A Deep Dive into Cyber Operations and OSINT with The Grugq

Hello everyone.

Welcome back to another episode of the Security By Default podcast.

I’m the host of the show and I’m really excited about being here again with all of you to share some, you know, what’s happening in the world.

A lot of great thought leadership, a lot of experience and knowledge to share with you.

And we live in a world of chaos and this show is really to bring clarity to that chaos and also to make sure that the world that everybody has access to security and knowledge and experience.

So it’s really bringing you all those ideas.

And welcome back to another amazing, awesome guest who’s been on a previous episode, previous show before.

So welcome to the group.

Do you want to give like you’ve been on before?

So, but I think for the audience just give a bit of a background.

What’s your origin story, how you get into this industry?

Did you choose it or did it choose you?

And what’s some of that journey along the way?

Yeah, sure.

So I’m the grug I these days, I’m a PhD student as well as just my sort of regular independent security researcher type stuff.

I started out, so when I finished high school and I didn’t, like, I wasn’t going to college, I didn’t really know what to do.

A friend of mine was like, well, you know, so this was in the late 90s.

He’s like, well, if you, if you don’t have a job, you don’t have a college degree, you’re going to have to learn how to use computers because that’s where, that’s where all the jobs are.

He gave me a book called something like Introduction to Unix or like UNIX in the Workplace.

And so I sat down and I read this book on Unix and I didn’t have a computer and like.

So you read the book without the computer?

Yeah, yeah.

So I read the book and then I saved up money from the jobs that I was doing at like the cashier and stuff like that.

Bought a computer.

Then I was like, oh yeah, time to do this UNIX thing.

And it showed up with Windows, which was very confusing.

So my friend’s like, oh yeah, yeah, yeah.

Like just install Linux and like you can.

So this was way back in the day.

He’s like, yeah, you can, you can adjust the partition table so that you preserve the Windows and then you’ve got Linux on the other end and as long as you don’t do anything stupid, it’ll be fine.

Yes.

So obviously I did something stupid because I had no idea what I was.

Doing, got corrupted.

Wrecked everything.

But anyway, I figured that out a bit.

And then a few months later another friend was over and we had found a bunch of these computers on the sidewalk, like someone was throwing them out.

So we rescued them and as we were carrying them back to his car, we were talking about Linux.

And we walked by this house and this woman on a porch just goes, excuse me, excuse me, do you know Linux?

And we’re like, yeah.

And she’s like, here’s my card, call me.

I work at this company and we’re looking for a couple of interns.

And so like we call, you know, the Monday whatever we call and they say, yeah, like come in for an interview, we’re looking for interns.

We show up, they, they do some like really basic stuff like, do you know computer?

Are you interested in technology?

All this stuff.

And we got hired and the internships that they were looking for was they wanted two people to learn how to do red teaming to hack the infrastructure.

And I helped them set up this red team.

So like that was our job for the summer, was learn how to hack.

That’s a lot of fun.

Yeah, yeah, it was brilliant.

Like, we left and we were like, I can’t believe this is my job.

I can’t believe they’re paying for this.

But you know, like they had a mentor guy.

Like they had experienced people, but they, they were having him train us to do this work so that they could, you know, have more people on.

Anyway, so that’s, that’s how I got started.

I worked for them for a few years.

Then I went to the uk, started working for At Stake, stayed there for a little while, left.

I think many of, many of us have had some crossover across paths with At Stake.

Yeah, it was, it was that semantic at the time when At Stake was or we both required very similar time.

And so many of our, all of our paths at some point came either through At Stake or people connected to it.

Well, yeah, I mean back then that was sort of the only game in town for a while, right?

It was that’s sake.

And then Symantec was, you know, huge.

So anyway, so I worked there for a little while.

Then I did a startup doing host intrusion prevention, which is now edr.

Yes, it’s the same sort of stuff.

Then left there and I moved to Thailand because I did not like living in London.

A very, very different world.

But I mean the.

So like the big thing was that after I left the startup, I Was like, I’ll just do freelancing.

I didn’t.

I didn’t really know very much about how to do consulting and stuff like that.

Yeah, like any other things, like, you send an invoice and it gets paid at some point very far down the line.

Like, not.

Not like same day or, you know, a couple days later.

But when.

When I moved sort of into London proper, I’d just done a few days consulting with a company where I’d be getting, like, €1,200 a day.

So I was like, okay, well, if we estimate that I do, you can do like 20 days in a month, which is, you know, say 20,000.

I don’t need to work every day.

Let’s say 15.

So 15 days in a month, I get, you know, 50,000 put away five, got 10 to live on.

So let’s spend like 3,000 on rent.

That seems completely reasonable given my projected earnings over the next whatever.

And so I didn’t get 15 days per month.

I got three days and three months.

Substantially different.

So I was running out of money far, far quicker than I’d anticipated, which meant that staying in London was no longer viable.

And so moving to Thailand, where it was like, you can reduce your outgoings by 90%.

That was.

It’s a big difference in cost of living, for sure.

Huge.

Plus, like, the weather.

And I wanted to move to Asia, but it was like, Singapore is very expensive, and money was already the issue.

Hong Kong, similar.

Bangkok is well situated in that.

There’s a good transportation hub.

It’s got good Internet.

It’s got good access to, like, you can go to Laos or Burma, and you can have decent stuff in terms of cost of living, but technology is very far behind and so on.

So Thailand was a good, like, intersection of all these things.

And I’ve just kind of been here ever since, sort of bombing along and doing my own thing.

It’s gotten slightly better at consulting since then.

Couldn’t get much worse.

So, you know, hopefully you figured out the invoicing and expensive.

Yes, yes.

And, yeah, that was.

That was a little bit of a shock where it’s like, look, like I.

The first invoice I sent, I was like, hey, man, in a. I kind of have to pay rent in the end of the month, and it’s the 27th, so anytime soon, you know, if it’s not too much trouble.

And he’s like, usually we pay in at 45.

And I was like, what does that mean?

Like, 45 minutes?

Is that.

I think when I got it When I started my own, own company as well, I had this.

I was like, okay.

I tried to do it all myself I think for almost six, six months to a year.

And I decided, okay, let the accountant deal with that because they’re way better at asking and, and understanding the terms.

Because I was wasting a lot of.

Times just chasing people when it’s like hi, I sent you an invoice.

Did you get it?

Because it’s like it’s been two months so I’m pretty sure you got it like at least the three other times I sent it.

So it would be kind of cool if.

So I mean you started from reading a UNIX manual.

Well, it wasn’t a manual, it was a, it was a, it was a book.

And it was very much like, yeah, yeah.

So it’s like, you know, welcome, you know, congratulations on your purchase of the UNIX whatever system.

And it was very much.

It’s like you will start out with a login.

Here’s how you log in, you know, here’s how you, you know, list the directory, the, the files in your current directory.

Here’s what you know, how do you change directories?

How do you make it so like all of this stuff.

And I was like this is fucking amazing.

Like this is so great.

This is like wow, like I want this thing.

It’s like everyone else is off reading all like in a traditional, you know, English books.

I have a very similar.

Because when I, I struggle with reading, you know, like what you had to read at school and I love manuals.

It’s like, okay, I’ll read all of that, you know, use the fridge, how to install.

So for me they were more, I guess I related more with like the logic and the understanding and the commands and the kind of interface and stuff.

So, so very similar.

Kind of like understanding is like I would love.

I’ve switched it now.

I still do, I still do very technical manual kind of or how to books but I do try to read a little bit more philosophical.

Philosophical or even like educational type of like you know, way of life books and stuff.

So I’m trying to balance between the two because I know you just can’t do.

Do it all by one logical method.

So what from that UNIX and you got into red teaming kind of.

What was the path afterwards?

What was your passion?

Which area did you really enjoy out of all of those areas?

Because it can get very broad.

You can get a very broad.

This industry.

There’s so many areas you can get into.

What was your passion?

Where does it lead you to.

Right.

So I mean, the thing is, back then it was small.

Like it was big, but it was small enough that you could actually do everything.

Like you could, you could know like all of the systems you needed to know.

You could know kernel stuff, you could know application level stuff, you could know networking, you could like all the defense, like forensics.

It was just like it was all small enough that while you could specialize, you could be a generalist still.

Yes.

So it was, it was, it’s actually quite weird.

But essentially what happened was way, way back in the day there used to be this guy called Mixter and what Mixer would do was he would take private exploits and he would rewrite them and then publish them.

So it wouldn’t necessarily be exploits, would be tools and things like that.

And one of the things that my mentor had taught me when I was learning was that.

So there’s sort of two things.

One was aspire to subtlety and the other one was, you know, what’s interesting is not getting on the box.

It’s what you do after you’re on the box.

And at the time, being young and dumb, I’d understood it very literally as a. Oh yeah, it’s like after you gate access, do you install a rootkit?

You know, how do you, how do you ensure access?

And so like that’s sort of what I was thinking about.

And this guy Miggster, he had released a thing which basically what it did was it opened the RAW disk device like dev SDA1 and then it went every 8k bytes and it overwrote a bunch of bytes with zero.

And the idea was that you’d kind of point it at a disk and it would overrun stuff and maybe it would hit some inode UID section and convert a file into a root owned file and then you could, you know, get a root shell.

And I was like, that seems dumb because it’s like the file systems, it’s structured right.

Like there must, there must be some way of understanding this.

So I sat down and I was like, I’m going to learn how file systems work.

So I started learning.

This was ext2.

Like we didn’t even have ext3 back then.

So it was like the ext2 file system.

And I, you know, spent a long time learning that.

And I was like, okay, well this doesn’t seem particularly useful for hacking, knowing how file systems work.

Like I could finally write that program he was trying to do, but you know, correctly.

And then I was in, I was in a course on like as a training for, for red teaming stuff.

Just some, some hacking course.

And in talking with the instructors, something came up about like, like hiding yourself or like doing, doing something on the box.

And I suddenly like, hey, why don’t I do anti forensics?

Like, why don’t I look at how to not be detected?

Like, if I was going to do actual hacking, I’d want to make sure that, like, I didn’t get caught.

The way to not get caught is to know how to, you know, hide all your stuff beforehand.

Right.

Aspire to subtlety.

So I was like, okay, so I should, I should learn how to do this stuff.

So I sat down and a.

Took sort of what I knew and so I went and I learned forensics because I, if I was going to defeat it, I had to know how it worked.

So I spent years learning forensics and then I started looking at, you know, like, what are the ways that you can interfere with this process?

There was like, there was nothing out there.

No, no one was writing about this stuff.

So I basically, I had to invent a theoretical framework on how to conceptualize different ways of attacking forensics.

So I came up with this framework of understanding.

So first of all, I had to figure out like what anti forensics meant, which was I formulated it as reduce the quantity and quality of evidentiary material.

And it’s like, it’s a, it’s not a very academic phrasing, but I think it captures it a lot better and that quantity and quality, right, because most people look at the, you know, how do I reduce the amount of evidence that’s left behind?

Or how do I make it useless?

But the thing is like, if you, if you reduce the quality, that’s what all this living off the land stuff is these days, right?

Like the, the quality of evidence is useless.

It’s like, oh yeah, they used like CD and LS and GCC and you know, gdb and it tells you absolutely nothing.

And how do you distinguish that between an authenticated normal user.

Exactly.

And a lot of what we tried to do today is from timestamp.

Literally time is, you know, where you really have, you know, an understanding of how user.

What time do they normally use things?

So you can at least pull out little pieces of potential.

But it’s never, you know, Right.

You’re never going to be 100%.

Yeah.

So I mean, the, so there’s the interesting thing from Matt Monti, who, he wrote out these sort of principles of offensive security or like network attack.

And there’s three axioms that underpinned everything.

So one of them is access, which means if there’s data that’s available, there’s a user who has access to it.

Like that’s like axiomatically, it has to be true.

If, if there’s data, someone has access to it, and if no one has access to it, then it’s not data, it’s just, you know, it’s garbage, it doesn’t count.

So as a hacker, all you necessarily have to do is impersonate that person or coerce them or get them to access the data or impersonate them to access the data or whatever, so there’s access.

Second principle is humanity, which is that humans built these systems, humans operate these systems, humans make mistakes, humans get tired, humans cut corners, humans have loyalties other than, you know, to the system, all of these things.

So there’s, there’s this humanity aspect.

And then the third one is economy, which is there’s a budget.

So the people who develop and run this system, they’ve allocated so much money to it, security is some part of that and it shouldn’t be more than it absolutely has to be from their, like, from their perspective, more than the system itself.

I mean, security is there to support another reason, another financial motive, and it should never be within the system.

So you always have to allocate what’s your appetite for risk is what bill thinking and how much are you willing to spend in order to protect the other economy that your business is.

Right.

So like if you, if it’s an enabler, it shouldn’t cost more than the rest of the system because, but, yeah, so, but economy applies the other way as well.

As an attacker, you don’t have infinite budget and infinite time.

For one thing, at some point the economy, like the economics, just no longer favor continuing to attack.

So it’s, it’s similarly, you know, these apply the other way as well.

Like the attackers are human.

Right.

Like there’s people behind them or there’s people directing them.

But anyway, like those are the three axioms of network attack.

And I think that they’re very, very profound and it’s very, very worthwhile understanding them because it gives you.

Just before the show we were talking about, people don’t necessarily get excited by the same things that we do.

As we’ve, we’ve aged, aged up, matured.

There we go.

As a matured.

Yeah, yeah, We’ve, we’ve aged into a deeper understanding of cyber as opposed to grown old.

I think, I think it’s, we also have to Remember, as we were there before, it was all a cyber thing because it was more just systems and misconfigurations.

And mostly it was just like, faults.

You had to deal with lots of faults, you know, traditional system usage.

And so we have, like, sometimes I always say that back, you know, we have a better understanding about the why we were doing things because ultimately we had a bigger picture.

We were doing everything.

And now you’ve got people who specialize in one very specific thing and that becomes exciting for them and they miss that, that time where, you know, and they have a very goal, it’s associated with cyber.

So which comes sometimes is that, you know, we’re the bringer of bad news and.

Absolutely.

I think we’ve just, we just came through a different generation of how we see the systems.

Yeah, I think that’s, that’s true.

Like, I think the, like, part of what was very useful was seeing like the, the renaissance of memory corruption as like new techniques were discovered.

And, you know, you went from these very, very basic simplistic understandings to these much more, you know, now we have a theory of weird machines.

Whereas back then it was like, you know, if you overwrite by 4 by, you can control EIP.

And EIP is like the thing that tells the computer where to go.

And it’s certainly.

It’s gotten a lot more sophisticated.

And, you know, I don’t necessarily think people be better off starting when we did because back then you had to write all your own tools and everything was slow and it was like.

I don’t want to sugarcoat it.

Like, it was quite painful and difficult.

I remember those days.

Yeah, Well, I was like, you know, it used to be like, you’d be like, okay, I’ve got this idea for a project.

You know, I want to.

I want to send arbitrary DNS packets.

Step one, I will write a string handling library in C. Step two, I will write a UDP handling library.

Step three, I will write like a DNS.

Oh, my God, I’m out of energy.

Like, I give up.

It’s been two weeks.

I don’t.

I mean, I know it.

Yeah, I remember like sitting.

We had.

I was doing a financial money market system and one.

One bank was like complaining because one transaction didn’t go through.

And I sat for hours looking at like literally GUID tables and logs, trying to figure out and trying to match.

I think it was like a 256 character.

Good with another one.

And just, just the time you could sit, sit and set up, you know, some sort of Automation for it you can get so far it would ultimately end up being.

It was what Cisco, local directors, they had a flag which is on a sticky bits.

And for whatever reason, certain scenarios, that sticky bit didn’t work.

So one transaction went in one CLD and it went out another one and then they try and match and then merge it together.

And it was so painful.

And we’re laughing.

We were talking about earlier.

I did a hackathon last weekend.

Normally, kind of for me, you know, I’m using mentoring, but I thought, I’m going to get hands on, I’m going to get.

I was shocked at like, you know, the, how many automation tools.

I didn’t really have to do anything.

I just had to tell another agent or application how I wanted it.

And it did it for me.

I just became a prompt person.

No, it’s amazing now, like kids these.

Days, they don’t know how easy they have it.

Yeah.

I mean, back when I was coding, it was uphill both ways through the snow, nine miles before breakfast.

Yeah, but like, it’s true back then things were a lot easier in terms of the complexity of what you were trying to do.

But the tooling you had was so much more primitive that it sort of, it compensated.

Like you had to create it yourself.

That’s the difference.

You have to write it from scratch without knowing any kind of baseline that was out there.

I hated.

One thing I hated was, you know, I used to do basic coding when I started off and I get the magazines with the games in it and I’d be spending all weekends, you know, under.

It was funny, you know, because my, my computer room was under the stars.

I was a little bit like, you know, the old school Harry Potter with a computer under the, under the surge, writing basic code from a magazine.

And then of course you get runtime or line, whatever, and you’re like, what the hell?

You know, like, you know, wasn’t working.

And then you try to like go through, did I miss something?

And then a month later you get the new updated magazine, like, okay.

And it says, remember the one we actually issued last month, this line.

And I was like, oh.

And even sometimes when I’m doing Catch the Flag as well, I still run into those simple things and you’re still going back and like, okay.

You had to know how it worked.

And also those mistakes made you go and realize that when you see it again in the future, it gives you that knowledge about how to go back and identify it.

So it really gives you that fundamental, very basic, like, you Know, getting into even I went back in order to make myself a bit better, going back and looking at disassemble code.

Because I think it’s sometimes it is important to have that skill and unfortunately, yeah, absolutely.

New generation, don’t go into that detail.

That’s not the fun part for them.

Yeah.

I mean, so, you know, it was for me before I started programming as well.

Like, I did the same thing that I’d done earlier.

I bought a book called Unix Systems Programming, first edition.

And this was from like, like 89 or 90 or something.

And so it.

It had.

Here is how you use Open.

And then it’ll be like, except on, you know, this sort of version of BSD where it’s got a different thing.

And then except on, you know, AIX where.

So it had all this stuff and it was like.

It sort of taught me how, like, there were different versions of UNIX that had all these subtle differences which now no longer exist because it’s just like POSIX interface is sort of followed by Linux and Linux is all there is, and that’s that.

Not that it’s necessarily a bad thing, but it’s just, you know, back then you did have to have a different understanding of just the details of how things worked, because a lot of the time they didn’t sort of.

It reminds me, like, so very, very, very early on, in one of the, sort of.

The first jobs I had with computer stuff, I was debugging some issues.

I don’t remember what it was at all.

This is 25 years ago.

A little bit hazy on the details, but what I remember is that there’s this one of my co workers who’s not technical, and she was sort of shadowing me to sort of learn a bit more.

And I’m there and I’m like, okay, so I’ve logged in.

This thing’s working ls, you know, CD at this grab, you know, doing all these things, and she’s handwriting out every single command that I’m doing.

And then I figured out what the issue was.

I fixed it.

And she was like, okay, so when that issue comes up, these are the steps that you take to fix it.

And I was like, no, no, not at all.

Those.

Those are the steps I took to figure out what the problem was.

And that’s based on, like, you know, some sort of intuition and some sort of, like, I’ve seen something similar and some of it just like I got no idea.

It’s gotta be in here somewhere.

Like let’s.

When you’re doing grep, you know, var log star and just hoping something shows up.

So you’re hoping that you see something that is, isn’t normal that you normally would see in a regular operator.

I mean kind of like.

And you’re kind of doing that elimina the things that you would typically and isolating it and getting it as narrow as possible.

So when you’re in the, getting into the forensic side of things and the anti forensic side, what, what did you kind of, what where did you go after that?

Have you started looking at.

So what, what’s the other areas that you kind of moved in from then?

So after that I got interested in voice over IP telephony for a while.

It was just that there wasn’t any tooling.

So I got to write some which back then was still interesting.

There’s no documentation on problems so I had to read the RFCs and then think about like what are the things that could go wrong?

How could you attack this?

What would you look for?

So there’s a lot of that for a while I did that for a few years.

Then I switched to doing GSM for a while which like switching to mobile was again it was interesting because there’s no tooling and there’s no, like no one had done anything and you could do it all from scratch.

But then afterwards I got more interested in operational security.

That’s the thing that excited me was the how do you, like how do you keep secrets?

Like how do you actually, do you actually do the security thing?

And so I spent many, many years researching that and that took me sort of quite far from technology because people don’t write about OPSEC on computers.

Yeah, now they do a little bit, but it’s a more, more, more of the thing now.

But yeah, the time you’re talking about is it was very fundamentally new and so there was not a lot of, let’s say, you know, knowledge and education around that, you know, you could simply go and do.

But there is a lot of, you know, from a lot of, you know, the modern wars as well, you’re seeing a lot of that come to, you know, kind of really having a, a massive purpose and, and yeah, so you.

Know, at that time I started, I started doing a lot of research on terrorists and spy agencies and essentially a little bit on cartels and drug smugglers.

Like that was like all of these things are people who face like when their security fails There are very bad consequences.

Therefore they invest a lot of time and effort and energy into making sure it goes correctly.

So that was quite interesting.

And then I was also from researching the spy stuff, I got interested in information warfare.

So I was, I was quite interested in that from the beginning because I could do a lot of analysis on like what is happening in real time.

And I found that very interesting.

And then after doing that for a while, a whole bunch of people jumped into the information warfare space because suddenly it was this new thing.

And I left because I didn’t like, I don’t like being in the same domains where there’s lots of other people lightning things that are.

I kind of like doing new things or doing things in a way that other people aren’t like.

I find that more interesting.

And so I started moving towards what I’m doing now, which is more of offensive cyber operations and cyber warfare.

Trying to understand if you are a state, how do you use cyber to achieve your ends and if you’re a non state actor, how would you use cyber to achieve your ends or how would you, you know, all these things that sort of like, that’s the thing that interested me.

So I was doing that for a while.

Friend of mine strongly encouraged me to go to university and get a degree.

I got a master’s degree focusing on like cyber warfare essentially.

And now I enjoyed that so much that I’m doing a PhD also on cyber warfare.

So that’s really interesting topic.

I think it’s, it’s evolved a lot.

You’re to your point every time.

Sometimes when I, you know, I don’t know what, what’s, what’s your kind of your methodology when, when you know, you get into different scenarios, whether being nation state or you know, let’s say the, this, the mercenary type of attackers who kind of wear multiple hats and you get into the more criminal side of things.

And I always get to is, I’m always trying to look, you know, the, you know what type of activity you’re looking at.

I sometimes try to work my way backwards from using what’s the motive here?

What’s the true motive?

And I actually really enjoyed reading Jeff White’s book Rinsed because it was very much in the financial side because we always work in the digital world.

And a lot of these motives you can actually find and trace back to some type of financial money laundering.

What are they attempting?

What techniques are they using for what purposes?

When you get into of course nation state, primary goal is stealthiness, is to not know that anyone’s there because that gives you the advantage.

And again in cyber warfare that’s an advantage is to make sure that you stay hidden, stealthy, so your anti forensics and those techniques become so valuable there.

Yeah, so I found it.

So I spent many, many years figuring out anti forensics from first of all discovering what the first principles were sort of empirically and trying to reason it out.

And then once I had first principles building on that and then when I started learning about opsec and counterintelligence, I discovered that what I’d basically invented from scratch is many thousands of years old.

And I could have basically read a James Bond novel and saved myself four years.

But of course it’s different because if I just short circuited it and read someone else’s thing, I wouldn’t have this bone deep knowledge that I have now.

You created within your DNA, it’s almost become a habit that you kind of, you built your own Persona, part of it, you know, rather than somebody else’s Persona, you know, becoming acknowledged.

Yeah, it’s, it’s, I mean it’s so like once I did that and then I did the opsec for about a decade and it got to the point that I sort of, I gave up on it for a few reasons.

One of them was that I would read things and it would sort of, I wouldn’t be reading what was actually there.

I’d just be going, okay, compartmentation attempt, use of COVID You know, a concealment device, a concealment attempt, compartment.

Like I’d just, just see like they’d write a bunch of stuff and I’d be like, this is the theory that they’re applying.

This is the principle that’s being invoked like this.

So it, it was no longer interesting at all.

Like it was just, it was very, very tiring to see the same things over and over again.

And then, you know, I just, I got a lot more interested in this, this offensive stuff, particularly the information warfare, which I thought was very, very interesting that you could like changing people’s minds.

Like that seems super powerful, right?

Like it’s, it is one of the most powerful things that you can actually do.

I always love, you know, I’ve seen lots of the documentaries over the years.

I remember I was like, you know, information is like, you know, is, is powerful if you can control the information.

I think that’s one thing is, is controlling information.

But if you control how people like Interpret that information that’s more powerful.

And that’s what you’re saying is like, how can you.

Not just about, you know, get the information in front of the person, but how can you get their mind in order to actually either believe it or.

Or contribute or interact with it?

So, like, there’s a lot of really interesting things about how you go about doing actual information operations.

And there’s a lot of theory on it.

And then sort of at some point it does break down into, like, you kind of just have to know how to do it instinctively, because if you follow the theories, it doesn’t really get you where you need to be.

Like, you need to get into the mind of the person that you’re speaking to and speak to them as if you are them.

Like, if you understand things from their point of view, but the things you say have to accomplish your goals.

So there’s some.

There’s some really fascinating stuff.

Basically, in Thucydides, like the history of the Peloponnesian War, he talks about how at some point there’s this one fleet that goes.

And they’re.

They’re obviously going to come to this particular area to get to this particular stream to get fresh water.

And so the opposing side went there first and they carved a message into.

They carved messages into rocks around there saying essentially, so the fleet that they were facing then was made up of two allies.

There’s a very large contingent of one.

And they sort of brought the smaller contingent of their allies along with them.

And so the message that was written was like, to this smaller group saying, hey, we’re not your enemy.

We don’t want to fight you.

When you go to battle, don’t.

Or at least just hang back a little bit, like, you don’t have to participate on the front lines.

You could sort of shirk your duties, essentially.

Right?

And the point of that message was not actually to encourage that behavior, but instead to put into the minds of the larger ally that their subordinate ally was going to do that behavior to create distrust.

So the.

The objective is actually this.

This, like this third option that’s not listed to.

To disrupt the cohesion of this group.

And it’s fascinating because that’s from, you know, two and a half thousand years ago.

That’s literally like.

That’s from the manuals today.

That’s.

That’s what you say.

Like, that’s literally the playbook that’s happening that we’re seeing at the moment.

It always fascinates me.

One thing I always remember, there’s a Couple of.

Couple of things that comes to mind when you’re talking about that.

There was a guy that I used to work with years ago, and he was always like.

His way of dealing with situations was so unbelievable.

We’d sit beforehand, we were going to like a big meeting with a large hardware.

He says to me before.

He said, this is how I want it to play out.

I want the people in the room believing that they came up with the idea and signing it off.

I’m going, I mean, but it’s our idea.

How are you going to do that?

And I was always like.

And we’d go into this meeting and like, you know, and the way he just positioned.

He would.

He would be doing it by asking questions.

It was just his method of asking the right question.

Kind of got little seeds into the other person’s mind.

And he was just as he was observing and he was watching their feedback and their interactions, he would ask another question that would kind of like move it a little bit closer to the goal.

Right, right.

And ultimately at the end, all of a sudden the guy’s like, oh, maybe.

How about, wait a minute, I’ve got.

An idea, I’ve got an idea.

I said, I’m literally sitting in the room.

I’m just going, oh, my goodness, how did.

How did he do it?

And it was very subtle because he wasn’t just asking little questions based on the feedback and just navigating that little bit closer to ultimately what he wanted without even giving his opinion or.

Right, right.

This is the idea.

It was ultimately just getting to that person to kind of say the words that the question was kind of indicating or forcing to ultimately them believing that they come up.

And I sat there, when we come out of the meeting, I was just always like, I was.

I was always impressed.

So many times he had this perfected that he was able just by simple nudging that to get the message and get that person to.

To come up and believe it was theirs.

And I think that’s brilliant.

Yeah, true.

Kind of like, you know, cyber warfare is.

You can get the other person to believe it even reminds me of some of the stories, you know, that I always believe that, you know, Swordfish movie is one of my favorite kind of types of these styles of movies of, you know, misdirection is getting people to believe one thing, something else is happening and that I always think it’s maybe an underrated movie in the hacker theme, but that misdirection is.

Is always a kind of a real thing that you’re that’s what you’re always looking at.

And I always remember as this is Stories and Talent, where during World War II, when they were bombing the city, they turned all the lights out of the city and they built lights, like, you know, a couple of kilometers away so that when the bombers were coming over, they would see those lights and then the bombs there.

But that wasn’t the city, it was just lights.

So that misdirection area is always something, you know, and it’s.

It’s always impressive to see those types of techniques and, you know, ideas and creativity to really create that misdirection.

It’s.

It’s always fascinating.

Yeah, well, so deceptions was one of the things that I was interested in for several years as well.

Like, I actually, I gave a keynote at the, like, the UK Cyber Deception Symposium or something like that.

Like, deception is sort of.

It’s fascinating because you’re not, like, when you approach it, you.

You go like, how do I get someone to think this?

And that’s actually not what you’re trying to do.

What you’re trying to do is change behavior.

Like, you don’t care what they’re thinking.

When they do something, you want them to actually do it.

So when you’re crafting your deceptions, you’re not sort of trying to change their mind.

You’re trying to trigger a specific set of actions.

And it’s.

It’s a slightly different way of thinking about things, but it’s quite like it leads to some.

Like, I, when I was doing research, I came across some amusing stuff.

Like during the Burmese campaign, basically, when the Japanese were chasing down the British out of Burma, and the British were trying to do all these deceptions that they’d been doing against the Germans, right?

So they do stuff like they would put together like a package of intelligence information and put it in a car and then create a car crash so that when the Japanese found it, they could recover these intelligence documents.

And then, you know, oh, you know, there’s 27 divisions in front of us or whatever.

And none of this worked because the Japanese just didn’t care.

Like, the Japanese position was like, the Emperor’s soldiers are going to do this, and it doesn’t really matter what the enemy is planning or doing.

That’s not relevant to our operations.

Like, this is just what we’re going to do.

They had a very static approach that wasn’t, you know, it wasn’t a dynamic.

It was very like this, this is how we’re going to do it.

And whatever influence is not going to change our actions.

Right.

So it became impossible to get them to do anything, but, like, they didn’t ignore everything.

So one of the things that was happening was the like, Indian section was sending out these, like.

Basically they had radio traffic to like, fake divisions to create the impression of like, more men than were available.

And the Japanese were picking this up and recording everything.

And at the end of the war, they find out that the Japanese firmly believed that The British had 150 divisions when they had three.

The thing was, it didn’t change whether there were three divisions or 150.

The invasion was going to go this way and it didn’t really matter what the, you know, like what the British were doing.

So they just believed everything.

Like they’re completely like, oh, yeah, okay, 150.

That makes sense.

So, so it’s interesting.

So one of the things, so what I’m seeing.

So over the years, I do a lot of incident response.

You know, I help the certs out.

I help in countries with the different major critical incidents.

Usually is it an advisory role or kind of trying to look at the techniques.

And one thing I’ve seen evolve over the years is that, you know, a lot of the nation states, mercenaries, cybercriminal groups, they used to create a lot of their own.

They would have a fingerprint that, you know, an attribute or technique that you could easily say, this is this group or this is this is this actor became.

So, you know, even a lot of incidents.

I remember there was one I was working on a couple of years ago that I saw a specific executable on the system.

I was like, what the hell?

You know, And I was talking with a friend of mine who’s working in a completely different incident, different ransomware variant, different techniques, but we all started finding the same executable on the system.

And there was that one thing that connected, it was the same group.

They just had different campaigns operating at the same time with different victims.

So you’re able to kind of trace back into kind of, okay, these, while they’re using one technique here with a different ransomware variant.

Because that was the way they get evade detection and, you know, get mass impact on that victim.

But where the one I was working on it was, it was like different, slightly different techniques.

So sometimes you start looking for those IOCs that can give you some sort of like, you know, understanding.

What I’m finding is a lot today is that, say, and maybe some people like me were old school, we would still go to those techniques because they still work but the more modern younger actors, you know that, you know, that new generation finding is, to your point, what we talked about earlier, they’re very much tool users rather than the script creators.

So they tend to go and look for other actors techniques and use them as their own.

And this gets into this fuzzy area of the operational side of things is that if they’re using other attackers techniques and masquerading behind them that disinformation or misdirection, but they’re pretending to be another country.

Are you starting, is attribution in this?

You know, Osint and warfare are starting to become very fuzzy because they are starting to kind of make it very difficult to determine what is true attribution because the techniques are so coming up as like, you know, one apt group is this.

And all of a sudden now, all of a sudden the campaign shows that like it’s operating like a different one.

How is that impacting the work that you’ve seen and been doing over the years?

Yeah, so the short answer is I don’t, I don’t deal with any of that.

My, my primary focus these days is sort of Russia, Ukraine, like cyber war, which I define as sort of just like air war is the air component of a war.

A cyber war would be the cyber component of a war.

So I’m looking at an actual additional large war that’s going on.

And then how is cyber used within that context?

So one of the big things that comes up is a lot of the rules that make sense during peacetime just don’t matter anymore.

Right.

So stealth during peacetime.

So you could basically say that there’s, it’s competition, competition, another one, competition, contest and conflict.

Those are the sort of the three states that you could sort of be in.

And peacetime is basically the first two.

So it’s during these phases, things like deniability and not being detected and not being attributed.

These are very important because you want to for political reasons.

They’re sort of political drivers of what you’re doing and how it can appear during wartime.

That doesn’t matter.

So if you’re dropping bombs on someone having your hacking tools found on their computers, it doesn’t really change things.

It doesn’t lift the needle because you know who you have already a conflict with.

Right.

It’s like, what are they going to do?

Shoot us more?

Like, you know, send more drones?

Like it’s, you’re not really moving the needle there.

So you don’t need to spend as much time and effort on that.

You know, the stealth that you need is to not be detected while you’re operating until you’ve achieved your mission objectives.

Yes.

Until the main goal has been achieved.

Right.

And then who cares?

So actually that’s what we see is that the, the tools that are being used in Ukraine tend to be these, like, these, these cheaper, simpler sort of, they’re ready to use and they’re not like, they’re not sophisticated like the, the.

Our boros.

Like that Snake malware that went up for 20 years that was updated and had all these complex, like, you don’t see that stuff because it’s not worth wasting.

There’s a Chinese saying which I think might apply here, which is that you don’t use good iron to make a nail, nor a good man to make a soldier.

And it’s sort of like you’re not gonna.

You’re expecting this stuff to get burned very, very quickly.

So you don’t want to put any more effort than you need to.

It’s good enough.

These are the things that you start to find.

And to me, that’s very, very interesting because a lot of the theory that gets developed of, you know, like, here’s how you have to do stealth, and here’s how we have to, you know, make sure we don’t get detected.

And it turns out that’s not actually true.

Like, that’s.

Those are not the rules of cyber war.

The rules of cyber war are completely different.

And sort of, that’s my PhD.

That’s what I’m looking into.

It’s like, what is.

What’s really going on?

What’s the.

What are the real.

The real issues here?

So my throat’s going.

My throat’s going.

It’s been an hour.

So.

Question kind of summarize things up as well.

How do you stay up to date?

What’s the things that you do?

You’re doing your PhD on this subject, which is fantastic.

I’m really excited about to read the research and stuff.

When you’re finally, you know, getting it published, how do you step to date?

What’s the tools and resources you go to?

Where’s your reading material in order to learn?

Yeah.

So it’s not very exciting.

I’ll admit.

A lot of what I do is monitoring Twitter for current events.

I check, for example, the Ukrainian newspapers, they tend to publish things that happen.

I keep up to date with think tanks when they put out papers.

I read a lot of academic articles, and I don’t recommend that to anyone.

It’s good for.

It’s good for research and Understanding how things work though, right?

It can be.

Not in cyber.

Unfortunately, there’s.

That’s the huge part of my PhD actually is the difference between cyber theory and cyber reality.

Or like cyber theory and cyber practice is significant.

I’ll leave it at that.

But yeah, and then there’s a lot of just talking with people, like, that’s a huge part of how I stay up to date on things is being in contact with people involved in a sort of let me know what’s going on or what to look for or oftentimes because the public reporting will be public.

Right.

So it’s.

It’s useful to, like, you.

You read a report and then you speak to some of the people behind it.

You say, like, look, this part is a little bit confusing.

Could you explain it?

And then from those details, you get a much deeper understanding of what’s actually.

Gives you more context.

Hang on.

Yeah, context.

Because you might see something and you’re like, oh, okay, that doesn’t connect or it’s not connecting for me for whatever reason.

And therefore just asking the questions.

You can actually get that context from the individuals.

Yeah.

Always a valuable resource.

So it’s fantastic having you on.

What if.

If the audience do come back and they have questions or they want to kind of follow up, where’s the best place.

Where’s the best place for them to get your knowledge?

You do have the website, I’ll add to that, right?

Yeah.

So I guess these days still the best place to reach me would still be on Twitter or X for.

For the new gen.

I’m still calling it.

Yeah, it’s Twitter.

So the Grug T H E G R U G Q. Yeah.

And that’s it these days.

Like, I’ve got a newsletter as well, but that’s just a summary of basically what I’ve read today.

Okay.

So I sent that out daily, which you can sign up for that.

That’s about it, really.

I do need to start publishing.

Like, I do a lot of writing but not a lot of posting anymore.

So.

Yeah, it’d be good to get your writing.

I think I still have some of your old stuff in the GTFO stuff, because I think that was.

You said you do a lot of articles in the.

In the gtf, so.

Yeah.

Yeah.

The old bibles.

Yeah.

Fracking everything.

Yep, very much.

Fantastic.

Well, it’s been fantastic having you on.

It’s really always great catching up with you.

You’re always a wealth of knowledge and I always enjoy hearing.

Hearing your stories and what you’re working on.

And really, I’m really, you know, good luck in the PhD.

That’s impressive.

We call Dr. Dr.

Soon.

Yeah.

So for everyone, hopefully this has been educational, you know, lesson of, you know, history and how all we used to do things in the past and what’s happening today in the world in information, it’s evolving and we really do have to have a better clarity and context of what’s happening.

Information today is so, so fuzzy and so muddy that sometimes you have to see through what is the real true message.

So awesome having you on.

Always great chatting with you.

So for everyone, this is the security by default podcast.

You’re really bringing clarity to the world of chaos and information.

Every two weeks, new episodes tune in.

Subscribe, share it with your friends and colleagues until the next episode.

Take care and all the best.

Thank you.