Reconnaissance in Cyber Security: Lessons from Mr. Robot ep 1.1

Reconnaissance in cyber security isn't just about scanning networks; it's about understanding your entire attack surface, including the human element. In this episode, Curtis and Prasanna analyze Mr. Robot season one, episode two, (AKA ep 1.1) to explore how sophisticated threat actors conduct reconnaissance before major attacks.
Learn how F Society mapped Evil Corp's infrastructure, identified backup locations like Steel Mountain, and used human intelligence to target vulnerable employees. We discuss the reality that attackers will spend months researching your organization, mapping your networks, and identifying weaknesses in both your technology and your people.
The hosts break down practical reconnaissance techniques, from social engineering tactics (like the CD attack on Angela and Ollie) to digital network mapping. You'll discover why backup systems are prime targets for reconnaissance and how proper network segregation can limit blast radius when - not if - you're compromised.
You found the backup wrap up your go-to podcast for all things
Speaker:backup recovery and cyber recovery.
Speaker:In this episode, we take a look at reconnaissance in
Speaker:Cybersecurity by examining Mr. Robot season one, episode two.
Speaker:Persona and I break down how threat actors conduct reconnaissance
Speaker:before launching major attacks.
Speaker:Just like F Society did against Evil Corp. In the show, we explore the
Speaker:human intelligence aspects, you know, like figuring out who's dumb enough to
Speaker:take a random CD from some guy on the street and put it in their computer.
Speaker:We also discuss why your backup systems are prime targets for recon.
Speaker:Modern attackers can spend months mapping your infrastructure, identifying your
Speaker:weaknesses, and planning their approach.
Speaker:This episode will, I think, open your eyes to just how thorough
Speaker:those recon operations can be.
Speaker:By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. Backup,
Speaker:and I've been passionate about backup and recovery for over 30 years, ever since.
Speaker:I had to tell my boss that we had no backups of the production
Speaker:database that we had just lost.
Speaker:I don't want that to happen to you, and that's why I do this.
Speaker:On this podcast, we turn unappreciated admins into Cyber Recovery Heroes.
Speaker:This is the backup wrap up.
Speaker:Welcome to the show.
Speaker:Hi, I am w Curtis Preston, AKA, Mr. Backup.
Speaker:And I have with me a guy that just doesn't seem to get stressed out like I do.
Speaker:Prasanna Malaiyandi.
Speaker:How's it going, Prasanna.
Speaker:I'm good, Curtis.
Speaker:How do you stay?
Speaker:So like even keel, like you're just like, I'm just like, ah.
Speaker:And you're just like, you're good, man.
Speaker:yeah, you just.
Speaker:I honestly, I don't think I used to be like this.
Speaker:Is it?
Speaker:Is it, is it weed?
Speaker:What?
Speaker:No, no.
Speaker:Like up or even after that, like through high school and college.
Speaker:I even like the beginning part of my career, I don't think I
Speaker:was like even keeled like this.
Speaker:I, for the most part I was, but I used to get stressed and
Speaker:then I don't know what changed.
Speaker:Something clicked and
Speaker:Hmm.
Speaker:I am like, okay.
Speaker:Hmm.
Speaker:I know a
Speaker:You're like, um,
Speaker:who are like, how are you so calm all the time?
Speaker:It'd be like in the middle of a fire drill.
Speaker:I'm like, uh, it's okay.
Speaker:yeah, I need, I need you in my fire drills.
Speaker:Um, I feel like I'm in the middle of like three or four fire drills, like right now.
Speaker:Like you saw, I got three phone calls we're trying to do, we're trying
Speaker:to do this episode and I got like three phone calls, which reminds
Speaker:me, I'm gonna put, I'm gonna put my phone on, you know, focus right.
Speaker:Um, there.
Speaker:Okay.
Speaker:Um, so.
Speaker:Curtis, just take a deep breath.
Speaker:Shall we turn this into like a meditation?
Speaker:Yeah.
Speaker:Anyway, but uh, speaking of focusing on stuff, uh, we are continuing our
Speaker:series of lessons learned from Mr.
Speaker:Robot, which is a great show.
Speaker:Spoiler alert, by the way.
Speaker:Uh, we're gonna be talking about stuff in this episode,
Speaker:uh, and all of these episodes.
Speaker:If you haven't watched it, if you haven't watched episode, season one,
Speaker:episode two of Mr. Robot, go watch it now before you listen to the podcast.
Speaker:When you and I watched this episode, we, we weren't quite sure what we
Speaker:were gonna pull outta this episode.
Speaker:And, um.
Speaker:There, there's a couple of things.
Speaker:This is a very foundational episode.
Speaker:You know, we sort of learn who Mr. Robot is.
Speaker:We learn, um, that, that, um, and, and Elliot is given the, the
Speaker:opportunity to participate in this hack that they want to take down.
Speaker:Uh, evil Corp, which I love.
Speaker:I love that.
Speaker:It's called Evil Corp. And uh, and it uses essentially Enron's logo.
Speaker:Completely unmodified, which is onic, you know, to say the least.
Speaker:And then, um, you know, he's given the opportunity to participate in this thing.
Speaker:And then they basically said, look, if you walk away, you walk away.
Speaker:And, um, you know, and, and he does, he actually walks away.
Speaker:Um, he, he will obviously end up coming back.
Speaker:Otherwise this would be a very short series.
Speaker:But, um.
Speaker:end.
Speaker:The The end.
Speaker:Yeah.
Speaker:But what we're gonna focus on is this concept of reconnaissance and network
Speaker:mapping, because what you see is that clearly they have been doing that because
Speaker:they know some things about Evil Corp
Speaker:that they wouldn't know otherwise.
Speaker:And so maybe just to provide a bit more context, because I'm sure people are
Speaker:not watching it as recently as we have.
Speaker:So in this episode, kind of as a recap, right?
Speaker:What ends up happening is he goes and he visits the bunker with where F Society is.
Speaker:Right.
Speaker:Um, in addition, this is where Mr. Robot tells him, Hey, we want you
Speaker:to, and we will discuss more in details about the network mapping.
Speaker:We want you to take out their backup facility where, if you don't remember,
Speaker:it was called Steel Mountain.
Speaker:Steel Mountain, not to be confused with any other company by a similar name.
Speaker:Yes.
Speaker:And it just, and that's where they have their backups as well as there just
Speaker:happens to be a gas plant next to it.
Speaker:We will talk about that
Speaker:Right.
Speaker:bit.
Speaker:Um, in addition, in this episode, this is also where you meet the drug dealer, uh,
Speaker:Yeah.
Speaker:right where, uh.
Speaker:Elliot's neighbor Shayla gets the drugs that she then sells to Elliot.
Speaker:Uh, so Fernando Vera was the guy's name.
Speaker:Um, let's see what else happened in this episode.
Speaker:This is also the episode where, um, I don't know if people remember it, but um.
Speaker:Angela And Ollie, right?
Speaker:Her boyfriend.
Speaker:Yeah.
Speaker:kind of standing out on the street and there is a guy who's trying to sell CDs.
Speaker:Yeah.
Speaker:like, oh, sell my CD or Buy my cd.
Speaker:All I need is like 20 tweets saying
Speaker:Yeah.
Speaker:it or whatever else.
Speaker:Yeah.
Speaker:Yeah.
Speaker:And they gave, and they gave him a cd, which turns out to be, uh, something very
Speaker:much not a CD or not a, not a music cd.
Speaker:Yeah,
Speaker:Yeah,
Speaker:in this episode too, right, they talk about how Ollie
Speaker:puts it in the laptop at home,
Speaker:yeah,
Speaker:And the guy is able to sort of take over it, installs some malware.
Speaker:He's
Speaker:yeah,
Speaker:at the webcam right
Speaker:yeah.
Speaker:Yeah.
Speaker:all the rest of that,
Speaker:And that was, that was where the very, the very last moment of that episode is
Speaker:when he's seeing the webcam and he can see the girl, uh, he can see Angela basically
Speaker:like going to take, I think take a shower.
Speaker:And he's like, we're in.
Speaker:The last line in the episode is we're in and
Speaker:And
Speaker:"we're
Speaker:in", was actually written in Chinese.
Speaker:Oh, okay.
Speaker:Okay.
Speaker:I guess I missed that part.
Speaker:Yeah.
Speaker:Um, the, and so any crucial, any hack, any major hack, which is going to
Speaker:include, like, this is, this is, you know, this hack that they want to do of.
Speaker:Evil Corp I is, is definitely, I would, I would call this like a, an EPT an or an
Speaker:a PT, an adv advanced persistent threat.
Speaker:Right?
Speaker:You know, they've got, they're going to be doing this over a long run, a
Speaker:long period of time, and they have a goal in mind and they, and they
Speaker:are willing to be patient to, um, to do the things that they need to do.
Speaker:To, to move forward.
Speaker:And I, I, I think that it, it gives us an opportunity to discuss this
Speaker:concept of reconnaissance, um, and, and network mapping, which is what
Speaker:we're, what we're talking about.
Speaker:Their goal, right?
Speaker:With this entire thing, right?
Speaker:What are they looking to accomplish with Evil Corp, right?
Speaker:Evil Corp basically has all the credit records of everyone in the country.
Speaker:Right,
Speaker:as you start to see Angela's in heavy debt with student loans, right?
Speaker:There are other people who, uh, Shayla, the Elliot's neighbor is also in debt,
Speaker:and so it's basically they're like, we can basically attack the company,
Speaker:destroy everything, and do basically a giant reset on everyone's rec financial
Speaker:right.
Speaker:Right.
Speaker:and
Speaker:Yeah.
Speaker:So that's, that's their end goal, right?
Speaker:Um, basically, you know, deleting and, and, and they know that if they delete
Speaker:the, the primary copy, they know that, uh, they have, um, a copy, you know, in
Speaker:their backups stored in Steel Mountain.
Speaker:Yeah.
Speaker:and so they know therefore, and by the way, why.
Speaker:And I guess, how do they know that?
Speaker:And the answer, the, the answer to that question is, the answer to this
Speaker:or the to is the title of this episode.
Speaker:Because they went in and they did reconnaissance and they figured out, and,
Speaker:and again, this is something that we, we've said on multiple episodes that.
Speaker:It's going to be one of the primary goals of once, once the initial, um,
Speaker:access has been granted to the threat actor, their next step is going to be
Speaker:figure out what can we get rid of that, you know, that basically how can we stop
Speaker:whatever it is that would then stop us?
Speaker:In other words,
Speaker:they're gonna try to take out the backups.
Speaker:Right.
Speaker:And you know, and, and, and yeah.
Speaker:This is a podcast dedicated to backups, but.
Speaker:And so maybe, you know, to hammer everything looks like a nail.
Speaker:Trust me.
Speaker:Talk to any, you know, go listen to the Red Team Epi episode where he
Speaker:basically said, he said two things.
Speaker:One is he loved backups because they were so great at helping him to do
Speaker:network mapping and figure things out.
Speaker:And, uh, and he loved the system, the fact that they run
Speaker:his system and all that stuff.
Speaker:Uh, and then the other is, yes, you're gonna try to take that out.
Speaker:And unfortunately, many of the designs that we have today are
Speaker:using entirely disc based backups.
Speaker:Dis and cloud, uh, and if you're, depending on how you set that up, they
Speaker:can easily map all of that stuff, figure that stuff out, and then delete it.
Speaker:Right.
Speaker:And what we have in this episode is we do see that this company is at least storing
Speaker:some offsite backups in Steel Mountain.
Speaker:And um, in this case it happens to be tape backups.
Speaker:It doesn't have to be tape backups, right.
Speaker:But yeah.
Speaker:which, which
Speaker:Go ahead.
Speaker:basically a third party vendor, right?
Speaker:It's
Speaker:It's a third party be Yeah, yeah.
Speaker:A-K-A-K-A Iron Mountain.
Speaker:Right, right.
Speaker:Iron Mountain or something like that.
Speaker:Right.
Speaker:And, um, the, um, I, I think it's funny that, like, did they, did they
Speaker:reach out to Iron Mountain, see if they wanted to be branded in the episode?
Speaker:Probably not.
Speaker:Yeah.
Speaker:No.
Speaker:but it just, it just, it's funny, like anybody in the industry is like,
Speaker:oh yeah, they mean Iron Mountain.
Speaker:Right.
Speaker:Um, but.
Speaker:There's a couple of things here.
Speaker:One is first just understanding this concept of reconnaissance, right?
Speaker:Um, what are the kinds of things, do you think that a, a threat actor,
Speaker:once they've gained an initial access, what are the kinds of things that
Speaker:they're going to try to figure out?
Speaker:Well, they're gonna figure out well for them, right?
Speaker:They wanna figure out what's the most valuable data in the company,
Speaker:Right.
Speaker:right?
Speaker:That's one thing.
Speaker:And then where all is that data sitting?
Speaker:Mm-hmm.
Speaker:then where are those things that can be used to recover from any sort of attack?
Speaker:Because remember we talked about with ransomware, right?
Speaker:It's not just a matter of encrypting your data, deleting your backups.
Speaker:A lot of these people will also exfiltrate your data,
Speaker:Right,
Speaker:For double extortion.
Speaker:right.
Speaker:now forced to pay in order to prevent incriminating evidence or bad things
Speaker:about your company from being published.
Speaker:Yeah.
Speaker:And, and, and if I, and I, I agree everything that you said, I will
Speaker:preface, uh, I will add to your list at the beginning of your list.
Speaker:Um, basically human based reconnaissance because we see that happening with Angela
Speaker:and Ollie and I would wager Toti bet.
Speaker:Well, not wager.
Speaker:I, I think if we go back to, to the first episode that, um, which oddly
Speaker:enough is numbered episode zero because.
Speaker:clarify.
Speaker:Yeah.
Speaker:So for people who are watching the show and then trying to map it to
Speaker:what we're talking about, the show technically starts with Episode Zero.
Speaker:Yeah.
Speaker:1.0 and 1.1.
Speaker:This is episode 1.1, AKA, episode two in, in binary fashion.
Speaker:Right.
Speaker:We're starting at zero.
Speaker:Um, which again, I think it's kind of cool, right?
Speaker:But, um, and also confusing for certain things, right?
Speaker:Uh, but basically what we see is clearly in the case of what happened with Elliot.
Speaker:Which is our main protagonist here.
Speaker:What happened with Elliot is clearly they did reconnaissance against Elliot.
Speaker:Clearly, they figured out what he was up to, which, and they
Speaker:figured out his proclivities.
Speaker:Right.
Speaker:They figured out.
Speaker:I, I think they find, I think they felt that they had found someone
Speaker:that they could, exploit is a strong word, but they could use, right.
Speaker:And, and this, and you see this on the previous episode, right?
Speaker:Where
Speaker:Yeah.
Speaker:sitting at the computer terminal in the data center and he's like,
Speaker:I should go delete this directory.
Speaker:And it's at the prompt where it's like, yes or no.
Speaker:And
Speaker:Yeah,
Speaker:should do it.
Speaker:And his finger's hovering over
Speaker:yeah, yeah.
Speaker:like, and, and because there was a text file that said, leave me here.
Speaker:Right.
Speaker:he's like, it was intended for me.
Speaker:So I think, like
Speaker:Yeah.
Speaker:Curtis, the only way they could have done that is if they had done some sort
Speaker:of human, uh, read on him to be like, yes, this is the sort of thing that he
Speaker:is struggling with and let us use him.
Speaker:Yeah.
Speaker:Also known as human, right?
Speaker:Human intelligence and yeah.
Speaker:So they figured out, and, and, and what we also know about Elliot is he has a
Speaker:problem, you know, in addition to being antisocial and anti, anti, anti, anti,
Speaker:uh, he is also got a drug problem, right?
Speaker:So we're seeing it.
Speaker:And then, and that's something that.
Speaker:That again, you know, like, um, I dunno if you've ever heard this, um, the only
Speaker:two people that actually know you are your hairdresser and your and your CPA, right?
Speaker:Yep.
Speaker:Like right.
Speaker:They know, they know your real, real hair color and your CPA knows where
Speaker:you're actually spending your money.
Speaker:Yeah.
Speaker:And so if someone.
Speaker:Had done reconnaissance against him.
Speaker:And, and you know, you think about it, there are the, the, they
Speaker:targeted him because of his access.
Speaker:Yep.
Speaker:He worked at allsafe, which is this, this cybersecurity firm.
Speaker:So they're like, who can we get that has access into the company?
Speaker:We're gonna find somebody.
Speaker:And they probably did a bunch of reconnaissance against all safe, um.
Speaker:employees and to
Speaker:And the employees, and they watch 'em and they see what they do
Speaker:and they see Elliot like going out there buying drugs and stuff.
Speaker:I mean, if, if they're, this is a big operation and they're gonna
Speaker:do stuff like that, um, to, to, to do the reconnaissance, to figure
Speaker:out, um, you know, what's going on.
Speaker:which was very interesting because you know, Elliot was super careful
Speaker:Yeah.
Speaker:a seed right where he hacks.
Speaker:Terrell, right, who is sort of the person who wants to become
Speaker:CTO of the of Evil Corps, right?
Speaker:And he realizes, oh, it's too easy.
Speaker:And there's a scene where he's literally taking apart his computer.
Speaker:He's drilling the hard drives,
Speaker:Yeah.
Speaker:out
Speaker:Yeah,
Speaker:cards and throwing it into the microwave and zapping them.
Speaker:yeah.
Speaker:with all being so careful,
Speaker:Yeah.
Speaker:Maybe he didn't think about the human intelligence piece.
Speaker:Yeah.
Speaker:Yeah.
Speaker:Um, and, uh, Tyrell, he is, he is a, he is a twisted little fellow himself.
Speaker:Right.
Speaker:Um, but, um, 'cause we have the, in this episode we have the scene
Speaker:of him paying money to go beat the crap outta some homeless dude.
Speaker:I, I do not know what that, I mean, clearly that's a, you know, it's a. It's
Speaker:like that's gonna come into play later.
Speaker:But, but this is the thing, like, like when you have a company, you have
Speaker:all sorts of people that work for you that have all sorts of weaknesses.
Speaker:Yep.
Speaker:They might be financial weaknesses, they might be drug weaknesses,
Speaker:they might be people, weaknesses.
Speaker:And if someone, if some entity.
Speaker:Wants to take your company down, they're, they're going to go through the trouble of
Speaker:doing this kind of recon, reconnaissance of figuring out who works at your
Speaker:company to see who they, who's gonna be dumb enough to take a CD off the street
Speaker:Yep.
Speaker:then put it into a network computer.
Speaker:Um,
Speaker:Do
Speaker:yeah.
Speaker:it drives me bonkers because remember back in the day, people would
Speaker:just leave, like USB sticks around
Speaker:Yeah.
Speaker:would pick it up and put it in their machines,
Speaker:Yes.
Speaker:would be like, please do not do this.
Speaker:That is bad.
Speaker:And then they had to start locking down all the USBs
Speaker:Yeah.
Speaker:Uh, another thing, um, is that, well, you, you can buy, like if you buy USB,
Speaker:like used thumb drives off of eBay or used hard drives, you will get data
Speaker:on those, on those drives, right?
Speaker:Um, and uh, again, I, I know I've told this story before, but I love this story.
Speaker:I'm gonna go back to.
Speaker:Several years ago when Symantec bought Veritas.
Speaker:And, um, it was the first, uh, that, and it had a, uh, Veritas vision was
Speaker:the name of the, of their conference, which it used to be called Vera Con.
Speaker:But then when they went to international, apparently Raan and
Speaker:French sounds like very stupid.
Speaker:No.
Speaker:and so they changed it to Veritas Vision and then Seman, and then it was
Speaker:Semantic Vision and it was the first.
Speaker:Uh, conference after the Semantic rebranding.
Speaker:And I, I remember two things.
Speaker:One is they didn't really do anything with NetBackup.
Speaker:They did literally, and because I remember blogging, I think you
Speaker:can find a blog on my website 'cause it's been around a while.
Speaker:You can find a blog on my website that says that the
Speaker:Semantic apparently spent a year.
Speaker:Painting everything yellow and black.
Speaker:That's, that's what I remember saying.
Speaker:But then it was the trade show and, um, they passed out a thumb
Speaker:drive, uh, for everyone to that, you know, it was the conference
Speaker:materials and the thumb drive that.
Speaker:At the Semantic Conference had had malware on it and um, and so like, it
Speaker:was like the next day and they were like, Hey, uh, have you got that?
Speaker:Some don't, don't put it in anything.
Speaker:It's a, it's kind a thing, which I mean, I mean that's just like.
Speaker:Ironic.
Speaker:Yeah.
Speaker:Ironic to the max, right?
Speaker:Um, the fact that a, you know, an antivirus company essentially would
Speaker:distribute a virus or whatever, whatever it was, I dunno if it
Speaker:was a virus, but it was malware.
Speaker:Yeah.
Speaker:Um, at their own conference.
Speaker:Yeah.
Speaker:So, I think the one interesting thing about this episode as well,
Speaker:right, so we talked about the human intelligence piece, right?
Speaker:Yeah.
Speaker:kind of understanding who's where.
Speaker:The other thing was in the episode they talked about, okay, all of their
Speaker:data is on their primary data center.
Speaker:Mm-hmm.
Speaker:Um, and they're like, yeah, we can go delete it.
Speaker:But being a financial company, guess what it has?
Speaker:They have paper records, right?
Speaker:Right,
Speaker:records still
Speaker:right.
Speaker:is actually what is in Steel Mountain.
Speaker:Oh, is that what's in steel mount?
Speaker:Is the paper records?
Speaker:Okay.
Speaker:I missed that part.
Speaker:And by the way, something I learned.
Speaker:I think I've said this in pre stuff, but something I learned is that if
Speaker:you see a truck that's branded and it says Iron Mountain, it's not like
Speaker:you did mention it
Speaker:Yeah.
Speaker:Level one stuff, right?
Speaker:It, it's like, I think it might be a,
Speaker:Shredding.
Speaker:only be a tape, a paper destruction, right?
Speaker:It's definitely not tapes.
Speaker:Uh, but I do remember many years ago, I don't know if it was Iron Mountain,
Speaker:but it was a, it was an offsite vaulting company and the offsite vault guy.
Speaker:He was driving his van.
Speaker:He was a man in a van,
Speaker:Yeah.
Speaker:stopped at Starbucks to get some stuff and he came back out and his van was gone.
Speaker:Oh no, that's not good.
Speaker:Yeah, it's like go from A to B. Do
Speaker:Yeah,
Speaker:Do not.
Speaker:yeah, yeah.
Speaker:Um, so yeah, so, so Go ahead.
Speaker:Go ahead.
Speaker:Oh
Speaker:ahead.
Speaker:yeah, so Steel Mountain.
Speaker:So they were like, yeah.
Speaker:And to find that out, right.
Speaker:They probably had to look at email records and pos and figure out like,
Speaker:when are records going out the door to this other place, and who's it
Speaker:going to and what's their schedule?
Speaker:And oh, you know what it was, is they
Speaker:I'll just interrupt there.
Speaker:Just interrupt there.
Speaker:And the, the amazing thing about things like pos and things like that
Speaker:is they're like just PDFs and they're generally stored in plain text.
Speaker:No one thinks about.
Speaker:Securing that data from outside access.
Speaker:Go ahead.
Speaker:Oh, the other thing is they did also mention in the episode they're like,
Speaker:where most of the s and p 500 stores their or archives, their data, and
Speaker:that's what they said, steel Mountain.
Speaker:Yeah.
Speaker:guess who one of those is?
Speaker:Is Evil Corp.
Speaker:Right, right.
Speaker:And
Speaker:It's, yeah.
Speaker:that's where they're like, it is this one facility that we need to attack.
Speaker:Yeah.
Speaker:And, I'm willing to go on a limb and say that there is nowhere where Iron Mountain
Speaker:has a facility next door to a gas.
Speaker:Uh.
Speaker:I was, I was, I was going to say, I was like, what is a likelihood that a company.
Speaker:That is, that is known for, that would put it like right next to a gas plant.
Speaker:Yeah.
Speaker:And you know, my, my previous employer I got sent to, um, I got sent to a facility,
Speaker:a, a secure tape storage facility for a household name financial organization.
Speaker:And it's in the middle of a giant field right,
Speaker:Mm-hmm.
Speaker:berms around it.
Speaker:Right.
Speaker:Um, and to get there with a car, you have to go through
Speaker:three levels of security, right?
Speaker:There's this, there's a giant like metal barricade that, that, that, that's down.
Speaker:You talk through a squawk box that lets you, through that barricade, through
Speaker:the steel reinforced fence, right?
Speaker:Then you go through there, then you park.
Speaker:In a parking lot.
Speaker:Then you go inside and you talk to the person who then determines, you know,
Speaker:and then, and then, and then you go through another barric, another of the,
Speaker:you know, crossing guard barricades to go inside a building where they then go
Speaker:around with one of those like scanning things to scan your car and they're
Speaker:putting stuff underneath, like I think, I think Iron Mountain would have something
Speaker:simple, I guess is what I'm saying.
Speaker:Yeah.
Speaker:It's like Fort Knox, right?
Speaker:You don't like
Speaker:Yeah.
Speaker:is in the middle of nowhere.
Speaker:Yeah, exactly.
Speaker:Exactly.
Speaker:Um, so yeah, so we talked about that, that basically they would do this, they
Speaker:would go through all of this effort to do reconnaissance and what we see,
Speaker:I think at the very end there is we see the beginning of a more digital.
Speaker:Method of reconnaissance, right?
Speaker:So now we've got access to the computer and we're, and they're gonna do, I
Speaker:think a couple of things there because obviously they have webcam access.
Speaker:So they're gonna be able to listen in on conversations, they're
Speaker:gonna be able to hear things.
Speaker:And this is Angela, who is part of allsafe.
Speaker:And so, and he's also part of allsafe, right?
Speaker:Ali
Speaker:Um, and so they're gonna have conversations that, you know,
Speaker:it'd be great to listen in on.
Speaker:And so they're, they're gonna be able to do again, um, you know, human-based
Speaker:intelligence and they're gonna, they're gonna learn all sorts of stuff.
Speaker:'cause these, these two people, they're,
Speaker:Yeah.
Speaker:they're very connected and they're gonna be in their, what they think is a
Speaker:very safe place discussing, uh, stuff.
Speaker:Um, but again, just, just going back to,
Speaker:you know, proper.
Speaker:Uh, stuff, right?
Speaker:You, you don't, you don't do that, right?
Speaker:You don't, you don't, uh, just take a CD off a guy or a thumb drive off
Speaker:a guy or a thumb drive that you find on the ground, and, uh, and then, uh,
Speaker:yeah, and then put it in your system.
Speaker:also please, when you're at an airport and you see those USB
Speaker:charging ports at an airport, do
Speaker:Yeah.
Speaker:in your phone to those.
Speaker:Well, I will say.
Speaker:So I'll, I'll, I'll push back on that a little bit.
Speaker:I, I, I can't argue with it too much, but what I will say is at least a
Speaker:decent modern phone will say, Hey, you just plugged into this device.
Speaker:Do you want to trust it?
Speaker:And I would say, make sure you say no.
Speaker:Okay,
Speaker:I mean, best practices don't do it.
Speaker:Right.
Speaker:Actually, best practice would be bring a plug.
Speaker:Yeah.
Speaker:Right, right.
Speaker:But yeah.
Speaker:Yeah.
Speaker:That, that's best practice, you know, good, better, best.
Speaker:Right.
Speaker:Yeah.
Speaker:even Department of Homeland Security also recommends not
Speaker:Yeah.
Speaker:Again, I can't, I can't disagree with you.
Speaker:I'm just saying if you're, if you're, if you're desperate, if you're gonna,
Speaker:yeah,
Speaker:but again, that's what they want.
Speaker:They want you to be desperate.
Speaker:Um, and also whatever you do, don't just trust a random cable.
Speaker:'cause I did watch a presentation on a cable that looked like
Speaker:just a regular normal cable.
Speaker:And it, and it, you know, it took over a phone.
Speaker:Yeah.
Speaker:Um, and what was that last thing you said?
Speaker:What was it?
Speaker:Oh, also on airplanes?
Speaker:Oh, yeah, yeah, yeah, yeah.
Speaker:Airplane.
Speaker:Yeah, because those are definitely, yeah.
Speaker:Yeah.
Speaker:Yeah.
Speaker:Um, so yeah, so basically, again, best practice is not to trust random guy.
Speaker:Yeah,
Speaker:Um,
Speaker:I think the other thing is also be careful what you post online some of these things,
Speaker:which maybe should not be out there
Speaker:yeah.
Speaker:It's something, it's something that, um.
Speaker:I think our, our generation you are in My generation aren't, no, actually
Speaker:aren't, aren't you a millennial?
Speaker:What are you
Speaker:I'm technically a millennial.
Speaker:Uh, you're an elder millennial.
Speaker:Just like I'm an elder.
Speaker:I'm an elder Gen Xer.
Speaker:Um, yeah.
Speaker:So both of our generations I think, understand that a little bit better
Speaker:than the current generations.
Speaker:The two, the two, um, where literally they just, they just, you know,
Speaker:they post, they, they got up.
Speaker:I, you know, I,
Speaker:Yeah.
Speaker:to the bathroom, here's what I had for breakfast, you know,
Speaker:Well, I
Speaker:you know what I mean?
Speaker:had like posted a video of like, they had joined a company and like were
Speaker:posting like their security stuff, like just a walkthrough of the building and
Speaker:the security things and it's like, uh,
Speaker:Yeah, it's no bueno.
Speaker:No bueno.
Speaker:Um, so, um, and again, I'll, I'll use this as an opportunity again that
Speaker:because the backup system is such a target, it needs to be segregated, right?
Speaker:It needs to be on a separate network.
Speaker:It needs to be on a separate authentication and authorization system.
Speaker:, It's gonna be on a separate Entra domain, formerly known as Active Directory.
Speaker:And, you know, my, my Prasannal is that you would use like local passwords and a
Speaker:password manager, um, that you wouldn't use a, a network based, um, you know.
Speaker:System and, and lots of, and lots of MFA and, you know, um, and, you
Speaker:know, UB keys and like by, you know, incorporate biometrics if you can.
Speaker:Right.
Speaker:Um, and, and just have that as separate as you can and, and, and
Speaker:it sounds like a pain to do it.
Speaker:And it is a pain the first time, but then when it's like, it's like,
Speaker:okay, when I'm doing backups, I just need to be on this other system and.
Speaker:The pain I went through recently, you know, after being chided from with Mike
Speaker:when he was on here and he was talking about, you know, don't do your financial,
Speaker:uh, transactions and anything that really matters from a security perspective.
Speaker:At the same time as you have other browser tabs open in the same browser.
Speaker:And, and I, I never really thought about that.
Speaker:And so I went through the trouble of getting a different browser, right.
Speaker:Um, and, uh, I had to get a browser that was supported by my
Speaker:password manager, uh, which I had like two or three to choose from.
Speaker:And then I also added a. Basically enforcement thing, so that if
Speaker:I forget that, and trust me, I do all day long, I forget it.
Speaker:Right.
Speaker:Um, I go to open up, you know, my, my bank on, uh, my usual browser
Speaker:and, uh, it, it basically says, you know, site prohibited, right?
Speaker:Yeah,
Speaker:Um, so it, it was a pain when I first first started doing it, but you
Speaker:know, there are ways to do it that.
Speaker:you don't just wipe your computer every hour
Speaker:I, I do not, I do not wipe my computer every hour.
Speaker:Um, and um, yeah, and I'll also say that, you know, his drilling of
Speaker:the thing, you know, for what it's worth, the drilling of the thing.
Speaker:I mean, it's helpful, but it's not, it doesn't, dam
Speaker:doesn't destroy the hard drive.
Speaker:Um, I, I think I like the idea of the, of the microwaving of the chips.
Speaker:I think that's probably an effective way of getting, you know, because
Speaker:that's the things that modern devices.
Speaker:Have all these like chips in them.
Speaker:What were you gonna say?
Speaker:he didn't have a giant magnet gals.
Speaker:The hard
Speaker:The hard drive.
Speaker:Those are really expensive.
Speaker:I mean, really expensive.
Speaker:Yeah.
Speaker:A, a ba a magnet big enough to dals a modern hard drive is
Speaker:actually, uh, quite expensive.
Speaker:See,
Speaker:Um,
Speaker:he would've had something around like his doorframe.
Speaker:So
Speaker:it would've to be.
Speaker:Yeah, that would have to be even, even more, uh, you know, uh, powerful.
Speaker:But, but the, but the thing that a lot of people do forget about are all the chips.
Speaker:The chips are in the tapes or in the hard drives or in all
Speaker:stuff, you know, all that stuff.
Speaker:The sim cards, sim card, I think sim cards is what he was, uh, destroying.
Speaker:Yep.
Speaker:Uh, but again, going back to the, the point of this episode, if someone,
Speaker:if some entity is going to try to take out your company, they're
Speaker:going to go through the effort.
Speaker:That, uh, of, of what we're describing.
Speaker:Right.
Speaker:Um, so
Speaker:is it hopeless then to try to protect against it?
Speaker:well no, well, no hope Hopeless is a hopeless, is a strong term.
Speaker:I, I would say in some sense, well, it, it's not hopeless in that like
Speaker:there is no point in doing it.
Speaker:Yeah.
Speaker:It is hopeless in that, oh, well I did it, I did all the things that.
Speaker:I was told to do, and so therefore I'm good that you know, you, you, you, you
Speaker:need to understand that you are most likely going to be compromised at some
Speaker:point, and you therefore need to be, uh, prepared to be able to, to deal with it.
Speaker:is it that or is it also you should estimate the risk look at your risk
Speaker:profile for these different activities?
Speaker:Yeah.
Speaker:Well, well that's kind of what I mean is like, you know, you, you
Speaker:need to prepare, you need to do what you can to limit the blast radius.
Speaker:Do what you can to limit, um, exfiltration and to detect of
Speaker:exfiltration when it's happening.
Speaker:Yeah.
Speaker:and, uh, yeah.
Speaker:way to understand how all this works,
Speaker:What's that?
Speaker:do tabletop exercises.
Speaker:Yes, tabletop exercises here.
Speaker:I thought you were gonna, uh, say buy a copy of my upcoming book, but
Speaker:Oh, that too.
Speaker:yeah, so, uh, all right, I think we're good.
Speaker:Um, uh, go watch episode three and, um, and we'll be ready to talk about that
Speaker:Or episode point or
Speaker:1.2. It's so,
Speaker:Yeah.
Speaker:1.0. Yep.
Speaker:Yeah.
Speaker:I live on the second.
Speaker:Yeah,
Speaker:that example.
Speaker:yeah.
Speaker:Yeah.
Speaker:It's very disconcerting if you're used to the, it's the
Speaker:first floor, so it's floor one.
Speaker:I, I, I, I don't get that.
Speaker:You know, European
Speaker:note,
Speaker:All right.
Speaker:the
Speaker:Like,
Speaker:and
Speaker:yeah.
Speaker:podcast episode.
Speaker:Yeah.
Speaker:Uh, thanks for helping me out.
Speaker:Prasanna.
Speaker:No, this was fun.
Speaker:I, I do enjoy rewatching the show 'cause I haven't seen it since it came out.
Speaker:So,
Speaker:Yeah.
Speaker:Uh,
Speaker:back
Speaker:well it's, it's either that or K-Pop demon hunters.
Speaker:So my niece wanted me to watch that.
Speaker:I have not watched it yet, but it's on the list.
Speaker:Li Lily, my granddaughter has watched it and she told me all about it
Speaker:and I'm like, okay, well, I'm good.
Speaker:I think I'm good.
Speaker:Anyway, um, anyway, thanks for listening folks, and uh, you
Speaker:know, you're, why we do this.
Speaker:That is a wrap
Speaker:. The backup wrap up is written, recorded, and produced by me w Curtis Preston.
Speaker:If you need backup or Dr. Consulting content generation or expert witness
Speaker:work, check out backup central.com.
Speaker:You can also find links from my O'Reilly Books on the same website.
Speaker:Remember, this is an independent podcast and any opinions that
Speaker:you hear are those of the speaker and not necessarily an employer.
Speaker:Thanks for listening.