“Who would actually go after us, anyway?”

A former client asked me this while refusing an internal vulnerability assessment. Months later, they called me back — after a ransomware gang had already answered the question for them.

“Who would actually go after us, anyway?” they had asked, invoking the minimum requirements for their annual SOC 2 audit, which didn’t really require penetration testing to begin with.

They were a small business in a small city serving mostly local customers. To them, they held nothing of value to a hacker, so narrowing their pentesting scope to their external IP address made plenty of sense.

That is, until someone exploited a fresh, critical vulnerability in their office SonicWall and locked them up with ransomware hours after disclosure.

No patch available, no way to stop the perimeter break.

Unfortunately yet predictably, I heard from my old client soon after they recovered from the ransomware attack, and we did a comprehensive set of assessments of their internal security posture.

We did a lot of good in those assessments, but only after they had already lost operating capital and taken a heavy reputation hit, far more than the cost of an internal assessment.

Where the Model Breaks Down

See, when a zero-day exploit drops, two clocks start ticking: one is the heist clock, which counts down to when you’ll be specifically targeted. Maybe you’ve been on someone’s list of high-value targets for a while, and all they needed was the right moment to strike.

The other is the drive-by clock, ticking down to when the exploit will be indiscriminately sprayed across the internet, hitting every digital door in the TCP/IP neighborhood to see who has a faulty lock.

Unless you’ve been paying attention, you won’t know which clock you should have been watching until it’s too late. And as much as I dislike having this conversation after misfortune has befallen someone’s domain controller, it is usually the first time they’re willing to listen.

The internet is a great and terrible equalizer in this regard. Any organization, big or small, could be using a vulnerable appliance with an IP address.

Some of them learned this lesson seven years earlier in 2014 (though still the hard way) with Heartbleed, one of the most reliable remote code execution (RCE) vulnerabilities in recent memory.

Sometimes, you don’t even need to be a company to feel the consequences. You just have to drive a Kia or Hyundai.

If you’re only expecting a heist, you won’t see the drive-by coming.

The Missing Third Piece

For much of my career, I’ve taken the controversial but undefeated stance that unless you have the following three things, your security apparatus is inherently flawed and unreliable:

1. Asset Inventory—you can’t protect what you don’t know you have.
2. Network Map—If you don’t know how critical assets talk to each other, an attacker will probably figure it out for you.
3. Threat Model—What are you protecting, how are you protecting it, and whom are you protecting it from?

The question “Who would actually go after us, anyway?” is humility or hubris depending on who is asking it.

One can only begin to construct a threat model with the answers to this question, but instead, many unaware organizations weaponize it against having to spend money on something they don’t see as worthwhile.

In the best cases, they never have to find out what their threat model is. At worst, someone comes along and shows them, often quickly and painfully, just how much they actually had that was worth taking.

Customer information, credit card numbers, bank account credentials, and even just plain old cash to pay a ransom are more than enough for someone to include you in their scanning target list.

Defensive Steps That Matter

It’s past time we changed the way we think about the likelihood part of risk measurement. Or, at least, non-patchable zero-day exploitation needs to be a part of every single company’s regular risk assessment.

The likelihood of a zero-day being tested against your environment is determined by whether you have IP addresses in the 0.0.0.0/0 space and whether you have computer systems attached to those addresses, not by the value of your data or the size of your organization.

The mitigations are boring but impactful. Here’s where to start:

Get a Full Inventory

If you’re going to spend money on an appliance or a piece of software, make it one that most reliably identifies your assets. This will require some manual validation, but the visibility is worth it.

Once, I performed an external network assessment for a company that had several data center colocations with systems in their racks that were decades old. When I found a server vulnerable to Heartbleed years after it was disclosed and patched, I couldn’t believe it.

Neither could they, since the IP address and hostname didn’t appear anywhere in their inventory.

I got the network admin’s VPN password from the first memory dump.

Understand What Is Reachable and From Where

With an accurate inventory, mapping out the packet conversations becomes much simpler. Passively capturing broadcast packets and analyzing the sources and destinations will reveal more than you could have imagined about how many systems may be interacting with each other.

Even better, if you have the access to do so, perform more active packet capturing on your switches and firewalls for unicast traffic to see as much as possible. When you’ve mapped out your IP space and correlated it with your asset inventory, you’ll have more than a lot of organizations have.

Few things have given me headaches more than well segmented, highly specific network setups in which there are only packet black holes.

Research Past Threat Activity

Once you know what is in your environment and what it’s doing, you can start looking at vendors and patch levels to understand what might cause you problems without notice.

For example, if your SonicWalls are the only device between your internal and external networks, a compromise can be a huge pain.

But if compromising the perimeter with a SonicWall exploit only grants an attacker network reachability to a few key hosts in a demilitarized zone (DMZ), and the firewalls between the DMZ and other segments aren’t SonicWalls, the attackable surface reduces dramatically without more unique exploits.

Exceptional threat modeling goes beyond this, however, and should inform decisions you make about how networks and assets are segmented away from each other based on what you need to protect.

As for where to start, begin by looking at your entire organization and asking the following questions (stolen from Centers for Medicare & Medicaid Services):

1. What are we working on?

   What features are we building/network segments are we concerned about/software do we currently use, etc.?

2. What can go wrong?

   Can it go down? Can someone bring it down? Is it already vulnerable, or could it become vulnerable based on past experience and research?

3. What are we going to do about it?

   Can we eliminate risks entirely? Can we mitigate risks we cannot eliminate? How do we test the efficacy of changes we make?

4. Did we do a good enough job?

   Did the changes make a difference? Is there anything we overlooked? Can we improve on the improvements we made? Can we apply these improvements in other areas?

And then, repeat.

TL;DR: Hadrian published research on an unauthenticated WordPress RCE and deliberately left the exploit details out, to give administrators time to patch. I wanted to know if withholding still buys anyone time in a post-LLM era. So, I tried building the missing piece of the exploit chain from just the public write-up and the patch diff.

It worked, and the little piece of withheld detail ended up not worth much.

There are so many things I want to write about: information security, technology, philosophy, overcoming the fear of death…it’s a long list.

To solve this problem, I’ll be posting everything here in one form or another, following the POSSE method of publishing, a.k.a. “publish (on your) own site, syndicate elsewhere”:

1. If I wrote for personal purposes, it will be here, and will be republished to Substack for people who want that over RSS/Atom feeds.
2. If I wrote for one of my other publications (like Empiric Security), it will appear here as an original and there as a copy.
3. If I wrote for someone else’s publication, it’ll be posted here as a link post with an archive.org link in case the live content ever disappears.

This is mainly so following and interacting is easier while maintaining my digital ownership. If sites ever disappear or become paywalled, you can always access versions of the content on my site (unless I’m the one who removes it, of course). Not everyone is going to set up an RSS reader, and that’s fine.

I’ll do a more comprehensive post on POSSE and the IndieWeb soon.

He opposes the death penalty, doesn’t think you can stop smoking without divine intervention, and believed at least for a moment - that China was “milking” the genitalia of its male citizens to remedy its population issues.

Despite it all, I hold on to this book and regularly lend it out to people.

If you haven’t gathered by now, I am referring to Jordan B. Peterson, and the book on my shelf is 12 Rules for Life: An Antidote for Chaos.

My curiosity about things that outrage people made me purchase a copy some time in 2019. I knew nothing about Peterson at the time, other than that someone on Twitter had posted a photo of a young man across from them on the New York subway who was reading the book, with a caption that expressed disapproval at the man’s choice of reading material.

It’s been years since I saw it so I have no links to share, but I have no need to fabricate a story to support the idea that many women have poor opinions of Peterson and his fans, even around the time of the book’s publishing. A little Googling will show you as much.

Now, I had never seen someone express such distaste for someone reading something written in my lifetime. Perhaps if the man had been reading Mein Kampf, assuming that he’s not reading it for historical education (there are people who have done so without being Nazis, mind you), I could understand her negative feelings.

But I knew nothing about this book, so I looked into it, and found that it was written by a Canadian professor as a self-help book, and that it was based on his rather popular response to a question on the website Quora about “valuable things everyone should know”.

Reading through the lines in the post, I couldn’t find a single “valuable thing” that was even remotely controversial. Naturally, I had to buy the book to find out what the uproar was about.

What I found was useful. What I also found was that usefulness and moral cleanliness aren’t always packaged together, and that refusing to acknowledge the former because of the latter is a choice with real consequences.

Now, I don’t think the book needed to be a book. Many of the books written these days could really be blog posts, in my opinion, but they tend to make the authors a lot of money, so they can do what they want. While I got less out of it than others based on the reviews, I would say the “rules” are generally good pieces of advice that anyone would do well to incorporate into their way of conducting their own lives. At worst, they’re harmless aphorisms that one can ignore and go about their day.

But together, they were nothing close to the sort of material that should draw the ire of strangers.

Ultimately, I keep the book for a few reasons:

1. I like to lend books to people that I think they’ll benefit from, and some of my close friends (especially the ones who make fun of Peterson the most) could really get something out of rules like “Tell the truth – or, at least, don’t lie”, or, “Treat yourself like someone you are responsible for helping.”
2. When other people visit my house who read, they inevitably wander over to my bookshelf and a good conversation starts based on something they see.
3. It is now a monument to my carefully honed ability to appreciate good ideas put forth by people who also have some really bad ideas.

Tolerance Thresholds Are Arbitrary

The other day, a friend of mine messaged me out of the blue and said:

“I am so unsure of how to proceed when I read something I enjoy on a topic and then realize the author has deeply problematic views on other topics”

This is like drugs for me. I thrive on this sort of dilemma, and few things matter more to me than discussing them, hopefully leaving with a better understanding of my own thoughts as well as others’. My friend followed up with:

“…if I read a piece of info on something totally random…then I start following that person and a few days later they post something totally unhinged about how climate change is a hoax or something…”

I sat on it just long enough to trust my first thought. Fortunately, I had dealt with this feeling myself many times. Years ago, I developed an interest in document typesetting with LaTeX, but found most of the documentation difficult to follow. Then came Luke Smith’s tutorial playlist to the rescue, taking me in a single afternoon from clueless to compiling the majority of my data science university paper into a gorgeous, academically pleasing format.

Slowly, I discovered many of his videos touched on more things I liked, such as extending Vim with plugins and running free software in place of proprietary software. What I didn’t know until a bit later was that, despite agreeing with him about things like Docker being excessive and overkill and older ThinkPads being amazing laptops, we were not standing on common ground on things like COVID-19 precautions and anthropogenic climate change.

In the throes of 2020, the former disagreement took an emotional toll. I had no parasocial relationship with Luke Smith to speak of, but the mere presence of COVID-19 denialism in my field of consciousness, to any degree, was difficult to contend with. I had friends who had lost loved ones to COVID infection, and I knew people personally who had to be hospitalized, one of whom is still on a ventilator to this day.

I responded:

“One must dispel with the notion that valuable insight can only come from who we see eye to eye with above a predetermined threshold.”

You can’t only listen to people whose beliefs match yours to a maximum possible percentage.

Now, the next hypothetical dilemma my friend posed to me was of a blog feed consisting mostly of helpful and useful server hosting guides but also the occasional post full of support for Neo-Nazi ideas.

“At what point would you unsubscribe?”, they asked me.

The real question was this: where was my predetermined threshold, and how would I quantify it?

I realized the threshold is, in all cases, entirely arbitrary. We don’t walk around (or, at least, I don’t) with an inventory of current issues and our corresponding stances constantly at the fronts of our minds, ready to perform the necessary calculus on the fly to determine if someone else, either passing us on the street or sitting in our living room, is worth listening to based on some kind of acceptable agreement quotient.

If you do this, you have my sympathy because it sounds miserable and exhausting.

Given how arbitrary (read: emotional, and perhaps even instinctual) such a threshold felt to me, I would unsubscribe when the content I came for became too rare to be worth it.

“What if it’s a paid newsletter?”

Financial support of bad ideas was now part of the equation. As I said, I love this stuff. Starting with a 50/50 split:

Ignoring how unwise of a content marketing strategy it would be, if every other post from an individual to whom I send 10 dollars per month to support the publishing of content I like (server hosting guides and tips), is about something I don’t like (Neo-Nazi talking points), five of my dollars could be considered to be funding the Neo-Nazi bile.

But what if I think the server guides are worth the full ten dollars? Could someone reasonably accuse me of being a Neo-Nazi funder and enabler, or does it matter what I believe I’m paying for? Who gets to decide how much of my contribution may be immoral?

What if I follow the content creator specifically so I can stay up to date on Neo-Nazi talking points and movements, because like the wonderful Daryl Davis, I have a vested interest in being able to affect change through understanding of viewpoints that oppose my own?

Am I still financially enabling a Nazi to spread hateful ideas, or am I using those ideas in a way that allows me to counteract their spread?

Somewhere in the middle, now, what if I have no interest in the Nazi content and simply ignore it, while staying subscribed? Where does this place me ethically?

Approaching Our Guillotines

Outside of the law, we have to be careful not to make moral judgments for anyone other than ourselves lest we fall victim to hypocrisy.

Now, I know what you might be thinking: there are some very obvious moral positions that any reasonable person can be expected to take. I would agree with you, but I would also challenge you to come up with any that are not already prohibited by established laws of the land.

I’m not suggesting murder is acceptable. We have laws against murder that we enforce, and that’s good enough for me.

But there are no laws around reading someone’s opinions, nor supporting someone’s opinions, as long as those opinions are protected by the First Amendment.

The hypocrisy I’m referring to is more difficult to spot, especially in ourselves, as it is usually hidden behind one or more of what Albert Camus refers to as an “abstraction”, or the prioritizing of reason over human feeling, that is, the feelings of other humans. He describes the breaking down of one such abstraction held by his father in Reflections on the Guillotine, describing his father’s demeanor before and after witnessing a public execution.

In short, despite his father’s morning excitement about attending an execution, the visceral reality of actually watching another human’s life taken by beheading broke through any abstraction between his perception of a guillotine and the very real consequences of its operation. He came back home and proceeded to vomit, forever changed.

It is much easier for us to plant moral flags with things we have not witnessed ourselves, and this extends to the humans behind the ideas we reject, even justifiably.

Unsubscribing from a blog consisting of mixed content that we can see does not absolve us from complicity in other morally questionable situations, such as buying cheap items from Temu made with slave labor under a regime currently performing an ethnic cleansing on its own people that we cannot see.

Or, perhaps, you’ve already forgotten that Chinese workers building Apple’s iPhones were committing suicide so often that the factory had to install nets to catch those who jumped off the roof.

Are you staunchly anti-Trump yet still buying Apple products?

If you’ve never bought anything from Temu, you need only look in your refrigerator for food that likely came from supply chains incorporating factory farming practices designed around the abuse of animals.

Do you dislike the concept of billionaires but can’t imagine cancelling your Prime subscription?

Does the idea of having to slaughter your own cow to continue eating beef, one of the most environmentally detrimental foods of all time, make you as viscerally uncomfortable as it makes me?

More than likely, you are already a supporter of something that would horrify you to witness. There are just miles between you and the inconvenient truth behind your luxuries and comforts.

Whataboutism For Me, But Not For Thee

This may seem like “whataboutism”, or responding to an accusation with an accusation of your own. However, my goal in mentioning Apple products and factory farming isn’t to elevate myself to a position of superior morality. I’m not here to interrogate the areas in your life where you feel cognitive dissonance.

We must be aware of our own dissonances before we hold anyone else to standards we’ve established in our minds, whether we’ve done so on the fly or years prior. By engaging in counter-accusations with ourselves, we can begin to take inventory of our own ethical shortcomings.

With this comes a sense of inferiority, and as has happened with some of my friends, a particularly grating brand of fatalism.

I once overheard someone talking about some news that another celebrity had been accused of using exploitative labor for one of their personal clothing brands (I don’t remember who it was because I don’t care about celebrities), saying:

“There is no ethical consumption under capitalism.”

Processing that statement in my mind was like trying to jam a square peg into a round hole. It simply didn’t feel right. What, then, was the point of all the fair-trade commerce initiatives of recent years? Do brands like TOMS, Bombas, and Marine Layer really have no impact by donating or recycling clothing? What is this perfect “ethical” designation that, if they can’t secure for themselves, makes them as unethical as companies that sell fast fashion on the backs of children?

If a perfectly ethical business model isn’t realistic, what is the point of any of it? Is there truly nothing between perfectly ethical operation and absolute moral bankruptcy?

Is going vegetarian worth nothing in the shadow of veganism?

Is buying from B Corps with mostly good scores no better than from big box stores?

Is paying $5 per month for a blog subscription that is 50% regurgitated, asinine neo-Nazi bullshit worse than actively feeding a profit model that can only survive on slave labor?

Ethics is Not About Efficacy

Let’s use veganism as an example. For full disclosure, this is one of my personal cognitive dissonances that I am currently tracking and working through myself.

Perhaps one person - me, in this example - becoming vegan will have a nigh immeasurable impact on the atrocities of factory farming. However, if I see such treatment of animals as a horrific moral failing, should that not be enough for me to change?

Imagine, for a moment, that you live in 18th century in the United States of America. Slavery is an enormous enterprise and the basis for much of the economic power ready for the taking. Despite knowing that owning slaves is a horrific moral failing, you know that refusing to participate in the exploitation of slave labor won’t make much of a dent in the Atlantic slave trade.

The refusal to own slaves being the right thing to do seems self-evident, does it not?

Yet you participate in the system anyway, because not doing so won’t bring about the kind of change required to make a true difference.

To do so would be to abandon the non-ideal in favor of simply grieving the ideal. John Rawls discusses how ideal theories beget non-ideal theories that are more realistically applicable across disparate individuals and societies.

Choosing to own slaves in the 1700s simply because not doing so wouldn’t bring about the ideal state of society is a cop-out of massive proportion. If ethos itself is asymptotic, our best approaches still matter.

The calculus of moral action has never been the point. What we do with the ideas in front of us is.

Ideas and Words I Disagree With Cannot Hurt Me

Interesting. How does “if ideas and words I disagree with can’t hurt me” relate to the idea of bringing in low quality things into your “brain-attic”? For instance, when I open my RSS feed I’d rather not even see Nazi talking points even if they’re just words on the screen for 10 seconds…

By “brain-attic”, they were referring to the rather hilarious conversation between John Watson and Sherlock Holmes, during which Holmes reveals that he wasn’t aware of the Solar System and had no intention of remembering it at all.

The mind is a finite space, and the conscious mind even more so. What we allow into it is up to our discretion. But the allowance or dismissal of ideas is not equivalent to their existence in our field of consciousness, which is not entirely up to our discretion.

As I mentioned before, during the height of the COVID-19 pandemic, clearly ridiculous stances on wearing masks or conspiracy theories about Anthony Fauci were exhausting and stressful for me. But despite the difficulty of managing that reaction, how I felt was not out of my control. Unfortunately, I didn’t learn this until much later.

I don’t blame myself for my reaction. The pandemic was a difficult time. Many people struggled as much or more than I did, and seeing myself as deficient for not being able to control my reactions to such new and enormous problems would be unfair.

But what is it about reading even the headline of a post full of pro-Nazi prose that would bother my friend so? I can think of several, quite fair reasons:

• The reminder that such hateful ideologies exist and are held by people today makes us sad because we don’t like that others might be marginalized or hurt by it.
• We have family members that also espouse similar or related ideologies and that, as a matter of course, makes us sad or angry, and the post title is a reminder.
• It is a reminder of the state of American politics which, depending on which voter base you’re in, can be distressing all by itself.
• …and so on.

However, trauma, no matter how large or small, is inflicted upon us by our perceptions of things or events, not the things or events themselves. No matter how controversial such a statement may be to many, this is well established and understood among the psychological community.

To quote Alfred Adler, the father of individual psychology:

No experience is a cause of success or failure. We do not suffer from the shock of our experiences, so-called trauma - but we make out of them just what suits our purposes.

Trauma is very real, but it is not inevitable. Things affect us because we allow them to affect us, a principle at the basis of cognitive behavioral therapy.

Our allowance of things to affect us is not always conscious, nor can we be blamed for it.

No one should blame victims of rape for struggling with having healthy sexual encounters, no matter how safe they are in reality, and no matter how much trust they have in their partner, and this consideration extends to all forms of trauma from all sources.

Instead, we can choose to “critically ignore” information that is false, inflammatory, or personally distressing, similarly to what the authors of Critical Ignoring as a Core Competence for Digital Citizens mention in Current Directions in Psychological Science, Volume 32. While that study doesn’t necessarily address our emotional responses to ideas that we don’t like, the function of choosing what to do with information presented to us is one worth acknowledging.

The idea that we have a measure of control over how things affect us is not new. Born into slavery in 50 CE, the Stoic philosopher Epictetus said:

It’s not what happens to you, but how you react to it that matters.

Epictetus was touching on a very real science behind controlling our stress responses by consciously relocating our attention from our amygdala (the part of the brain where survival mechanisms sit) and the prefrontal cortex (the part of the brain used for higher order cognitive functions).

Ideas we don’t like or that make us uncomfortable exist whether we are thinking about them or not.

Seeing a post from a neo-Nazi that isn’t the server maintenance expertise you sign up for doesn’t make them more of a neo-Nazi. It doesn’t create more neo-Nazis out of thin air if I read the entire post instead of ignoring it, just like it doesn’t make server administrators smarter or more plentiful when I read about how to efficiently migrate storage volumes.

Pretending the bad ideas don’t exist doesn’t make them go away, and reacting to them in any way at all only gives them power.

Avoidance of Information Is the Avoidance of Influence

Shielding oneself from Nazi blog titles (assuming you don’t click and open the full post) doesn’t make them cease to exist, it only exempts you from any opportunity to understand a contrary viewpoint, no matter how detestable, and therefore from making any difference in the direction or evolution of such ideas.

I then shared a picture of the bottom of my bookshelf, where I have a few different translations of the Bible, the Book of Mormon, the Bhagavad Gita, and the Koran.

Despite my previously monstrous amount of religious trauma from my Christian upbringing, I don’t throw the Bibles out because their contents bother me, no matter how many problems I fundamentally have with them. I keep them, and have gathered other religious texts, because I seek to understand.

I seek to effect change.

If one avoids bad ideas, it follows that one does not know much about them. Logically, not knowing about bad ideas limits one’s ability to change the minds of those who hold them.

The choice to avoid knowing is the choice to be passive.

There is a fashionable shorthand for the refusal to engage: the paradox of tolerance. The argument, borrowed selectively from Karl Popper’s The Open Society and Its Enemies, goes roughly like this: a tolerant society is not obligated to tolerate intolerance, therefore you are absolved from having to sit across from it.

What the people deploying this argument rarely mention is that Popper’s prescribed response to intolerance was reasoned debate and public argument, not expulsion. Suppression without argument was his last resort, reserved for movements that had already abandoned reason and resorted to violence. The people invoking Popper to justify blocking and muting and no-platforming have not read the book they are citing. Daryl Davis has a better conversion rate.

And if Davis, a black man, can sit across from member after member of the Ku Klux Klan and other associated hate groups and have a civil discussion with them, why can’t you or I?

Until someone can show me a higher Klansman conversion count than Davis’ count (which, according to NPR, is at least 200) that resulted from such internet tough guy strategies as “punch Nazis”, I’m not going to close my mind off to ideologies simply because they are repugnant.

“If you’re interested in being on the right side of disputes, you will refute your opponents’ arguments. But if you’re interested in producing truth, you will fix your opponents’ arguments for them. To win, you must fight not only the creature you encounter; you must fight the most horrible thing that can be constructed from its corpse.”

– Black Belt Bayesian

Whether that was accurate or not will have to be verified by truer veterans, but it certainly wouldn’t stay “performance based” for very long. The exam eventually got shorter and there was nothing practical about it, at least not when I took it in 2016.

CEH existed but was irrelevant to me. As a broke middle-schooler discovering computer hacking, one meager year after the release of the infamous Hacking: The Art of Exploitation, 2nd Edition, any money I had to my name was going to Lego sets and airsoft. All my learning took place in forums and IRC channels, the logical successors of the post-BBS online hacking scene.

I learned how to use Nmap by reading the documentation.

I learned SQL injection after learning SQL first, how to use Linux by setting up file shares and web servers for my friends, and how to write malware by convincing the right people that I was worth sharing source code with.

Then came the OSCP. The certification that proved you knew your shit.

24 hours in a lab with machines to hack, points to earn, and a report to write with what little energy you had left. It was a badge of honor that demanded respect, and few people had it. But enshittification comes for all, and once the OSCP landed in a job posting under “preferred qualifications” for the first time, our journey as an industry to where we are now officially began.

The OSCP became a nigh-invincible staple for recruiters in the 2010s. Offensive Security, the company who designed the course and proctored the exam, realized they could make it a revenue engine — and so began what would eventually become a certification “ecosystem.”

Soon came other certifications like the original OSCE, a more advanced version of the OSCP that placed heavy emphasis on binary exploitation, as well as web and Wi-Fi oriented courses, all of which became household names for security professionals across the world.

OffSec had struck a gold mine, but they weren’t going to get away with keeping it to themselves.

The Little Disruptors That Couldn’t

See, the value of the certification itself had gone up. Now there was demand for it in the job market. When you purchased Penetration Testing with Kali Linux, the companion course for the OSCP, it came with an exam voucher. The certification itself was the value holder, not the course content, since it was what proved you knew what you were doing.

With the demand increase came rising costs, and the price hikes made room for disrupters. HackTheBox and TryHackMe undercut the education piece for a fraction of the cost by removing the credential from the equation — with a far more accessible format than OffSec’s do-it-yourself PDF and lab approach.

In a single, polished web platform where much of the content was completely free, the early chapters of the penetration testing methodological corpus had been effectively democratized. However, though they had decoupled the credentials from the coursework and made education more accessible, the signal was starting to get lost in the noise.

The inevitable convergence of democratized training and credentials that boosted hirability was not far off: PNPT, eJPT, and others, where previously only CEH had any sway against the OSCP (not much, for obvious reasons).

The skill set that had previously derived its value from context and pre-existing technical background was now modularized, packaged, and sold in shiny bundles built on publicly available resources. Credentials attached, resume parsers happy.

VC Deals Always End the Same Way

Running training platforms costs money. You can’t just have hundreds of thousands of aspiring hackers spinning up little virtual machines to run Nmap against 24/7 without bleeding money. Luckily, there’s a whole industry that has made capital hemorrhaging their modus operandi: venture capital.

Taking on external funding meant adopting the same primary directive as every Silicon Valley unicorn that came before that always ends the same way: make more money so we can all exit handsomely.

Investors need recurring revenue more than life itself. And it has to go up, of course, so training platforms and companies turned to creating their own certification ecosystems, leaderboards, all while keeping the dream of employment alive, hoping to ride on the success of OSCP with HR reps reviewing job applications.

HackTheBox introduced “VIP” that allowed you to hack on your own target machine instead of the public ones that were getting reset all the time. TryHackMe added premium learning paths that you could access with a subscription.

One by one, they switched to recurring “all access” models — one easy platform, a stack of acronyms, and a promise that it’s all you need to land your dream hacking job.

The AI Pivot Is Just the Latest Version

TryHackMe founder Ben Spring has a new company. NoScope sells an AI-powered pentesting platform — not to practitioners, but to the companies that hire them.

I’ve seen many reactions, the gist of which seems to be that a company that made its name educating people to do actual work has potentially used training data from people to build NoScope.

I get it - to an extent. There are approaches to practitioner augmentation that are like Praetorian’s, releasing what I imagine are open-source versions of internal tooling. Then, there are profit-seeking approaches like NoScope, which sell their AI augmentation tooling to companies for a fee.

This dichotomy has always existed. Sliver and Cobalt Strike, Nuclei and Nessus - the open-source vs. paid divide has always been with us. What’s different now is who is doing the buying and what they’re being told it replaces.

AI “autonomous pentesting” — and even worse, “autonomous red team” — is poised to be the next thing companies, not practitioners, want to see. The race to a profitable exit is blatant, and it’s not going to change.

Those two things are being sold to people who buy tools, not use them. I’ll give you one guess which group is most upset by it.

What To Do About It

The goal is money. It is almost always money.

If you learn genuinely useful tradecraft and grab a cert along the way, great. But your professional development is not the primary purpose of any flashy training platform — especially one backed by venture capital or private equity.

So it’s up to you. Instead of outsourcing your education to companies that don’t actually care about it, take it upon yourself to explore.

Set up a home lab. Augment your own workflow (you do have a documented methodology, don’t you?) with open-source agentic tooling. Use it to make yourself a force multiplier that can stand up one day in the future and show a customer exactly why buying an expensive AI pentesting tool was a risk calculation error.

Or, you know, don’t. Just don’t be surprised when you’re staring at the back of the industry’s head as it flies away on this rocket ship.

I’ve been on a lot of purple team engagements. Many of them produced little value.

It wasn’t because the techniques were wrong, or the tools were bad, or the teams lacked skill. They fell flat because everyone involved had optimized for the wrong things.

But with contracts already signed and expectations already set, I had to see purple team projects through regardless of how doomed they were to begin with.

Both consulting firms and clients can conspire to torpedo a purple team engagement, often without even realizing they’re doing so.

Here’s what actually goes wrong and why it keeps happening.

The Client Side

You Treated It as an EDR Benchmark

Pick your poison. Either you measured success purely by whether your EDR fired an alert, or you skipped host-based testing entirely because “EDR will catch it.”

I watched a team spend three hours troubleshooting why their endpoint tool missed suspicious LDAP traffic that returned a list of Kerberoastable users. They had only ever tested if their network monitoring tools could see the exact kinds of patterns produced by BloodHound, not boring, manually crafted LDAP queries from ADSearch.

I also had a client decide not to pursue other on-host testing because their EDR caught vanilla Mimikatz.

Of course it did. It has for years. Meanwhile, none of them had considered that running Task Manager as Administrator to accomplish the same LSASS dumping goal should catch someone’s eye.

This does not count as testing your security program. You’re just testing whether a vendor’s signatures still work.

You Can’t Write Your Own Detections

If your entire detection capability is vendor-provided rules, you don’t have a detection capability. You have a subscription.

Even half-decent attackers don’t match signatures. They use living-off-the-land binaries, legitimate admin tools, and techniques that look like normal operations until you understand the context. When I simulate something that doesn’t trip a vendor rule — and that’s most things — the response is usually “nothing we could do.”

There’s always something you could do. You just never built the muscle to do it.

You Had No Idea What to Test

I’ve kicked off engagements where the client’s answer to “what threats are you most concerned about?” was a shrug. No threat intelligence, no prioritized list of techniques, no understanding of what adversaries actually target their industry.

So we tested whatever seemed interesting. The results showed gaps in techniques that didn’t matter to their actual risk profile. We validated defenses against nation-state tradecraft when ransomware groups were the real threat. Everyone felt productive, but nothing notably useful happened.

The Report Went to SharePoint to Die

I’ve watched six-figure engagements produce reports that never left their PDF form.

No one prioritized the findings by impact or stuck them in a ticketing system to at least appear like they were interested in improving. Without a framework for improvement, every finding is equally important — which means none of them are.

Without an improvement strategy, your analysts will context-switch between “we can’t detect Kerberoasting” and “we need better phishing detection” until they burn out or quit, and you still have both problems.

You Thought Buying Tools Was the Same as Using Them

This one’s universal, but it’s especially lethal here.

Lots of companies buy adversary detection platforms and never configure them. Admittedly, “no configuration needed” is a strong selling point, but if that also means “no configuration possible,” the vendor is just saying “trust me, bro” and you’re believing it.

Money spent does not equal security achieved. Tools require people and process. If you don’t have both, you have expensive shelfware.

The Consultant Side

This is the side I’ve spent almost all my time on, so get ready for some precision-guided frustration.

We Sold “Purple Team” Without Defining It

The definition of “purple team” is loose enough that sales can pitch almost anything under that label.

I can’t count the number of times sales promised what was effectively a red team ride-along where the client could fix things along the way. That is not a collaborative security improvement exercise. That is a field trip.

We, the red team, showed up ready to collaborate on running attacks and building detections, only to get stuck eating the cost of the sales team’s sins and trying not to look incompetent while we “red team” the client over a screen share.

The client ended up watching us work instead of working with us.

Worst of all, purple team engagements are so commonly shorter than red team engagements that the client ends up getting a condensed red team exercise for a huge discount. Putting your practitioners under immense pressure to compress a red team exercise into a purple team timeline makes them miss things, burn out, and resent the whole enterprise.

This happens constantly. “Purple team” means different things to different people, and by the time the practitioner gets involved, the contract is signed and the sales rep has moved on to the next deal.

We Skipped the Hard Scoping Questions

It’s uncomfortable to ask “what’s your detection maturity?” when the answer might be “we don’t really have any.” But if you deploy custom malware against a team that doesn’t have EDR, or test for advanced persistence against a team that can’t detect a whoami command, you’ve wasted everyone’s time.

The engagement should meet the client where they are. That requires asking questions that might make the deal smaller, or even turn it into another project entirely.

Plenty of purple team clients need to be talked down to a penetration test, but that’s not as profitable.

We Over-Engineered Instead of Just Running Attacks

Consulting outfits all share this weird curse where they have to constantly optimize to squeeze just a little more profit margin out of a good thing.

I’ve watched consulting teams spend months and months building the ultimate purple team platform, only to never finish it. Every technique automated. Every detection templated. Every report auto-generated.

Meanwhile, real attackers were just opening PowerShell and nobody had validated whether anyone would notice.

The most effective purple teams start with documented attacker tradecraft — the actual commands from real incident reports, MITRE ATT&CK, or even a recent pentest — and see what happens.

Sometimes that’s a Python script, and sometimes it’s literally typing commands into a PowerShell window. The tooling is secondary to the outcomes.

Both Sides Are Optimizing for Theater

The structural problem is that purple teams serve two masters with conflicting incentives.

Clients want validation. They want to prove their security program works, justify their tool purchases, and show the CTO a green dashboard. A purple team that finds serious gaps is politically inconvenient.

It’s no easy feat to justify detection tooling that costs orders of magnitude more than the project that just revealed its glaring holes.

Consulting firms want billable hours and repeat business. Telling a client their detection program is fundamentally broken doesn’t get you invited back. Delivering a report full of findings they can’t action doesn’t either.

And telling them they are nowhere near mature enough to benefit? Good luck explaining that contract loss to the sales VP.

So both sides unconsciously optimize for theater. They run some attacks, maybe generate some alerts, and write a red team report with a collaborative spin. The auditors will love it, bless their little hearts.

Everyone feels productive, but the underlying problems persist.

Breaking this cycle requires something uncomfortable: honesty about current capabilities and realistic expectations about outcomes. Most organizations aren’t ready for what a real purple team would reveal. Most consultants don’t have the freedom to tell them, or worse, aren’t willing to.

What’s the most reliable way you’ve seen a purple team exercise fail? I’m always looking to expand this list.

Several months ago, some dudes climbed through a window of the Louvre Museum at 9:30 in the morning and stole around $104 million worth of French Crown Jewels.

They were dressed as construction workers.

The first time I broke into a building, I shimmed a door latch from an emergency exit stairwell and walked in.

I was dressed as a guy who only owns gray t-shirts and black jeans.

My project partner had already signed the office suite guest book (a formality), used his toolbox and clipboard to make a convincing pitch that he needed to do an off-schedule check of the fire alarms, and gotten comfortable next to an exposed ethernet port.

So I joined him and we let our contact know that we had made it in and no one seemed to care, kicking off the walkthrough part of the project where we demoed badge cloning, opened some server room doors, and talked through improvements they could make.

After, as we were packing up, our contact asked me a question I thought I had the answer to: how often do people actually commit crimes this way?

I had no idea.

My quick internal logic told me that either there were Ocean’s Eleven-esque heists happening all around corporate America all the time, and no one was getting caught, or corporate office buildings don’t often deal with break-ins at all and we were performing a novelty service.

But the Louvre heist was hardly Ocean’s Eleven (even calling it a heist feels generous), and the impact was still enormous, especially since most of what was stolen hasn’t been recovered as of my writing.

So what is the value of a physical penetration test, and why on earth would you pay someone to break into your buildings?

I went to Florida to find out.

The Gurus On Mount Tampa

Last month, I got to spend a few days cloning badges in coffee shops, taking photos of security cameras from over a hundred feet away, and bypassing locked doors to plant malware on laptops.

I was attending the Practical Physical Exploitation training course put on by Ralph May and Travis Weathers of the Mayweather Group, and aside from having fun in Florida with some friends while the rest of the United States tried not to freeze to death, my goal was to understand the basics of physical intrusion enough to start slowly building it into my own services.

It wasn’t the first time I had used badge cloners or bypass tools, nor was it the first time I had to socially engineer my way into a restricted area, but I like to round out any knowledge gaps with good training before I try and accept anyone’s money.

Exhausted by the intensity but invigorated by the fun, I spent the plane ride home thinking through how I would communicate the importance of physical security to a potential customer, which reminded me of the story I opened this blog with.

There were two questions I felt I needed answers to:

1. Who do physical penetration tests help anyone defend against?

2. Why is a physical penetration test a worthwhile expenditure?

My time in Tampa helped me with part of the first answer, which was “anyone who could do any part of what we were doing”. Obviously a clone of me who had defective intent (bad bad guy) instead of cooperative intent (good bad guy) would be an obvious threat.

We can also surmise that someone more skilled than I would be a bigger threat, and someone less skilled would be a smaller threat, but skills with a lock pick set don’t matter to a brick if the door is made of glass, and why use my lock picks as anything but paper weights if I have an undisclosed 0-day for your firewalls?

The second question is harder to answer for any organization that hasn’t already dealt with physical threats and, admittedly, this wasn’t the focus of the course.

Much like when a company undergoes its first ever internal network pentest, after which they realize how much - ahem, technical liability - they’ve inherited from Active Directory’s “intended design”, it is quite difficult to just imagine the impact, especially if you’re not sure how anyone would go about making one.

“Why would anyone go after us?” the perennial question goes. Well, have you ever considered what someone looking to make some money could do with documents you leave out in the open?

Clearly, there are some margins of uncertainty to address, here. We can do thought exercises all day, but I’m here to determine if one of the best things you can do is just let someone break in.

But let’s not get ahead of ourselves.

Who Are These People Anyway?

Somewhere in between fleecing the Las Vegas strip with George Clooney and lifting candy from a convenience store are the real threats to businesses, and when it comes to which ones anyone should pay attention to - as with all things in security) - it depends.

In the end, I came up with five threat profiles that I would use for threat modeling an organization, ordered by sophistication level:

1. Petty Thieves: Opportunistic with access to basic, commercially available tooling if not just a bat they can break glass with. They’re most likely looking to make a quick buck.

2. Associated Threats: Not actual employees of an organization but still familiar presences, e.g. delivery drivers, cleaning crews, maintenance staff.

3. Insider Threats: Current and former employees of the actual business with knowledge of day-to-day operations go and what the weaknesses may be.

4. High-Capability Threats: The dark-side version of a physical pentester, with all the tooling and expertise to match. Probably the closest real-world analog to George Clooney.

5. Nation-State Actors: Highly sophisticated and well equipped members of an adversarial government looking to cause damage to or steal information from critical systems and facilities (and probably don’t need to use physical means to accomplish this very often, if at all).

If we factor in the statistics presented by Gartner in 2024, insider threats account for around 75% of security breaches, even if just by accident. While exact numbers aren’t easy to find, for the sake of discussion, let’s imagine that the graph is fairly bell-shaped:

         │
         │                    75%
    % of │                    ┌──┐
breaches │                    │  │
  caused │                    │  │
         │                    │  │
         │  ?%       ?%       │  │     ?%       ?%
         │  ┌──┐     ┌──┐     │  │     ┌──┐     ┌──┐
         └──┴──┴─────┴──┴─────┴──┴─────┴──┴─────┴──┴─
           Petty   Assoc.   Insider  Hi-Cap   Nation

Within the bounds of their 2024 report, leaving out situations in which credentials were compromised by phishing (A) or other means, insider error (B) was slightly more common than insider malice (C), but only just over half as financially damaging.

Physical security issues (D) sit on the low end of breach causes, just above 9%.

As has been the case for a long time, most insider threat-caused breaches (including phishing victims) are rarely due to someone acting maliciously. However, they are certainly the most expensive.

Now, because the raw data is not available from IBM and they admit in their report that their sampling methodology was selective:

Our study drew upon a representative, nonstatistical sample of global entities. Statistical inferences, margins of error and confidence intervals can’t be applied to this data, given that our sampling methods weren’t scientific.

So, we have no idea if they incorporate physical breaches into insider threats, or if all possible insider activity falls under “physical theft or security issue”. Without the data, this could mean anything from a stolen laptop with sensitive data on it (from a company location or even just a parked car) to a badge being cloned Mr. Robot-style.

In writing this, I haven’t been able to find a statistically sound source of data on how many breaches started with an insider threat specifically letting someone piggyback through a door (error) or stealing data from their job (malice). But, for the sake of coming to some kind of useful conclusion, we don’t need impact measurements to discuss who could possibly break into a building.

To actually answer the question about who on earth we are actually protecting against with recommendations from a physical pentest, likelihood and impact aside, we should look at each of the five threat profiles I listed above and understand how we can mesh them with parts of the process.

Once again, we are trying to answer the question of who is actually doing anything like this, not how much it hurts when they do. That is a separate question for people with access to good data.

Let’s establish phases of a physical intrusion and cross-reference them with said threat profiles:

1. Reconnaissance: Learning, either from a distance or in person, what the physical security posture of a target building consists of, a.k.a. “casing the joint”.

2. Initial Access: Gaining unauthorized entry to a facility intended to house and protect assets or information.

3. Post-exploitation: Using the access gained to steal assets or establish persistence mechanisms for future use, e.g. malware on an unlocked workstation or a drop-device plugged into an ethernet port.

4. Profiteering: Making money off of the whole thing by selling stolen assets/information or extorting the organization. This is when the ethical hackers are writing reports.

Petty Thieves

You’ve seen them on the news during periods of high tension and unrest, barging into electronics stores and stealing whatever they can easily sell on the secondhand market for easy money.

If they’re not taking advantage of localized chaos, they’re most likely just going to smash the glass door you put a badge reader next to. Their goal is to get in, get out, and get away, making as much money as they can with as little associated risk as possible.

Your job is to make sure that anything valuable is a pain to get to. Locked (and non-smashable) interior doors to things like storage rooms and closets go a long way to deter someone who didn’t drop 100 dollars on Covert Instruments and watch a bunch of YouTube videos on lock picking and door bypasses.

Associated Threats

These are regular people doing regular work in and around the physical area you’re concerned about, but aren’t explicitly employees.

Maybe they’re part of the maintenance team for the building you share with four other businesses. Maybe they’re the package service driver usually on the route you get deliveries from. Someone who is a familiar, frequent face but might have access that wouldn’t just be afforded to someone off the street.

While they most likely have too much going on to be concerned with exfiltrating confidential data, they inherit a default level of trust that can be abused by someone either in this category or someone wanting to look like someone in this category. Clip boards and toolboxes don’t cost very much at Home Depot.

Insider Threats

When discussing insider threats, it’s vital to understand that motive is vital to the story. This is where we borrow a razor from Hanlon:

Never attribute to malice that which can be adequately explained by neglect, ignorance or incompetence.

• modelthinkers.com

Ignorance of best practice does not place the insider under blame, though neglect and malice absolutely should.

Neglect may look as benign as an overly courteous door holder, not wanting to cause any interpersonal friction by closing a purposely access controlled door behind them, despite someone jogging up behind them, arms full of pizza boxes, making them scan their badge if they have one with some degree of frustration.

Similarly, ignorance might be allowing a guest to sign the visitors’ log book and simply stepping into a privileged office space without verifying who they are or who they are there to see. If no one communicated this policy outside of, say, the front desk receptionist, it is simply a case of not knowing best practice.

Finally, the rarer insider threat according to the IBM data from before, is one acting with malice. A disgruntled employee (or ex-employee) may leave a door unlocked, weakening the security perimeter and hoping someone takes advantage of the gap.

More directly, they may know where sensitive or valuable information is kept and can access it and sell it without anyone knowing.

High-Capability Threats

These are the people I’m not sure actually exist, and are the reason I’m writing this particular post.

How many people out there are high-capability threats and how many are high-capability threat consultants like myself? Statistically speaking, there’s a non-zero chance they exist, and maybe they’ve even been to the Louvre recently, but what is the likelihood that a business will have to deal with such a person, and how much should they spend on preparing to do so?

Nation-State Actors

While information on nation-state activity is difficult to find, I’m fortunate enough to know some people who could point me in the right direction without divulging information they’re sworn to protect.

According to the Federal Bureau of Investigation (FBI), economic espionage is notoriously difficult to prosecute. Without proof that the defendant was acting as a foreign agent or on behalf of a foreign government’s interests, the cases are usually prosecuted as trade secret thefts.

Notable examples of actual economic espionage cases include not just the theft of aerospace and missile technology secrets, but Akamai customer lists and security system designs as well as source code for trading software that made the financial firm Citadel quite a lot of money.

In the Coverage Lies the Point

Remembering the four stages of a physical intrusion from earlier in this post, it’s time for some cross-referencing. How can we correlate phases and components of a physical intrusion assessment to the five threat profiles?

Much like network security, it helps to start from the inside and work your way out. What do the people who already have access (associated/insider threats) pose, and how can those risks be mitigated?

Post-exploitation has the answers.

Moving outward, how could someone gain access if they do not have it already (petty thieves and high-capability threats)?

Initial access tests will find out.

But what does that actually mean? Some of the more eye-opening potential, I think, lies in the sort of finding each phase can produce. Here are some examples of findings I have put in reports for actual clients:

Recon

• Security guards don’t follow a regular patrol schedule and often take breaks in their cars.

• Employees all use the same six-digit code on the side door keypad.

• People hold the door open for each other constantly.

Initial Access

• Badges are easily cloned as they are worn in plain sight and can be easily read by a long-range badge reader in a shared space such as an elevator.

• The front door has a thumb lock that someone can turn from the outside with a $20 j-tool.

• The back door is never locked because delivery drivers are coming and going 24/7.

Post-Exploitation

• The CEO’s computer was left unlocked and could be infected with malware.

• Employee social security numbers were left in the HR managers mailbox.

• The wireless password was written on a conference room white board.

You may have noticed that I left out the final phase. Profiteering is not a canonical part of a physical penetration test because, well, that would just make the whole exercise just a crime. It is certainly part of a real physical intrusion.

However, once malware is on a laptop, all of the risk associated with the “Phishing” data point from IBM becomes yours, since there’s more than one way to infect a computer. Ransomware and other kinds of extortion hacking took the world by storm a mere 13 years ago beginning with CryptoLocker.

Sounds like profiteering to me.

In Summary

Ultimately, the most I or anyone else can do to effectively convey the risks of a threat actor engaging in any kind of intrusion activity is to tie real-world consequences to everyday ignorance or negligence.

Until the impact has already been made, you might not see the value of a physical security assessment until it’s too late.

“Arthur Jensen Pitches Economic Determinism’s New World Order to Howard Beale” - americanrhetoric.com

The security industry would not exist without bad actors.

Think about it for a moment. What is the point of a locked door if no one wants to steal? Any security team, product, or service exists only because there is someone out there looking to access systems that are not theirs.

Buying clothes, storing important documents, and conducting business with each other digitally are all lawful actions taken by regular people to fulfill some goal. Using the language of game theory, we can call this uninterrupted exchange of value cooperation.

Yet, we only have that word because of its opposite, defection. Without defection, there would be no cooperation. People would still do the sorts of things that we may consider cooperation, but there would be no need to call it anything other than simply living, working, trading, etc.

One cannot exist without the other. Cooperation cannot exist without defectors.

Security cannot exist without hackers.

So why do organizations so rarely invest in products and services like penetration tests in comparison to compliance initiatives?

And surely, if bad actors are the sole reason anyone spends money on security at all, those that understand how attackers work and what they do should have the most influence over improvement. And yet, penetration testing is at best, even now, an annual requirement by many compliance standards such as PCI DSS and ISO, and not even mentioned by some others.

The variable businesses are solving for is not improvement or resilience. It’s something bureaucratic and easy to digest, and it’s harming real security.

The World is a Business, Mr. Beale

“Why do businesses pay for SOC 2 reports?”

I froze for a few seconds, each of which felt like its own century. For my third day on the job at a company that, at the time, was primarily selling SOC 2 reports, this should have been a slam dunk answer for me. And I definitely thought it was.

“So they can stay compliant and prove they’re operating at a standardized security baseline.”

“Wrong”, said the founder who would eventually become my CEO.

Panic.

I had no idea, then. I had no clue why our customers bought our primary service which generated the majority of our revenue. Luckily, I was just incredibly naive, and was about to learn a valuable lesson that I would take with me forever.

“People buy SOC 2 reports so they can make more money,” he continued.

He then described what our compliance services were really about: a pipework of business-to-business relationships built on externally verifiable assurances and contingencies that, as far as I could tell, just kept any one organization’s skin from being the furthest into the game.

No, the goal was not to be more secure and improve over time. It was not to prevent breaches, it was not to better protect customer data, and it was not to mitigate business risk. Those were all afterthoughts.

The goal was to make more money.

If you’ve seen Network (1976), this would have been when I saw the face of God if not for my near bulletproof idealism and naiveté, an inescapable brain cage native to my mid-20s.

Instead of in a shotgun blast revelation, ballistically delivered down the length of a solid wood conference table, the existence of shadow incentives in the security industry would slowly and painfully unravel itself across the landscape of my innocent mind over the next few years.

What I would eventually learn is that there is a race being run in security, but the finish line is not resilience or continuous improvement. It’s something contradictory, an antithetical box to be checked that is benefitting few and harming many.

Let’s take a step back and try to understand how, in security of all things, we’ve strayed so far from actually staying secure.

Where Do Penetration Tests Come From?

My fellow penetration testers and security researchers hate to think about what, to me, is a crucial part of the “buy security services” equation: most clients are only getting a penetration test or other vulnerability assessment of some nature because they have to.

When I ran the penetration testing practice at a previous employer, over 90% of our projects (and a similar percentage of our revenue) were what we called “compliance driven”, meaning that if we were performing a penetration test of an environment, it was because that environment was part of a compliance initiative scope.

If it involved a network, there was a good chance it was part of a PCI DSS card data segmentation effort. If it was purely external IPs and web applications, ISO 27001 was likely involved. The flow at my old company was simple:

1. A company wants to make money (e.g., via payment processing).

2. The company seeks out an external verifier (a PCI DSS auditor).

3. The auditor informs them that PCI DSS requirements mandate penetration testing of the scoped environment.

4. The company buys penetration testing services from the same firm as their audit services.

5. I get paid to attack a card data environment.

In this exchange, PCI DSS compliance via certification is the obvious answer to the dilemma of wanting to process card payments. For the purposes of my next point, it is one degree removed from the problem (a.k.a. “the solution”).

Penetration testing, being a requirement of PCI DSS, is two degrees removed from the problem. This second degree is emphasized by the fact that the skills required to audit a company for PCI DSS compliance and those required to perform penetration testing against a card data environment rarely overlap.

As with many things, the further a measure is from the problem it supports in solving, the more susceptible it is to “enshittification”, which is just a hot new phrase for a subset of the actions and consequences of a “race to the bottom”.

The Illusion of Quality-based Competition

Race to the bottom is a socio-economic concept describing a scenario in which individuals or companies compete in a manner that incrementally reduces the utility of a product or service in response to perverse incentives. This phenomenon is in contrast with traditional competition, which tends to improve goods and services.

• Wikipedia

Since penetration testing was (and still is, increasingly so) a rider requirement for many major compliance frameworks, I came to terms with certifications and attestations being a necessary part of the ecosystem, at least as it pertained to my revenue targets.

What I did not expect was how much we would need to compete with cost leaders, and how being a cost leader would invariably mean not being a leader of much else, namely work quality.

But to an auditor, a pentest report is a pentest report, and how much it cost the audited company is of no concern.

Outside of PCI DSS, organizations are often only required to provide evidence that a penetration test happened, either in the form of a heavily redacted/abbreviated report or a simple letter of attestation from the firm that did it.

When compliance depends on admittance, and admittance only depends on occurrence, and occurrence doesn’t depend on cost, the race to the bottom begins.

The areas over which many pentesting teams compete are no longer the coherence and robustness of the deliverable, the rigor and depth of the methodology, nor the relevance of the findings. Instead, they compete over cost and delivery time.

And when lower costs and faster delivery are the winning traits, everything else naturally suffers.

What To Look for (if You Care)

Everyone has to make a choice when paying for security work: quick and cheap, cheap and good, or good and quick.

At this point, it should be obvious that cheapness is a reliable indicator of lowered quality, though the inverse is not as reliable. An expensive service is not reliably a good service.

Cost is a metric on which different providers can easily compete, but why lower your prices until you’re forced to, either to match a competitor’s pitch to a prospect or to simply pull in more leads from the start?

Even more dastardly is the inflationary cost competition strategy by which a provider constantly markets themselves as “bleeding edge” or “constantly innovating” in order to make their pentesting methods to be the most relevant, while not adding anything of real substance at all.

The best example of this is when, before LLMs were as impressive as they are now (a meager five-ish years ago), and the marketing term was “machine learning”, vendor after vendor was shoving “AI” into their firewalls, IDS, and EDR, just hoping you wouldn’t ask them what that actually meant.

An expensive service doesn’t guarantee a high quality product, but very rarely is a high quality service not expensive.

Apart from playing the cost guessing game, to know you’re looking at a higher quote with guarantees behind it, check for any of the following:

1. Expertise on Display

   Blog posts are ubiquitous. Quality writing is not.

   Look for where your prospective vendor actually talks about what they do and why. Do they discuss their methodologies and why they do things? More interestingly, are there things they’ve opted not to do?

2. Sample Deliverables Get an example report. If a vendor can’t give you one of these, they’re either not proud of their results or are not committed to standing out.

   Good reports aren’t some kind of proprietary knowledge or insider information. Competitive advantages though they may be, they’re also the the table stakes and shouldn’t be some secret they keep close to the chest.

3. Recognizable Customer Testimonials

   It has never been easier to generate fake testimonials. LLMs are very good at this, so verify the people and their respective companies are real. Customers actually willing to vouch for a vendor is a strong indication that the service is good.

The bottom line is that, if you’re looking for a pentest report that is going to fulfill a compliance requirement without any scrutiny, just about anyone will do.

If you’re looking for security professionals that can make positive change and help improvements stick, you might need to look toward the top of the barrel.

“How dare you fall for this exceptionally well crafted phishing template we explicitly whitelisted in the mail filters so it appeared to be legitimate?”

Phishing simulations are extremely popular in the business world.

Organizations these days are so worried about ransomware that they’re diving in head first, sending their employees fake gift card offers and asking them for their passwords, then sending the ones who fail the tests to training over and over again.

And I can’t totally blame them.

Ransomware has singlehandedly bankrupted a number of organizations and the gangs perpetuating the breaches are only getting better at their jobs.

The demand for some kind of solution is huge.

Kevin Mitnick started a whole business around delivering phishing simulations and subsequent training, though they’ve been criticized recently for requiring explicit approval through spam filters and other detection mechanisms.

Smaller companies are making plenty of money on education platforms with recycled content about how to spot a phishing email, how to report a phishing email, but they’re not doing any measurement.

But is it working? Is it useful?

It’s hard to say.

I’ve seen a lot of phishing attempts in my 10 years in this industry. From detecting and stopping campaigns in SOC/sysadmin roles to running many myself (internally or for clients as a pentester and red teamer), nothing really surprises me anymore.

Except, of course, the myriad of misconceptions around phishing and the growing list of blind spots organizations have about what happens next.

Many companies do next to nothing to patch vulnerabilities, secure endpoints, or segment networks - all things that make it more difficult for a successful phish to matter.

They’re one good phish (or Exchange zero-day) away from the very thing they’re spending so much money to prevent.

Why?

Because they’re placing the responsibility for preventing breaches on the wrong people: the users who can’t do anything about it.

To provide an alternative perspective, and maybe get us on the right track, here’s what I’ve learned about phishing attacks and how to approach them differently:

No one is immune.

If you think you’re not the kind of person to fall for a phishing link, you’re dead wrong.

I’ve seen even the most security-minded individuals fall for a link that was well placed and convincing.

It’s not all their fault, either. There is a direct correlation between the time and effort put into the campaign and the success rate, and we work pretty hard.

Twenty minutes of research on what someone’s interests are will give me more than enough context to include in a personalized phishing attempt to anger, worry, or offend them into falling for my red team’s tricks.

Training only works so well.

A phish that works on someone is likely to just be better than the fodder from your curriculum. Keep training on gift card offers and people will fall for them less, but they’ll still fall for me impersonating the IT helpdesk or HR.

Did you train them not to click an “Unsubscribe” link in an annoying newsletter?

Of course you didn’t because that would be silly. And I’ll keep putting my credential-stealing links there.

Click rate only matters in context.

What actually matters is what happens after.

If everyone clicks but no one enters credentials, maybe they recognized the page as malicious. This should be celebrated, not punished. Look at why the email landed in people’s inboxes before you blame them.

Sure, older software is more prone to web-based payload delivery.

Browser 0-days exist.

But those are unique threat model elements that should be uniquely considered, not universally used as flimsy justification for a click-based metric.

Neither are usually a user’s fault anyway.

MFA is just another flag to capture.

Speaking of contextualizing clicks, if someone is willing to enter their credentials, they’re probably going to enter their MFA code.

I can steal all of it if I want to. Either buy everyone hardware tokens or stop leaning on MFA as a cure-all.

So are phishing tests worth it?

Should you let a vendor through your protections just to gather metrics?

Does the training work?

I don’t have data to sway you either way, just my experiences on the blue side and the red side.

A great piece of research was recently published by some smart people at the Department of Computer Science at ETH Zurich, Switzerland that does provide data, and you can find it right here.

Here are some things that I know will help:

Reward people for reporting malicious emails.

In a previous job, I wrote a monthly “Spam Hall of Shame” newsletter that lampooned user-submitted phishing attempts while breaking them down and teaching people about their various elements.

Want to know what happened?

• Click rates plummeted.

• Reports skyrocketed.

• People had water cooler conversations about how they recognized this or that phish.

Suddenly it was much less of a problem and our risk was lowered by creating cultural momentum.

Keep stuff out of inboxes.

Seriously, just reduce the number of bypass events as much as you can.

This is your first layer of defense. If you want to test it, and you should, champion someone to build the skill set to do so. Or hire for it.

But test it.

Test for post-delivery impact.

What can actually happen after just a link click? Nothing?

What about credential theft, MFA or otherwise? What about host compromise?

This is the stuff that actually matters in a real attack, which is the situation you’re trying to avoid, is it not? Penalizing a user for falling for a phishing attempt while not protecting them on either side of the attack is deflection, not improvement.

Castles have walls to protect people. If it was possible to stop an invading army by publicly shaming citizens, no one would need walls, but that’s not how it works. Educate people to understand the “why” behind more security-oriented thinking.

Turn your users into heroes who have a part to play in the organization’s security, not liabilities that weaken it by just existing.

Final Thoughts

SpecterOps, a firm I highly respect, recently posted this article on how they’re changing the way they do phishing engagements from here on out.

It is, in a few words, highly valuable perspective.

Especially because we’ve been dealing with this same quandary internally: we know we can phish well enough to get clicks, but is it actually helping?

Sometimes it seems like it, but most of the time we’re just telling everyone what they already know, which is that all humans are suggestible. Everyone can fall for social engineering that has enough time and effort behind it.

As cool as it is to spend a ton of time on initial access attempts for that “I’m in” moment, at some point it might just not be in the cards, so as pentesters and red teams, we have to provide value somehow.

The “automatically move to assumed breach after X amount of time/effort” model is superior in this regard. We can’t waste time either proving the inevitable and then calling it a day like a breach just isn’t possible.

They’ve communicated this better than anyone else, including me, and I think they deserve the last word based on how well they articulated the current state of phishing exercises.

If you can take one thing away from it, it should be this:

People are not entry points you can close, patch, or update. They are a component of the greater security boundary around which you should be placing mitigations like better email security, payload detection, and more.

In other words, measure what you can do about a successful phish before and after a human being acts like a human being.

Penalizing a user for falling for a phishing attack while not protecting them on either side of it is blame deflection, not security improvement.

A while back, a red team friend asked in a group chat how to handle management pushing agile on their offensive security team. My answer got really long really quickly.

Since red team management and practice leadership is my bread and butter, I have a lot of experience with fielding the sort of misguided idealism about KPIs and “stories” that comes from disconnected executives who mistake familiarity for wisdom, assuming that because one thing works somewhere, it must work everywhere.

What follows is a refined reproduction of my reply.

Quit depending on the tooling.

The first thing every project manager has to understand is that your app/platform/tool/whatever isn’t what gets the work done.

It isn’t the reason work doesn’t get done, deadlines get missed, or anyone misunderstood the requirements.

So changing the tooling every six months isn’t going to do anything except keep upper management off your ass because they usually don’t know better and annoy your team with more meaningless changes.

No end state, no solution.

It is the job of the project manager to define this and test whether it’s feasible with the people who will be executing the work.

Most of the time, especially in security consulting, the end result is outlined in a contract as a report or deliverable of some kind. For freeform projects like research efforts or tool development, replace the end result with an end state.

To do this well, you have to ask the right questions. What is the actual problem? How are we currently working and how do we want to be? Where are the bottlenecks?

Here are a few real-world examples from my career and the solutions my team came up with all on their own that were better than anything I could have come up with myself:

END STATE: We need a way to quickly and painlessly deploy access to client environments from which to conduct pentests.

SOLUTION: Vagrant VM templates that could be automatically uploaded to S3 for downloading by the client and, on boot, connected up to a Tailscale server and provided us remote access without the client having to punch holes in their firewall.

END STATE: $projectmanagementtool doesn’t support natural language due date setting, which is crucial to our project structures, so we need a way to deploy projects that saves us from manually selecting a bunch of dates from shitty dropdown menus.

SOLUTION: A custom Python script that builds projects entirely through $projectmanagementtool’s API.

END STATE: Our standard operating procedures for pentests (i.e., the bare minimum actions to take against a target) aren’t getting updated and therefore aren’t getting used.

SOLUTION: Make the SOP checklists the backbone for connected wiki articles so that new articles about vulnerabilities or exploit methods can’t be added without creating a reference in the SOP first.

If you can’t come up with a desired end state, your limitations become their constraints.

Bonus thought exercise: How many of the problems above have you seen “fixed” with a new product or piece of software?

Make your templates freeing, not restrictive.

The most common types of projects your team works on should be templated and purely logistical.

Start date, end date, status update cadence, and that’s it. Everything else should be filled in by the practitioner. How they research, what they try, how they try it, etc. is all up to them. In a project management tool, that looks like this:

• Fieldwork Start + date
• Client Status Call + date
• Fieldwork End + date
• Report Draft to QA + date
• Report Draft Delivered + date

Quality isn’t a field in the template. It shows up in the work, or it doesn’t, and the status call is where that becomes everyone’s problem. This works really well for things like 5-day web app pentests that sales sends your way.

The less common, less rigid, and more freeform projects can still be templated as long as the template is purely logistical. Track what matters for the sake of billing milestones and contract terms. Leave the rest up to the experts doing the work.

A good attacker doesn’t need a script — they need a target and a scope. The rest is tradecraft. Give them enough constraints to ensure the delivery is to spec without suffocating them.

Pick a tool. Any tool. Stick to it.

Calendar events with notes, a project management tool, dedicated Slack threads, whatever. Just make sure everyone can go to the same place and see what the expectations are. Project management tools are references, not crutches. If you think a project management tool is going to make work easier, you’re delusional and avoiding the real problems.

Project managers should leave doers alone.

If you’re going to check in, build the check-in into the template upfront so it’s expected. Otherwise you’re just going to annoy everyone.

The person executing the work, or leading the project if there’s a team, is most likely going to come up with a better route or product than you could’ve come up with on your own.

Practitioners, especially hackers, tend to thrive with autonomy and room to experiment. Ask me how I know.

Learn to tell management to back off, politely.

Get desired end states from them, not dumb shit like “number of projects completed” or “number of tools integrated into methodology”. Ask them what they want to be able to say was accomplished.

What tangible improvements are they looking for? What gaps in the current product offering/security posture/etc. do they see that they want rectified? What are their true concerns?

This will help you cut through all the bullshit they heard on some podcast or from the board about “agile” and “story points” and get to the root of the problem, which is why the work needs to be done. Do not let them turn you against our boy Goodhart by making good measures into targets and, therefore, into bad measures.

Fix the communication problem, fix the project management problem.

People treat project management as some kind of equation to solve when it’s really just about communication.

The trouble is that communicating effectively is hard and requires more time spent on actually knowing, training, and trusting people than most companies have the time or energy for.

The irony is that it produces better outcomes than the alternative, just not the kind that light up a quarterly report.

Over time, taking this approach will make your team happier, give them more time to do what they’re actually good at, and outperform any version of this story where management got exactly what they asked for.

But be ready for upper management to see that and ask you to do 5-10% better year-over-year, killing the soul of your team for the shareholders.

My friend Jordan Mussman found a novel way of abusing regular functionality in the less binary to maintain persistence as a regular user OR root. Go read his research, and maybe give your environment variables a look while you’re at it.

By breaking, I mean any of the following:

1. Truncating the XML entries to only be the first chunk of the body content.
2. Only publishing the title and summary of the body content.
3. Killing the feed altogether (likely because you didn’t know you had one).

If you set up your site yourself with a static generator like Hugo or something more comprehensively painful like Wordpress, you may not even know that your site has an RSS feed built in by default.¹ Anyone can point a piece of software known as a feed reader at the URL your RSS feed lives at and read what you write wthout having to visit your site to check for new content.

This is because the reader routinely checks the feed URL for new posts in the form of XML entries that should contain the title of the post and the full content.

Plaintext is not that heavy, and it is certainly not as heavy as all the third-party plugins and JavaScript abominations behind your frontend.²

For the sake of the open web - and especially for the sake of not hating your audience - stop breaking your feeds.

# Microsoft Sharepoint
    
## C2 Projects:
  https://github.com/looCiprian/GC2-sheet
  https://github.com/RedSiege/GraphStrike
    
## Detection:
  url: https://graph.microsoft.com/v1.0/sites/*/lists/*/items/
  url: https://graph.microsoft.com/v1.0/sites/*/lists/*

One of the biggest barriers to me writing anything at all is usually feeling like I need to say something long and profound, when in reality I more often have short commentary to make on what I’ve read (which I do a lot):

I decided to follow simon’s approach to creating a link blog, where I can share interesting links I find on the internet along with my own comments and thoughts about them.

I am deciding to follow Xuanwo’s approach to Simon’s approach for some of the early content here so I can fill it up without the pressure of changing the world with an essay.

• Codemadness
• computers are bad
• Julia Evans
• Ludicity
• Nyxt Browser
• Own Your Web
• Reform
• Secluded.Site
• (videos) Dreams of Autonomy
• (videos) Dreams of Code
• (videos) Fireship
• (videos) Vimjoyer
• (summary only) out there in space
• (summary only) Solene
• (summary only) fasterthanli.me

Hacking

• 0xRick’s Blog
• Adversary Fan Fiction Writers Guild
• Isosceles Blog
• SpecterOps Blog
• Tevora
• TrustedSec
• dirkjan
• hausec
• mubix
• (videos) webpwnized
• (videos) IppSec
• (summary only) 0ut3r Space
• (summary only) Black Hills Information Security
• (summary only) Graham Helton
• (summary only) Rants of a deranged squirrel.
• (title only) chompie at the bits
• (broken) Hacking Articles
• (broken) Make My Day [IO])
• (broken) eXploit

Security and Privacy

• Bad Sector Labs Blog
• coreboot
• Internet Archive Blogs
• News for libreboot.org
• Schneier on Security
• Sec Team Blog
• String Literal
• The New Oil

This is the written version of a talk I gave at BSides Atlanta 2022 called “These Violent Delights”. Since it wasn’t recorded, I thought I would make it more available to people by blogging it. You can see the slides on Github here.

It’s been about two years since I wrote all of this for the first time.

The reception of the talk version at BSides Atlanta last year was good enough that I figured publishing these ideas and lessons for everyone to access would be beneficial.

But in trying to make it all perfect and complete, I’ve procrastinated publishing anything at all.

So, to remedy this, I’m going to publish in parts.

This is Part 0. Based on my massive list (mess) of talking points, here’s what’s coming up:

• Part 1: Where To Start
• Part 2: Improving Your Personal Health
• Part 3: Setting Professional Boundaries
• Part 4: Smash In Case Of Emergency

Recovery First, Prevention After

I will talk about burnout and how to prevent it, but more importantly, I want to talk about recovery.

Why?

Because most people have already experienced burnout, and I suspect a lot are still in it. I have to suspect because, though I have tried, I cannot find any data on how many people have recovered.

There are plenty of data sources for how many people have been or are currently burnt out, and prevention only matters if you’re not burnt out already.

Why even talk about this?

Because the working world has a burnout problem, and to make matters worse. Infosec as an industry also has a talent problem.

According to plenty of sources, there were 2.72 million job openings in 2021. That number is going down, but it’s not one to laugh at.

Meanwhile, 75% of employees said they’ve experienced burnout, and 56% of employers admitted to have retention issues, 36% of those surveyed by Eagle Consulting said their organization isn’t doing anything to help them NOT be burnt out, Gallup found that burned-out employees are 2.6 times as likely to be actively seeking a different job, AND that only 60% of workers can strongly agree that they know what is expected of them at work.

The bottom line is that people are burning out, a lot of them aren’t getting help, and almost as many have no idea what standard they’re even supposed to be meeting.

Maybe you can see why I’m not confident about that number going down reliably. What are we missing out on because the talented people we already have are at or near the end of their rope?

Crime pays a lot, actually

Adversaries are making more money, their jobs are easier, and they work remotely. I’ve talked to people I know who were in ransomware gangs or are currently in them, and most of them say their work lives are easier.

What they told me boils down to a few simple points:

• No one is asking them to return to the office and commute through traffic hell
• The pay is better than what they might make legitimately
• The work is generally easier (since many targets aren’t as mature)

How are salaried, commuting, underfunded infosec professionals supposed to keep up?

There is a greater mission and much of the industry is not prepared to accomplish it.

Disclaimer

Before I go any further, I need to get some things out of the way:

• I am not an expert, a medical professional, or a psychiatrist
• I cannot diagnose or account for existing mental illnesses, personal situations, or other variables

But rest assured, I have had my fair share of hard times. I am no stranger to mental illness nor trauma. I know that life can be hard and there are a lot of factors at play.

I get it. I’m not here to sell you a cure-all, or even a cure-most. I’m here to share what worked for me and maybe impart something useful to you.

How I Got Here

Like many, I spent the majority of 2020 working too hard, burning too hot, and not getting the things I needed to be happy.

The company I worked at was in a period of intense growth where we had plenty of new pentesting work to do, but some of us still needed to make audits happen to pay the bills.

During that time, I started to study for my OSCP, and after seven months, it had knocked me out. I would study for 3-4 hours per night and all weekend in the labs, grabbing flags and honing my methodology.

I failed my first exam attempt in late September but came back with a vengeance by the end of October. Then I descended into one of the deepest ruts of my life.

Collecting debt from yourself

What confounded me is that I was just doing something I loved: learning and improving my pentesting skill set.

But the price I ended up paying was steep, and it took a lot longer to cover my debt to my passion than it did to destroy my passion.

The year after (2021) was filled with attempts to pursue my passion without the energy I needed, leaving me feeling unfulfilled and frustrated at my sudden lack of progress in my career, but even more disappointingly, lack of appreciation for something I was once fascinated by.

I would listen to my favorite security podcasts and roll my eyes when people would talk about how energized they were and could spend hours just learning. My cynicism was through the roof, and the problem wasn’t them - it was me. I needed to feel better. My new state was not sustainable, and I needed a solution. That’s how I came up with what’s in this blog.

It took me a long time, but I made it, and I want to share that with anyone who’s in that same place.

Look out for “Part 1: Where To Start”, coming soon.

This has sent my typical corner of Twitter into somewhat of a debate.

Dubbed “Infosec Twitter”, exploit researchers, red teams, SOC analysts, CISOs, DFIR teams, and more can reliably be found commenting on the news of the day, sharing research, discussing breaches, and more.

When I joined Twitter in early 2020, I did it primarily because I was starting to present at conferences and knew that it would benefit me to have some kind of network, and LinkedIn still grossed me out.

What I found there was a mixture of enlightenment and confusion, of insight and of disappointment.

Amid my newfound source of threat intel, tradecraft, and (of course), memes, was something I didn’t expect: the hacker culture I grew up in was surprisingly absent.

Instead of discussing information freedom, privacy, or technology that helped people, I found arguments about whether offensive tooling was okay to publish, whether EDR is good, and whether infosec is an entry-level field (to list only a few).

The kinds of topics I used to see regularly on forums and IRC were rare to see.

Luckily, curating who you follow helps a lot with this. A muted word here, a muted account there, and you can end up with a feed of topics you mostly care about.

This has changed even in the short time I’ve had an account, though, in that Twitter has been serving more and more advertisements and struggling to be profitable.

As Elon Musk has taken over Twitter and cleaned most of the house out, it’s become evident that a platform up for purchase by any individual is not a platform conducive to user freedom and control.

This is not a blog about ideological statements for or against Musk. It does not matter to me who is able to take over Twitter for $44B, only that someone can, and only as long as there are alternatives.

However, in disappointingly predictable fashion, certain sections of Infosec Twitter have been outspoken about the most popular platform, Mastodon, being unrealistic and a non-answer to the problem of unitary platform control.

This would be entirely reasonable if many accounts with large audiences were not stating inaccurate information about it as insurmountable downsides of the federated alternative.

Federation Mythbusting

The purpose of this blog is to address as many of these myths as possible with accurate information. So here we go.

You have to host your own server

Though it would solve a lot of problems outlined in sections after this one, no you do not have to host your own.

You can join any instance you want and see content from users on any instance that is federating with yours. Conversely, any instances not federating with yours (for any reason), will be invisible to you by default.

You can’t verify yourself and can be impersonated

Again, not a problem if you host your own, but let’s assume you’re not able to or don’t want to. That’s fine.

You can verify yourself via a relative link in a different place, such as Keybase or your own website. By simply creating a link like this on the homepage of your website:

<a rel="me" href="https://infosec.exchange/@rybaz">mastodon</a>

…a Mastodon instance will show a green checkmark in my profile, verifying me as the owner of that domain, which I use as my primary source of identity on the internet.

The blue check on Twitter is only a luxury for certain high-profile people anyway. If anything, those most at-risk for impersonation are those who Twitter doesn’t deem worth verifying, rendering them helpless to stop it.

Content moderation is a problem

Aside from this being a problem on every social media platform, Twitter included, Mastodon instances can block entire other instances themed around content they want nothing to do with.

If you join a mainstream instance with lots of people, you’re likely to run into content you’d rather not see, but that’s why:

1. There are so many instances to potentially join, often centered around interests or subcultures.
2. You can host your own.

DMs can be read by admins of instances

Also a problem on Twitter and most any other platform owned or operated by someone else.

Have sensitive conversations over channels you trust, like XMPP, Matrix, Signal, Session, whatever.

It’s confusing

Of the people I interact with on a daily basis, including on Twitter, I am on the lower end of the intelligence scale, and that’s a good thing.

If I can spend 10 minutes Googling how Mastodon works, so can everyone else.

This goes without saying that, in my short time on a Mastodon instance, people have been more than willing to help new users figure out how things work. All anyone has to do is ask.

We should just start a forum

I love forums. I miss forums. I learned a ton from them.

Luckily, there are federated forum platforms like Lemmy that accomplish that goal of asynchronous, topic-based discussion, while being interoperable with other ActivityPub-based implementations.

We don’t need ANOTHER social media site

I agree. Completely.

I hate social media, but it’s the way of the world, and I want a professional network. But apart from LinkedIn and Twitter, I don’t have any other social media accounts, so the “too many platforms” exhaustion isn’t very strong for me.

Federated platforms and protocols are meant to clean up and change the noise, not add to it. It must be viewed as a different way of interacting with digital communities in order for value to be extracted.

The Ethos of Federation

Switching to Mastodon or any other federated technology shouldn’t be driven by the volume of content there is to consume there, but a desire to invest in systems that are controlled by users instead of corporations, investors, or executives.

Or where content isn’t force-fed to you by an algorithm to make you angry, sad, happy, entertained, and lonely all in a single session of scrolling.

Or where your dopamine levels aren’t corporate growth metrics, measured by variance of spiking and sinking and correlated to profit.

Federated services aren’t meant to be Twitter or Facebook competitors. If you’re looking for one to replace the other, you’re going to be disappointed, especially if you have a large audience on one of them.

But large audiences and maximum reach is not what federation is about.

It’s about taking back platform control and using open protocols.

It is about quality over quantity.

It’s about fostering the free and open exchange of information, interoperability, and highly censorship resistant content. The same arguments for Signal relays or Tor nodes in oppressive countries can be made for Mastodon, Matrix, or any other federated tech.

If sufficient amounts of content is the #1 value driver for you to use a platform, that’s fine, and centralized media may be what you actually want, as it’s more conducive to quantity.

You’ll ultimately be disappointed with platforms that emphasize user freedom over how long they can entertain you.

For better or for worse, that is the current dichotomy.

Federated platforms won’t get there overnight, but the dynamic of “where everyone else is” only changes based on the decisions of individuals, something the Twitter algorithm would rather you not do.

If everyone waits for everyone else to go first, nothing will change.

There is nothing to stop someone else from taking control of Twitter or whatever comes next, be it a competitor or clone-like alternative.

There are several reasons for this, the first being that I don’t want to deal with the bugs and resulting mishaps of an implementation in beta (not right now, at least).

Though I’ve read that this has been fixed recently, as soon as I spun up my Conduit server, I couldn’t communicate with most of the rooms created on existing Synapse servers due to later versions of rooms not being supported yet.

The second reason is that I’ve been evaluating some other options, mainly Session. Though it’s not perfect, there are some things I like about it that are impactful enough for me to put the Matrix ecosystem on pause for now. To be clear, I still love what Matrix is doing, but running my own instance is just a little more than I want to deal with at the moment, and federation is the only way to truly realize the full range of benefits offered by the protocol.

Session Messenger Breakdown: Pros and Cons

Pros

• Uses Tor by default
• Decentralized by default via volunteer-run nodes
• APK is available via F-Droid
• Doesn’t require any personal information on account creation

Cons

• Uses Google for notification services*
• Desktop client is Electron-based

*There is an option to not use Google’s notification servers, but it’s a lot slower and you can’t set the check interval. From their FAQ:

If you choose slow mode, the Session application runs in the background and periodically polls its swarm (see What is a swarm) for new messages. If a new message is found, it is presented to you as a local notification on your device.

If you choose fast mode, Session will use Google’s FCM push notification service to deliver push notifications to your device. This requires that your device IP address and unique push notification token are exposed to a Google operated push notification server. Additionally, you will expose your Session ID and unique push notification token to an OPTF operated push notification server, for the purpose of providing the actual notifications to the Google FCM server.

Session vs Signal, and Why I Will Use Both

I see Signal and Session as complimentary layers. Session is arguably more privacy-friendly than Signal for a few big reasons:

• Signal servers are centralizedconduit
• Signal APK is not available on F-Droid
• Phone number required for account creation

Despite this, Signal has an advantage where Session does not: the ability to replace SMS apps. Signal has basically become a catch-all for anyone who might be using it with their phone number. This only applies to around 3% of my contacts, but that’s better than 0%.

For anyone else who I communicate with on a regular basis, most of them care about communications privacy and security enough to use a separate app to achieve it.

The Ideal Future Setup

More recently, Rocket.chat announced it’s building federation capability via the Matrix protocol, which is a refreshing move. Matrix has only ever wanted to be a protocol in the same way that XMPP is a protocol, leaving the frontend messenger client responsibility to others if you don’t want to use the one they provide.

A single protocol that can be audited by the community is the best case we can hope for outside of complete decentralization. There’s a reason why e-mail with PGP is still considered one of the best ways to communicate securely and privately: you at least control the keys.

If the answer to the problem of walled messenger gardens is Matrix, it’s Matrix. I would love to see more of these platforms begin to adopt interoperability so that people can finally stop juggling digital communication channels based on contexts and pros/cons lists.

While studying for CEH (hold the judgment, please, I was young and naive), I had to resort to far more than just the EC-Council curriculum. If you’ve ever tried for one of their certifications, you’ll know why: the material isn’t good enough.

For the OSCP, I had the same experience. The PWK lab was not diverse enough to make me feel truly prepared, and looking back, I’m glad I resorted to sites like HackTheBox, Vulnerable Hacking Labs, and Vulnhub for extra practice. Luckily, many outstanding individuals like TJNull had compiled lists of practice machines for me to reference.

After spending time learning advanced pentesting and red team tactics in a useful-but-never-too-deep manner, I’ve landed on exploit development as my next deeper learning path. I’ve built a roadmap for myself entirely made up of free resources and compiled it here.

I may edit this as I go, and I will post reviews as separate blogs if warranted. If I do make a meaningful update, I’ll be sure to mention that.

(Prerequisite) x86 Assembly and C

NASM and C are more important than I realized at first. A strong understanding of both will help you tremendously as you get into the actual exploit development and research parts of this.

Resources will be mostly focused around Linux to ensure that the barrier to entry is as low as possible. Once I get into Windows, I’ll add resources around that OS, but I’ll stick with what I know best for now.

• OpenSecurityTraining2 - Debuggers 1012: Introductory GDB
• OpenSecurityTraining2 - Architecture 1001: x86-64 Assembly
• OpenSecurityTraining2 - Architecture 2001: x86-64 OS Internals
• Learn-C.org

Books

• The C Programming Language 2e

Linux Exploit Development

This list contains a healthy mix of challenges, guides, course material, and books. These resources are invaluable and I cannot believe they are free.

• Exploit.Education - Phoenix
• Exploit.Education - Nebula
• OpenSecurityTraining - Intro to Software Exploits & Course Textbook: The Shellcoder’s Handbook
• pwn.college
• Exploit.Education - Fusion

Books

• The Art of Exploitation 2e

But first, what is paranoid realism, and what makes someone a paranoid realist?

Healthy Doses of Paranoia

Having worked in security for so long, it’s difficult to not see most technology as fundamentally broken. Web apps are built on APIs without any access control, EDR can’t keep up with some of the most basic bypass techniques, and on and on we go.

Test turning your own webcam on via Meterpreter and you’ll understand what I’m getting at: this shit is easy, and you may not know when you’re being watched.

There are three ways of approaching this new, substantiated feeling of paranoia: ignorance, fatalism, and realism.

The first is the easiest and just involves sticking your head in the sand. The second is deciding that because there are things you can’t control, you might as well not do anything about anything.

Finally, realism (or pragmatism, if you prefer it) involves doing the best with what you have. Technology will never be hack-proof, but it’s also never been easier to take some meaningful steps to improve your resiliency against the inevitable.

All three can be characterized by their response to the idealism of perfect security:

• Ignorance is simply unaware of it or refuses to be aware of it.
• Fatalism is aware of it but sees it as unattainable and therefore worthless wholesale.
• Realism is aware of it and knows that something is better than nothing at all.

One of my favorite books, “Absolute OpenBSD, 2nd Edition: Unix for the Practical Paranoid”, was written for this mindset. From the book’s introduction:

It’s not that everyone on the Internet is trying to attack you, but there’s always someone who wants to break into your system. Even if you think you have nothing of value, someone wants to own your computer. And you won’t realize the value of what you have until someone else has it. That’s just human nature.

If you’re not paranoid on the Internet, you’re in trouble.

Michael W. Lucas, “Absolute OpenBSD, 2nd Edition: Unix for the Practical Paranoid”

Dispelling Fatalist Mythology and Threat-model-ism

Choosing to remain ignorant is the choice of each individual. I can do nothing about this, and I wish you luck if that’s your path.

Fatalism, on the other hand, I have a refutation for. Additionally, fatalism’s close cousin, threat-model-ism, this is for you, too.

The argument that you should only care about encryption if your personal threat model requires it, whether for messaging only or for as much internet traffic as possible, is made by many seemingly knowledgable people, much to my concern.

For example, a VPN will not make you anonymous on the internet. Sure, it can hide your source IP from the destination and it keeps your ISP from snooping on a good portion of your traffic, but it doesn’t do much more than that.

Keeping my ISP out of my data in transit is a good enough reason for me to use one, even if it’s just to keep them from throttling certain services, as Comcast did with Netflix not long ago.

I also would rather them not sell my browsing habits to advertisers or tell me what proper use of the internet constitutes. Even if these practices are not predatory to an Orwellian level yet, they could get there in the future.

And even if they don’t, caring about privacy as a principle is the only reason you need to run a VPN, encrypt your messages, et cetera.

Lastly, threat models evolve. Many small businesses probably wouldn’t have considered themselves very interesting to multi-million-dollar ransomware gangs 10 years ago, but they’ve been such easy targets recently that they’re now one of the most common victim types.

I could go on for much longer about this, and I may do so in future posts, but that’s not the goal of this one.

What is the EARN IT Act?

The EARN IT Act is yet another government attempt at breaking encryption in order to protect children online. While protecting children is a noble and worthy enterprise, like any other effort, there are methods that work and methods that don’t.

According to Stanford, not only does EARN IT not work, but it will actually do the opposite of what it intends to do:

…the EARN IT Act would do little to protect child sex abuse victims – to the contrary, it risks making it even harder to track down and convict offenders.

I encourage to read the entire article linked above. In the end, true to form for over a decade, this is a case of people with power exercising said power in areas they fundamentally misunderstand. What is unclear is how long this phenomenon will continue to plague us.

While we have no answer to that question, we can at the very least take steps to reduce the impact of weaponized ignorance of this sort by utilizing systems that are the opposite of fragile, or as Nassim Taleb puts it, “anti-fragile”.

Communication channels that are not fragile are the true resilience to legislation like this, so we need a way to evaluate them and choose the ones that really work.

Evaluating Anti-fragility (AAA)

In order to objectively evaluate communication platforms and protocols for anti-fragility, we have to establish criteria. The information security industry has been using confidentiality, integrity, and availability (CIA) for a long time and it’s a good measurement set, but it doesn’t really cover enough for me.

Instead, I’ve come up with the three As to evaluate a platform or protocol: availability, anonymity, and autonomy.

• Availability: it does not have to suffer impact of external events.

Something that is completely out of my control, such as downtime of a server I don’t own or maintain, should not inhibit my ability to communicate. Whether it’s the Signal servers, a CDN, or the entirety of us-east-1, my communications should be unaffected.

• Anonymity: the ultimate privacy is pure anonymity, and this must be possible.

I should be able to completely control the details of my identity, from source IP to registration details. No phone numbers, email addresses, physical addresses, or anything that sits outside the function of the platform/protocol.

• Autonomy: it can be used without third-party permission or interference.

I should be able to use it without anyone else’s input. No one, including my ISP, VPS provider, domain name registrar, smartphone app store, federal government, et al should be in control of how I communicate, nor should they be able to easily place an injunction on my use.

Note: These metrics operate on the idea of perfection, so nothing will likely ever fully meet them. This is on purpose so that we can remain objective and honest as we are realists here, and we prefer better over stagnant.

Case Studies of Popular Platforms

Below are some examples of how common messaging platforms and protocols match up to AAA. Let’s use a 1-5 scale.

Note: This is not a comprehensive or systematic list, nor are each of the platforms I mention in the list comprehensively or systematically scored. I am trying to make a point with some fuzzy numbers, though I may soon catalog these by metrics and score them more consistently.

SMS

Availability: 0 Anonymity: 0 Autonomy: 0

Not much to say here. It’s horribly insecure, out of our control, and dependent on cell towers we don’t own.

iMessage

Availability: 3 Anonymity: 2 Autonomy: 1

This is probably my favorite one to pick on because some iPhone users see non-iMessage users (or, derogatorily, the undesirable green bubbles) as members of lower socioeconomic castes, which is profoundly cringe.

I’m not exaggerating either. I’ve spoken to people who purposely exclude Android users from group chats with friends for not having iMessage. This has happened to me personally, also, and all I can do is look at all my Signal conversations and not care.

It’s a great communication channel for iPhone-to-iPhone communication, but it is by no means anti-fragile. The servers and OS (the user gateway) are fully in Apple’s control, as is the encryption.

I’ve heard that it’s also a uniquely American thing to use iMessage universally, which brings me to my next platform.

WhatsApp/any social media chat feature

In Europe, Asia, and many other areas of the world, WhatsApp is the staple communication plaform. However, like any platform run by a giant company (Facebook), it scores fairly low on all three As.

The data is definitely being collected, the traffic runs through centralized locations…need I say more?

Availability: 3 Anonymity: 1 Autonomy: 1

Case Studies for Niche (Non-Mainstream) Platforms

Signal

Availability: 2 Anonymity: 3 Autonomy: 1

Signal is the app that actually made me write this blog because I resisted it for a very long time.

I wanted a perfect solution for all my non-SMS communication that wouldn’t add to my existing paranoia, but many of the alternatives at the time were difficult to adopt for most people or were being bought up by bigger corporations with unclear motives (Keybase and Wire, looking at you).

However, I had to realize that some encrypted chats were better than no encrypted chats. This is paranoid realism at work and is how you have to approach this stuff sometimes.

Now if they would just build an F-Droid version…

Telegram

Availability: 2 Anonymity: 3 Autonomy: 1

This is the one I really want to drive some points home about.

It’s not the only service that masquerades as an end-to-end encryption service for chat while maintaining a master encryption key and centralized servers.

Telegram’s clients are open-source, but their back-end infrastructure is not. This is where everything is stored and where all the data travels through, so this is a big red flag.

Any possibility of compromising any part of AAA is not acceptable. There has to be trust between developers, the platform, and the users, and this is not possible without completely open-source code and standards, front to back.

Matrix/XMPP

Availability: 4.5 Anonymity: 4.5 Autonomy: 5

I am well aware that these are not the same thing, but I’ve lumped them together because, in my opinion, there are the best options we currently have.

• The code is all open-source, server to client and back.
• The encryption is truly E2E, which we know because we can look at it.
• You can host your own server for yourself or anyone else.
• Communication is federated, meaning no central server controls who I talk to.

That said, I’ve only given them both 4.5 for the first two As. This is because without a central server, they are dependent on external factors such as your VPS provider and other infrastructure you have no control over.

Perhaps if you were to self-host them at home, that would change, but I haven’t thought through that one.

Between the two of them, the cons that they don’t share cancel each other out and, I think, provide the best option for secure messaging at the moment.

Honorable Mentions

These are some projects that I think have promise, mainly because they’re doing things differently. I don’t use them personally and never have, but I expect that they will eventually have niche followings of their own and am watching them with great interest.

• Briar
• DeltaChat