sticks—I came up with it on my own. I came up with it as I was leaving. When I was in the military, I went through a few different variations of things I would use, but ultimately settled on Cyber Warrior and Cyber Warrior Studios.

That was because I have never been one to kick down doors or do anything like that. My life, my fights, my battles have always been behind a computer screen, hence cybersecurity and IT and everything else. That’s where the “Cyber” comes in.

But both in life and in my career, I’ve always been a fighter. I’ve always been a warrior, and I always will be. I will fight for the little guy. I will help people stand up. I will lift people up with me.

It goes beyond—when people think “Warrior,” they give it a bad connotation. I’ve heard that in the past, like, “Oh, ‘Warrior’ is offensive,” when in reality, it’s not. When you take the term for what it is, it’s a fighter. It is somebody that is going to sit down and go to battle no matter what it takes.

With five kids, a wife, a huge family, and then all my friends and family online that I’ve met through Twitter, Discord, and LinkedIn, there is not a day that goes by that I will not fight for somebody. I will always put other people before myself.

Manoj Tandon
That’s a commendable quality. My only reason for bringing that comment up was just—and this is just my personal experience and not the opinion of my company—that a lot of the issues that we have seen in cybersecurity are fundamental, foundational failures in strategy.

People have implemented things without thought. I’m going to summarize it in that way, and that’s why I asked the question. Is it the “Cyber Strategist”? It seems that in our industry—and again, this is just my opinion—that strategic thought process has been a missing element.

Derek Scheller
Yeah, it is. The strategy—a lot of times when cybersecurity is implemented, it is implemented in such a way where it’s, “Oh, we have this problem, and this company says they can solve it, so let’s use their product.”

For this issue, let’s use this product; it’ll solve it. But not a lot of thought goes into: do we have the people to maintain it and to give it the care that it deserves? Do we have the strategy involved or the procedure and policy in place for things like vulnerability management?

“Okay, I’m going to buy Rapid7 InsightVM, but I have no team to support it. I’m just going to implement it and whatever happens, happens.”

“I have LogRhythm as a SIEM, but I have no team to engineer the backend or to configure alarms and alerts and constantly tune it.” There’s no SIEM that you don’t have to constantly tune. You must constantly tune those babies to make them be of any value.

Manoj Tandon
Correct.

Derek Scheller
And so unfortunately, what we’re seeing is a lot of companies selling the product, and then trying to pitch professional services to help set it up. Unfortunately, that’s a problem because they’re using FUD as a sales tactic and then on top of that, they’re not providing any—I can’t say none of the companies are; I’ve not talked to all of them. Don’t take it as all of them.

But there are a lot of companies out there. Instead of giving them advice like, “Hey, this MSSP actually uses this product. If you don’t have a security team, they do really good work with helping you manage alerts,” things like that are a step in the right direction.

But the question comes down to: what are you going to do with those? Do you have a policy? Do you have a procedure? Do you have any type of program that handles if we’re breached? How do we prevent a breach? Do we need to hire more people? Do we need a security director that’s going to write a program? Do we need to work with a consulting firm to help us develop our program and tell us what we need because we don’t have a clue?

Manoj Tandon
Yeah, these are all problems of strategy where people have not thought this through. I’m so glad to hear somebody else saying it and it’s not just me.

Derek Scheller
That’s why I love where I work, because I get to help clients that are looking for that strategy. I get to help clients that are looking to develop a vulnerability management program and that are looking to grow their team and say, “Hey, look, we need someone that can help us figure out what we need and what we don’t.”

Is this software tuned correctly? Are we doing something wrong? What’s going on? We get to advise on that, and it becomes more than just “check the box.” The clients who come to us truly want to make a difference. They truly want to invest in their security programs and figure out where they can do more and get better and develop that strategy.

Unfortunately, not all companies are like that. Not all companies care about the strategy; they care about making money. Unfortunately, in this day and age, even though it’s 2022, people still see security as an expense. Instead of investing in it, they just see it as wasting money because we, as security practitioners, have not developed a way to communicate effectively that security is actually an investment.

It is not an expense; it is an investment in your future. Without it, you’re going to come out of pocket. Your insurance companies are no longer going to cover you if you get breached because you didn’t have due diligence. You didn’t do your due diligence to make sure things were implemented properly and to have the teams to secure it.

So now they’re not getting that money from their insurance companies, which means if they get breached, they’re coming out of pocket—sometimes a million or two million.

Manoj Tandon
Oh, they could be sunk. They could be sunk. I mean, for a small business, it could be very much game over.

Derek Scheller
Yeah.

Manoj Tandon
So on that note, give us a brief description of what, in your mind, would be “defense in depth,” staying on that topic of strategy and security here.

Derek Scheller
Well, defense in depth, as any security practitioner will tell you, is multiple layers, right? Unfortunately, people always stop at the technology and don’t realize the human element or the documentation.

The very first part of defense in depth—we love to say it’s the firewall, the router, the endpoint, or this, that, or the other—the very first part is that documentation. Do you have a program? Do you know where your assets are? Do you know what assets you have? Do you know what software you have? Have you done any type of inventory?

Because the first thing that’s going to kill you, beyond someone getting phished, is rogue IT. If you have systems that nobody knows about, they can’t be monitored. It doesn’t matter what you have in place; you’re not going to see it.

You have to know what assets you have. You have to know what software is on your network so that you can see when things are out of bounds. Ultimately, defense in depth comes down to your program, your policy and procedure, your people, then the software, then the hardware, then the networking layer, and it goes all the way up.

These days, with the cloud and things being cloud-native, you can still have all of that. You have your program, you have the people, and then you have the ability to run firewalls and run all this stuff on your SIEM and your security products and things of that nature in the cloud.

Unfortunately, we still have companies out there that go, “Oh, I’m in the cloud, I’m secure.” No, because you’re in the cloud, which means guess what? Now I just need to figure out who’s sitting on that provider.

Manoj Tandon
That’s right. And there are a lot of misconceptions around the shared security model with being in the cloud. You said it very well.

I just don’t think we can say it enough. Out of the hundred-some odd guests we’ve had, many of them have spoken about this topic. I hope people are starting to listen, because this is fundamentals. What you’re stating are the fundamentals: know your assets, know your inventory, know what’s out there, and know about rogue IT.

How do you do vulnerability management? Well, that’s a huge topic which would take shows, not just one show, to cover.

Derek Scheller
Hey, that’s why I do it. That’s why my company does it. We help you do your vulnerability management program and develop all that. So if you’re looking for that, CSO is where to go.

Manoj Tandon
That’s fine, man. Please send us a link; we’ll put it in the show notes as well on how to reach out to you guys.

Derek Scheller
Yeah, definitely.

Manoj Tandon
Now let me ask you one more thing before we move on, because I do want to talk about the adversarial, offensive position. While you were in the Air Force, did you come across a term called the “Prevention Paradox” by any chance?

Derek Scheller
I vaguely recall it. I don’t know the definition offhand.

Manoj Tandon
Derek, it’s kind of cool that the U.S. Air Force coined it. They apparently did an extensive study, and what they found basically says that the more you focus on prevention, the less secure you become. The reason for that, especially if you’re going to a single platform on your prevention side, is because you lose visibility of your adversary’s movements to anything that you are not able to prevent.

Which makes a lot of sense.

Derek Scheller
Not wrong. Here is the thing, and here’s the biggest issue with it: companies want to be 100% secure. The ones that care about security, they want to be 100%. Well, you can’t be.

Manoj Tandon
There it is.

Derek Scheller
You can never be 100% secure. So it doesn’t come down to risk elimination. There’s no way to eliminate all your risk. There’s risk mitigation, there’s risk acceptance, and there’s just knowing your risks and knowing how to monitor them.

If you sit here and tell me you are going to block every outbound port, I’m going to tell you you’re crazy, because you can’t. Or else your people are never going to get on the internet and you might as well just disconnect the internet from your computers anyway, because it’s not going to work.

Manoj Tandon
Well, you’ve got a load of shadow IT if you do that.

Derek Scheller
Oh yeah, for sure. And so it comes down to monitoring, and that’s where things like XDR, SOAR, SIEM, and all these other technologies come into play, because you have to be able to monitor this stuff.

Like I said, without ever being 100% secure—and knowing that you’re not—because people are always going to find ways around. No matter what EDR you use—you could use CrowdStrike with the best policies in the world and someone’s going to find a way around it.

Manoj Tandon
No, and you know what the thing is? A lot of malware distributors out there are now building in tactics that specifically get around your favorite EDR and SIEM tools. I won’t mention names, but if people go and research it, they can find it. It’s made that way.

Derek Scheller
And things won’t detonate, or detonate the right way, if they’re in certain environments. I got my GREM back in 2020 and I learned malware can be fun because guess what? It’ll recognize if it’s on a VPN, if it’s in a virtual machine, or if you’re using some type of tools like Ghidra or something like that.

It’ll interact differently. So, if it doesn’t have an internet connection, it’ll interact differently; if it reaches out and can’t touch the IP it needs, it’ll interact differently. So it builds in all these different things.

Yes, malware is getting to the point where I don’t care what EDR you’re using. The best you can do and the best you can hope for is to eliminate a script kitty. Those who truly want to get into your system and truly know what they’re doing—especially your nation-state actors—are going to get around it.

So it comes down to monitoring. You can limit and mitigate your risk and limit your attack surface. That’s the whole premise of EDR—because it’s not a hundred percent—is to take that attack surface from this big and bring it down to like here.

Manoj Tandon
Yep.

Derek Scheller
And so that’s what you do, and then you want monitoring to be able to monitor essentially the “why.” You want to be able to monitor that stuff that you know you’re not going to be able to stop. You know that if it gets in, it gets in. So how do we monitor it, and then how do we react to it?

How do we go in there after the fact and say, “Oh crap, this detonated. This malware got us. Let’s stop it, let’s isolate it.” Let’s follow the whole IR process and incident handling and keep going.

That way, you can get back to business as soon as possible. And that’s what it should be; it’s about business enablement. If you don’t do all these things, then your business is enabled, but it’s going to get hit and it’s going to be gone. See you later.

Manoj Tandon
Yeah. Well, some people—there’s going to be a group of people that’s going to say, “Well, that’s fine, I’ll take that loss.” And you can’t do much with them.

Derek Scheller
Oh, for sure.

Manoj Tandon
But let’s get into the mind of the adversary. In this case, what makes a good target? I’m looking out there, prowling for a victim as a bad guy. What makes a good target? How do you select your victim?

Derek Scheller
Low-hanging fruit.

So, soft targets. Those that, if I’m scanning and I find open ports to things like LDAP. These days, you look at what your zero-days are, and a lot of times that’s going to be the first thing that they’re going to look for: any zero-day, or well, it’s no longer a zero-day, but let’s say something came out this year.

We know, and your adversaries know, companies are going to be behind on patching. They’re not going to be able to handle everything; a lot of them can’t handle the workload. So they’re going to go out there and they’re still going to scan for the most up-to-date vulnerabilities that there are.

And then after that, they’re going to look at things like EternalBlue—anything that came out that’s like, “Hey, this should have been patched if you update your stuff.” And if you’re leaving it open, then sorry, but you just enabled lateral movement by doing that. You gave me access, homie. I don’t know what to tell you.

So it is—it’s always about that. But then it also comes down to—it really depends on the type of attacker you’re looking at. Are they a hacktivist? Are they going for money? Are they going for data? What are they going after? That’ll determine the target.

Manoj Tandon
Financial corporations—and that gets back to the strategy. Do you know your assets? And where do you fit in the supply chain or your revenue chain? That’s something a lot of businesses neglect. They may not be the direct target, but they may be the vehicle by which you get into your target.

Derek Scheller
Oh yeah. Well, that’s where TPRM and all that stuff comes in. If you’re not doing third-party risk management, you’re going to have another system like Target, where the HVAC is how they got in because they tied into the network and then they had access.

So, if your strategy, your policy, your procedures, or your program is not up to date and this stuff is allowed to happen on your network without your knowledge, then I don’t know what to tell you, because security has been around now long enough that companies should know better.

And I think that’s where the problem comes in. There’s enough knowledge out there, and there are enough people who have been in the field long enough, who have done YouTube videos, podcasts, conferences, and all this other stuff. I’m not talking about vendors—and I’m not talking about vendors because vendors, especially technology vendors, tend to spew FUD.

I’m talking to practitioners, the people on the ground who speak at these conferences, on YouTube, or on podcasts. They are telling you this is a problem.

And if you are not listening, then I don’t care. Why should I care about your organization if you don’t even care about it? As the CEO of a company, you should truly care about the security of your company because it is part of our culture now, or at least should be.

If you don’t care, as much as there have been ads about phishing on TV and cable everywhere, well, just put yourself out about it.

Manoj Tandon
Just look at the news. Does a day go by when there isn’t a major story about some kind of a cyber event that took place? I mean, given the fact that the Russians are going after the Ukrainians on a daily basis, you just have to look at that. What’s going on over there, and you can see those same models would be in play over here.

Which gets to the question: when the adversaries are reconning a target, how do they go about doing it without getting detected? And in your experience, at least, how many companies are actually compromised and may not even know? They’re just sitting there; they compromised them and they’re just sitting there, and they’re going to sell that access to whoever, whenever they need it, or they’ll act when they need it.

Derek Scheller
Yeah, yeah. And again, it all comes down to: who’s the target, what are they doing, what are they going after, and what are they trying to do?

Manoj Tandon
Well, you look at what the Russians—I mean, their general game plan is disruption of life, right? So they don’t care about the money as much. But they’re paying, apparently—we can’t prove it, but—”state-sponsored agents” that are doing ransomware, who do want the money, or who are doing DDoS attacks, as ancient as those things are. That crap is still going on.

But the motivation behind them is a state actor that just wants disruption. That’s it, by any means possible.

Derek Scheller
Yeah. And that’s going to happen. When it comes to disruption, there’s not a whole lot that you can do other than have the right things implemented to prevent it.

Unfortunately, as we’ve seen with things like AWS, DNS, Cloudflare, and all these other services, as good as we are getting at preventing things like DDoS, as good as we are getting at preventing disruption, we’re not there yet because of the botnets and because of all the issues.

You figure—I think it was a four-terabyte attack that took down one of the major services; it might have been Dyn or Cloudflare, I can’t remember which. But it was a huge botnet that crashed it, and they had to bring the services back up. Now, it wasn’t permanent, and it wasn’t for a long period of time, but it was still enough to bring the services down.

So, for that, it’s one of those things where disruption is going to happen. We can only do so much.

Manoj Tandon
So, that’s the hardest part. How do we go on the offensive then? Is there a means? What can we do that would be the equivalent of a concealed carry? That says, “You know what? You hit me and I’m going to hit back.”

Derek Scheller
They’re trying; they’re trying that, or it’s been kicked around with bills and policy to allow for “hacking back.” The problem that comes down to, though, is attribution.

We have a big problem in security, especially with some of your major companies that just want to be the first. It’s kind of like, “I’d rather be first than be right.”

So what they do is, within the first half hour to an hour, they look at something and they go, “Oh, this is probably…” They’ll always put those terms in there: “probably,” “maybe,” and things like that. But they’ll attribute it to a Chinese hacking group, a Russian hacking group, a Korean hacking group, or whatever from whatever country.

“Oh, it looks like it probably might be from here.”

So people see that and “probably” doesn’t matter; it’s “this is from here.” That’s how it’s read. When you’re looking at companies that have been breached and you look at hacking back, attribution is the hardest part because of VPNs, Tor, and proxy servers.

I can buy hosting space in another country and make it look like an attack is coming from there because of botnets and things like that. So unless somebody stands up and says, “Yeah, that was me. I did that. It was all me,” it’s very, very difficult and very, very time-consuming to actually attribute any type of attack to any single entity, unless we know without a shadow of a doubt because they claimed ownership, which very rarely happens.

Manoj Tandon
Now, did that not also happen with the Sony attack? I mean, it turned out that it may not have been the North Koreans.

Derek Scheller
Yeah, that’s been kicked around back and forth. It was attributed to North Korea. I think there’s been a few other groups that have stood up and said it was them, or at least one other. Then I think they’ve also done a little bit more investigation and said, “Well, actually…”—you know, how many years past this—but it may have actually been this group from this country.

Attribution is one of those things. You can write in any language that you’re fluent in. Hell, these days with translators, you can write in any language you want. It may be broken, but you can do it.

And then on top of that, the fact is you can have your network traffic go anywhere in the world. Just because you reside in one country doesn’t mean that’s where the network traffic is going to go.

Manoj Tandon
Sure, but don’t our intelligence agencies have the Tor networks? I’m sure they own or at least have a strong into a lot of the nodes that are on that thing.

Derek Scheller
With Tor, I think it’s about 40%, maybe 50%, that the NSA and our other three-letter agencies own. But there’s still an issue with that. At the exit node, if you’re still going to a clear-net site, that traffic is still unencrypted, so they can still see what is being done. If you’re passing credentials and things like that, stuff like that can still be grabbed.

Plus, they have a way now—I think it’s like time relay, or I forget how they’re doing it—but they can actually eventually track back who the original source was. So, Tor—though it’s safer and more anonymous—it’s not completely anonymous. They can still find you.

And if you’re going on things like hacking forums like RaidForums and you’re like, “Oh yeah, I want to buy this malware,” half the time it has another malware attached to it anyway, which may be a locator from one of your friendly little three- or four-letter agencies, depending on which country you’re in.

So, to sit here and say you’re anonymous or they can’t track you is wrong. To say you’re a little bit more private and secure from the everyday person—sure. But from anybody that truly wants that information? No.

Manoj Tandon
Right. But they would have to expend resources to get at it; you have to be a target.

Derek Scheller
That’s how your illegal operations—that’s how they brought down things like your drug marketplaces. I can’t think of the name of it now, but there have been a few huge marketplaces that have been shut down by the three-letter agencies and four-letter agencies across the world.

That is because it was worth the effort for them. They were a major contributor to a major problem, and for them, it was worth the effort. For one or two people that might go out there and download something—which more than likely has malware from the person distributing it anyway because they’re like, “You know what? I’m going to keep track of what you’re doing.”

Not really. But if it becomes a problem, if they know it’s a group or if they have eyes on a group, then yeah, they’re going to start feeding information and doing things to track it back. From any regular old script kitty that’s just like, “Hey, I want to spend 10 grand on this ransomware,” because they can afford it because mom and dad have a trust fund for them? Great, go for it.

But they’re probably not going to get very far. There are very few of these folks out there that have the technical acumen to create these technologies from scratch and deploy them without buying them off the black market.

Manoj Tandon
Correct.

Derek Scheller
Yeah, and that’s the thing. There are a lot of people online that like to argue about hacking and what it is and who it is and all this other stuff. But here’s the kicker: You don’t have to know programming to be a hacker.

Go back and look at the literal definition from when the MIT Model Railroad Club were the actual first hackers. It could probably even go further back than that if you really want to get into the nitty-gritty.

But to be efficient at what you do, it takes a certain mindset. Malicious programmers that develop exploits have one mindset to do programming. Can some of these APTs enlist the help or are they responsible for not only the exploit development but the distribution and actually attacking systems? Yes, but that requires a team.

Manoj Tandon
GRU, correct.

Derek Scheller
Very rarely will you find one or two people that can write the exploit, distribute the exploit, phish people, and do everything, have the infrastructure, and do all that. It’s very rare. I’m not saying it doesn’t happen; I’m just saying it is rare.

And so those who can write those exploits efficiently and not get caught, and bypass security measures like your EDR systems and everything else, that takes a certain frame of mind and a certain skill set.

I equate those people to the ones that wrote Microsoft Word and all that. That type of programming knowledge to be able to decipher and do all those things doesn’t really allow for understanding or comprehending different aspects of computer systems. Again, not saying it’s not possible, but saying it’s rare.

Manoj Tandon
I would agree with you. It’s a combination of multiple advanced skills. Writing malware is a non-trivial exercise; writing something novel is a non-trivial exercise, and it requires an in-depth knowledge of the systems that you’re trying to bypass in order to do it right.

Derek Scheller
Because you’ve got to figure—let’s think about this: say it’s a web-based exploit. So now, are you going after a Chrome vulnerability, a Firefox vulnerability, an Edge vulnerability, or a Brave vulnerability? Are you going after all of them?

If you’re going after all of them, okay, now you’ve got to write four different bypasses depending on which browser you’re going for. A lot of times those bypasses get written as assembly or C, which would require even further knowledge.

Then once you bypass that, are you trying to bypass one type of EDR? Are you trying to bypass them all? Or are you taking a shot in the dark that they’re going to be running Norton or McAfee? So then you’re going to write your bypasses for those and make sure you can get around those.

Then you’ve got to make sure that no one uploads it to VirusTotal, because then that signature gets passed down to everything else and now your signature is out there. There are so many nuances and so many steps that go into developing malware that is excellent at what it does.

It takes a special breed of human being to be able to sit there and purposely write things to bypass other things.

There are people that can do it. I’ve seen some of the malware that Keatron Evans wrote. But again, it’s not all over the place. He sends his signatures to companies so that people can’t manipulate his stuff.

The stuff that he’s been able to develop—and yet he’s still an instructor and does networking and consulting and all this other stuff. Do people exist that can write malware and do all this? Yes. But the ones that truly are malicious, I highly doubt that they do much more than bug hunting and vulnerability stuff, looking for a particular way to exploit these systems and write the code for it.

Manoj Tandon
Got it. I think the audience listening should—that’s an excellent identification of the adversary and knowing them. People, take what Derek is saying to heart. There’s a great description there.

Derek, unfortunately we’re running out of time. We didn’t even get halfway through this.

Derek Scheller
I like to talk.

Manoj Tandon
Yeah, we’re just going to have to have you back at some point. I would love to continue the conversation if you would. But I want to give you two minutes here to plug whatever it is that you’d like to talk about.

It’s your forum, please.

Derek Scheller
Yeah, definitely. Look, so, like we said in the beginning of the show and as has been mentioned several times throughout, not only do I work for CSO LLC as a senior security consultant, I am also the founder and content creator for Cyber Warrior Studios.

Over there, if you’re looking for motivation, if you’re looking for interviews with major people in cybersecurity and even some newcomers—because everybody deserves a voice—please head over and check it out.

I also do Tech Tuesday; it’s just not every Tuesday. I release those as I get around to it. Finally, I do have a brand new podcast I just released, Episode Five, called Walk With Me: An Audio Guide to Self-Improvement.

Look, if you’re looking to get along in your life and move further and keep pushing forward, I have everything out there for you, whether it’s in cybersecurity or just life in general. I’ve got something for everybody.

You can head over to my website, cyberwarriorstudios.com, to see everything I have to offer, including some awesome mushroom dice. Just saying.

But it’s been fun, Manoj. I really enjoyed the conversation. We’re going to have to get together and grab a beer sometime. I’d like to drink and hang out.

Manoj Tandon
For sure. That would be fantastic. I would look forward to that, and thank you for giving your time.

Derek Scheller
Yeah, definitely. Anytime, man. Just let me know.

Manoj Tandon
Sounds great.