all right hd welcome to
this episode of the cyphercon podcast
the uh
hd tv edition uh
am i the first person to make that lamb
joke uh this year yes
this year okay all right well there we
go i guess uh
there hasn't been a lot of tv
appearances uh
these days other than the zoom uh
you know it's kind of in everyone's
vernacular these days
um but anyway uh welcome and thanks for
joining me and i apologize for the
temple joke
and uh let's jump in right away and uh
you know i thought that maybe we could
start with
um your background how did you how did
you get into
this uh you know wonderful uh career
and all the achievements that you had
for yourselves like what were your early
days like how did you get into hacking
how did you get into
tinkering and you know finding exploits
and doing all this kind of stuff
a lot of it just comes out of like being
poor and growing up in texas with you
know no real funding and so
you know you walk you know walk to and
from school you find trash in the ground
you find
chunks of computers hanging in a
dumpster you start building stuff you're
trying to try to make like one
functional computer of all the parts you
find
um i spent a lot of time sneaking at
computer labs you know before and after
school and
playing around with apple tvs is
generally trying to get a feel for like
how they worked
how to write and they kind of that led
to getting involved with you know the
kind of
freaking telephone scene here in town
which was you know
you know free internet dialing random
bbs is trying to either
um get access to other bbs's the whole
calling card thing to go you know over
you know long distance calls back then
which sort of thing so generally just
trying to explore kind of what the
telephone numbers look like and that
eventually became
a strong focus on where down uh which is
you know dialing huge ranges of numbers
from as many modes as i could find
trying to figure out what was out there
connecting all kinds of random stuff
from you know hvac systems tied to large
department stores to
radio towers and old linux machines and
you know prime os and everything else in
between
holy spokes so you you found what
what made you want to build computers in
the first place like how did you first
like can you remember like what your
first experience was like
oh i want to build a computer oh yeah
definitely so i'm
probably when i got so i got kicked out
of school a lot so every time i got
kicked out of school i lost access to
school computers right i came from the
lab so i had to find something to play
with
so i kept trying to like build parts out
of leftovers i found it dumpster dough a
lot i
pulled things out of the trash
everywhere i could find it uh took about
a year and a half to my first 46 and
i was just building you know about half
a modem here half a mode in there you
know hard drive over here
cpu over there motherboard there i
finally got the machine set up
and i had a like you know shirt with a
pocket on the front i remember like
leaning over
pushing power hearing that thing finally
kick on the fans were up you heard the
the virus post beep and then a penny
fell out of my pocket went right in the
motherboard and shorted the whole thing
out and discarded from scratch
holy smokes that's awesome how did you
so did you find
dumpsters that you had a lot of
computers in it like how did you locate
was it like okay this is a computer
company or a school you knew that
they're getting rid of computers they're
like where'd you find these things in
the dumpster everywhere i mean
apartment complexes were great because
people would throw away all kinds of
stuff
uh telephone companies for sure you have
to jump the razor wire and stuff to get
back there and go through all their junk
all my own telco manuals were pulled
directly at the trash bt back in the day
uh so i still like my old oc3
multiplexer manuals and all my old like
default login scripts were all basically
pulled directly out of the telephone
company's trash back then
holy smokes razor wire and everything
you're you're hardcore man that's
awesome you're
really dedicated so how did that um
like those early experiences and really
love for computers
how did you know and freaking and you
know
all that kind of stuff how did that
inform uh
you know what you created with uh
medisplay what became medisplay
oh metaplay was a kind of like a big
amiibo roller project like
most people know these days is like the
big software package that it is and all
the exploits things like that but it
started off being a research project
and the idea was like let's start taking
all these random ideas and random
presentations that our friends have
that we had and start putting together
the one giant containing you know
container
stuff so it started off with uh show
output development trying to get shell
output sizes and windows down really
small
uh we spent a lot of time things like
power sea shell code and then uh
from there i kind of looked at building
out exploits and you know at the time i
was working in a uh
mssp um heading the red team at the time
and we had a crappy pile of tools we
needed better tooling
so we started putting together um you
know this kind of clean version of all
the tools that we had and realized this
tool still sucks because at the time if
you want to swap out the payload you
want to go to blind shell reverse shell
you need to go
you know rebuild the exploit from
scratch and half the time um
the characters that you had to avoid in
the shell code like null bytes things
like that
were different for exploit for per tool
so
that really led to the design of like
metasploits kind of lego like model
where
you take a payload you can exploit an
off an encoder um and you kind of put
them all together and build kind of
dynamic exploit runtime
and use that and so i wrote in the
language i knew at the time which is
pearl managed to convince a couple other
smart people to join the team
mostly because they made fun of my code
and i told them to do better so they did
that was spoon and escape and then we
kind of rolled through that for a couple
years and it turned into
uh early on it was kind of widely panned
as a scripty tool and people made fun of
it but the idea really was just to
stop letting research die in the mind
like when someone has a cool idea
actually implement it and make it part
of this thing that we just keep
maintaining going forward
and so if you want to talk you know half
the time you go to death count you see
really cool talk
two years later no one remembers that
talk right you have to really we want to
make research applicable
you know real world useful and that's
kind of where next week came from and
what it became
that's it it's kind of like taking it's
kind of like the you know the concept of
like continuous deployment which is kind
of
ubiquitous now you know everyone's using
agile and that kind of stuff and
and but and when did you originally make
that a split
um the first code was back in like late
2002
and then i think we had our first
release in 2003. and so that's kind of
what you're
doing is like kind of continuously
adding on to these things and it seems
like you know
that wasn't the thing that you did at
the time and and so people are
like what what is what is this you know
but but now it's like that's the thing
that you do is you're constantly
improving you're constantly
adding to your um your software
you know back then the challenge was
exploits weren't something you took for
granted like a lot of folks thought
exploits should be illegal or that they
were illegal and didn't know better
this is back when just port scanning
somebody we locked up in jail so
the whole um view of the world was very
different back then uh
people thought exploits were these you
know dangerous things created by
criminals which they were but they're
also useful for contests and security
auditing and everything else and
if you're working ids or a security
solution or a firewall you need
experts to test that too so it ended up
being this kind of weird world where
half the security industry desperately
depends on having the exploits do the
job
the other half absolutely hated them
didn't want to exist and
that's why i kind of pushed the bar from
moving exploits from this kind of shady
underground activity to something that
everyone kind of
you know use like regular tools like a
port scanner like anything else
huh yeah and so that's yeah that kind of
like
it's like sort of like inventing the gun
you know it's like
you're using this tool and uh and
that like you can do it like it's you're
able to kind of you know take all these
exploits instead of like
having to cherry-pick and you know
there's some issues with figuring out
how to use
you know different ones or whatever and
um
you know but i guess i guess the other
side of it and i'm curious
to learn a little bit about this is is
you know
uh you know like the same thing with a
gun like you can be a good guy or a bad
guy with a gun right
and um i'm curious to learn about like
what was the response from people at the
time as far as like
hey you're just like giving uh you know
nefarious hackers like some
more tools to be you know to hack into
things like what
what you know what kind of flak did you
get from people if you did
don't i don't know for a fact that you
did but uh um
you know what what sort of criticisms
did you get and how did you respond to
those criticisms and
how did that kind of evolve over time
yeah sure
um so all kinds of criticism like both
from my employer from our customers
from friends from people on the internet
from random companies you know there's
everyone the mom has an opinion about uh
whether you should disclose
vulnerabilities where they should
release exploits uh and so we took the
problem and we basically said we're just
gonna keep doing what we're doing we're
gonna keep releasing stuff until someone
stops us and they did
and where they tried we won um ended up
being uh you know i had a
large soccer company trying to get me
fired from my job for multiple years got
pulled in front of board hearings all
kinds of crap
so it at the end of nato i feel like we
made exploits
what they are today which is a tool that
you use as part of security work not as
this
special scary it's not like a virus
where it's going to take over your whole
network it's not like something's it's
you know wantingly destructive that
there is no values for
exploits are a very valid way to test
security to uh make sure patches are
being applied there's we kind of
made turn them from this kind of scary
thing people weren't really sure what to
do with to
kind of just get another boring tool in
the toolbox and a lot of people didn't
like that
both folks on the black outside didn't
like the fact that our exploits were
widely available and often more reliable
than their exploits and for the same bug
but also that uh they just didn't like
the fact that it was that widely known
like all the cool mystique that came
with like doing explain
development um you know is less cool
when it's widely built right so
i think we took from the shine off of
exploit dev back then but i also think
it helped raise the bar and also help
uh the rest industry accept that
exploits were just you know a tool you
need to use to do your job
yeah i like that and i think you know
one of the strongest
disinfectants is sunlight right and so
that's what you're doing is shining a
light on like here's here's
here's the bugs here here's how you can
exploit them and
and uh you know here's how we can find
them fix them make it better and and by
reporting all that and having that you
know
transparent to the public it's doing
everyone uh
a good right yeah i mean we had a strong
focus on ids evasion back in the day too
because the goal was
let's make it clear that these tools
don't actually work like you can't build
a good ideas for the smb protocol or the
dc-rpc part of all it's really hard to
go to those particles reliably
there's so many different ways to
fragment it something's out of order do
multi-binds all this crazy stuff you can
do in the protocol itself
that none of the defensive tool vendors
were taking into account when they built
their products
so a lot of what we did in that is
making it very clear very obvious that
the existing security solutions aren't
actually working properly and they can't
detect these attacks
and that pushed the whole industry to
try hard and do things differently now
you know we are where we are today for a
bunch of reasons but
i think uh the work that went into
metasploits
ids support and protocol invasion
definitely helped
cool uh so what are you what are you
working on these days what's uh
what's going on i mean the was kind of
what got me in the security was being
able to explore the big unknown back
then it was like telephone networks and
it was like scanning id space and i
spent a lot of time
working in project sonar about the
sevens getting all that before
uh and i feel like i still love that i
still love the idea of just exploring
network spaces like
the fact you can pick any numbers in one
and four billion right now and it's
probably a valid device
it's probably a valid server that's
crazy but you can just like pick a
number out of
thin air and it somehow belongs to
someone's printer in malaysia that's
that's awesome
so i love that stuff so i started
working on a platform called rumble
never discovery
which is to help companies identify all
the network connected assets internally
and externally
so instead of it being like uh internet
wide scan we're constantly like we're
running a scan across the whole internet
our customers scan their own stuff with
their own hardware with our agents
installed
and it builds a big inventory of all the
things and ideas that we take all the
cool techniques from
kind of the pen testing red team side of
the house things like um you know doing
segmentation analysis
identifying topologies uh finding
information links to tell you about
secondary interfaces things like that uh
really small information links you can
use to determine exactly what a device
is
and combining that with the iq side of
analysis which things like communication
uh object id databases uh lots of
fingerprinting things like that
so you try to kind of bind both sides
and give you a really good view of
what's on the network without
credentials really quickly
uh so we've got a free version it works
for most folks there's like 156 assets
which most homes
most small businesses can use for free
um and it's a lot of fun so it's a fun
tool for
you know it's if you look at tools like
uh in map or other scanning tools
they're very focused on
telling you what services a particular
device is running we focus very much on
telling you what that device actually is
and how it's connected
huh interesting and do you find that a
lot
of small businesses like they have stuff
on the network they're like what is this
or like is that kind of like one of the
you know one of the benefits that you
bring to
some of these companies oh for sure i
mean we help out you know oftentimes
we'll
someone just scans the networks they
know about but typically find about
twenty percent more stuff than
they have once we help them find what
their all the other networks are the
ones that were aren't being covered
with their current management then it's
usually forty percent like we just find
so much more stuff because we look for
it differently
uh and it's a different model um there's
a lot of things that wouldn't really be
safe to scan with standard security
tools
we have a custom scan engine that's
designed to be you know safe to use in
clinical environments ot ics
everything like that so uh not to
infomercial soapbox too much but
like i think it's a cool way to explore
networks and it's much safer to use than
your standard security scanners cool no
that no
feel free to soak box away i mean i'm
happy that
to learn about what you're doing and you
know if it provides value to other folks
you know
um a lot of stuff is just long it's
rolling up all the techniques from like
nut display from pre-metasploit days
internet scanning days
um so there's a bunch of open like the
tools of this commercial we have a bunch
of open source projects we contribute
back to
we've maintained a macro editor's
database in conjunction with the d-mac
folks
uh we have this giant fingerprint
database we work on that's the same
fingerprint database used by an expose
and by metasploit investment pro
is the same when using we're using
rumble as well so that fingerprint
database is called re-cog and it's a
great way to like fingerprint anything
basically
so we've been uh dumping data into that
trying to find ways to print more stuff
uh we work with like the wrap seven
teams they add fingerprints for project
cylinder
scanning we add stuff that our customers
see internally um
and just trying to make a much better
set of tools to help fingerprint what's
out there
that's awesome that was something that
so i think before we got started i
mentioned that i had this uh cyber
security startup and
uh we kind of had a lot of you know id
we never actually like
fully went into you know building a
product we were looking for a paid
customer first type thing but
one of the things that we found is just
by like searching showdown
and like finding you know these
different devices all over the place and
finding out you know what version of
linux they're running and knowing that
there's
you know these known exploits or you
know that aren't patched you know from
that version and stuff like that so
um you know we were thinking about like
how can we
you know uh take this information and
let the companies know and let them know
how to
make sure that they know um you know
what devices are on their network what
they're running and where
where the potential exploits are and
stuff and that's what you're doing so
or i should ask is that what you're
doing and uh how's it going
mostly yeah i mean there's a lot of
folks doing just external these days
you've got folks like the discovery
census sheldon of course a bunch of
other folks that do external monitoring
we focus on doing mostly internal
corporate networks so we do like lots of
large hospitals lots of large enterprise
uh state governments things like that
and you know the cool thing about that
is we're able to
help them explore their internal network
stuff that you never see on show because
it's never going to be sort of
exposed right right we see devices that
you just you wouldn't see anywhere else
like strange radio towers microwave
links
uh all kinds of crazy clinical gear all
kinds of you know weird industrial stuff
that
you know if you see on the internet it's
already a problem but we see a lot of it
in turn so it's kind of cool being able
to
uh work in a space that is kind of like
the the lesser scene side of network
discovery
cool and you mentioned a couple times
project sonar i'm not familiar with it
can you just tell me a little bit about
what project sonar is
yeah like so metasploit was a good way
to get sued and project project center
was a really good way to get suited too
so when i was working around seven we
started this research
project where it was very short and like
we're gonna go scan the whole internet
constantly and we're gonna give all the
data away for free
so we kept doing that did that for our i
think it's still running now so the team
still has an open data platform
but the cool thing about that is all the
bulk data is free you can go download
gigs and gigs and gigs of just raw data
and comb through it and that data
includes like a full dns database of the
entire internet
uh like billions of records every host
name ever pulled out of server
transparency tls
web crawling link discovery all kinds of
stuff so it's a really cool
um data set to do data money on to build
fingerprint spam just to learn more
about how the internet works
wow and so you mentioned it's a good way
to get sued
i mean have uh people come after you and
you know tried to sue you and like how
you know if you're comfortable talking
about it obviously if it's if it's
something
all kinds of fun stuff like there's a
couple iterations of the project before
became project sonar
one of them uh i started i got like
indicted on a grand jury for subpoena
like like never actually went to court
they finally dropped the facebook work
out there but
lots of scary letters lots of scary
stuff um basically uh
if you if you're scanning the entire
internet then if there's any compromise
any criminal activity anywhere
your ip's also in the log so they just
say okay let's pull all the ips that we
ever saw in this box
at this time period obviously they're
all criminals even though we're just
scanning everything all the time
so we also have folks like um cso for
state government get really mad that
we're scanning uh
it devices in the state over the
internet i'm like you know everyone else
is scanning already right like yes but
we know who you are i'm like yeah
because we're telling you where you are
like we're trying to get front and open
about this but they got really mad and
demanded that we never scan any
computers anymore in that particular
state
and it was it was quite silly and but
they wouldn't tell us what their ip
space was because they didn't know
either
so that turned into like a week-long
like doing all the research to figure
out what their ip space was so we could
stop scanning it so they would know
their id's and they never replied
anywhere emails but
yeah lots of chaos lots of threats uh
lots of scary letters
wow holy smokes so what was i mean
i mean when you when you started doing
this you probably anticipated that that
was going to happen right and
you know what was your i guess i mean
what was your what's your strategy
behind that it sounds like it's just
like be
open and uh you know transparent and
honest as possible
but well full on and get through it
right i mean that's the thing about
metasploit too like i had my name on the
whole thing going through the project i
never used like a handle or anything
like that so
uh we got a lot of uh ddos attacks we
got a lot of death threats we all kind
of crazy eagle like you know angry hate
mail all the time
um but it's fine now that it's done no
one cares anymore right but it was
trying to make it the norm trying to
make it exploit norm just like we tried
to make scanning the normal with
projects in our
showdown was already doing an awesome
job and making it kind of a standard
thing people knew about
but there were very few like large
security companies doing uh
active internet wide scanning at the
time so it was a good way to like put
another name behind it and make it feel
like it's something that
people should be doing more they should
be treating like a criminal activity
wow that's awesome that's that's super
courageous you know my hat's off to you
i mean
when you're going through this i mean
did you have a lot of anxiety around
like
you know i mean i can't imagine what
that's like if you have like
whole state agencies coming after you
like
uh it's not much fun sometimes but it
was worth it right i feel like
that made things normal that made things
uh it opened the door for other people
to work on similar projects right i feel
like
because of metasploit people weren't
scared to publish exploits anymore uh
because of project sonar other companies
were willing to get involved with
internet wide scanning contribute back
to these kind of global research
so i feel like that's those are the
table stakes you have to put some risk
out there to make it normal and that's
what we did
wow that man that's that's incredible i
uh
i i yeah i'm amazed that you know you
have the courage
and like the tenacity to do this and uh
and it you know it worked out i mean you
you did like raise the bar
on you know uh transparency and
security and and you know you were part
of the
the architect that made it to what what
it is today so that's that's amazing
this is a huge community right it was
you know product sound was a huge team
it was all our lawyers were very helpful
too
it was nice working for a large company
when that was going on because they
could help cover me a little bit
metasploit was just you know i think
almost like 300 people by five or six
years in so it was a huge community as
well
and those folks are still contributing
it's still an awesome group of people to
work with so
it was just really great being able to
work with all these folks who care about
the same things and really want to
you know see the status quo change
that's awesome uh
well do you have any uh you know final
words of advice
or plugs or where people can find you
that uh you want to share before we uh
sign off here sure yeah probably easiest
is twitter these days my dms are open
just hdmore
um and then on github hdm is my handle
there uh for any products working on
these days
uh rumble that run is what i do for work
these days that is rumble.run on the
website and then uh you can always reach
me at you know htmlrumble.run as well by
email
um but yeah i think uh the only thing i
can really recommend is
one of the challenges i run into like
starting new projects is that i feel
like overthink them and it takes me a
long time to finally feel comfortable
with the new thing that i want to do
and what usually works better is just to
shut up and do it like just go face down
and just do
you know two weeks straight at work on
that thing and then two weeks into it
okay feel like okay did i make enough
progress that i understand where this
thing is going where i want to be
or is this a complete waste of time but
trying to judge it before you really
spend a good two weeks of effort on it i
don't think works
and so anybody wants to start a business
or explore an idea start a research
project i feel like you need at least
two weeks in before you can really make
that call
cool that's awesome and that was one
other thing i i forgot to
to ask you about i read your uh paper on
i think it was metasploit and money or
something like that
and i thought it was a really cool paper
because it kind of went through like the
whole
um you know act of of of monetizing and
like what went into
you know figuring out how to i think you
were
leasing out the software or like how to
monetize it and
and i thought that uh yeah in addition
to what you just said like is there any
advice that you have to folks that you
know maybe they're working on
you know a passion project or a side
hustle or something and they're looking
to
monetize it or turn it again it it turn
it into a full
time gig like do you have any uh advice
to
folks and and now uh i'll actually link
that that paper
that i read because i thought even
though it was i think he wrote it you
know a few years back now but
um i found it to be um interesting to
get that insight in
you know how how you went about you know
like with the merger and acquisition
people and stuff like that i was just
like
i was like that's that's this is really
good insight so
um but yeah do you have any advice on
that end
uh sure i mean the that paper was
written probably about 10 years ago now
so it's
a little bit dated but yeah uh hbr like
harvard business review actually did a
study
of the metasploit acquisition as well so
they've got their own document to put
together which
i think the the one we wrote for black
hat was better i think it went into more
depth but
um it was neat to see kind of because at
the time there was nothing really to buy
so
perhaps someone bought medical
investment was just an mit license code
base and a domain name and that was
really it there was no
like assets really purchased so we ended
up going from you know
33 000 users at the time and no real
assets no real income outside of
training
to you know millions of dollars of
revenue on a commercial product but also
keeping the resource open
and that whole transition and all the
weird stuff we ran into it's a the paper
kind of covers a lot of the issues that
we ran into with like
uh companies kind of taking the software
and competing against us with it for a
while things like that
um i think the only main advice i have
these days is
the gpl is not your friend when it comes
to commercializing your own software
if you have any plans to commercialize
your software going forward do not use
the gpl find any other license stick
with mit bsd
something else or go commercial with
your license but don't use the gpl it's
just going to call you
like light years of pain cool
um all right well yeah i'll uh i'll link
to
a link to that in the show notes and all
the other links that you mentioned
and yeah thank you so much for taking
the time this has been fascinating to
to listen to your story and uh yeah so
uh thanks a lot thank you for having me
all right bye