Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Phillip Wylie on bear wrestling, pentesting and understanding the adversary
Guest:
Phillip Wylie
Published:
Updated:
Duration:
41 min
Episode summary
In this episode, Phillip Wylie talks about his journey from pro wrestling to pentesting and what motivated him to start teaching, mentoring and giving back to the infosec community. It’s an inspirational story for veterans in the field and newbies alike. Phillip not only talks about his work helping others get started in ethical hacking, but the value of truly understanding the mind of the adversary. Why you should listen:
Phllip’s story is both educational and inspirational – worthwhile for anyone interested or involved in cybersecurity.
Learn something from one of the most prolific cybersecurity speakers and educators.
Get a better understanding of ethical hacking and the value of offensive security testing.
Anyone can come into security Phillip shares his background as a power lifter and pro wrestler to show newcomers they do not need a computer science degree to build a career in cybersecurity.
Defenders need the attacker mindset too Understanding threat actors matters for adversary emulation and for defense; Phillip suggests using the MITRE ATT&CK framework to study APTs common to your industry.
Compliance will not stop a breach Phillip urges testing beyond PCI scope, including infrastructure, physical, and social engineering, and remediating findings instead of filing risk exceptions, like one company did for SQL injection on a development box.
Enforce MFA for customers Companies often relax password and multifactor requirements for customers; Phillip argues MFA should be enforced and users educated rather than accommodated.
Learn from bug bounty hunters Because bounty hunters are paid per bug, many specialize deeply in certain attacks, and following them on Twitter is a useful way to pick up new techniques.
Topics covered
Pentesting
Notable quotes
If this power lifter, former meathead, pro wrestler can get into cybersecurity, then you can too.
…if you can help people succeed, that's even more rewarding than personal success…
…your compliance is not going to keep you from getting breached. So your number one priority needs to be secure.
Any skill pretty much can be used for evil.
Questions this episode answers
Why is it important to understand the psychology of threat actors?
Phillip says offensive teams need it to emulate real-world techniques, especially in adversary emulation, and defenders need it to defend against attacks. It also helps individuals spot phishing and scams. Read this section
What is the attacker mindset and how do you develop it?
It is the ability to think like a threat actor. Phillip compares building it to developing troubleshooting skills as a sysadmin: you learn by working through things that break. Read this section
Should security researchers share vulnerability information publicly?
Yes. Phillip says if defenders do not share, only attackers will have the information, and he wants disclosure handled so researchers do not fear legal repercussions. Read this section
What does the Innocent Lives Foundation do?
It helps unmask child predators, with volunteers using OSINT skills to build cases that are turned over to law enforcement. Phillip is an ambassador and has run Pwn School T-shirt fundraisers for it. Read this section
About the guest
Phillip Wylie is a pentester, instructor, and former power lifter and pro wrestler from Denton, Texas, who moved into IT through CAD drafting, spent six years as a sysadmin, and moved into network security in 2004. At the time of recording, he was the founder of The Pwn School Project, host of The Hacker Factory podcast, an author, and an ambassador for the Innocent Lives Foundation. He began teaching ethical hacking at Dallas College in January 2018.
And I'm Jeremiah Roe. Today, we're getting into it with Phillip Wylie, a founder of the Pwn School project, instructor, and host of the podcast, The Hacker Factory.
Phillip is one of the most prolific writers and speakers in the cybersecurity industry and is always so gracious about helping newcomers to this space and adding to the collective knowledge on cybersecurity.
We'll be talking about his most recent DEF CON talk that's all about better understanding the adversary's mindset. We'll also get into Phillip's past as a pro wrestler. He's got some pretty wild stories, but first, a quick word from our sponsor.
WE'RE IN is brought to you by Synack, the premier crowdsource platform for on demand security expertise. Synack delivers twenty four seven testing, intelligence, and vulnerability management from global network of researchers whose work is enhanced by smart technologies to accelerate your critical cybersecurity missions. And now here are your hosts, Bella and Jeremiah.
So, Phil, I'm just gonna jump right into it. You've been in the cybersecurity business for quite a while now. I'm just gonna kinda throw it out there because I know a little bit about your background. I'm curious about how many people know that you were power lifter and pro wrestler in the past?
Do they really? That's something that I never knew about. Maybe maybe you could speak about that bear. So by the way, for any of the listeners that have not looked up Phillip Wylie, please go and do that right now. And while you're at it, look up the bear wrestling photo. That's a real bear, by the way.
Yeah. Was a 750 pound brown bear, I believe. That was back, during my pro wrestling career. I worked at a a nightclub as a bouncer of my hometown of Denton, Texas. You know, I was working... Wrestling once a week, so I really wasn't making a living off of it. So my my main job was working as a bouncer in the nightclub I worked at. They normally had bands like Thursday and Friday and Saturday night, but, usually, it wasn't worth the money to spend that on Sundays. So they had other types of events to try to bring in crowds. Since I was a bouncer, a hometown guy, and a pro wrestler, they thought we got this wrestling bear coming in, so we'll have Phil wrestling.
So I've got a I've got a photo of the bear right now. I'm looking at it, and it's and it's and it's the one where the bears kind of the the bear and you are, like, locked in this embrace. And and the bear kinda looks like he's just hanging out there, like, maybe giving you a hug and you look like you're you're trying to move an 18 wheeler. How how how does that work?
That's what it felt like. I mean, the way I describe to people is trying to move that bear is like trying to move a parked car. You know, you can... If it's parked, you can move it just a little bit, but that's about all you're gonna do. That bear was, you know, really tough.
Phillip, you've been in the cybersecurity industry for a while. How did you how did you initially get into pro wrestling and what transitioned from pro wrestling to cybersecurity? That's... It's a very interesting transition.
Yeah. So not only have I been in cybersecurity a long time, I've been on this earth for a long time. So when I graduated high school back in 1984, we had computers in our school, but really IT really wasn't a career path that people really thought of back then. And only the smart kids took the computer classes, but I never took classes back then in computers. And when I graduated high school, I had no clue what I wanted to do. But being a power lifter and being a bigger muscular guy, my friend said, you should be a pro wrestler. And so that's something I never thought of, and it sounded pretty cool. You know, it's one of a career that would take advantage of my love for working out and stuff. So I went to wrestling school and wrestled for a couple years, and I got married and needed a more stable lifestyle because wrestling is not conducive to to marriage. There's a lot of traveling and stuff.
And, you know, so I tried all sorts of other careers. I worked in retail sales. I worked in manual labor and going through all these other jobs. I just really didn't like what I was doing, and I have to like what I'm doing as a job where I just... It can't hold my interest in all this. So I went to so I went to CAD school and I learned AutoCAD and did CAD drafting for a few years. And while I was doing AutoCAD, prior to that, I had no experience with computers. And I realized that I had a better knack for the IT side of things. Some of these companies I worked for were too small to have IT staff. So whenever we had computer problems, I'd figure out how to fix them. I got interested and learned how to build computers, took a Novell NetWare CNE certification course, and then got my first job on a NetWare four eleven and Windows 95 rollout.
Oh, wow. So Windows 95 was one of the first computers I ever had, actually. That was that was probably my first computer. They were huge bulky things back in the day, and that's really interesting. So you've had tons of experience up until that point when I was just even, you know, thinking about computers, very first one. Today, you help actually educate others in getting them introduced into cybersecurity and newcomers. How does your previous experience in pro wrestling and then IT factor into what you do today in helping others get into the cybersecurity realm?
Yeah. Really don't know. What... Where... Really the pro wrestling thing comes into play and why I like to share that story is I really didn't have much confidence in my mental abilities. I really didn't think I was that smart. I never thought I'd use my mind to make a living. And so I think it's a way to show people who wanna get in. If this power lifter, former meathead, pro wrestler can get into cybersecurity, then you can too. So... And and when I share that story, it does kind of let people think because, you know, some people think football players or this... You know, there's a stigma that they think that they're these mindless drones or whatever, and and it just kinda help encourages people. So that's one of the things that I like to share. It actually has, encouraged some people. They thought, wow, I didn't realize you came from that background because you see some of these guys in the industry, like take for instance, harmj0y from SpecterOps.
I mean, the guy has a computer science degree and just really sharp, super smart person. That's usually what people think about in cybersecurity that they have to be that level to be in cybersecurity. You don't necessarily have to start out there. You know, people start out in all different areas.
Back in twenty eighteen, January twenty eighteen, I started teaching at Dallas College. They were starting an ethical hacking class, and they needed an instructor. My wife was going through their digital forensics program and recommended me to her instructor. So I went to work there teaching. And towards the end of the first semester, I had students asking, where do they go next? What do they do next to learn more about offensive security? Because the college only offered one ethical hacking class, and that was it. And then I had a couple other students that, at the time, you know, they were credit students. They were trying to get into my class, and they couldn't get transferred in time. And so I thought, I wanna start something where people can get a cybersecurity education, and they don't have to worry about not having the money or any kind of, registration hurdles to try to get over to to be able to take advantage of this education.
So it it sounds like beyond just the Pwn School, you spend a lot of your time educating others in this space. You know, you've written a book, you do a Twitch stream, you have a podcast. That's a lot of educating. What inspires you or drives you to educate others in this space and why do you think it's so important?
Just kind of the inspiration, Steve, and make me interested in doing that is I was kind of looking, you know, after I've been in the career as long as I have, I looked at my accomplishments, I had certifications and I really started looking at my legacy. What do I have to leave behind? You I was looking at my wife, she has an ESL program, she was teaching, non native English speakers English, you know, Spanish speakers and she went in as far as learning Spanish to be able to teach them and it really inspired me and I saw, you know, the story she had, how rewarding it was for her. And for me to teach just like jobs I work in has to be something I'm passionate about. So pentesting, I love to talk about it and I love to teach it. So and just really after I started doing it, the reward from helping people was what kept me pushing me to go further.
And one of things I found too is if you can help people succeed, that's even more rewarding than personal success to help someone else, you know. So the reward of it, that's really what... What's kept me going. And
I consider myself an ex pentester. My my previous job was as a pentester. And having had any amount of career in the security space, I find that a lot of folks reach out to me about learning resources, just guidance in this field in general. And, you know, I I don't have a lot to compare to because I I haven't switched careers. This is my only career path that I've been in. But it kinda seems wild to me how how much of a... Like, seems like there's a huge demand for folks looking for guidance and learning in this field. Why do you think that is with cybersecurity?
If you want to go to school to be a lawyer, that's something people have been doing for so long. It's so well known, it's easier to find resources. You know, what we all do as security professionals is a little more specialized. So finding someone to do that, you know, someone has an uncle or aunt that's done some specific trade that they can go to. I think this just, since it's really, you know, cybersecurity has been around for a while, compared to a lot of other trades, it's kind of newer, even in the IT space altogether, because whenever I got started as a CIS admin, you know, a couple years into my career, a company I worked for, I was working for a financial institution. They had a bank and a chain of mortgage companies and they didn't have a dedicated security team. So I think it's still kind of relatively new. I think that's why there's so much, you know, the lack of people to talk to being such a specialized and new field.
I think that's why that there's such a need for the help. And it's so high in demand. I think people see that that there's a lot of jobs out there, so they want get that guidance to help them be successful in finding a career.
You presented at DEF CON this past August. Your talk was called The Way of the Adversary. As you mentioned in your talk, there's a lot of time devoted to understanding the psychology of victims who are targeted by attacks, like the end users in social engineering, things like that. But why do you think... Why is it key to understand the psychology of the threat actors, the people actually actually perpetrating the attacks.
It's important for offensive security professionals, pentesters, and red teamers to be able to successfully do that role and emulate real world techniques. Pentesting not as much, but the more you get into adversary emulation, the more you need to understand it. And I think also too that is very important for defenders to be able to defend against things. You're you're going through pen tests. You know, maybe you're doing Red Team engagements and and Purple teaming exercises, but I think it's really important to understand the attacker mindset. Because, you know, as you all know from experience with pentesting, once you learn how to pentest, your whole world changes. When you see a USB stick laying on the floor at an airport, what's the first thing you think? You know? Or you see things related to the field.
Of course. So just like anything, you know, you see how things can be exploited. You recognize social engineering things or how you feel like people are social engineering you at times. So just understanding that I think is very important. And I think it's kind of important for individuals to be able to protect themselves from being phished and scammers and that sort of thing. But it really kind of once you understand social engineering, you kinda get mad at salespeople too because you realize that they're trying to social engineer you, you know?
Yeah. Like once you've you've taken a look behind the curtain, then you can't look at anything else the same way. I, like, I was talking with my friend the other day, and I I... You know you're a pentester when when you have friends that get, like, spam or scammy emails, you tell them to send you the link
in your, you know, locked down virtualized environment and figure out what it is. It's interesting. I think a lot of people don't really think about how important it can be to understand the adversarial side so that you know how to defend against it. So what are some of the common threads that you observe when analyzing attacker mindsets, and how do you think those could relate to some of the attacks that they carry out?
I think it's just kind of idea... Identifying the the type of attacker, you know, if it's a script kitty or hacktivist or like a nation state to be able to understand those type of attacks and what type of attacks they might use. You know, leveraging something like a MITRE ATT&CK framework to, you know, check out certain APTs that may be common to your industry. That would be a good place to start there to kind of understand the type of attacks that you may see. And just things that are popular in general. And then some of those things too, you know, when you look at some of these ransomware attacks, if you look at some of the APTs there, you can understand some of the attacks that ransomware might use. You know, whenever you can remediate those things and protect against those type of APTs, then, you know, it should give you some level of protection against possible ransomware attacks.
Yeah. Advanced persistent threat or like APT groups. So like it could be like some nation state from a foreign country could be not necessarily even nation state. It could be like a a cybercrime group or something like that, cybercriminal group or something like that.
Yeah. The attacker mindset is to be able to think like a threat actor or malicious hacker. And one of the things I would say to that mindset as far as like someone that's an aspiring pentester, one of the things I guess it's... I've... You know, when I wrote the book, I mentioned something about the hacker mindset. And kind of the way you develop it is kind of the way I would say someone develops troubleshooting skills. So you you install Windows and Windows Server and it goes perfectly. And next time you go to install it, something doesn't work right. Something breaks, you can't get it to work, and you gotta troubleshoot it. And so that's one of the things. Because when I was starting out as a sys admin, my first year was just doing installs. So I went to work for a company that was a very unstable environment, things were constantly crashing, there were like two or three of us on call.
And it's like you were on call seemed like all the time. And things broke so much. And I really came close to quitting that job because it was really a tough job because things breaking all the time. Pretty high stress job. But I knew, okay, I spent a year of an intense install, can install my sleep, but I thought, you know, I really need this troubleshooting. So I kind of... Developing the hacker mindset's the same way. Just like I mentioned a while ago, if you find a USB stick on the ground, you're kinda developing that attacker mindset. And so with the the hacker mindset, it's just learning how you see certain things.
I think there's good information out there, but, you know, possibly not everyone is staying up to speed as quickly. I know a lot of pentesters just see what's working out there and not keeping up with it. I think a lot of us as professionals, we're not keeping up with the threat intelligence and and that sort of thing. So it's not real common in the news, big story, then people are overlooking some of those things.
Why do you think that is? Is it is it is it because the organizations, you know, don't have enough manpower, or is it because they're lacking or deficient in some area to be able to to keep up with with these things?
I think it'd be a combination of things. And I think training in some cases, in some sources, you know, some people in some organizations maybe, you know, this may be your first cybersecurity job. You may not have a good idea of resources to use. And that changes over time. You know, when I was getting started out years ago in like IT and stuff, you went to blogs and articles and stuff. And now you see like Twitter is a good place. So someone is come out with a POC for a certain vulnerability. A lot of times you're gonna see it on Twitter before you see it somewhere else. A lot of researchers on there. So I think it's kinda knowing where to look and being diverse in your research.
Are there any specific resources or training materials that that you feel like are your go to places, things like you follow specifically on Twitter or anything that you would like to mention?
Yeah. People I like to follow on Twitter, of course, SpecterOps. They come out with some really cool tools and especially like in the Red Team space and stuff around active directory for, web application pentesting related stuff. I follow a lot of bug bounty people because they... You know, they're paid per bug. As pentesters, we get paid regardless we find anything. And so it's kind of like you, if you're a fisher for pleasure compared to a fisher that has to feed themselves, you're going to be a lot better if you have to feed yourself. And so some of these people really specialize in certain types of attacks. And so following these different pentesters, I mean, bug bounty people is helpful. That's kind of how I found Jason Haddix and learned some different tricks about web app pentesting.
He's developed some great material. Jason Haddix, there's there's you know a bunch of folks out there. Alyssa Miller, there's there's Jason Jayson Street. They've done some really cool stuff that they focused on the Discover channel.
Yeah. Think it's really good to diversify those resources because there's some people that don't really follow the people that they see more in the conference space like Jayson Street, Alyssa Miller, Alyssa Knight, those sort of folks they may not be aware of, or maybe they don't know of Dave Kennedy. So they really need to get out there and research the different, you know, people. Because the funny thing is that it doesn't take someone that's been in the industry a long time. There's some people that come out there new that are finding some really cool stuff. So that's one of the things that for people that have been in the industry for a while, listen to the new folks because I learned a lot from my students coming into class because one of the things with new people, you got a fresh set of eyes, they're doing this all from scratch. When we came through it, these certain resources didn't exist and maybe they ran across them and they got stuff that they can share.
It's interesting to me how much information is shared on sites like Twitter and random blogs. And I've heard people talk about how, like, that's bad. We shouldn't be talking about these vulnerabilities on Twitter and, like, we're giving information to the hackers. And I think this is an argument that comes up a lot of, like, for us as researchers who are on the, you know, quote, good side of things, we wanna improve the overall security of, you know, the world. It's so important for us to share information, and the best way to do that is online. But also the reality is any information we share, we're also making accessible to folks with bad intent. My personal opinion is that it's better that we all collectively have the information regardless of those consequences. But I'm curious about your take.
Oh, I definitely think we should share because it's... If we don't, only the bad guys are gonna have it, then it's gonna... It'll get out there on the dark web. I think in some cases, it's probably helped prevent some people from going over the dark side. You know, there's some people that are writing code, and if you make it to where it's illegal to write these tools and post them out there, some of these people wanna do that and they feed the need. Maybe they'll do it more for bad purposes. Maybe they're selling these exploits and stuff to people to to do bad things or just to the highest bidder. So I think it's good that we share because just trying to ignore it, it's not... It's just... You're just ignoring it otherwise. I mean, because people or researchers are gonna share this stuff. You're not gonna make that stop. And and, you know, there's so many things out there that really limit what people do now. You take people to do bug bounty. They're really worried about if they, you know, disclose a vulnerability that they're gonna get in trouble.
And so I think we need to work more towards making that more open and be able to to, deal with disclosure in a way that researchers aren't worried about, you know, any kind of legal repercussions.
So you mentioned responsible disclosure and around, legal repercussions. There's a bill that helps to protect researchers out there called the safe harbor, And this goes directly to that point. But I I think there's another interesting negative information there that directly pertains to something that Bella just touched on, which is a direct reference to, again, responsible disclosure and what happens when a company doesn't fix something when a researcher or, you know, a good entity or, you know, a good faith submission doesn't get taken care of.
Yeah. I think too many times that, you know, there's some cases you've heard of researchers that companies had a bug bounty program and they tried to find some kind of loophole to go after that person because they really didn't want things to be disclosed. Companies really need to take these seriously and listen to these folks and if they don't have a bug bounty program or they need to... If they're not doing it theirself, they need to outsource it, but they really need to look into doing that and take it seriously because you don't know how many times... You know, I've worked for companies before that... A couple different companies and that people have come up and say, here, here's this bug, and this is something that wasn't found. And and you really don't want people worried about trying to disclose those because some people would rather just, you know, be quiet and stay out of trouble opposed to help you out.
I am... I previously worked for somebody who was of that mindset, very much closed off, doesn't want to share with anybody and doesn't want anybody to, you know, know that they're curious about certain vulnerabilities because just the act of them being curious about it might directly relate to the fact that they do have them and they don't want people to know that they do have them because they don't have the resources to fix them. And so they just kind of leave them there and try to obtain that security through obscurity mindset when in fact, you know, the malicious entities that are out there, if it's externally facing, they already know it's there for the most part. They know it's possible if they don't know it's there. And if they know it's possible, I think the... One of the only benefits we have as, you know, good guys or defenders or people who are trying to close the gaps, The only benefit we have on top of those pervasive, entities are the fact that we can knowledge share and the fact that we do let others know and that we can share this information to educate as many people as possible and as quickly as possible.
Yeah. And I think that's really important too. You know, some companies don't have the budget and the more we're able to share like that, the more you're able to help some of those companies out, you know, maybe some nonprofits or companies that just don't have the budget. So sharing like that's definitely gonna help them.
There's there's, speaking of malicious, things that are currently going on in the industry, there's been a lot of focus lately on ransomware and supply chain attacks. And so what do you think that organization should do right now to help prevent the sort... Those sorts of attacks from perpetrating in the future?
Yeah. I think one of the things that that really need to take, more seriously is their their security assessments because you see too much of companies worry about compliance. They're worried about being PCI compliant because your compliance is not going to keep you from getting breached. So your number one priority needs to be secure. Yeah, the attacker is not, oh, they're PCI compliant, we should go on. They're not gonna secure. And those are the worst kind. You know? You should... Compliance should be part of it, but your priority should be to secure things. So I think really companies need to look at that. And, you know, going through your pentest, doing your remediation, you know, because a lot of companies will file a risk exception and not remediate the item. You need to remediate those things. I did an external web app pentest once, got command line access through SQL injection.
So you mentioned like guiding this effort through security testing and not compliance testing. I'm wondering, can you talk about like what the difference is and why it's important to focus on security testing either more or at least in addition to compliance testing?
So one of the big things I think is scope because for PCI, if you're only testing what's in scope, you you could be missing a lot. And, you know, when you're doing PCI testing, if you don't have proper network segmentation, then the whole enterprise is in scope for PCI. So companies are are better about, you know, their segmentation because they don't have to have the whole thing, you know, in scope. So I think a lot of it's a scope, making sure that you're testing things outside of scope, because maybe externally, maybe what you have is not in scope for PCI, but make sure you're doing those things. Not only testing the applications, make sure you're testing the infrastructure. Going beyond that, doing physical penetration tests too because if someone gets hands on keyboard, there's all sorts of things they can do. So you need to be testing physical and social engineering as well.
There's a slide that I've done previously for a talk that mentioned some of the common risks in an organization. I start with users and I list several things and then I list users again. Just because of that fact, users are the biggest risk to any organization. And, you know, what's central around that is training and helping to understand. And, I mean, you know, it's it's a difficult problem, that's that's out there for sure when you talk about criticalities, in relation to organizations. Speaking about criticalities, what's sort of a critical a critical type of attack or security risk that you think is going unnoticed currently?
One of the things I have to say is, like, for applications, like the the password requirements and some of the things they do that they make it easier for end users. Because you know, at your company, you've got to have you probably got stricter passwords, multifactor authentication, but our customers, we don't wanna make it too difficult for them. So I think that's one of the biggest areas that we miss out on. We don't need to dump Well,
Yeah. That's pretty funny because I remember people back in the day having their their sticky note under their keyboard or on their... On like their little, sticker or their little board on their desks with all their notes and stuff.
Yeah. I think that just they make it easier. I mean, you know, even some of these banks, some of their password complexity is not that complex and some, you know, some different applications, multi factor is an option. It ought to be enforced, then you should be using strict passwords. You know, maybe you need... If you need to, then provide some education or information to your end users instead of making it easier for for them to use it. You know, why not make them more secure? Because, know, there's password reuse and if their account gets breached somewhere else, they may be using it against your application.
I think we should start a tally on this podcast of how many episodes, MFA comes up in because it might be every single one. That's like... That's... If I answered this question, my my biggest, like, why isn't anyone paying attention to this is, like, just do MFA. Just do it everywhere. So we talked a little bit earlier about, you know, companies needing to be kind of more... I don't wanna say... Like, don't know if welcoming is the word I want, but open to listening to hackers, attackers who are observing, vulnerabilities on their sites, which brings me to my next question. You've been active in promoting a group called hacking is not a crime. Can you tell us a little bit more about what that is and what are the goals of that organization?
Part of the... One of the big goals, it was interesting because Brian Makinich, one of the co founders started Hacking is Not a Crime right before DEF CON in 2018. In part, it was just a sticker campaign. He had these stickers hacking is not a crime, you know, a catchy slogan and a neat sticker just to kind of bring awareness. And then last year, he partnered with Chloé Messdaghi, and they got involved in more of some of the legal matters, you know, trying to talk different local governments and went a step further than just stating on social media that hacking is not just used for criminal activities. They've actually talked to different media sources. If they see a certain company or news organization using hacker negatively, they'll not scold them in public, send them an email and say, we're trying to help bring awareness because you know, hacking skills are not only used for bad, it's used for good.
And trying to bring awareness to that because, you know, the media years ago, and they always, you know, a story sounds better whenever you say, you know, a hacker opposed to using the right terminology. They need to get a little bit closer. But it's one of those things that's that's happened over the years that's really kinda hard to kind of undo because, you know, just the terminology. If a, you know, a hacker, you know, breaks into a bank application, is still a hacker, but they got... They're a threat actor and got malicious intent and the intents not always shared or noble. But then a lot of people don't realize you could do it for good because I've told people before because when you tell people you're a penetration tester or a pentester, they look at you really strange. So it's easier to say I'm an ethical hacker. And I've had people ask me, is there such a thing as an ethical hacker?
Yeah. I've gotten that question too. I've gotten people ask me like, don't you feel bad being a pentester? And it's like, no. I feel great. This is great work. Why do you think though that that stereotype... Like, where do you think that stereotype even came from? Why is hacker such a negative word?
The media. It's just a way to really... You know, it's... They're they're trying to sell stories and the more drama you can bring to it, the more... You know, it's like a a story, you know, or a movie. You're gonna go see the movie that looks the most intriguing and interesting. So it's just a term that they're used and I don't think they came out with the... They started using the term negatively because it was even before it was used related to pentesting because you had... You look at the hackathons, it's not anything to do with pentesting. Usually, it's people writing code because it really came more from the maker side of things, the inventor space and that sort of things. Some of your early creators of computers like Apple, you know, you know, Steve Jobs and Steve was... Or... And and Wozniak and and these folks, is where it came from.
And just somehow or another, the media used that term, and it just got popular. Then movies, you know, have movies about hackers and stuff, and usually it's criminal type activity. And that's just kind of the way it's just like a lot of other stereotypes.
How can we change that stereotype and sort of remove that negative connotation? Like when people ask you, is there such thing as an ethical hacker? How do you explain that? How do we how do we reclaim this word?
Yeah, the way I one of the ways I explain it is someone that knows how to pick locks, locksmiths, jobs are perfectly legal as long as they got permission. If you're going picking locks to get into someplace without permission, then that's wrong. And that's just like using a gun, you know, you have a gun for protection with I don't know what whether people, you know, it's their right to have guns or or their thoughts. That's their opinion. But, know, guns can be used responsibly. And same thing with these skills. It's like martial arts too, or any kind of MMA self defense type stuff. You know, you could people use it for self defense, and you can also use it for bad if you want to. So, you know, it's just all skills... Any skill pretty much can be used for evil.
I would agree with that. I think one of the biggest, to your point about, you know, some of the background with with where the term hacker came from at, the MIT labs and working in those industries when you would get the coders together and the makers together and they would take these products and they would say, alright. We need to build, you know, x and we want to put it together to function for y. How do we do that? Well, we've got some old, leftover components from say, you know, a model train and then this, old old, processing unit over here and this old, you know, whatever. And they take these these these hardware components, compile them together into a cobbled mess, and then they develop code around it. And it happens to function for the thing that they wanted, and that's where that's where the term hack sort of sort of came from.
Right? Fast forward, you know, before penetration testing was really a thing and before cybersecurity was really thought of, what ends up happening is you have this whole subset of a community who is trying to circumvent controls around things to your lockpick point. They're trying to break into things and trying to take care of all of this subculture type stuff during the time, which which was coined hacker. And that's where sort of that dissemination from the negative connotation began to erupt. And it was such a a new thing for this population that knew nothing about cybersecurity at the time and every... You know, at the time, the Internet was just the wild wild west. I'm sure you remember back in the day when Telnet... Telnet's freely opened out on the Internet. Things weren't secured. Traffic wasn't encrypted.
You know, you go to a website database and it's just there. You can go to it. He... It's not even password protected. And so that's that's where this negative connotation started coming up because it was all over the place and nobody really knew about security. They just kind of thought it was inherent. And so I think you made a great point, Phil, that that when it comes to changing the perspectives of what hackers are, it's all in the intent. To that point, you are also working with, the Innocent Lives Foundation. That's something I've got a I've got a really good friend of mine who who works with with that organization. What is it that they do, and how do you participate?
Yes. Innocent Lives Foundation helps unmask child predators. And so what they do is they've got people from different areas of cybersecurity or IT that use their OSINT skills to help track down these child predators so they can build a case against them to turn over to law enforcement. And, hopefully, law enforcement will be able to apprehend and prosecute these individuals. And so what I do for them, it's been, I'm an ambassador now, but I started out doing fundraisers for them. I would do Pwn School fundraisers because, you know, I wasn't looking to make a profit, but I thought if I could go through one of these t shirt websites that creates t shirts for fundraisers, that that would be a way to to create t shirts from our organization for Pwn School and then bring awareness to Innocent Lives Foundation.
And that's one of the things too that's important to anyone that wants to help innocent lives. Awareness is a big thing alone. I mean, towards the first of the year, I was kind of bummed out because the pandemic last year, I wasn't able to raise as much money as I had in previous years. But then there was someone that had, someone in their family pass away and got left a large sum of money and part of, them getting the money, they had to find a nonprofit organization to donate to, which end up being like over a $100,000 donation to Innocent Lives Foundation. I had no clue, and I was bummed out about this. And this guy had sent me a direct message on Twitter and said, hey. I just wanna let you know, you know, because of your T shirt fundraisers, I found out about Innocent Lives Foundation. And so I'm... We're making this donation.
So... Oh, sometimes it's just awareness because the more people know about it, the more they can donate to it. And, you know, during the pandemic, kids are on their computers a lot more because they're not able to get out and and play with other kids due to low... Lockdown or just, you know, social distancing. So they're online even more, and and that's just the way for predators to... You know... They may think it's another kid online and, you know, use some of these, you know, nefarious skills like social engineering for bad and and, you know, possibly actually abduct these children. So, that's one of the reasons it's needed. And and Chris Hadnagy, a very well known social engineer, runs the social engineer village at DEFCON, is the founder of the organization. And there's a lot of high level people actually like Robin Dreeke from former FBI behavioral, unit lead that's involved with the organization.
That's that's such a amazing thing that they do. I can't even begin to fathom the atrocities that are out there, honestly. And I think anybody, again, Innocent Lives Foundation, anybody that can, they should get involved. And if they, by any means, have the means, please utilize those to help the Innocent Lives Foundation.
Awesome. So we have exactly one final question to close it out. This is a question that we ask everyone at the end of the show. What is one thing that people wouldn't know about you just from looking at your LinkedIn or other online social media presences?
Well, one thing I I could share that a lot a lot of people know is back in the early nineties, I think it was back in '91 or '92, I tried out to be a contestant on American Gladiator. Woah.
Oh, I love that show. Did you make it? Nah. Oh, bummer. Man, I would've I would've loved to see that. That would've been so fun. I did get to watch some of your pro wrestling videos, by the way. Those are fun. So cool. Phillip, thank you so much for joining the show. We... It's been a pleasure having you. And as Bella said, you know, thank you so much for everything that you do.
Yeah. It was great meeting you. This was a great conversation. Thank you so much. And it's, again, I think I said this earlier, but it's really, really cool to hear about more people and, organizations and efforts to spread knowledge in this industry. So really, really awesome to talk to you.
Cloud cybersecurity is a large penetration point for malicious actors. See how your organization can be protected at synack.com. That's synack.com. Check out the show notes to learn more.
