May 13, 2022

Making Hacking Accessible with Deviant Ollam

by Hacker Valley Red

Show Notes

In this season of Hacker Valley Red, we focus on cybersecurity legends in offensive operations with a legend in physical pen testing and lockpicking: Deviant Ollam. As a pioneer in our industry and an author of two incredible books about lockpicking, Deviant shares his history from hobbyist to professional and all that he’s learned along the way. He also discusses making the secrets of the hacking world accessible to all.

Timecoded Guide:

  • [01:28] Defining the pioneers in cybersecurity
  • [08:47] Deviant’s first explorations in lockpicking 
  • [16:03] Accessing and democratizing hacking secrets
  • [18:58] Becoming an author to transfer his knowledge
  • [23:12] Seeing the past, present, and future of hacking

 

Sponsor Links: Thank you to our sponsors Axonius and PlexTrac for bringing this season of HVR to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone

PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley

_________

 

What does it mean to be a pioneer in cybersecurity? 

As our season focuses on legends, it’s important that we explain what makes these individuals such a vital part of our community. In the case of this episode, we explain that our guest Deviant is nothing short of a pioneer. Deviant has been willing to take on new challenges and revolutionize the industry throughout his career, influencing hundreds of individuals and leaving a lasting educational impact on the entire industry.

“That ‘zero to one’ part can be the hardest part of any progression in any field, but especially in cybersecurity.” — Chris

 

When you reflect on changing this whole industry, how does that make you feel?

Despite our guest’s legendary reputation, Deviant is humble about his achievements, caring more about how his work has impacted others than himself. What he focuses most on in his teaching, presentations, and writing is making lockpicking and penetration testing accessible and understandable. Instead of harboring secrets and perpetuating exclusionary policies, Deviant wants anyone to be able to master these skills and understand this knowledge.

“I’m not the first one who ever did this. What I like to think of my contributions is that they have chiefly been making it accessible and democratizing this knowledge.” — Deviant 

 

Do you think it's harder today to stand out than it was a couple of decades ago?

For Deviant, our globalized internet and algorithm-focus social media sites are both a blessing and a curse. While knowledge can be found on every corner of the web and anyone can become familiar with the information that was once borderline inaccessible, Deviant also recognizes that younger hackers and lockpickers will have a very different rise to success than he did years ago, especially due to fragmented audiences and tricky algorithms. 

“We have more avenues to put yourself on display, to put yourself out there than ever before, but that means the audience is fragmented and is spread so thin.” — Deviant

 

What piece of advice would you have for the folks that want to make an impact in security and technology and in our community today?

Although success will look different for newer members of our cybersecurity community, Deviant is confident that the younger innovative minds of the future will be able to solve so many of the long-standing problems within our industry. However, he reminds our younger audience that they need to still respect the tenured members of the cybersecurity world and learn from them without oversimplifying the issues past professionals have faced. 

“Start thinking about it in a way that doesn’t use ‘just,’ because every old head in the industry has heard that….We couldn’t ‘just’ do it, or we would’ve ‘just’ done it.” - Deviant

 

Hacking the Vocabulary:

Physical pen-testing — A simulated real-world threat scenario where a malicious actor attempts to compromise a business’s physical barriers to gain access to infrastructure, buildings, systems, and employees.

CVE— Common Vulnerabilities and Exposures (CVE) is a database of publicly disclosed information security issues. 

Lockpick Village — A physical security demonstration and participation area where participants can learn about the vulnerabilities of various locking devices, techniques used to exploit these vulnerabilities, and practice on locks of various levels of difficulty.

Additional resources to check out: Robert Morris, the Morris worm, TOOOL, the CORE group, Practical Lock Picking: A Physical Penetration Tester’s Training Guide by Deviant Ollam, Keys to the Kingdom by Deviant Ollam, DEF CON

________

Spend some time with our guest, Deviant Ollam, on his website, Twitter, Instagram, and Youtube channel

Keep up with Hacker Valley on our website, LinkedIn, Instagram, and Twitter

Follow Ron Eddings on Twitter and LinkedIn 

Catch up with Chris Cochran on Twitter and LinkedIn

Purchase a HVS t-shirt at our shop

Continue the conversation by joining our Discord

 



Transcript

Chris 00:50
And we are back with another season of Hacker Valley Red, where we are exploring the nexus of offensive cybersecurity and humanity with a hacker’s mindset. I'm one of your hosts. I'm Chris Cochran.
Ron 01:04
And I'm Ron Eddings. And this season, we're going to be exploring cybersecurity legends, people that have really put their heart and soul into this game of red teaming, offensive operations, and hacking, and we're going to be breaking it down and showing you all facets about cybersecurity legends. This episode, we've actually brought in a founding member of offensive cybersecurity.
Chris 01:28
I'm super excited for this conversation. But first, let's talk a little bit about being a pioneer. What does that really mean in cybersecurity? Really, the pioneers are the people that are stepping into the darkness, they're stepping into the unknown. They have no peers, and they are the ones that are going to illuminate everything for the rest of the world. It's honestly a pretty scary place to be, but it's also very, very exciting. A lot of folks talk about "zero to one" and "one to 1000," that "zero to one" part can be the hardest part of any progression in any field, but especially in cybersecurity. So, think about all of the folks that started all this stuff, the folks that were tinkering and playing around with computers before we even imagined what they could be on the internet.
Ron 02:15
Yes, stepping into the unknown. When you think about the unknown, and the pioneers, the legends, who is the first founding member, the first cybersecurity expert that you've ever heard of?
Chris 02:28
You know, it's so funny. I did something, I think I was doing maybe my security plus or something like that, and they spelled out the different types of attacks. And they said, "The worm does X, Y, and Z." And the first worm was the Morris worm, from Robert Morris, but I didn't really understand that story until I did my own research into what that story was all about. I just thought it was just some hacker that was just trying to do something funny, but really, if you look into the history of it, Robert Morris was actually the son of another computer scientists, a computer scientist who was at the National Security Agency like we were, and this kid was in college and he devised a way that he said, "I want to see if I can map the internet, I want to see if I can connect to all these different computers." So, he wrote this
program and what this program did is it went to your computer, and then it went to another adjacent computer, but the problem was that there wasn't a check in order to see if it was already infected and if it was already infected, it would not run. But this would continue to run and reinfect, and it took down 10% of the computers in the world at that time. So, there was a lot of money that had to go into fixing all of these computers. So, when I think about like the really early stages, right? So, that Morris worm became all these other wormable attacks that we see today.
Ron 03:50
Right. Exactly. You know, that's one of my first recollections of it, too, especially when I was in school learning about computer programming. They would always refer back to the Morris worm, and it actually inspired me to create my own exploits. I will be honest, I was a little destructive when I was a teen, I wanted to break into everything. I actually got my start in cybersecurity because of AOL Instant Messenger. I was talking on chat with my friend, we would talk about sports, talk crap to each other, but we would also talk crap to other people and that was not the best idea because someone sent me their own rendition of a virus, or a worm, and it started to not only attack my computer, but it started to propagate and spread around just so they created that persistence. It was almost like my computer literally got a virus. It had this virus and was infested. Exactly. And it made me think about creating my own exploits, but not from the idea of going deep into C programming or assembly, but using someone else's program to my advantage, understanding how a program was built, looking at the source code, and then saying, "Ah, they put this fix in the program to protect against too big of a buffer size." And I would just use people's programs against them instead of creating my own when I first started to get into this world of red teaming and exploitation.
Chris 05:23
I don't know if you remember Bad Store, but Bad Store was a program that you could load up onto a server and the server could be just the size of your laptop. It was basically a website, that had every single issue you could think of. Like, you could do SQL injection, you could do all sorts of different types of things to basically get information from a database, or anything else. You could do cross site scripting, all this cool stuff. And really, it was like the origin of the Escape Rooms, because I was like, "Oh, man, it's so cool that you could go into this application, and commit all of these crimes in a very safe way, so you don't go to jail," because you know, I definitely don't want to go to jail. But what I love about being able to play, and I think we're going to talk about this a little bit when we talk to Deviant, who is the guests for this particular episode. Deviant is someone that I look up to in so many ways. He is definitely a founding member on the red side, when you're talking about physical pen testing, you're talking about lockpicking. He's a part of TOOOL. He's a part of the CORE group, where— I used to be a part of the CORE group, where we would break into places and we would teach other people at Black Hat to break into places as well, but it really is all about mentality. It's all about a mindset when it comes to the red side. Sure, the tactics and techniques might be different. Picking a lock is much different than popping a shell, but really, the mentality is all the same. It's the tinkering, the puzzle solving that I think inspires everyone. When you pick a lock and the shackle opens, there's an endorphin rush. When you see that terminal has connection to someone else's computer, an endorphin rush. I'm sure you felt that several times.
Ron 07:07
Yeah, for sure. I mean, there's nothing like it, especially when you are going to these new frontiers that we're talking about. When you're trying to discover something that no one has discovered before. In the case of me, I was trying to figure out how to teach people, in the simplest way, how to look at a vulnerability, a CVE, and use that CVE to create an exploit. And for me, to go through that process and to create my own exploit, you get that endorphin rush and it just feels so special.
Chris 07:41
It feels special, and it makes you want to do it again. It's that brain reward mechanism. You're like, "I want to do this again. I want to do this again." I've like, seen some slick lockpickers. And I mean, these folks are just so good, it almost seems like they just put the picks in and then boom, it's open. It's like what the heck? How'd that even happen? But the same goes for folks on the red side of the house from a cybersecurity perspective. I love sitting in a CTF, and it's quiet and everyone's focused and you just see the leaderboard just kicking up, and you see people just kind of get that jolt of energy whenever they do something. That's what's so inspiring because all these pioneers, all the folks that started the hacking, all the folks that created DEF CON, Dark Tangent, right? Some of the greats, the most monumental people in our space, they have led to thousands, if not hundreds of thousands of people that have gotten into cybersecurity and have gotten into the red side, the offensive side. So, with that, we're gonna jump right to this interview with my good friend, Deviant Ollam.
Deviant 08:44
Thank you so much for having me. It's always good to be here.
Chris 08:47
It's always good to have you brother. And one thing that I've loved about you is that, even though you are like, a founding father, at least in my eyes, for cybersecurity, and really on physical pen testing, you're still the most humble, relaxed, and empathetic guy I know. But for the folks out there that don't know who you are just yet, we'd love to hear a little bit about your background and what you're doing today.
Deviant 09:09
Yeah, so I am Deviant Ollam, spelled not at all like it sounds if anyone's trying to find me on the
internet, figure out what you're saying. But I have been around— I've been around the hacker
community for a while, the gray in my beard has come in proper like. So, I used to show up back in ye olden times at hacker cons and such when there weren't really separate tracks. We're talking single digit days of DEF CON and so forth. And this would be like, "Oh, someone's doing a talk," and then they'd be out in the hallway. Like, they just— Now here's the time to spread my stuff out. Here, I put a Linux on a toaster or something. It's like, sitting out there in the hallway. So, I was one of the people who was doing a lot with lockpicking back around like, well, some of the first hacker cons, and then at conferences in New York, then conferences at DEF CON, I would sort of like, give a talk and then just spread out locks in the hallway, or by the pool at DEF CON, near a hot tub, just handing out picks and locks and stuff. And this was right around the days— Really old heads of DEF CON will remember the Alexis Park Hotel? That one, but then the next property that DEF CON moved to was going to be the
Riviera, which has also now been made obsolete.
Deviant 10:25
But the Riviera had this conference floor with what were called "sky boxes" all up and around the building, and they said, "Man, we're gonna get the sky boxes, but we don't know what the hell to do
with them." And they were like, up this weird hallway, but they're really cool, but no one's gonna go up there. So, Russ Rogers, Dark Tangent, and some others, they came up to me and they said, "Hey, that thing that you and some other people do with the lockpicking stuff." And I wasn't necessarily the only one doing lockpicking, a lot of the Colorado crew was doing it, the whole 719 group would come in and they were like, "Yeah, so when those other presenters start winding down, they're going to want to just chill by the pool, but this whole 'sky box' idea... Do you think, if you had space, could you make something happen? Because like, that could be a draw to get people upstairs on that level." And I said, "Yeah, let's do it." Let's talk, you do that, maybe you do some hardware hacking, talk to Joe Grand and other people. And that was the earliest days of what now a lot of cons have, which are called "villages," right? So, that was the Lockpick Village, that was us, then there was a wireless village, which at the
time was just called "WIFI Village."
Deviant 11:27
Like, listen to and learn how to crack WEP like, you know? How much could you do? Nowadays, there's tons of RF hackers that do amazing things. I mean, you know, you go to DEF CON now and there's like, 20 villages. There's a cryptography village, there's a biohacking village, there's a car hacking village. So, the origins of Lockpick Village were Jeff and Russ and others saying, "How do we get hackers to come off the con floor and go to these upstairs skyboxes?" So, that was way back when like, DEF CON 14 or 15. But I've been doing that ever since. I've been a part of TOOOL. TOOOL is The Open Organization of Lockpickers. So, we've been bringing that kind of content all around the country and around the world. And then I learned, as any young hacker kid eventually does, that money can be exchanged for goods and services. So, you get yourself a legitimate job and you make a career out of what you love. And of course, you know, Babak Javadi very well. He's been around. Babak and I have had a company doing professional security consulting in the physical space for a very long time and I'm very, very lucky for all the physical doors of opportunity it's open for us.
Chris 12:32
So, tell us a little bit more about the early days of utilizing the thing that you love to do and it taking up so much of your time. Was it the puzzle of the locks itself? Was it the community? What was it that drew you to lock specifically?
Deviant 12:47
People like to legitimize their hobbies in a way that makes it sound professional sometimes, like, "Well, I was a security researcher." Like, "No, you just like popping shells? I know what you were doing that for." Yeah. So, it's okay to be honest with ourselves and say that any time of there's sort of a forbidden knowledge or a, "Whoa, I can look behind the curtains, I can see what you don't know I can see," that's a mentality that drives a lot of us when we're young and experimental. And, for me, a lot of that, that was lockpicking. I never saw it going somewhere for years. I just saw it as, "Hey, I can do this thing that you're not supposed to be able to do. I can open this lock, even though I'm not stealing," like, knowing like, I could and I could steal. It's the same reason that a lot of kids do a lot of urban exploration in abandoned buildings. Maybe they fancy themselves like, cat burglars or something like, "Look, I'm on the roof." Well, there's nothing up there to steal. You're not breaking into a diamond vault, but like, what if it was a diamond vault? I could be, you know? Yeah. So, just being able to play like that.
Ron 13:51
Are one of those keys behind you the keys to Chris's house?
Deviant 13:55
I mean, they could be right quick, right? I keep a large array of key blanks. Most of these are all really rare key blanks. They're not exactly the normal ones. So, there are different manufacturers. Yeah, here you go. So, here's a block of locks, right? These are all different Schlage locks. And Schlage has different keys in their key series, but what you can actually get are upper level keys in this tree, and a key that might work some of these like— Well, there's actually keys on the wall there, for different brands, it's like they work all the locks in the series. So, I mean, I have like, the super top Schlage key, the super top Sergeant key. If someone gives me a key and they say, "Hey, can you copy this? I'm not sure which Sergeant lock it is." It doesn't frickin’ matter. Like hey, yeah, it's gonna fit on this one no matter what.
Chris 14:46
Yeah, I remember when I first started hanging out with you guys, I showed you my key house at the time and obviously I don't live there anymore, but I definitely changed the locks after. The code was like 11112, and you were like, "There's no way this is like, a real key, get this out of your house like, ASAP." Do you remember that?
Deviant 15:05
Of course, man, of course. And that still sort of happens to this day, people will— I love it when it's students in our class, and we start telling them about how bidding works and how keys work and they go, "Oh, man," and at lunch, someone will come up to you and be like, "Hey, don't show anyone else, but look at this, look at this crazy key." And it's like, "What is that?" And they're like, "It's my landlord's key, he gave it to me." Like, all right. Good job.
Ron 15:28
So, we titled this season Cybersecurity Legends, and I think like, what you're saying is you don't really know what you're getting yourself into. You're just exploring a hobby, you're loving it, but now, you've made it so far in your career and it's a perfect opportunity for reflection. You have one of your pupils here, Chris was one of your pupils. I know that y'all go way back. When you reflect on just changing this whole industry, like creating this realm of physical penetration testing and really helping expand it so other people can also practice it, how does that make you feel inside? And like, what kind of thoughts and emotions come up?
Deviant 16:03
I think who once was a student has now become the master. But I do like that, because as anyone who really knows, I mean, I'm not the first one whoever did this. What I like to think of my contributions is they have chiefly been of making it accessible and democratizing this knowledge. There's a lot of very private knowledge about security testing and awareness that wasn't being talked about. And, for whatever reason, there's a number of industries that rely heavily on secrecy. They tell themselves that, "Well, if this knowledge were to fall into the wrong hands," and I mean, what they're really doing is like, "If this knowledge were to fall into our competitor’s hands..." There's a lot of guardedness there where industries just don't want competition, and I've never really believed that I believe that security is a huge pie and the stakes are so high, it's far more important for me to have competitors trying to take a bite of
that pie if it means that the customers and the public are getting serviced properly. I mean, just right now, I was sending an email before we jumped on to somebody who said, "My apartment building keeps getting broken into. The front Plaza, like the front little lobby door, where all our mail is, there's somebody that keeps breaking in and we see him on camera, we don't know how they're bypassing the door."
Deviant 17:15
And there's far more good people in the world than bad people. You might see a story like that and think to yourself, "Man, that could be Deviant's fault. He's been giving lectures. What if a criminal watched that and now that criminal is using his techniques?" You could throw that stone at me, that could be true, much as you could walk up to a martial arts dojo and say, "What if somebody learns how to beat people up? They're gonna go mug people." And the answer is, "I mean, yeah, there's just crappy people in the world." But there's far more good people in the world than bad, and sharing this knowledge, the fact that the residents of this apartment building knew enough to say, "Hey, I saw you on YouTube. You talk about this stuff, can you help?" And giving people, arming people with the ability to know there is a better way to understand why something could be violated and be broken. You're ultimately helping the world by exposing weird, strange stuff, and I think that's the right thing to do. I think that's my reward, is every time someone says, "Hey, I saw that thing you did." I don't care if they're emailing me and saying, "I saw that thing you did, can I pay you some money?" Or if they're
emailing me and saying, "Hey, I saw the thing you did and here's how we fixed it ourselves with like, a hammer." Great. I didn't even have to come out there.
Chris 18:27
You talk about making an impact, and you talk about making information digestible for folks. One of the best ways to do that is to write a book, you have a book, Practical Lockpicking. I'm sure that was such a labor of love to put all those images and put all of your thoughts about the world of lockpicking and physical penetration testing into something that you could just hand out to people like, "Hey, you want to know the basic levels of a lot of this stuff? Boom, here you go. Here's a book." Tell us a little bit about that journey of writing that book. Was it difficult for you? Or was it just super easy?
Deviant 18:58
The hardest part was, I mean, I'm a really fast typist, but even then, it's all up here and you just want to get it out, get it out, get it out. It was like, a funnel thresholding down into like, a pipe. And it was the throughput of just how much I wanted to get out. Yeah, I mean, I wrote that book in a few months. The images, making all those new images, that was the best part because those really live on. We use those diagrams in our slides and trainings to this day. They've been the basis of my animations and many other people's animations, because I just put them all out open source, right? For Creative
Commons, anyone can use those diagrams. Anyone listening, if you have some kind of cool idea, or something you just think would be interesting, trap yourself into something where there's a deadline. I know it sounds counterintuitive. It sounds stressful, but my best work has always been done in the context of a forcing function, right? I've had, I don't know, can we talk about guns for a second? Guns are kind of related to security. So, I've had so many gun parts kind of laying around that have been like, project ideas for this, project idea that, and then I found out in Florida, there's a gun match, it's actually— I'm leaving in two days for it. There's a gun match called The Gunmakers Match, where every entry has to be a home build, and you can't be off the rack. And I said, "All right, I'm going to sign up for this match." And now I have to finish building like X, Y, and Z. And I'm really glad I did, because Washington State changed their laws. So, literally, I'm going to go shoot the match and then, I got to put all these guns in one of our offices, or something out of state, because Washington doesn't allow anyone. But if I didn't do that, if I didn't set myself up with that forcing function, I would have been out all of this money, all this investment, I would have been stuck. Like, I'll set a talk, I'll submit a talk idea, or I'll submit a training. And I'll say, "Look, we are going to be the company that does the new RF-based alarm system attack, we've got this hardware, we got to turn it into a training." And sometimes the guys, like our TA will be a little bit on my case, but I'm like, "No, I put it on the calendar. I put it on the calendar for October." And they're like, "Why did you do that? You should have asked us." I said, "I did ask. I asked you right now." It is how many months between now and October? If we can't get our act together between five months from now, we don't deserve to be running this training. I'm really pushing my views on others when I do that, right? But that's how I have to do it. Forcing function, shit or get off the pot, man.
Ron 21:25
Yeah, that is a principle. It's a Parkinson's Law. It's like, you commonly over anticipate the time. Like, you're like, "Hey, I could finish this in three days." And then you wait to that very last day, and it really only takes you one day, because you can complete what you said you were going to do in that amount of time. If you say you're going to clean your room in one hour, then it's going to take you one hour, maybe it's just not as clean as you thought it was, but you are going to be done cleaning in one hour if that's all you give yourself. And it makes me think, right? You've been in this industry for quite some time, we all have that knowledge. The things that you knew back in the day, when you first were getting started, if you were to teleport yourself 10 years ago to today, would you be successful? Would you be able to still break into buildings and locks? Have things changed is what I'm really asking?
Deviant 22:16
So, if I took my knowledge of today and went back in time? Or if the kid I was 10 years ago— So, if the 10 years ago me suddenly was dropped into this? I think I would be successful. I don't know if I'd be successful at this. I was successful, because I looked at something that no one was doing yet and tried to turn that into my thing. What is the thing right now that no one's doing yet, but it's gonna become big? I don't know. That's a younger man's question, I guess.
Chris 22:49
Do you think it's harder today to do those things? To stand out? To do things that other people aren't doing? Because our access to information is incredible compared to it was 10, 15, 20 years ago? Some do you think it's harder now because everybody's looking at pretty much everything it seems, or so it seems. There are a few like, diamonds in a rough that no one's even looked at, but do you think it's harder today to stand out than it was back then?
Deviant 23:12
I think it is harder. It's a paradox, right? Because with YouTube, and Instagram, and Tiktok, and all these places where people are suddenly trying to just make a name for themselves, we have more avenues to put yourself on display, to put yourself out there than ever before, but that means the audience is fragmented and is spread so thin. And I won't deny that it's a little bit frustrating how everything is about gaming the algorithm. I couldn't have the channel that I have now. Like, my channel just kind of grew organically over the years, right? I don't know if any social media type outlet can grow organically anymore, even the big ones. I love a couple really big science and education YouTubers, you might know this, but the audience might be like, "Oh, God, I've seen that." You'll get like a notification like, "So and so has released a new video," and you get the little thumbnail and you watch it and you're like, "Oh, this that's educational, thumbs up, click." But then later on, when you're checking YouTube later in the day, you'll be like, "Wait, didn't I just watch their video? That looks different." And the thumbnail is different and the title is different, because what they're doing, and all the big channels do this, I don't have time for this and it's amazing that anyone does, but they will for the first hour or two of releasing content flip through a bunch of different thumbnails, and a bunch of different ways of naming their title, and watch in real time, watch their analytics to see which one it's like, fishing for the algorithm. And when one takes off, they're like, "Alright, stick to that one. Stick to that one." Yeah. So, how a young up and coming voice could do that. I don't know. I don't know if it's feasible that way. Maybe that's why everyone's on different platforms now like, TikTok, or something.
Deviant 23:15
Right. Deviant, there's someone that's listening that has heard your accolades, heard your story, heard your journey, and they're like, "Wow." It seems like it's a lot harder today to be a pioneer, to be a founder in this thing called cybersecurity, because it seems like there are more topics and pathways today than there were 10, 15, 20 years ago. What piece of advice would you have for the folks that want to make an impact in security and technology and in our community today?
Deviant 25:26
Definitely listen to what the old head folk who are already around, listen to what they're frustrated at, but don't listen to them when you talk about, "Could you solve the problem this way or that way?" In general, there are certain problems that are still frustrating the people and they haven't been solved yet. If you respond to that problem, you say, "Hey, what if you did this." The only thing you're going to kill yourself on is: get the word "just" out of your vocabulary. You talk to an old timer in the industry, and you say, "What still frustrates you? What's the perpetual problem that's still around?" And they'll tell you this, "Well, we haven't really solved for how to implement blah, blah, blah, cleanly." You think about it, you say, "All right, there's still opportunity, that's still problem," and then start thinking about it in a way that doesn't use the word "just," because every old head in the industries heard some, "Well, if they just used quantum position magnets." No, they can't just do that. It's been tried. You just sound dumb. If you could just do it, we wouldn't done it, and it would have gotten somewhere. But that's the thing, finding out what frustrates the people who've been around for a while. And you learn about that not usually in the big mainstage talks, the mainstage talks is nowadays, let's be honest, it's mostly people looking for new jobs and going from one company to the next. It's like, "Hello, I work at Microsoft, and I'm probably going to work at Tesla after this. It's really quite simple. See this amazing thing. Anyone who has me can do this." But what you want is to go to those villages, to go to those small out of the way places and smaller regional cons, where you really get someone who says, "This is this thing, and
no one's actually implemented this yet." Chew on that, because you, the new voice coming up who doesn't have all this ingrained baggage that we all have from being around it forever, you're gonna be the one who comes up with the new thing. And if you pitch it the right way, which what's the word we don't use? The word is just. If you say, "Well, could we blah, blah, blah," or "I've thought about maybe this, that, or the other." And if someone doesn't immediately try to slam the door, you might be onto something there.
Chris 27:33
There you go. Make way for the new voices and the new minds. Deviant, thank you so much. As always, it's an honor to sit and chat with you. For the folks that want to stay up to date with you, your incredible content, and everything you're doing for our community, what are the best ways that people can do that?
Deviant 27:49
Yeah, we always joke that Deviant Ollam spelled not like it sounds. It's Deviant spelled the right way. And Ollam is O L L A M, Deviant Ollam on Twitter, on Instagram, on YouTube, on GitHub, on probably something else out there. You search my name plus various strings of profanity, you'll probably find me.
Ron 28:07
When we first met Deviant, I knew he was something special because you introduced me to him. So, he already had credibility in my heart, but just to see his confidence with lockpicking, to see his confidence with being a teacher and articulating all the things that people should be mindful of, but also articulating the things that he's really, really good at. And in this conversation that we had with him, it made me also realize everything is changing. Cybersecurity is not the same, it's not going to be lockpicking as much anymore because we are at home. This is the world of digital transformation and it's happening right now. So, we have to also talk about: What is the future? What is the next frontier of cybersecurity? When you think of that, what comes to your mind?
Chris 28:55
Yeah, you're right, we're in this new phase of cybersecurity. There are new pioneers that are up and coming right now. Obviously, with everyone being home, there's probably not as many people doing physical pen testing, but I think it's going to come back. People are going to start returning to work, it's going to be more important, honestly, is going to be even more important because we're going to be out of that muscle of making sure that people are who they say they are, making sure they have their badge. There's going to be a bit of a slow start, I think, in the beginning when people start coming back. So, making sure that we still dive back into physical pen testing. I'm sure there's gonna be all sorts of new things there, but honestly, the best thing I think that we're going to see going forward is offensive security in the cloud, because now everything is so interconnected. If you think about a puzzle, right?
When you're young, there's like a 10-piece puzzle. The pieces are very formed so you know exactly where they need to go. But now, look at a puzzle that has a million pieces, and that's what I think about when I think about the cloud. Now, you got to think about all the different connections, all the different attack surface that you need to be cognizant of as an individual, as a company, but this is giving a complete playground for folks that want to be on the offensive side. "Oh, this is connected to this, so that means that if it has this particular dependency, I might be able to use that to get access." There's going to be a lot of folks that are going to be really focused on the cloud, in my opinion.
Ron 30:19
Yeah, just imagine if you combine the cloud and physical pen testing, lockpicking, because a lot of the information that we use that used to be on our computers is now in a data center. And I'm sure that now, with digital transformation, more people working remote, just the threat of someone breaking into a physical data center or building, it's probably decreased a little bit at least. And if someone were to combine the two, to break into a data center, plug in, drop exploits all over the place, then to also take advantage of cloud configurations. That's really, I think, the next frontier for what we're going to see from criminals, and maybe even when we can see with the capability of red teamers and pen testers, to really have that holistic view of security. Not just the cyber aspects, but looking at security as a complete domain.
Chris 31:14
When we look at Deviant, he was such a good communicator, as an instructor, as a friend, as a
lockpicker. And that's something that PlexTrac is trying to solve. They're trying to solve that
communication problem, the context problem between the blue and the red teams. They have an application that's going to enable you to put all your information if you're on the red side, or ingest all the information on the blue side, so that you have a place that you can make sure that all of that hard work does not go unused. From your perspective, Ron, when you look at this, you look at communication, what is the most important aspect of communication when it comes to red team information on the blue side?
Ron 31:55
The most important aspect in my heart of hearts is just that: communication. I mean, it's very difficult to describe how to communicate, right? You need the right tools, you need the right opportunities to facilitate that communication, and that's exactly what PlexTrac does. It brings red teamers and blue teamers together and it creates this color that we call purple. Purple is, you know, mixing those two elements together because it's one team and one fight, and that's exactly what PlexTrac does through their platform and we would highly recommend for you to check them out. They are a sponsor of this episode, but they are also friends of Hacker Valley. Check them out at PlexTrac.com/HackerValley. That's PlexTrac.com/HackerValley.
Chris 32:45
Absolutely. We have many more conversations upcoming with some of the legends on the red side of cybersecurity. I cannot wait to continue this journey to reunite the red side and the blue side and find out about more legends.
Ron 32:59
So, that is what we are going to do. Stay tuned with us on Hacker Valley Red finish the season. We have additional seasons that we've done in the past highly recommend them. And if you want to stay up to date with Hacker Valley, the guests, Chris and myself, we have launched a discord you can check us out at HackerValley.com/Discord. Join us in the server, drop us a line and stay in touch. We'll see you all next time.

Keeping It Open Source with Metasploit’s HD Moore

July 1, 2022 Hacker Valley Red

00:00:00