Husam Shbib is currently working as a digital forensic consultant in Saudi Arabia. He has experience in different cybersecurity fields such as penetration testing, user access reviews, configurations reviews, IT and cybersecurity audit, risk assessment, and programming. He has a bachelor degree in computer science and holds multiple certifications in the cybersecurity field, such as ICMDE, 3CI, 3CE, CCE, eCDFP, etc. He likes playing CTFs with friends and solving online challenges regularly. He was keen on cybersecurity domain since the middle school and decided to approach this career.
Originally Aired on: Jan 11, 2024
Husam Shbib is currently working as a digital forensic consultant in Saudi Arabia. He has experience in different cybersecurity fields such as penetration testing, user access reviews, configurations reviews, IT and cybersecurity audit, risk assessment, and programming. He has a bachelor degree in computer science and holds multiple certifications in the cybersecurity field, such as ICMDE, 3CI, 3CE, CCE, eCDFP, etc. He likes playing CTFs with friends and solving online challenges regularly. He was keen on cybersecurity domain since the middle school and decided to approach this career.
Originally Aired on: Jan 11, 2024
00;00;29;29 - 00;00;40;05
Speaker
Hey everyone, it's Eugene here. And welcome to another edition of Forensics talks. This is going to be episode 95. And my guest today is Sam Scheib.
00;00;40;05 - 00;00;44;24
Speaker
who Sam should be is currently working as a digital forensic consultant in Saudi Arabia.
00;00;45;00 - 00;00;52;05
Speaker
has experience in different cybersecurity fields such as penetration testing, user access reviews, configurations, reviews, I.T.,
00;00;52;05 - 00;01;00;20
Speaker
cybersecurity, audit, risk assessment and programing. He has a bachelor's degree in computer science, and he holds multiple certifications in the cybersecurity field.
00;01;00;20 - 00;01;04;05
Speaker
I see M.D. three CI, three C There's a lot of these things.
00;01;04;05 - 00;01;05;27
Speaker
I don't even know what they are, so
00;01;05;27 - 00;01;23;00
Speaker
but he's got a lot, let's put it that way. But he's an advocate for fostering cybersecurity awareness in local communities. So, he's committed in sharing cybersecurity knowledge both through online platforms like LinkedIn and YouTube. He has a channel in for a client of OIRA, Seeley and as well as in person.
00;01;23;06 - 00;01;39;13
Speaker
And I met Sam not very long ago in Riyadh, and this was at a conference in the in Saudi Arabia. And we had a very brief conversation. But let me let me do this. Let me bring him in here right now, because he's been patiently waiting there. So, there he is. Hey, Sam, how are you? Hello. Hello, how are you?
00;01;39;13 - 00;01;57;14
Speaker
I'm fine. Thank you for having me. Professor Eugene, I am so glad to be here with you, the audience. So, I will talk about different cybersecurity topics. Excellent. Well, thanks so much. We had we only met. I mean, we only spoke for, what, like 2 minutes on the way to lunch. We were right there. Yeah, right.
00;01;57;14 - 00;02;21;23
Speaker
I was just doing just small research about my private forensic investigation, private browsing, and then we met actually, and have, as you said, small talk and then. Yes. Yeah, me maybe just very quickly. Yeah, you did. That's where I saw your first. Where I sort of saw you was your presentation on the private browsing. I thought it was super interesting.
00;02;21;23 - 00;02;42;15
Speaker
Like just, you know, simple things sometimes are often the most interesting and so I thought you did a great job there. And we're definitely going to maybe we'll talk a little bit about that later. So, first question for the day has to do with your background. And of course, cybersecurity is a big field right now. If you're on anywhere on social media, you're seeing posts about it all the time and a lot of stuff going on there.
00;02;42;15 - 00;03;00;09
Speaker
So, I always like to ask people about it. So, when I see people, how did you get into this? I go far back. So, it's not just about university. I want to know about when you were a kid and like were you a nerd on the computer or like, what? What was your interest back then and how did you get into this field?
00;03;00;11 - 00;03;34;08
Speaker
Sure, sure. Actually, it all started since middle school. I really liked to innovate new things, discovering new technologies and downloading new programs in the computer, everything. Like I was obsessed with computers. But in the middle school, specifically in the seventh grade, actually, I was reading, and I did schoolbook. I came across hackers like hackers, just hackers. And then they define it as networks.
00;03;34;11 - 00;03;58;13
Speaker
This I was really you know, I really wanted to know more. What is this, hackers? It seems dangerous. You know, I asked my teacher in the school Teacher, what is hackers? They said that they are these. He said, no, no, no, son, never be close to this. Hackers, they are very dangerous. Don't even come close to them.
00;03;58;13 - 00;04;24;20
Speaker
Don't even know anything about hackers. What is this? Only got really actually ignited this, you know, the passion he ignited my career. So, I said in myself, I wanted to know more. I came back home. I started actually learning what is hackers, what is hacking, what are the different methods actually to hack into computer, into email account? Like, what is this actually what is all about?
00;04;24;22 - 00;04;49;20
Speaker
And I found it. It is very, very special field and not anyone can enter it. Actually, at that time I really wanted I said okay, they will not teach me at all regarding for this topic. They will not even talk about it. Okay. I will only have actually my own self learning techniques. So, I started learning what is hacking all the techniques I can do.
00;04;49;20 - 00;05;14;14
Speaker
Actually, the concepts of hacking, what are the types of hacking? Black books, hacking light books, hacking Whitehat like there are a lot and all. It was actually theoretical because actually it is like it is, you know, it is prohibited somehow. It is prohibited. And even I cannot talk about talking with anyone seriously. They will all be afraid of me.
00;05;14;21 - 00;05;45;27
Speaker
Oh, this is a heck up even like I am just starting ABC, the ABC of hacking, so I don't know anything actually. But people became afraid of me like, he's a hacker. He's a hacker. I said, Let's keep it quiet and just like concerned, just learn by yourself and don't talk to anyone. I was studying, I was learning like sometimes 12 hours per day, just learning, learning, learning and actually applying the concepts that I have learned on my inner circle.
00;05;46;05 - 00;06;15;21
Speaker
So just applying to my, for example, relatives account, I am telling him like, okay, okay, I will try to hack your system. He is challenge me like just on my inner circle, very strictly not telling anyone actually outside the circle. And actually, I was getting like the results actually I was able like to do some, let's say, ethical hacking to my accounts, to my relatives’ accounts for sure with their permissions, everything.
00;06;15;23 - 00;06;40;18
Speaker
I found it very interesting. And at the same time, it is dangerous, really, like you have the authority to do really everything. You have the power like you feel very in a very privileged actually position. So, I said, like it is really dangerous. And you need actually to really be a let's not tell everyone about it because they misuse it a lot.
00;06;40;20 - 00;07;03;20
Speaker
So, because at that time hacker, it was like just a dream for a lot of people. And I said, okay, let's keep it quiet and not telling them that I am Hacker Actually, at that time I was like studying, as I said, like 12 hours per day, just for one concept. Like, for example, if there is like a hacking course concept, for example, spoofing.
00;07;03;23 - 00;07;25;22
Speaker
So, like almost one day complete one day, what is spoofing? Because I have like I have no idea actually what this concept is. So, I was just like each day I learn like only one concept, like 12 hours, five, 12 hour, 15 hours per day. Next day, another new concept. I am learning another new concept. How can I apply this concept?
00;07;25;22 - 00;07;52;23
Speaker
What tools I can utilize, what is different type? For example, if I am talking about spoofing, what are the different types of spoofing and on go on after that. Okay, next day let's talk about different something else. What is for example, IP address. Okay, let's talk about what is Mac, others aren't actually I found a lot of communities actually online only online about related only to hacking.
00;07;52;23 - 00;08;16;03
Speaker
And actually, this was myself like I was searching a lot to find them because it's not that easy to find them. But after you find them, you can actually create an account and then you can like engage with the community and all the community. They are some hackers, some script kiddies, but you need to be careful at that time because you may actually hack your computer while you are learning.
00;08;16;03 - 00;08;39;26
Speaker
And it happened to me once actually when I was a kid. They had my computer because I wanted to learn and they give me a virus and I opened the virus on my computer, compromised. Unfortunately. And after that I became, I became actually realizing that this is dangerous. I need to do need to actually have security before I learn hacking.
00;08;39;26 - 00;09;10;04
Speaker
I should secure myself, secure my computer. So, I learned about validation. The virtual machines deep, deep freeze, all type of tools to actually protect myself first. After that, I was just installing, for example, tools, installing on the virtual machine and on the host machine, just trying to play playground like have playground. My host machine, my virtual machine tried to have my system, all these types of stuff.
00;09;10;07 - 00;09;37;19
Speaker
And after that they said, okay, off. I decided I would go actually to a cybersecurity degree in my bachelor’s degree. Then after I took a lot, actually I have a lot of discussions with my relatives, with my mentors. I said, okay, they told me, don't go to cybersecurity degree, go to the computer science degree, because in computer science degree they will teach you more fundamental stuff.
00;09;37;21 - 00;10;06;28
Speaker
And in cybersecurity they will go straight actually to the cybersecurity topics without having any basis. So, you don't have any foundation and you are actually doing cybersecurity stuff. And this is actually not that good for anyone who wants actually to be in cybersecurity. It needs to, let's say, have some fundamental knowledge in, for example, networking operating system databases, one programing language at least, and some other stuff.
00;10;06;28 - 00;10;36;04
Speaker
Then, because cybersecurity is not let's say a concrete is not a field by its own. It is a field that built upon other fields like, for example, I.T. Cybersecurity, build it up on it. So, this way I said, okay, let's go to computer science. And I started like five years in my computer science bachelor’s degree. And I discovered actually, even if it is computer science, even if I took some elective courses, they will not, will not teach you how to break things.
00;10;36;06 - 00;11;00;19
Speaker
That really, I was really excited that they will teach me how to hack, for example, in ethically. But no, they will not teach you that in universities. So, I started actually to go after that to professional certifications. I wanted to do, for example, Certified Ethical Hacker. This my beginning, my like my journey started was certified Ethical hacking as a certification.
00;11;00;22 - 00;11;23;08
Speaker
But as I said, like into cybersecurity, I started in the middle school. So, I started in my professional certifications taking some certification, trying to apply the knowledge, as I said, virtual machine, some vulnerable ups. You can have. I know there are a lot actually in these this apps. You can have a lot of apps actually that you can learn how to work on it.
00;11;23;08 - 00;11;53;27
Speaker
Everything is ethical. So, I started hacking. I started actually to have some online friends have been training testers all together with the same goals we want to learn together. Building community around you in cybersecurity is crucial. You cannot actually really survive without this. Why? Because you will learn a lot and share knowledge a lot with them and they will tell you, oh, we are doing this way while you are doing this way so we can share different concepts in different ways.
00;11;53;27 - 00;12;20;21
Speaker
And you may actually not even think that these ways are even exist. So, trying after building communities, learning, finishing my bachelor’s degree certifications, then I need to have like an internship. I want to actually apply my knowledge in a company. Then like, like a normal employee. But in the university, we need to have an internship actually to finish your graduation.
00;12;20;23 - 00;12;47;03
Speaker
So, I applied to one of the like global consulting companies and they accepted me actually. And at that time, I was dealing with application penetration testing, audit I.T and cybersecurity audit. I was doing also programing in Python, but cybersecurity programing like trying to program a little bit some tools, some scripts for example related to cybersecurity, all type of stuff.
00;12;47;06 - 00;13;16;23
Speaker
Then I moved to another company, also consulting company as information security consultant. I was doing all types of intrusion testing specifically in application moderation testing configuration reviews. So, I was doing the project go to like for example, P.S. Ideas is another project penetration testing for busy ideas, compliance, doing user access review, doing a lot of stuff. Then I said, okay, this has been duration testing.
00;13;16;23 - 00;13;44;29
Speaker
It is really good. I love it. I am really keen of it. But if you also you, if you are just wanting to be offensive, like in the offensive security, you will not be that perfect. I said, why? I said, because you don't know how to defend. You don't know the defensive mindset. I said I wanted to learn the defensive mindset as a job, as a let's like not to transition to another letter carrier.
00;13;44;29 - 00;14;10;14
Speaker
No, I just wanted to learn the defensive mindset. So, I said, okay, what other like the most thing that I really care and love after been training, testing, it is digital forensics because actually I really like Charlie Comms. They said, okay, let's be the cyber owns. I learned digital forensic. Actually, I didn't have any idea actually at the time about digital forensics.
00;14;10;14 - 00;14;40;06
Speaker
I am just like just love it. I don't know anything about it. I said, let's go. And I applied actually as an entry position, like for digital forensics. And at that time, oh my God, Thriller, a lot of things changed. Now I have like different vision, different mindset. I know, for example, the defender, how we react. I know like, for example, husband station tested or the offensive site, how it was, how they read, react what is I will be left.
00;14;40;06 - 00;15;04;10
Speaker
I will be leaving actually when I'm doing an assessment how they are going to catch me. For example, if you are doing a routine assessment, all this type of stuff, you can actually have an eye on it because you learn something and you learn. As I said, cybersecurity is an ocean, and you must be specialized in one or two fields for sure.
00;15;04;11 - 00;15;23;19
Speaker
You can know a lot of fields, but as to be an expert, as to be really professional, you may have like you may choose one or two fields like penetration testing for me. And digital forensics on this is I think I took too much time. But yeah, no, honestly, I'm fascinated. That was one of the best introductions I've had.
00;15;23;19 - 00;15;41;01
Speaker
So that's fantastic. Thank you. Thank you. It's really, really wonderful. So, and you've mentioned a whole bunch of different things there, so and I apologize if I jump around because this is. No, no, no. Yeah. So, I'm just going to start simple here and especially for some of the people who are listening in. So, let's talk about ethical hacking.
00;15;41;01 - 00;16;07;26
Speaker
Okay? So, I watch YouTube and I see these guys, you know, anti hacker, they break into another hacker’s department or something like this. I don't know that that's actually what ethical hacking is. But can you explain to us and the listeners what in your mind constitutes ethical hacking and thinking hacking? You need to have the mindset of actually breaking things, like you want to have the passion to break things in out of the box.
00;16;07;26 - 00;16;33;08
Speaker
We like very creative way. You need to have a very creative way in breaking things for sure. Networks, systems, applications, mobile applications, web applications like they will give you a system, for example, this network, try to break it. Try, for example, to take a privileged escalation account in one the systems try to pivot one system from one system to another system.
00;16;33;10 - 00;16;55;15
Speaker
All this, it is an ethical hacking. It is a way to access a system that's for sure. It is unauthorized way, but it is authorized because actually you are after the engagement is finished, after you finished your assessment, you will tell them, okay, you have vulnerability X, you exploited this vulnerability. You this impacted the system very much.
00;16;55;15 - 00;17;25;03
Speaker
For example, it is very critical vulnerability. And this is my exploitation. You can and you can actually reduce civil liability. They need to reproduce the viability of following your steps. Recommendation to remediate is for inability. So, all of this, they need to take care of it. And ethical hacking actually like simply it does, you know, like say general methodology like for example it starts with bring engagement is pre-engagement.
00;17;25;03 - 00;17;59;17
Speaker
You come with the client or some what you need to do is like for example gray box testing. Okay, Gray box testing. They will give me for example, a little bit knowledge about system architecture. They will give me, for example, a credential and they will tell me, okay, from that you can go for some. And also, you cannot do for example, they will need to specify the scope, scope of engagement, for example, for some, only this domain you can hack, you cannot do brute forcing like you cannot do it.
00;17;59;23 - 00;18;25;12
Speaker
You cannot make, for example, a lot of noise because it is a protection environment. You may actually cause the network to be down and after that everything is settled down. You need to go after that to the information gathering fees. You need to gather as much information as you can about the target, the domain, the network, the everything that they give you as a target.
00;18;25;12 - 00;18;51;06
Speaker
Actually, you need to gather as much information about it. What is, for example, as a network subnet, what is a domain, what is IP address, what is the DNS records? A lot of stuff. Okay. And usually, they will give you actually small details about this. This in like in the engagement. In the engagement they will tell you some IP this is a domain you can look this like small details not everything.
00;18;51;06 - 00;19;15;11
Speaker
Then you will do information gathering or reconnaissance. We call it after that. Actually, it is a scanning this. You need actually to scan the system looking for vulnerabilities in the system. Whatever system, as I said, like a web network, anything. Actually, you need to look for vulnerabilities, like you can use multiple techniques, multiple tools actually to find vulnerabilities.
00;19;15;14 - 00;19;54;17
Speaker
After that, you find the vulnerabilities, you check the vulnerabilities. Okay, let's go with the exploitation. Actually, people actually are really confused between inability, assessment and intuition testing. They call it the SBT. It is that as just an acronym, but actually even a vulnerability assessment is different from penetration testing. Penetration testing after you actually find like, for example, you found a vulnerability, okay, penetration testing, you need to exploit this vulnerability in order to determine the impact of it.
00;19;54;18 - 00;20;19;25
Speaker
And you need to report it for sure. You need some vulnerabilities. It is really dangerous. You need to take like a consent or an approval from the client. Okay. Actually, maybe if I exploit itself as this, we're not ability, it may take the system down. So please, I'm allowed to do that or not. Like when I was doing actually some engagement, there are like two like bodyguards, one on the right, one on the left.
00;20;19;27 - 00;20;38;06
Speaker
They are doing, oh, no, no, don't try this, okay? Don't try this house. This is very dangerous. Don't try this. Okay? Don't say. Actually not. I am. Just tell me. They are on my head, you know, like they are just beside me. Like doing a some do this, don't do this. So sometimes it is very dangerous. Specially if it is a protection environment.
00;20;38;06 - 00;21;06;07
Speaker
If they don't have any mirroring environment or any testing environment or it is very dangerous. So, you need to take, as I said, an approval from the client. If you are exploiting this, you will not be able to and you know it is dangerous. It may cause damage to the current system. This this has been threatening testing, but invulnerability assessment actually you will not be able to you not because you will not be able your fears end in the vulnerable in the scanning.
00;21;06;12 - 00;21;30;05
Speaker
Okay. You discovered there is a vulnerability. You check. There is a full narrative for sure. Like you are sure it is vulnerability, not false positives. Okay, you are done. You just reported that there is a vulnerability, but inventories in testing, you need to its ability to determine, as I said, the impact. After that. You for example, let's say we exploited the system, we exploited like one of the systems on the networks.
00;21;30;07 - 00;21;56;01
Speaker
Okay, I can actually try to do privilege escalation. For example, if you have a normal user, you can actually try to do privilege escalation to take, for example, into authority or for example, admin user. Like you have more blockages, you can do more stuff, you can actually try to pivot from one network to another. If that network, for example, is very like Air Guard or something like that, you they consider it as there is no Internet connection.
00;21;56;07 - 00;22;19;00
Speaker
No one can connect to that network. Okay. You actually discovered a way to connect that network. All this stuff you can do actually mutation testing for sure. If you have a written approval, especially you use written approval because it is dangerous. Okay. No. Yes. You have discovered all or simulated everything you tried like to do everything thing after that.
00;22;19;00 - 00;22;41;29
Speaker
And as I said, like you can try to privilege escalation, pivoting. Then you can also try to enumerate different data inside the system. Like some data you are not you don't have access to it when you are seeing from outside. Like if you are looking up from outside the big picture, some details you will not you will not have access to it because they are in different systems.
00;22;42;05 - 00;23;04;22
Speaker
But when actually when you exploited a system, actually you may have more details. So, you need to enumerate the details because maybe you can actually take advantage of them to actually to go to another system. And this is like a chain, you know, like you take advantage of the weakest link, let's say, from a circle. Then you can go to another system because all it is chain together.
00;23;04;24 - 00;23;35;12
Speaker
Then after we exploit actually the systems and it works, you can actually have your report to report. Everything that I found is from the ability was this damage with these criteria. Like for example if there is a C, the E or common vulnerability disclosure for it or number, you can actually mention what is your general recommendation actually to solve this or to patch this will not ability everything with screenshots, with everything, not a complete report and then you can give it.
00;23;35;18 - 00;23;56;29
Speaker
And for sure when you start an engagement, you send an email. When you end an engagement, you send another email like every day, like I started because sometimes they need to do some stuff, or they meet. They may exclude your warnings because sometimes they the blue team, actually they, they may be scared, oh, someone is attacking us.
00;23;56;29 - 00;24;16;04
Speaker
But no, when they know that I am interested in testing ethically hacking their system, it's okay. Okay. Let me let me summarize a couple of things because there was a there's a lot of information there. So, when we talk about the different types of approaches or methods, you talked about, obviously a vulnerability assessment, you talked about penetration, penetration testing.
00;24;16;08 - 00;24;37;16
Speaker
But where does for example, you talked about brute force testing and in my mind. So that means to me that means just somebody is just trying. Okay, you know what? What password might they have used? They're guessing at things that just trying to see if there's vulnerabilities or if they can get in. But are there also, like routines that they use, little scripts or little things that they try that automatically will go?
00;24;37;19 - 00;25;05;24
Speaker
So, what kinds of things are there at your disposal that you can try on a system? Like, what are those? What are those tools and techniques? For sure, for sure. Actually, there are a lot of techniques used in brute forcing and also there are a lot of mitigations for it. For example, in tools, there are known tools for example like Hydra, for example, it is in calculus or even you can download it in any system, you know, system, it's okay.
00;25;05;25 - 00;25;29;06
Speaker
Like you have, for example, in brute forcing, let's say we can have we have different types of brute force. We have like different. It is password cracking as a general term and brute forcing actually is one type of password cracking techniques if we can visualize it. So, password cracking is generally a general term. And for example, brute forcing is one technique.
00;25;29;13 - 00;26;01;03
Speaker
We have also a rule-based technique. We have also rainbow table. So, there are a lot of types, let's say like for example, what is brute force in brute forcing is when you try all combinations that you can think of for the password for example, I can try to do brute forcing for a password. I want to all the combinations of, for example, in English alphabet from A to Z, capital letters, small letters from 0 to 9, or also all the special letters.
00;26;01;05 - 00;26;25;10
Speaker
And you can imagine that this will take ages. Actually, it will take a lot of time. Actually, to do on mostly this one is ineffective because it will cause a lot of it cause a lot of noise in the network sometimes you need to be stealthy and this one for short fills in this. And sometimes, like you have very limited time in your engagement.
00;26;25;10 - 00;26;52;18
Speaker
If you are just sitting and you are waiting, it will never finish really. And this is very ineffective. So, we have like other types that are more effective and you can actually use them, and they are very fast. For example, there is dictionary-based attack. Okay, let's say, okay, what is I had I am I have gathered a lot of information in the information gathering phase about, for example, this employee.
00;26;52;21 - 00;27;25;22
Speaker
Okay. This employee likes similar. He always like five number five, for example, he always let's say like, for example, Spiderman, all these types of data, we can gather it. Why? Because we want to make an idea about what the password might be. So, for example, I can make a dictionary. Dictionary just lets it combinations of known data that I know that this might be.
00;27;25;23 - 00;27;59;12
Speaker
If I even change the combination of these words, actually it might be the password. So, for example, I will when one for example, when what is my dictionary will be for example, Spiderman five. Next word. Okay. Summer five, Spiderman next word, Spiderman five summer Nicole and you will change the words interchangeably. We will change the words. And as much information as you have on the target, you can make very customized dictionary to use it in your password.
00;27;59;12 - 00;28;28;24
Speaker
Cracking is an okay. Let's say it's also not possible actually to make your own dictionary. Here are some of the most known dictionaries that are out there. Like usually, you know, there are some websites, they leaked their information, they got compromised, all the databases got leaked. So, what these people what they do, actually they took this information that got leaked.
00;28;28;27 - 00;28;49;06
Speaker
They make a dictionary for all this data and actually they put it on the Internet. So, you can use this dictionary, you can use this leak data, actually use it as a dictionary without doing any stuff. There are a lot of techniques sometimes. Also, if you are, for example, okay, you took your password. I found the password. Oh, great.
00;28;49;09 - 00;29;12;18
Speaker
But unfortunately, you found the password is hashed. Hashed means that actually you cannot take advantage of it because you know, the hashing algorithm, it is one way function that it will make the word, let's say not obfuscating, obfuscation, deficiency. But it is not does not make sense like this is hashing. It will not make any sense for you.
00;29;12;23 - 00;29;37;16
Speaker
So, you need to do hashing. But the hashing is different than the encryption. The encryption, the hashing. You cannot reverse it. So, encryption, you have one you cannot decrypt and encrypt, but hash, No. So, for example, I have password and I have a hash, but I do not know the password. So, what people also did they for example, they make a lot of hashes for different password.
00;29;37;18 - 00;30;04;03
Speaker
Then they compare each hash with the password. Okay. Okay. Have a host and I have already computed different buzzwords in my mind. I've, I got their hashes, and everything is sorted out. So, what can I do now? I can compare the hash that I found with all her. She's not in the list if there is a match. So, the corresponding password is a password.
00;30;04;06 - 00;30;24;11
Speaker
I hope it's clear. I don't know if it's a clear. Okay. Yeah. So. Yeah. So, is this one, is this called rainbow table attached? So, there are different techniques actually to crack a password or to track the hash of the password. Okay. So sorry. Let me ask you about the I mean; you're using these your software programs. You said you can download and simple like that.
00;30;24;11 - 00;30;52;01
Speaker
And as a computer science graduate, there's obviously different languages that you're going to be using. So, there's actually a question here from one of the people here, and it has to do with what languages are important in hacking and ethical hacking. And I have I have I'm going to guess it's all of them. Actually. There are for sure like a like as many programing language that, you know, is very good, but like as many you learn as the better.
00;30;52;01 - 00;31;22;16
Speaker
But for sure, there are programing languages that are more used in the industry on the scripts, the tools are written in these programing languages. So, for example, I would advise Python as it like if you want to learn, if you want to do some scripting, some cybersecurity tools you can actually use Python doesn't is very well known and widely used in hacking field bison is one Brooklyn language.
00;31;22;22 - 00;31;50;28
Speaker
There is c, c is fantastic, but the advantage of it is a bit more complicated than by some, so I would not recommend it. If you are new to the program and programing, I would not recommend starting with C, start with Python. Now we have gone golang. It is becoming more popular. It is very. It's really like taking all the attention in the industry.
00;31;50;28 - 00;32;20;29
Speaker
Golang It is very new. So, you can use a lot of programing languages, but if you ask me, I would advise go for Python, then you can go for JavaScript. If you are interested in whip hacking, then go for C. But as I said, there are many programing languages and actually the more you learn, the better. Why? Because actually if you learn Python, it will be easier for you to learn JavaScript, you know, because you have the concept, it is just the syntax.
00;32;21;02 - 00;32;46;15
Speaker
The different way of writing is different, but the concepts are the same mostly. Sometimes they're like very slight difference. But yeah, some there are differences, but mostly the syntax will be different, but that semantics will also will always be the same. The right always like, okay, so let me ask you another question because you talked about like when you were learning, or you were asking people about it.
00;32;46;20 - 00;33;06;04
Speaker
You know, everyone is like, oh, don't talk about hacking. You know, it's like, forget it. But what about like legal, legal and compliance aspects for ethical hackers? Like, are there are there any laws in place now or is it depending on the country, some things are nobody cares. Some things are very strict. Like what can you tell me about this?
00;33;06;07 - 00;34;03;13
Speaker
No, actually, ethical hacking slash penetration testing is mandatory like in this. In every cybersecurity concept or it's a component. Why? For example, if you need if you have, let's say, a basement, a company is dealing with payment cards like Visa what others like. I think there are a lot actually like Visa, you need actually to do penetration testing regularly to be compliant, to be able actually, which is like PCI IDs is this is payment card industry that the security that's good that you need actually to have been tracing testing regularly I think twice per year to be actually compliant and I'm if you are not doing that actually you may have fines you will not
00;34;03;13 - 00;34;36;11
Speaker
be able to use visas and you know like it is now up and the online is for sure using visa, something like that. It is a must for example, for medical, medical industry or hospitals. Heba There is a labor industry compliance that also you need to do been tracing, testing, ventilation, testing or ethical hacking by law now, or like for example, I think all countries that really, they have cybersecurity mature established their cyber.
00;34;36;19 - 00;34;57;10
Speaker
I think most countries they have that they need to do ventilation testing engagements regularly for everything other. Otherwise, it may actually come was circumstances that you don't want to. Right, right, right. Let me let's move on a little bit because there's a few other things that I want to get to. And we are flying by in time here.
00;34;57;10 - 00;35;19;09
Speaker
So, I hope you don't mind if you're going to stick around a little bit more. I think you're going to go, well, okay, we're going to a little over an hour. And it has to do with the presentation that you did because in in when we were in Riyadh, you did the gist of your presentation has to do with how much information you could retrieve out of a browser under different conditions.
00;35;19;09 - 00;35;47;04
Speaker
Right. Okay. Maybe in a simplified way, could you explain to people what you did and kind of like what you found? Sure. My research was about private, private browsing forensics. So, if you are using private browser, we all know like incognito mode of like the Chrome browser, private browser of Chrome. People think that this browser is bulletproof, like it is a silver bullet.
00;35;47;04 - 00;36;17;19
Speaker
You can do everything if you are actually running this private, the browser and it is just a myth, you know. So, my research was focusing on, okay, let's say you are running private the browser, you are doing some activities using private the browser. Is there a way actually to retrieves information, seen or for example, the searches that you did when using private browsing, like, okay, I am using private browser and I have done some searches.
00;36;17;22 - 00;36;48;05
Speaker
Can you discover that actually private the browser string is it gives you some privacy on localhost, it means it gives you privacy on your computer. But the ISP, Internet service providers, the local administrators, the website admin themselves, they can all know your activities. So okay, I said okay, so this is just the weaknesses, but I will not touch about its weakness.
00;36;48;05 - 00;37;23;08
Speaker
I will touch about it. Just think, okay, it's good when you are using it on localhost right? I said, okay, so let's just let's study its history. Let's try to find some loopholes in its strings on the localhost. So, I have done like multiple research more, I think more five six use cases. But I showed in the presentation only four cases for only four use cases and I walked through only one because I have limited time at that time.
00;37;23;11 - 00;38;01;06
Speaker
So, what I did, I just did some search on private browsing, and I didn't close the private browsing. Then I took a digital forensic image from the hard disk and from there on this to like, you can't this is the first use case. The second use case, I closed so private the browser and I waited 10 seconds. Then I took also a digital forensic image from the artist and also from that on the third use case, actually I was doing it.
00;38;01;08 - 00;38;27;16
Speaker
I rebooted the host the virtual machine. Yes, I rebooted the virtual machine. And then after that, I took a forensic image from the hard disk and run. And last case, I actually not only rebooted, I shut down the virtual machine. So, at that time I wanted to analyze all the artifacts. All the traces are actually there any traces left behind.
00;38;27;17 - 00;38;58;27
Speaker
And I used like five different criteria on my system. For example, I was searching for a knife. I was doing some YouTube searching on the YouTube video, Google of using a video file like five criteria on the same five criteria on all use cases. And actually, in the first and the second case, like for when I was doing the private browsing without closing up the private browsing, like for example, you left your computer and someone like, for example, had access for sure.
00;38;58;27 - 00;39;23;28
Speaker
But even if you could like make it hidden, you any digital forensic investigator, if he took a digital forensic image or RAM image, he could actually know your activities. And but the most interesting one is actually the second use case, which is after you closed the private browser, I closed it, and they were 10 seconds. Then I took, as I said, the digital forensic image and the image.
00;39;24;00 - 00;40;11;00
Speaker
I was able to find the same activities specially if you have the ram, the ram will have some artifacts, some traces. And also, if you RAM is not that big enough, you will have something big fight that is written on the hard disk. When something when the ram sees like for example, there is inactive data or it is about to get full, so it push some of its data to the hard disk like swab, put it on the hardest and make more data like more, I think like active data to come to the RAM so when it is not to get full, so just to prevent itself from getting full and make more active
00;40;11;00 - 00;40;36;00
Speaker
data in its front. So, this page fight, that is why it's I found a lot of data actually, and all traces in it. But unfortunately, in the third and first case cases, I was not able actually to find any traces. But actually, it is really, I think, a very interesting topic to research, even like more research should be done on it with the Tor browser.
00;40;36;03 - 00;41;03;13
Speaker
Okay. Yeah, it's very interesting. Yeah. So, and again, just to be clear, so on the local host, this is all locally like, you know, what can you get whatever. But that doesn't exclude what the ISP can pick up for this now so let me lead into Tor browser. You mentioned it. So now can you explain to the audience here what is the dark web and what is the Tor browser and how is the Tor browser different than Chrome or some of these other browsers?
00;41;03;15 - 00;41;38;14
Speaker
Sure, sure. Okay. Now we are like having this for example, stream or the live session on a clear net service. Meaning like everything. Like no, thank you. Thank added. Now if actually if you are browsing the internet normally like doing some Google searches or going to Facebook, Instagram, anything this all in the clear net like all archive everything can you exist using for example, Google, Firefox, any type of browser?
00;41;38;16 - 00;42;09;02
Speaker
That's okay. Just clear net. What is the dark web? Actually, the dark web is I think the dark web actually it is the archive version of Clear Net. Let's see how I am seeing an archive, meaning like if you have a website or if you have a service, we call it. If a service, it is in the dark web we call it didn't service it or onion service.
00;42;09;09 - 00;42;41;10
Speaker
If we if we have a hidden service in the dark web, you cannot actually access it in the clear. Like in the normal browser chrome, you cannot access a hidden service using normal browsers. So, this is why it is like now is a clear net gain. It is actually like 5 to 10% of the internet. All everything is like 90% that we don't usually have access to it unless we do some procedures.
00;42;41;12 - 00;43;02;08
Speaker
The most important procedure to do is using a browser that you can access with it to the hidden with or dark web. Let's see. Okay. Is that is that just sorry, just a quick question, but is the Tor browser dangerous in any way in a in and of itself? Is it is it like just like installing chrome or something else?
00;43;02;11 - 00;43;31;16
Speaker
Yes, yes, yes, yes. Okay. It is very, very normal. But actually, some countries are actually preventing actually downloading tor. And if you download the Tor, some countries may tell you or may question the people who download it, why you actually don't know why. So, it is not dangerous by itself, but it may be dangerous if the actually the governments ask your question you what is your need?
00;43;31;18 - 00;43;53;21
Speaker
What is your need of downloading tor This is only that in your pattern, or if you are downloading it from the source itself that it is okay. Yeah. No, the no danger about that. Okay. No, we will use doors to access the hidden service. As I said, it is hidden service. It is only in the dark. It is not in the clear net.
00;43;53;21 - 00;44;28;17
Speaker
You cannot access it using Chrome or Firefox. Okay. The door is really interesting. Like, let's say you have you have the Tor and you were able to access the hidden services, but actually using the Tor itself, you can actually access the client services or websites like you can actually you can actually access Google from the Tor itself because even the Tor itself is actually based on I think, a free one version of Firefox.
00;44;28;19 - 00;44;53;28
Speaker
So, it is like it's like Firefox, you know, like it is the same similar to the Firefox, but you can access the dark with it the dark web. Let's see what it is. All people talking about dark web. You can be anonymous using the browser, but it is 100% using if you use don't know. Okay, it gives you some anonymity, it gives you some privacy.
00;44;54;05 - 00;45;20;12
Speaker
But no, it is also not bulletproof. Why? Let's say you are a client like I am, for example, for some I want to enter the dark. Okay, I have downloaded Tor. Everything is fine. Okay. What is Tor? Actually, Tor is Tor stands for the Onion or Outer like as the Onion. It has some, you know, some layers. You have some layers there.
00;45;20;14 - 00;45;53;04
Speaker
The Tor actually encapsulates your requests using three layers. So, if, for example, I want to access it, X is a perfect. If you want to access what will happen, you entered, you open the door and Tor is doing some background process. What is that process? Actually, taking your request after you actually type X dot? I don't know the first thing.
00;45;53;06 - 00;46;21;24
Speaker
There are three nodes like the nodes or relays or anything. They are just computers. So just deal with me, please. So now you entered the Dark web you use Tor you thought X not I don't know this website. Actually, it is a hidden service. So, what Tor will do Tor will do will take your request encrypted. And this is the first, let's say, note.
00;46;21;26 - 00;46;45;00
Speaker
This is one computer node is just a volunteer run computer that you can run. I can run. Anyone can run to just in the dark. So, it to help. It's being anonymous like to help other users. You can make other users actually use your computer to be using the Dark web so they can buy through you know, bust through your computer.
00;46;45;00 - 00;47;07;17
Speaker
So, you're actually you will be your computer will be alone that browsing the data. Okay I am taking the request encapsulated encrypted everything this is into node, and which is we call it sometimes a guard node. So, this is a first. And then this first node will give it to a randomly computer will entirely like someone who said, okay, I will be volunteer.
00;47;07;17 - 00;47;33;29
Speaker
I run my computer as a known to the middle node. This middle node also will take the request from the not from, you know, from the internal. So, we have now second will take this request link ups related encrypted everything will give it to the third node, which is we call it exit node. The exit not actually will take it in capsule8 it everything and we will give it.
00;47;34;01 - 00;48;08;14
Speaker
But once the requests reach the exit node and it will go to the destination like, The Onion, for example, which is a hidden service, it will be it will be not encrypted using Tor, it will be using its database. But this is if it was like normal loop. So, for example, go get if it was a hidden service, it will go with another three cycle like the exit node.
00;48;08;14 - 00;48;43;25
Speaker
Will. What? Because people like, for example, I was actually thinking selfishly why I am only the why I'm the only one who actually using Tor. Okay for the heading service once actually to protect its identity. So also, the hidden service. There are three nodes, two busses through to reach its final destination. So, if you want to connect from like to connect to a hidden service, actually it is six nodes it needs to pass through, but if it is a client, it services only three.
00;48;43;28 - 00;49;19;18
Speaker
Okay, so I to make something so but it's excuse me it's it sounds very serious though like interest one exits another. It doesn't actually distribute does it distribute things in parallel like the information in parallel or is it pretty much Siri. No, no, no, no, no. Siri It will go from one to another from and every time, which will change on this node, sometimes in do not usually it will stick with your like usage for two or three months, but the middle node and exit node like for every request or Timmins, I think it will change everything until serial will take one take to another.
00;49;19;23 - 00;49;44;03
Speaker
As I said, if you are accessing normal service only three nodes to be bus through on the request that is actually taking out or coming out from the exit node will enter for example, declaring the service will be HDD, be is protected hopefully, but not in the total protection like it will not be protected by Tor because it is existing Tor.
00;49;44;05 - 00;50;05;04
Speaker
But if it is hidden service, as I said, exit node, let's say that personal like for example, the exit node is different from the destination exit. It will be six nodes accordingly and it is different. Six months is three notes. So, it's the fact that you have all these layers that makes it more difficult to keep tracking down.
00;50;05;11 - 00;50;46;26
Speaker
What's the next node, What's here is, is like y actually you can see a lot of agencies actually sees some malicious hidden services because you can voluntarily you can actually be volunteer and run actually and police agency node and you can actually when requests it will pass it through you. Okay, wait a minute. Okay, wait. What happened? Okay, sometimes you can change the request, sometimes you can actually, if it is an exit note, especially the exit, not like the exit nodes know the destination and the entry node.
00;50;46;27 - 00;51;10;26
Speaker
Know your identity's IP address. So, if they want most probably, they will be actually hosting a malicious exit node because they want to know like what is the website that or the hidden services that you want to access. And they will try actually to trace it. But it is difficult as a traffic analysis. It's a huge but there is a pattern.
00;51;11;03 - 00;51;39;26
Speaker
There is there are some buttons actually the icon or any police agency that they can do it the ISP, they can do it even if it is really difficult, but it is not impossible. And any trace that you leave behind, it might actually trace back to you. So, the exit node, as I said, knows your identity. So, if, for example, he is trying to access something illegal, the exit node will have this information.
00;51;39;26 - 00;52;10;24
Speaker
So, what, it is actually like a fake exit node or blunt? Blunt exit node, they will actually sometimes do downgrade. As I said, don't be a downgrade. What I mean by that, like after, as I said, exiting, for example, to your network, if it is like just he wants to do any let's see stuff, it will be trying to, for example, change or change the his request to malware for example and the when he took his response he will download the malware.
00;52;10;24 - 00;52;30;23
Speaker
For example, if there was an illicit file to be downloaded, they will change it. For example, if he is accessing clear net service. But this service, even if it is illegal, but it is in that clear net, not in the dark web, they may actually downgrade downgrades to be a protocol to be so it will not be encrypted too.
00;52;30;23 - 00;52;53;28
Speaker
All information is in plaintext. So, there are some techniques actually the investigation, digital forensic investigations, police agencies, they can do actually to trace some illegal activities like this. Okay. I have a question here, and I'd like to know if you can address this one. That's from Kevin here. He says, if you're writing a node, is the content of the original request stored on the node?
00;52;54;02 - 00;53;18;28
Speaker
If the request was for illegal content, would it be discoverable on the node after the request was completed? Is this what is the content of the original request stored on? It will be encrypted. It will be encrypted this way. It will be encrypted on the node. Like for example, on the note, it will pass through. Okay, I will take this information, as I said, like it will be encapsulated and encapsulated by the node.
00;53;19;03 - 00;53;47;09
Speaker
So, the note itself, who is the one who encrypting the information? So, it will take the information encrypted and give it to another. The second? No, the second one will encrypt this information and give it to the third node. So, this information is encrypted, but by the node. Okay. When we talk about cybersecurity in general, especially concerning like what we're talking about, the dark web Tor browser, what are some of the more important trends that you see emerging right now?
00;53;47;11 - 00;54;21;06
Speaker
Like what has been changing over the recent past and what are the hot topics, let's say, and now artificial intelligence using cybersecurity with digital intelligence is huge, is very strong. Like I can see like technologies with this, with artificial intelligence, it's really powerful compared to like normal cybersecurity technologies or tools or let's say appliances. So, if you combine artificial intelligence with digital, with cybersecurity, it's very good.
00;54;21;08 - 00;54;48;00
Speaker
This one trend, actually the Iot is and drones, they are now doing some let's say Iot is especially as it is this is very trendy and sometimes, they for example, hack a smart home. So, this is very the trend is a cybersecurity You need to actually it is very actually it is very licit. It's not really protected for to cyber attacks.
00;54;48;02 - 00;55;18;17
Speaker
So, this is very an emerging topic that we need actually to address. A lot of stuff in Iot security is, for example in the drones when they are actually doing some activities in drone, if a drone crashed or anything, they need to do digital forensic on the drones, a drone. Now it is also a trend. We can also we have these sick ops which is development security operation like let's this software engineering with security in mind.
00;55;18;17 - 00;55;47;01
Speaker
So, you are developing designing doing the requirement everything but in security was minds with using automation all the ops operations. Also, a lot of stuff actually are really now you can take advantage of it also study between now is really a huge problem. We can utilize it in really different ways, and you can see like Chad Djibouti for distance charge, Djibouti for close charge if you like.
00;55;47;01 - 00;56;24;04
Speaker
No specialized charge for only, for example, one field in cybersecurity. So, you can utilize it a lot in the eyes. Now, a lot of companies, they are moving actually to API services like I know like it has been since long that they are using us. But now it's a huge I mean; duration testing is very mandatory nowadays. So also, the cloud, the eight of us, for example, Azure Cloud GCB, every anytime now, all moving to the cloud.
00;56;24;04 - 00;56;48;17
Speaker
So, cloud security is crucial. Also, you need to know, for example, the tenants, what are the components, how to do, for example, digital forensics on the cloud. If you have a log trails, what you can ask where the data on the cloud is, all this type of stuff. You need to have knowledge. Actually, as I said, what you need, you can choose one and you can choose, for example, cloud security and take this fast.
00;56;48;18 - 00;57;13;10
Speaker
Or you can like for example, go for arbitration testing and learn it, for example, if you like, after that, if you were really comfortable with it, you can actually go to another field or some subfield. Let's see. So, this I think the most like emerging ones. Yeah, in my opinion. Okay. Let me ask you about prevention measures because, you know, everybody's interested in getting protected.
00;57;13;10 - 00;57;33;11
Speaker
People have been hacked. I'm sure it's not. I mean, so many people have been hacked nowadays or they get something malicious or something that's troublesome. But what are what are some of the things that individuals or organizations, what they can do to protect themselves from threats that originate either from the dark Web or even from the clear Web?
00;57;33;13 - 00;58;14;04
Speaker
Okay. So, cybersecurity measures, okay. Actually, especially for people who are not specialized in cybersecurity, this may seem actually very difficult task for them, actually for non-security. So, cybersecurity people, but there are some mitigations, normal mitigations. There are many, many. But I will actually focus on people who are not in cybersecurity. FIELD Then you can go to for people who in cybersecurity, for people who are not in cybersecurity, really, you need to have, for example, normal antivirus, normal antivirus with Internet security.
00;58;14;06 - 00;58;40;06
Speaker
This is a must. This is must. I know it may seem silly, but no, really. Like, for example, some people, uh, they are not actually sure. Should they download an antivirus? Like what? The benefit of antivirus? No. It will give you some benefit. Trust me. Especially if it is always updated everything. Secondly, you need actually to update your system.
00;58;40;06 - 00;59;24;21
Speaker
For example, if any, especially security patches. For example, you are having Windows ten, Windows 11 and there is a security, but you must download it immediately. You need to enable firewalls and actually make some let no for non-security people, not just activate the firewall at least actually because a lot of people just deactivated make it offline really and this is not could actually make it I want I want actually to tell you download like let's say a vendor firewall or but no at least you really to have a firewall then any little link you need actually to check it like for example especially if you took it from the internet, not the Google link.
00;59;24;21 - 00;59;51;24
Speaker
No, no. Any link, you need to check it. For example. Simply, you can, for example, use any symbol, let's say scanning engines, for example, like VirusTotal. Just try to check the link. Don't put it immediately on your browser unless you have, for example, some technologies which is like disposable browser. You can do it over whatever you want on that because after close the browser, everything will be go with it.
00;59;51;24 - 01;00;16;00
Speaker
So, this is not an issue, but if you have, you have like your normal browser on normal host, normal computer, don't do that. I want also to emphasize if you are in the I.T, not in the cybersecurity, try actually when you want to test something, do something like download any file. Try actually to have a virtual machine like for example VMware.
01;00;16;03 - 01;00;36;17
Speaker
Explain to people, explain to people what a virtual machine is and why it's beneficial. Okay. Virtual machine. We can say like you have no windows, I want to have windows. Okay? You have your operating system. Okay. I want to have another operating system. I want to have, for example, Kali Linux. Okay. You can have dual boot clean. It's okay.
01;00;36;20 - 01;00;58;05
Speaker
I want to have another a third operating system. I want to have Ford's operating system. You want to have a lot of environments, but your resources cannot actually have all of that because it will take all a lot of resources. It will be very heavy on your operating system or on your actually CPU and you run all your computer resources.
01;00;58;07 - 01;01;27;00
Speaker
So, what they can with a technology that you can actually have an operating system inside an operating system like for example, it now that you can use a cell in Windows, you can use it without actually any, let's say, third party application. But let's say now Virtual Machine was like program like VMware, Virtual Books. Any program you can have an operating system inside an operating system.
01;01;27;00 - 01;01;53;20
Speaker
For example, I can have Galileo, Nicks or Pinto Linux in, for example, Windows, and you can configure it as normal computer like it has its Internet, it has its resources from RAM, from CDU, from hard disk, like a normal computer, but it is virtual. So, you can have another computer, you can have like for example, three operating systems in your windows, for example, or in any.
01;01;53;22 - 01;02;23;04
Speaker
Yeah, like your main operating system. So is a beauty in this. You can actually test, for example, any malicious files or seemingly suspicious or malicious file on those actual Windows operating system in the virtual machine after you configure it to properly and make it, for example, there is no contact between the host and the virtualized environment. Actually, you can configure to run this to make it really isolated, isolated environment.
01;02;23;06 - 01;02;44;05
Speaker
And once you click for example, you have for example, anyone give you a file or a link, you can actually open the file open even if you don't have any cybersecurity. Sometimes it feels suspicious or if you have just a normal EVA, it will not pass through. But for example, sometimes it will be hidden, it will be stealthy, your antivirus will not be able to detect it.
01;02;44;08 - 01;03;08;29
Speaker
So, you check that file. Okay, now you can make like reset. So as a virtual environment, everything will be gone as you have not done anything. This is a beauty like you can a lot of this, a lot of this on that virtualized environment without harming or damaging your operating system. So, this is a beauty and I really recommend to have, for example, a virtualized format.
01;03;08;29 - 01;03;50;21
Speaker
For example, VirtualBox is a free you can actually have access for it. You can also if you have I think PowerShell four or five, you can have WCL actually you have like subsystem like Windows subsystem, you can go with the US anyway, it was, you can have for example Linux inside Windows and it is let's say Windows which is doing this like window enables you actually to do this like subsystem technology they call it or and so you can actually they will tell you which subsystem you want they to you are telling them that for example Kali you can do different commands and different things.
01;03;50;28 - 01;04;28;27
Speaker
But I would advise for just the people who are like in New in cybersecurity or even just a bit, they have some knowledge in I.T actually to drive virtualized environment to try VM and check with it. So just procedures you like security, you cannot actually be 100% secure. This is facts but you can make the process of hacking your systems more difficult, for example, than for example, instead of actually making all hackers hacking your system you can make or actually your system immune to only like 5% of hackers who can actually hack into your system.
01;04;28;29 - 01;05;04;01
Speaker
And this is like one way to make your system like more like you are hardening your system, let's say in jargon terms. So this is a way like for people who are like just simple terms and conditions bit simple procedures you can actually take and your system will be much more secure actually just enable you every your firewall you have virtual machine, you check your files on a malicious even you if you don't know how to analyze them like just normal or online scanning engines, they will do the job for you and you will be more secure.
01;05;04;04 - 01;05;19;10
Speaker
This is like very, very, very on very simple terms. Yes. Yeah, I think it's a good point. And I think I've heard that before where it's just, you know, nothing is 100%. But you make it a problem for somebody that they're like, you know what, I'll move I'll move on to the next person because this is just going to be it's going to take time.
01;05;19;13 - 01;05;56;00
Speaker
It will be tedious, and they will do a lot of effort. Yes. And maybe the value of hacking your system will not be actually because hackers have different values that some people they want, just like a system to get money. And if they will say, okay, let's compare is the value that I am supposing to take or they will do a comparison, the value that I am taking, is it worth we actually do all this stuff and trying to hack your system like I will do a lot of effort all my like I will waste a lot of time is it worthy if it is not worth it, they will not actually even if they
01;05;56;00 - 01;06;20;19
Speaker
have actually the probability to hack your system. So yes. Okay. Could you share or like do you have any interesting case studies or any examples that highlight the, you know, the complexity and challenging challenges that are encountered when you're dealing with like investigations related to the dark web or Tor or some kind of security issue or use cases you want in the dark.
01;06;20;19 - 01;06;50;08
Speaker
We are actually it is very difficult actually to if some activities lead to a dark web, really it is really difficult. And you have need to take some permissions because here the regulations, it is really difficult actually to be part of some cases related to so only like I only one I think the government can do this type of stuff.
01;06;50;10 - 01;07;21;28
Speaker
So, it is a bit difficult, actually, but it is difficult to share on this really. It is really difficult. But what I can say that using your Tor browser, it will not make you anonymous. 1%, but you can actually, with the help of police agencies, with the traffic analysis, the Beckett inspection and malicious exit node, they will like you, not like they will cut you.
01;07;22;03 - 01;08;00;28
Speaker
Maybe not now, but they will catch you after a while even though they will catch you. They got you. Yes, yes. But yes, it is really tedious. Does y because sometimes you need to take some warrants, you need to take. But in the dark web, you know, like in the claim that you for example, if you came across any, for example, Google services and you do not know the password, you may take somewhere to take, but in the dark, with nothing really known to you, you may sometimes actually or you may make sometimes persona or fake identity T and plant yourself on the head and service itself and gathering information, gathering information.
01;08;00;28 - 01;08;29;04
Speaker
Then you may try to do social engineering with the one that you are. No? Yeah, for sure. You know, that is the guy. That is my guy. You may actually try to plant yourself as the one who wants actually that hidden service, even if it is difficult. But you make a fake identity, fake name, fake big. All details are fake and make on to that system.
01;08;29;06 - 01;09;01;21
Speaker
It is not the invitation only. You can actually create an account and try to gather as much information on that target so you can use some open-source intelligence in the dark web monitoring, all that type of stuff to know more information. And as I told you, like, even it is like sometimes you cannot get many results. But if a case is related to dark web, it may take some time.
01;09;01;21 - 01;09;21;25
Speaker
Really. It may take sometimes, but eventually you may be able actually to seize it or to get to that information that you want. But as I told when any guesses related to dark web, it takes much time to be honest. Yes. Okay. Yeah. You know, just a couple more questions. So one is, what is next for you? Like what are you going to be working on next?
01;09;21;25 - 01;09;53;00
Speaker
Like, do you have any areas of special interest that you want to focus in on? What can you tell me about your next moves? Oh, sure, sure. Actually, I am trying to be more in engineering and also like more in malware analysis, also like strengths in my little skills in those areas I want to have actually in the near future, I want to have my own actually digital forensic course to people so people can actually take advantage and use this course.
01;09;53;02 - 01;10;17;18
Speaker
Hopefully I can learn and be more as a skilled person in this cybersecurity because you need to learn every day, every single hour, you need to learn, put into, put into the work, but in time. So hopefully I will try every day, learn and conquer these challenges. Yeah well, I know you've certainly taught me a whole bunch today.
01;10;17;18 - 01;10;36;11
Speaker
It was fascinating listening to you. I really enjoy your talk and you've got a wealth of information. So, I think of course would be, in fact, while you were speaking, I'm thinking this is a course right here. Like, it's just fascinating. So, you're definitely going to have to get a B, a professorship at some university. You know, I am learning from you, Professor.
01;10;36;11 - 01;10;57;24
Speaker
I am learning. So. Hey, listen, could I show your LinkedIn profile? Because I'd like people to know where to reach you, if that's a Sure, sure, sure, sure, sure. Here we go. Slowly Put it here. This time you're on LinkedIn. They can find you there. That's a profile for those of you that are there. Also, I'll put up the very quickly, put up his website here.
01;10;58;01 - 01;11;14;29
Speaker
And if you want to go over, trust link that say I didn't check on your website actually, yeah, this is my company that I am working, and you have a contact. There's a contact here it a company contact. But if you reach to the info, I trust link you, I will take it afterwards and show info I trust link.
01;11;14;29 - 01;11;32;18
Speaker
Okay. Perfect. Yes. Yeah. Great. Well, look how awesome we're getting on and I thought I found this fascinating. At some point in the future, I think I'm going have to invite you back and talk about maybe a more specific subject or something like this, but that's great. Fantastic. Yeah, I really thought a lot. I took too fast. I'm sorry.
01;11;32;19 - 01;12;00;26
Speaker
Maybe it's a bit also confusing to the audience. Like what? What are you talking about. Sorry. I hope, like, you really get at least even one piece of information that really was useful for you. I hope it was not boring and exciting for you because cybersecurity is really, really interesting field and I really encourage anyone who wants to be in that field to study and start from now.
01;12;01;01 - 01;12;03;14
Speaker
You can do it. Excellent. Well, look,
01;12;03;14 - 01;12;08;29
Speaker
hang back for a second and then I'm going to come back. But hey, we'll chat with you soon.
01;12;08;29 - 01;12;10;28
Speaker
Thank you. Bye. Ticket.
01;12;10;28 - 01;12;11;28
Speaker
Thank you for the comments.
01;12;11;28 - 01;12;20;17
Speaker
Thank you for being back here. We have regulars that keep showing up, which is fantastic. So, look, folks have a happy Thursday, and we will see you soon. Bye bye.