SAEDAY: Subversion and Espionage Directed Against You

bridge of spies care interested in the movie it's about a true story about a lawyer there are such bridges have been on them in Germany their bridges that span between former East Bloc Czechoslovakia former East Germany in Germany and we did trade individuals on those bridges because the bridge the middle of the bridge was the dividing line between borders between countries and we could watch them across the bridge and you know trade anyway but it's a based upon a true story the bridges do exist I've been on they do work set up here interested in movie it's a cool movie but this is subversion and espionage directed against you is a tape upon a a presentation that I had to

give to incoming soldiers in my unit every week and once a year and the subversion and espionage directed against the army because we had on army uniform another flag and whatnot you were targeted for espionage this terrorism and subversion directed against you trying to get our us secrets and I I went to Derby con 2 years ago I've ignored most of social engineering stuff because it's and I'll tell you why later but I sat through a talk about social engineering and how what they were doing and how they were targeting individuals to do the social engineering the bread teaming event and one of it was a bank and they were supposed to get into the server room at the headquarters

instead of going to the headquarters they went out to one of the branches and this is what the red teamer said he did I sat out and I sat out in the parking lot before all the employees showed up so I could so figure out which one I was going to talk to I did their profile I watched him as they walked in and he picked up the woman that he was going to talk to what he got inside so we walked in the door he was dressing khakis and a nice polo shirt kind of looked like he was from the Home Office what not said I mean open up she said over here working on it so he

started working on it and because I need to go to the bathroom can we take a break so she said sure it's down the hall when you're done come back and we'll finish up so when he got out of the bathroom he must have waited long enough she got busy with the other customers when he walked out there was an empty office he went into the office sat down and spent the next hour happy nobody approached him because he looked like he belonged right he looked like visitors from the Home Office and so about an hour everything like I said the bank manager walked up and is like what are you and what are you doing

that's when they realized and so but his dilemma this is his talking about his dilemma as a red teamer is they fired her the next day and he got kind of set as opposed you know but I do my job really well people lose their jobs and he did another story so the same thing the next time he did this they had to go to the to the data center they were supposed to get into the server room that was the goal of the pen test or their red teaming effort so he they had security at 24/7 security they had perimeter security they had a guy sitting out in front of the desk in front of the data center door that he

needed to get into he showed up and said I was the fire extinguisher examiner and he said I know there's a fire extinguisher in the room he examined all the others on the premises right that his job and he walked up to the security guard and as I know there's an extortioner in the room hit me in there and the guys like your honorable list I don't recognize your name you know you didn't you're not scheduled to be in here because I know but you're the last one for the day it's five o'clock and help me out just you know

all the sudden for an hour and I'm just friends so the guys can you just let me get in there just check it out come on let's go because sportsy man I don't know what happened the lead security guard he got a text message he goes look I've got to leave I'll be right back that was the pin test to be in the room by himself next day he found out they fired everybody on a security detail they fired the company all the security guys and so listening to them talk was when I I got kind of mad because they're using tactics that I was training to do as a counterintelligence agent to get secrets

and to get things from you and get things out of you and these guys these red teamers are using exact same thing as I was trained to do it and you're not going in there determines your to dare to do your job but their job is to get you to give up your information and incident they will do whatever that takes same conference they one of the they had a talk about ethics and red teaming and you'll find out when I talk about another story how they twisted somebody one of the guys they have panel two women and two other gentlemen and they asked the guys they asked them all how far would you go for your red tinea

this is red team people how far would you go and he goes look at this who can deny this and I swing both ways kind of walked out let's never expected that in today's business world so I'm here to tell you as a kind of telogen sage and I didn't see anybody that looked like that I didn't have parties like that I was in the woods I got frostnip on my feeders we had a manual typewriter had to take my gloves off in Germany to type reports that's how fun it was of the past but this is something I read as I was driving away from Derby County Louisville I was I was getting angry be honest with you I was

going to pee because what you're facing is an adversary and you against them you know we all think we work for a company you all think your security team is going to be behind you when they comment they're gonna target you and you're not awake when you're awake or when you're probably or out when you're doing something on your free time especially if you have a lot of social stuff I don't know you know Facebook is your friend right Nate is your friend so but anyway this is something I read that I was like this is what we need to do instead of security awareness training we need behavioral change how many of you go through your yearly security

awareness training it's one hour it's for compliance and most of your people go right back to their desk and start clicking on everything on their inbox you know it looked like it was from the company but it wasn't changed a little bit but we all do it right we all walk away with our one year one hour of compliance training we need behavioral change this is one reason why I wanted to do this presentation because this is what I'm trying to get you to do is realize you is it it is you by yourself when you're out there doing your job and you're out at work you're by yourself you're CISO or your security team they're all behind

you but they're not the ones that are facing adversary because when the adversary comes are going to come 101 so this is this a very good blog by Ben I was like oh my god this is what we need to do in the industry and so that's one of the factors but social engineering I didn't realize I thought it was a relatively new term as a 21st century term until I looked it up and around since 1899 it's like wow you know as a kind of Tolerance agent they didn't teach us they didn't call it social engineering I was in school when I went through training that's what I think it is but Chris Hackney got to follow him

if you can he talks about it very open about it he was the one that was a mining you and the model he was the one who was hosting it as the social engineering village if you ever go go watch and he does now do these panels where you can ask that the red teamers you know how far would you go and I was a person to take an action that may not be in their best interest that is essentially a social engineering that that's essentially abandoned butter of espionage and spine I want information that you have it's not foreign countries that weren't your information either oh here this is the one that should horrify you all this is

what also made me walk away going oh my god so when I walked out after the young man goes you know I swing both ways I'll do whatever so I was talking to a friend I said can you believe that I can beat that I'm one of our red team efforts we were supposed to get the system administrator user ID and password to the network the domain admin one young man he said we profiled him we noticed on his Facebook his social media and he liked the women who's recently married either his wife just up pregnant and they just had a baby but this relatively newly weds they also noticed that they liked the women

they had a beautiful woman on their red teamer that was a lesbian they asked her would you be willing to compromise them could have been a compromising situation she said sure so so she became an employee the company he struck up a friendship with he I don't know how long it took before she got in to meet her in a hotel room or a motel room she was as sexy lingerie to add pictures of her with the door open because they have pictures of her walk into the room they had pictures of him walking to the room they have pictures of her in the room with him and the door and her and her sexy lingerie Cheadle early do that then

she knew there's nice one out there taking pictures right she knew this was coming so he walks in shuts the door and she goes no I'm not gonna do it we don't need that picture so the next day were they sent him a note and said we want the username password to the network goes out so the next day after that they sitting pictures at the hotel room will tell your wife and will tell your sister we want the user ID and password to the network game over red team one I'll do whatever it takes so I was looking at the guy and really you know you blackmail him you probably caused him to get a divorce if this all comes out he

goes the company didn't have to help them face this kind of situation so I wanted to show the company you don't have enough parameters in place you don't have enough policies you know we're not governance I hope somebody will need to put in that kind of situation I didn't have to know any code I didn't have to know but unless you were running I didn't have to know the firewall what endpoints you had I went and just hacked you as an individual customer 21 and that's when I was kinda like oh my god you guys are facing an adversary that I was never trained I was not to go after you as a newest person I was to go

after foreign Ashley right here we are today on today's world you're facing back you're facing a u.s. person talking to you and collecting information your face is someone who's speaking here even English that is targeting you you will never know what you're being faced with but that kind of horrified me when I saw that or heard about that that that's what we're that's what we're doing now in business to collect information and red team pentesters whatever you want to do it okay how many you are a red team

how many you were veterans we're willing to admit you're a veteran cook tomorrow thank you for your service how many of your army

this is another person I would highly recommend that if you want to learn how they gather if she's doing what she's doing Sophie Daniels she's I can see on Twitter she talks she'll tell you exactly I show that my name is purple I look like I belong in the office Oh

somebody in my office did that it was the young woman she did have her hands full I didn't recognize her with setting up the groups of people and they were like opening the door for this but you just please stay in your bag for me just just me I work here I know but just Spanish make me happy please this you know and the guys you're looking at me funny I don't recognize her and he's doing the exact same thing we tell everybody don't do you know this is a perfect scenario show up hands full we're very courteous or in our country were very courteous and that is used against us everybody is a friend until

you prove otherwise in Russia everybody is an enemy until you prove otherwise that it's just how they think we're that's why we're so easy but what she this is I took this from the blog and I was like lock-picking climbing over walls barbed wire fences and dumpster diving those are the exact same things I did as a car intelligence agent the exact same thing why are you social engineering because it works that's that's what the industry says that's why they do it I'm sorry guys you're really anything I went it when I went to Derby con this past year and I listened to triste resent he wants to hire more women he said I desperately need more women on my

teams

espionage has been around as you know it's a long time I thought I didn't I didn't ask that actually but tragedy can you can receive information the National Defense I honestly believe that we need to change this it's not such national defense it's just I'm trying to safeguard information and you don't need to have an you don't need to have it and you'll see some other issues of course some companies that they others did that spine I'm not sure why spying was older than espionage maybe the astronauts is nice to work for it but spine is what it is that the illegals program I'll go over this one you should recognize her well hopefully you never recognize her I

mean she never saw her met her in Chapman this year with China with lots of money in this briefcase and unfortunately I don't like that when I hear about CIA and FBI agents who get caught because those are my friends they're supposed to be covering my back when I'm doing stuff and here they are so information out and so subversion this is I thought this has been around for longer than the 14th century but do you guys remember this NSA employee you would work for their highly top-secret where they're creating stuff you know we don't know about and he was taking it home and I just got sentenced for five and a half years it just came out like

two months ago he was taking home the secret of the box that they were working on and he had stalled him on his home pcs we had Kaspersky antivirus running our home PC they have special things running on their antivirus that when certain things are installed they said they make a copy of it and he said to their home office with her home offices Moscow the owner of Pasteur see is an ex-kgb he says he's not affiliated with the any of that right that's one reason why I pastor see now he's not allowed on any US government computers because of this event but because Russia getting a hold of it Amsterdam for some reason they were

monitoring it and Amsterdam warned the u.s. that Russia now has your NSA secrets and our country wouldn't blew the whistle on opening Amsterdam upset because we threw them under the best thing we know now what Patterson's been doing we know KGB has it and so it's kind of a big mess but this is what I consider a little bit subversive who knew that your antivirus was sending copies of what you have installed on your PC back to another computer everybody who knows how many wires works I decide it does it's going to send a signature back there you go Symantec ISA they don't now I'm all gonna have that same thing difference is that every

business in Russia is easily subverted by the people that run country right right that's that's that's Weber did you hear about uber uber and lyft I think it was left they didn't really in the article they didn't really say uber had employees working a became employees of their competitor some units left and this is what was interesting there crystal clear to the extent anyone working on a competitive intelligence project that involves the surveillance of individuals stop it now that's us being on plain and simple it doesn't have to be a foreign country doing this that is espionage they could be charged with this this one this is if you'll notice that this is something to happen

after the Cold War ended there was there was an article about it there were a lot of spies with nothing to do these Germans for me Germans Czechoslovakian former and so they said you know what we're kind of this we don't have a whole lot to do so why don't you have target businesses and that's been the last 30 years since the end of the Cold War these experienced spies have nothing better to do than to come over in the US or wherever in collect information on industry and so why do I need to tear your country down if I can tear your businesses down instead that's how I think that is being subversive right I

don't need to be I don't need to clear war on your country let me take out your businesses let me take out your industry then simply build your industry build your country so this was this gentleman here this is what I like about this one is he's a Chinese Canadian he was found sitting on the conference room of med robotics the CEO Samuel walked by and happen it was end of the day he was sitting there at three laptops open on the conference room table the CEO walking sick can I help you and he goes well I'm here to see the CIO because well he's not here today oh I'm here to see you to see somebody else so he's out

of the country oh I'm here to see the CEO he goes that's me so he called and found out he was he was in there hacking their network what had happened is China had been trying to buy a part of their company and he kept turning it down over over and over so no no no so instead they sent somebody to come steal his information so but this was the part that I thought was funny was in his legal-defense he said he'd been struggling to accept the fact that was no longer brilliant all right smell like you know now don't use your defense he worked for a Chinese patent law firm this is an interesting C have you ever

watched the movie the show the Americans come on baby work crap all right I got tons of time but anyway if you ever watch the Americans I can't watch it I watched it once if you want to see what real true stuff is it is written by a CIA ex CIA person I watched it once I couldn't do it again he's talking about things that we were not allowed to talk about we weren't allowed to show and he's presenting them for everybody to see to see how it's done this tradecraft was still done super-secret spies living next door they look like us they speak better English should we do to make sure I don't have any spying around here

the Americans is a somewhat sensationalized version of Soviet espionage from the United States in fact most Soviet spies in this country were Americans not Russians posing as Americans and they didn't engage in murder kidnapping the kinds of dramatic episodes that appear on the Americans the Soviet Union had had two kinds of agents in the United States first time were legal officers who would be attached to the embassy or consulate then there were the illegals who people that came to the country into this country illegally and lived as ordinary Americans the couple in the in the series are illegals that is they are Russian citizens who are in this country illegally posing as Americans they have

jobs and they spy on the side and the Soviet Union recruited illegal what they were looking for people that were ordinary that could blend in to the United States I think I'm supposed to one of the advantages of recruiting people for the United States is that this country has a very diverse citizenry so even somebody with an accent they can still pose as an American the most important job that the illegals performed for the Soviet Union was the service couriers the event Judy ilegales in the country illegally the FBI doesn't know who he is he can meet with sources pick up the espionage material and then he has to meet somebody else transferred but it's the

anonymity that's important occasionally couples would serve as illegals there were instances where you had couples who were not illegals they're actually Americans as flying soda so you done attempted to recruit children I was spas the sender's started a program to develop a second generation then they caused a 1-page to be the illegals were not executed the United States and the Soviet Union kind of kind of implicit deals that they didn't do that sort of thing which is also why one of the themes of the Americans are all these these assassinations and so on but really occasionally happened there was a quite quite risk and certainly not in the nineteen eighties countries never cease spine and Russia has historically

used illegals no doubt they will continue to use them but they're very expensive and cost a lot of money to train them and it costs a lot of money to maintain this couple right here this is what the show was about he's stay-at-home dad she's live had the job she was an accountant working in the Democratic Party and when she made it to a certain level the FBI said we gotta stop this and so that's when they took ten of them did saw their legals program if you look it up they took ten of them and they sent them back to Russia and one of them being an Chapman I'll show it pictured her in a

second but she President Vice President Biden said he would miss having her around so this was what was interesting that I didn't realize you're old as I am you probably remember that cartoon the this was I thought but but spine we weren't really taught this either when I was I mean that to know what the other side is doing probably stopped World War three from happening again so spying has helped out I mean I know what I was doing I know that I was collecting for but this is what Russia was saying why they're doing it so we know what you're doing we know when you're puffing your cheeks we know what you really are gonna hit in Iran so in a

way it was kind of interesting but John Walker is one of the humans of he had gotten put in prison right at a time when I became an agent and so he's kind of my my go-to guy he's kind of the bad guy of all bad guys in my opinion that's just from my area but I just wanted you to realize that North Korea information we all think it's buy happiness if they can't hack us they're gonna show up in person and anybody who's a red team or they've said that if I can't make it through your network your network is so good but I still need to get into that server room somehow I will show up in

person and look at this who's gonna deny this and I swing both ways that's the mentality you are posed you're not gonna win the red team is going to win if that is their goal it is you against them trust the verifying did you realize that that is a Russian proverb I can't pronounce it but that's what it is it really is a Russian proverb and our advice our president said it so much to war but traffic pissed him off eventually of step forward chopper because I think he was truck testing his Russian out but what I thought was interesting you know just thirty years later I think we're now don't trust and verify and I think that's because of the

internet it's easy to get to information without me being in front of you and I also want you to know blockchain is not gonna solve espionage I free that's just because of this part down here but watching is not gonna solve as we know no matter what anybody says you recognize her this just happened right she freely admits I'm Russian get her drunk she apparently told off apparently that's what I read - this just happened yesterday I just saw on the news an Austrian colonel spied for Russian since 1990 Austria the most nicest country ever this is another one this was found three months ago it was a woman that she'd been working in the US consulate

Cheban spy for Russia and her driver for the last 20 years he's now the accusing him now being a Chinese spy he was her driver for 20 years so it is it's alive and well now I'm gonna quickly go through this cuz I think I'm about done - mice is the reason why most people spy if they're gonna get you to do it they're gonna use one of these tactics to do it money biology compromise coercion s to blackmail that's for most of the women and the sex show up drinking and ego and then that very minute connect most of them to put this and then put them together most of that's the driver and

the rest of them show up I don't know all of these are gonna be used and this sign was used during World War two beware of spikes that was handed out so it was a very obvious thing that's going on Walker I'm gonna go through him really quickly he then for 18 years his wife turned him in three times to the FBI he recruited his son he recruited his brother recruited his frantic try to recruit his daughter when she was in the army amen but he got caught most of because of the spinning habits he was given a lots and lots of money the Russians love D and what he gave was signals intelligence that's what he did

in a navy and hid in his defense he said I can't help the Russia gave it to Vietnam the war was not with Russia the war was with Vietnam I didn't give it to Vietnam I can't help that they did and his defense he also said not as his defense but then 60 minutes they hit in every winning he's dead he passed away in prison he kept like in prison he they actually not to know what would you do differently I make sure we can get caught all right yeah CIA Ames he did it for money he was one of those spying wife 2 million dollars for wedding present he's in his life in prison and I'll put this you

don't hear about her she was out she's on the news dia she gave she I was upset about what we were doing with Cuba so she gave away our secrets what we were doing give up she avoided a trial and everything because she plenty go to you that's all of the thing this couple did the same thing for Q but he got life in prison and his wife got six years so I kind of you know be careful if you're gonna do it make sure you get a really good lawyer because apparently time he got life in prison and his wife got six years so just be careful that's what you're gonna do I think they did it

for ideology because if they're really gonna have a lot of money involved you recognize this one recognize her that was just recent her name is reality winner yeah yeah she gets accused yeah this is the favorite one this is the one most everybody falls for compromise blackmail coercion something and if they can't get it on you they go after a family member brother sister wife husband father there's an this was also a sign that was given out during World War two this is North Korean that's what she looks like in South Korea can't really tell right all of these women were spies during World War two they're famous now because they helped us out but this is

the biggest thing this is kind of what also started when I was doing have a friend a young man it's a friend of mine he was approached by a woman that was Russian I got a picture of her they found in love she broke his heart she started seeing pictures of herself to his friends said this this is this is somebody I know this is somebody in the industry this is a young man that this job made him vulnerable make him a target and she approached him and that's when I that's another reason why I'm doing this is because there's there are people in this industry that are watching you when you go to these

conferences especially the happier it's a really great place to go everybody knows why you're there right and so people show up so anyway I I think I'm done right is it 9:30 10:30 you Thank You sweet honey pots you know what honey pots are in your network right honey pots is a woman right there's a chap that's what she looks like in Russia now she's famous for what she did I don't know if you can read this but the oldest trick in the book never stops working in spy agencies continue to use seduction as an effective method of espionage who's saying no I even think she's pretty come on this this is what I want you

guys really to hear this come on baby

nobody belongs to the state since your birth the state nourished it now the state asked something in return

you must learn to sacrifice Ohio's push yourself beyond all limitation I believe that as a woman as a woman I've had what I've had women come up and ask me why do you think women would do this you're gonna have to if I'm gonna have to do that they're gonna you gonna have to blackmail me make me do something it's a woman the army didn't make us do that believe me we didn't have to do that but for a Russian this is I believe that's what they do you have family members back in Russia you got family members back in China start paying attention really quickly how many Chinese nationals you're caught fire think about it how many others how many

I'm covering up family members back in China I kind of pressure you because I've got your family that's what Russia does that's what China's been doing you're gonna start seeing more about coming out in the open then I'm gonna run through that one you remembered this real quickly Iran is not about doing using women this is what they did they they created it they took a woman's Facebook page this was part of her Facebook page and she's pretty she was a photographer so they took her and they created a first you know the Claddagh stock and they were targeting engineers and technicians and oil and gas industry in the Middle East is some in India in the

United States and Saudi Arabia she was targeting there that she their sock was targeting middle-aged men and after a while I was talking back and forth you know trading information they kept they sent pictures to them to click on pictures they installed malware on there on those machines so they could see what these guys were doing in those countries but this is what Iran got caught doing this is real quick madamebutterfly recognize you remember doesn't it I've never seen it but this is this is him that's a hurt and he said that he was born female and these two had relationship for almost 20 years and this temp at her they had a breakup for about 3 or 4

years they went back to China he came back with a four year old toddler like they got about a whorfin inch got a four year old toddler and comes and he convinced he convinced him that was his son so he adopted him no there's no sex change somehow they had it don't ask me I did read an article about it but but he didn't know that was a man and this is a foreign a French diplomat had a relationship for 18 years it did adopted son thought it was his but madamebutterfly based upon that a ego that someone says that Snowden did what he did for ego I think that I want to say audiology - he didn't put a whole

lot of money out of it because he's sitting in Russia right now and he wants to come back to the US he is going to be arrested as soon as he hits the ground as a counterintelligence agent the charge of espionage for you to be charged with the picture of the exchange happening one of the some of the cases I worked on I didn't have that evidence I had everything else but that so I had to reduce the charge to mishandling classified information this four and a half months of investigative work but I could never get working paint that in from he had it in his house so goods he had secret actually had these little

this was secret written on it had a stash of him in his house of goods he didn't know how they got there yeah that secret written I don't know how he didn't know and that's what his job was for the last 20 years in the military he was a signals officer handling classified information on day to day basis he worked in ask if they recognize what those are right he's surrounded with it I need to know how the classified information got in his household back so I was I had investigating but because I never had where he was handing it over to another entity I couldn't charge him with espionage the charges that mishandling classified

information he got put out of their butts no no I'm sorry if you're think he's a hero he's actually a criminal soon as he steps foot on this country and I also have a co-worker that just admitted to me one of his friends after what Snowden done one of his friends was doing a an exercise they were actually doing a live exercise his friend got taken and put into a third-world country prison for six months for medical get him out what Snowden gave up is not just classified information he also gave up the people who gave it to us and sometimes that is another sensitive thing it's not so much the information it's the source of the

information and what he did got people hurt and possibly killed but I know one of my co-workers she said one of his friends we had to go rescue him out of a prison third-world country and tell you now you don't want to be in a third world country prison I've been in our prisons and they are literally making rocks out of the big rock I saw him over there the chisel I saw the mound of cement and they were over there literally making gravel out of it that is about as bad as it gets but I'm pretty sure in a third world country prison that's not they this was definitely everyone says he did it he

was passed over promotion at the FBI and so he gave it up because you know I you don't like me and I'm better than you you're not promoting me so look what I can do this information

[Laughter] all right so this is um this is my favorite my cereal days are your employees these are red team but this is one reason that I wanted to bring up that we call virtual engineering I think social engineering is a nice term for what's really happening to you it's espionage its tradecraft being used against you and you're not going to win it's his and like the director said I'm gonna do whatever it takes it's me against you my full-time job is to penetrate your network now your full-time job is probably to keep most of us out right but I'm only thinking of bytes and bits and network traffic and the red teamer says if I can't get

through your network I'll show up in person who's gonna deny this just to let you know um this is what I thought was really good is that sometimes it might not necessarily on if you see your co-workers exhibiting some behavior that makes you question loyalty to the company you don't have to work for the government to give up information required for this fee not so but if you suspect that I talked to Cisco's about this and I asked him what do you want to do there's an employee thinks he's being targeted don't tell me I'm like well how do I know it's not a red team effort going on and you know he goes they still

want you to call the FBI so please call the FBI I know be honest with you if the red teamer is gonna go to the you're gonna blackmail me I want to take you out I would call the FBI I want you out but don't call me I'll tell you to call your local FBI office but it can be sometimes like like I said this young man that's a friend of mine loving dearly and when he told me what this woman had done and I'd warned him to stay away from her to back off from her let her go let her go but mom she loves

she didn't I've turned her information in and she's now disappeared receive her for about the last four months and I said let you know I mean this is it's going to happen you know and be paranoid please and your industry be paranoid and challenge people when they walk in the door they tell Viet you make me stay in a badge let me see if it works you know if not she know them I knew the co-worker all right but even I do it when someone because I I'm I'm talking to people and so I still stand my back even though they know me just to sit just to show good practice right there's no cat's-eye like this there's

no patch for untrained user and even experienced security professional forgets in the heat of the moment to follow what they've been taught and that's what a red teamer will do for you so I took over thank you very much if you get questions you're more than welcome to grab me outside every thanks