Hey everybody welcome back to Salted Hash I'm your host Steve Reagan today I'm joined by Philip Grimes we're gonna be talking Red Team stuff stay tuned and we'll be right back welcome back Philip how are you it's good to see you again man my Great Babe yeah man the week again end is almost here so I'm doing pretty great how are you I'm doing good I'm doing good so we want to close where you are but I do to get the distinct feeling there's a lake involved somewhere Some kind of jealous about like in the middle of the woods. I'm just waiting for this interview to wrap up so I can get out And do some fishing Oh see look at this I'm keeping positive here right now. I like that so last time you and I talked You were sharing some wonderful red team stories and we got into a bit of a conversation about not just like some of the really Interesting things that happen while you're out in the field doing you know physical assessments and never assessments and things like this But we also got into the topic of words matter and people tend to think they need one thing when in fact They need another so I think today if you don't mind Let's start by by talking about the difference when like somebody says they want a red team assessment But they can't really handle a pin test yet. How do you work with customers like that?
You know that's one of the biggest struggles that I encounter as the leader of the well as anybody in a team I mean a member of a team you always struggle with the fact that sometimes customers tend to bite off more than they can chew And I think you know the statement that words matter that's something that's becoming a lot more prevalent in the industry lately We have we've seen a lot of conference content a lot of you know content online about how we need to Standardize the verbiage throughout the industry and so that that can spill over into Operations into where our customers are working and unfortunately that's just not happening yet Like most things we're seeing security become a bigger thing. We're slowly starting to see that verbiage standardized But it's it's a constant conversation and a an education effort So when I get a customer, I'll give you an example here recently We had a call where we were doing an RFP for a red team engagement And to me, I mean that a scoping call for red team should be pretty quick and simple come get us sign the paper and it's done Right? There aren't a whole lot of rules in that that type of environment But when we talk about they start saying well, you know, we aren't gonna let you fish our people We aren't gonna let you do any kind of social engineering. You can't hit our physical perimeter.
You can't touch any of our actual stuff It's like, okay, so what are we doing here? We're not even we're basically doing a glorified vulnerability assessment and you're trying to get us to sell you something and call it a red team engagement And it's just trying to trying to talk them through understanding what each phase of the the attack model looks like from things as trivial as like vulnerability Standing which really is a very low value anymore into actual vulnerability assessment penetration tests up into that more red team type attack And so it's just constant education and talking and trying to rather than build a customer vendor relationship It's really building a partnership with your customers so that they understand what you're talking about and that they feel and realize that you have their best interest in art So then it's really on the team that's doing the assessment or the the engagement to make sure their customer does understand the nuance Behind why you're there and what you're there for so then my question is when you when you run into this situation And they have all these limits on the scope. Why are they doing that? Is it confusion or are they afraid that you know don't don't fish our people because we know you're going to get in that way is It's a combination of both of those things and and the reasons are many I mean first of all you have the fact that a lot of these places are trying to just check a box They just want the compliance to be able to say that it's done and less often does that ever approach the line of a red team assessment?
Most of the time when they're talking a red team assessment and they dumb it down. It is more because of ignorance They don't necessarily know what a what a red team assessment is Everybody hears that term red team and it's ubiquitous with the attackers So yeah, I mean I've heard it be I've heard red team used as a reference for the very lowest level of what we would call skiddy type stuff And then the more advanced security posture the customer has when they're actually able to handle that real red team type engagement Then they start to learn that that's you know eliminating scope that that's eliminating pretty much everything except for you know An attack window so you've got x amount of time that you're going to be throwing everything at us We don't know when you're coming. We don't know how you're coming. We just know that you're coming and it's just that That constant, you know trying to talk and using the standard verbage makes sense So speaking of verbage you and I also talked about some common key phrases that some people get confused about so if you're such a guy you have a phone Let's uh, let's let's do a little bit of a hybrid here.
Tell me your favorite dumpster diving story while we explain what dumpster diving is Oh, man. Okay So this I don't tell this story too often because it really is my first foray into professional dumpster diving I actually um, the little bit of college that I took I put myself through college with dumpster diving I go and like dig stuff out and rebuild computers and sell those to be able to pay for a little bit of uh college money But once I moved into to the consulting world and I realized that hey, that's actually a viable attack vector And we started selling dumpster diving engagements. I found myself in a dumpster in the middle of the summertime Oh, and I didn't the downside to it is, you know, sometimes when the customers know that you're coming They tend to stack the deck they try to stack the deck against you So I was given a very specific day and a very specific dumpster with which I was supposed to target Um, so I went in this hot hot august day And I start jumping into this dumpster and it wasn't the first bag that I was through before I realized this was nothing but bathroom and food trash From this facility The entire thing was it was about waist deep and all of the bags were nothing but bathroom and kitchen trash from this it was a fairly sizable Building so it was it was kind of nasty As I'm digging through the bag so the point in dumpster diving is Typically to find something of value depending on the threat model of the attack You know what that value is changes when I was younger It was you know trying to find hardware that I could salvage to make a little money off of when I'm an attacker in this type of a situation Though it tends to be you know, what data can I steal? Is there intellectual property?
Is there sensitive information that someone forgot to shred or shredded improperly or whatever the case may be So why is this my favorite story? Well, hey, it was my first you know It was my very first foray into dumpster diving professionally. So that's a big deal to me Be it was pretty gross again Imagine, you know, what's in the bathroom trash in the kitchen or break room area garbage of your office And you can tend to imagine that as a dumpster full and you can tend to think how how fun that can be But I'm most proud of the results. So the the target here was a financial institution So ideally the overall threat model was something that was it related to pii that I could take and make some sort of malicious use of I found three working debit cards Like complete they weren't shredded they weren't cut they weren't deactivate like these were working available debit cards that we were able to salvage from this trash improve that we could reuse if we were malicious Um, and that you know that proves that what goes in the trash tends to be a risk and people again, just don't think about it So let's talk a little bit about tailgating.
That's uh one of your favorite means of just kind of accessing a building What's uh, what what happens when you get caught tailgating? Tell me a story about a time you got caught tailgating Why we talk about what that is? Um, so I did I did an engagement some time ago where I gained access to the facility fairly quickly And I was able to maintain access across several floors of this building simply by tailgating and You say tell you about a time when I got caught the fact of the matter is I have never been officially confronted or stopped tailgating never Uh, if I if I've launched a tailgating attack, I've been I've been able to execute that Um, the only issue that I've really ever had when it comes to tailgating is that I've had people Who knew the organization was small enough and they knew I didn't belong to the point where seeing a big ugly creepy guy hanging around the doors And I tend to you know, I tend to target Um smaller people than myself, which is pretty much anybody But I mean for the most part I try to go after people that I want to make them feel uncomfortable because I'm trying to get them to alarm Right? I want to give my my adversary some ability to detect and to determine that they're under attack so um, um, I get a complaint from my point of contact that said, okay Well, we've had several concerns from some of the females in the office about you tailgating them And that's the only time I really ever had much was that someone would make a report Um, the sad thing is it wasn't until well after the fact I had already been able to breach the perimeter I had been on the floor and no one said anything to me during the attack It wasn't until after the fact that something was said and the point is they need to talk to you during the attack That's that's when it's key when it matters most see something say something, you know And it's kind of like training a puppy if you if you go rub the puppies nose in a mess two days after it's made it It's not going to learn anything from the situation.
You've got to confront and deal with it during the attack So then moving a little bit forward from that once you gain access to a building and you're walking around Standard awareness training always talks about don't leave no pads at your desk Don't use sticky notes with passwords things like this, but we all know it happens We all know it's going to be done in fact depending on how complex the password is if you just keep it out of sight Maybe writing it down is the smart thing because you don't want to lose your your your cool or get kicked out of a critical system But sticking it on the monitor just doesn't ever seem like a really good idea that daily journal with the password written on the front of it Probably not another one. What are some of your favorite places to find written down information that's useful later in the engagement? um Well, you know Because of the nature of what I do the technical assets tend to be the first place that we look So if I can gain access to the desktop, we look for passwords.txt spreadsheets that have that stuff in there I mean unfortunately that's still a very common thing But when we're talking more in the physical layer, you know, I've seen sticky notes posted pasted underneath the keyboard underneath the phone I've seen them post it stuck on the back sides of monitors so that they're out of sight I've seen a you know that the if you're in a cubicle and you have those cabinets above with like the lift up It's like a lift up cabinet above you. I've seen pages taped on the inside of that cabinet door full of passwords And then of course, I think the last time you and I talked I told you the story about the password Yeah, the guy right on the ceiling that was a stare at always yeah that will always be my favorite The fact of I mean to talk about some security by obscurity just putting things in plain sight where the average person isn't gonna look that that We'll always stick out as the most but um there there those are my favorites Yeah, every time I think back to that story where you just watching this guy and he's staring at the ceiling and suddenly goes into the vault Then he comes out goes back and stares at the ceiling again and you're like all right What do you seem like you do and you look up and there it was Combinations like right there that was genius.
Yeah, I wish that was a joke, but no It's real it happened so wrapping this up. I guess What's your advice to organizations who need to understand? All right, I'm not ready for a full-on red team engagement. I need something a little different What's your advice for them?
How should they go about knowing when to step their levels up for their posture? Um That's a tough a tough question to ask for somebody that like me I try to avoid seeming salesy at all And I don't want this to become that it's not a salesy thing It's just but the fact the fact is the first advice is be honest with yourself You know don't try to fool yourselves or your peers or your your bosses into thinking that your posture is better than it is because You will sadly be shown the truth But then the next thing would be to find someone that you can trust to work with to help evaluate and improve that posture So so finding somebody who isn't necessarily a security vendor who comes in and just offers you the penetration testing services or whatever But to find someone who can come in and can say okay, let's let's start at the ground You've never had a penetration test before so let's start with a vulnerability assessment Great. You have your you have an internal vulnerability management plan. Let's see how that works And then once we build from there Having the relationship with a a partner who can help to Like I said evaluate what the posture is to show metrics for the improvement of that posture And then to take the results when we do an evaluation and to bring that back in some way that it can be usable Rather than just throwing you know, here's a hundred page report full of junk I would rather have 10 pages of information that I can take back and make useful And that's what I think we need to find more often in our security partners than just a raw Here's a technical report go figure it out for yourselves Perfect if you guys want to learn more about red teaming or anything else remember to check us out online CSO online dot com and of course this has been Phil Grimes.
I'm Steve Reagan. Thanks for watching. You have a great day