dnsUNFILTERED: Edna Jonsson, Engineering the Socials

 

[00:00:06] Mikey Pruitt: Welcome everybody to another episode of dnsUNFILTERED. Today I am joined by Edna Johnson. Edna, welcome to the show.

[00:00:14] Edna Jonsson: Hi, Mikey. Thank you for having me. I'm happy to be here.

[00:00:18] Mikey Pruitt: I know. Thank you for joining me. I randomly came across some LinkedIn posts of yours, then I dug a little deeper got very fascinated at your plethora of work, so you've been.

I guess you've worn a lot of hats. You've been, or you are a sock analyst. You've done a little threat hunting, a little capture the flag action. Community organizer. Podcaster. What, I'm curious, to get started with a little snack. What is the thing that keeps pulling you into cybersecurity?

[00:00:50] Edna Jonsson: Ooh, what pulls me in, I get such a joy out of it. The community is the best part for me. I get to meet many amazing people there. The people that I interact with, they're from such different walks of life they do different things. it's always intriguing to me meeting new people getting to know their story what their background is what do they do.

I am a curious person, so I'll ask people a bunch of questions about themselves I to dig in find out more about people get to know them.

[00:01:21] Mikey Pruitt: is curiositystarted you down this path of cybersecurity capture the flags things that?

[00:01:26] Edna Jonsson: I'm definitely a very curious person. I know when I was younger, I would be into Nancy Drew books I had this envision of I was gonna become an investigator of some sort. I thought maybe I'll get into the FBI it's I have this very curious mindset, I love having challenges working through them digging in.

If I have a challenge that takes me hours, such a brush. When you finally figure out what the solution to that challengesthat's the stuff that I enjoy.

[00:01:56] Mikey Pruitt: You turned out to be a little bit of a Nancy Drew, you Yes. you're solving things.

Investigating. Have you ever seen the online sleuth community where they're analyze pictures I know it is related to capture the flag, little clues here and there.

[00:02:09] Edna Jonsson: seen that. osint challenges and things that.

Let's talk about some of the. Challenges. You've gotten a few awards, I believe, capture the flag at Wild West Hack Fest. Is that right?

Yes. I competed with, a team we won the black badge, in that competition. that was, a fun time. They had great challenges that the platform we were on was the meta CTF, they put on great challenges for people.

it was a fun time.

[00:02:38] Mikey Pruitt: What was the hard thing that stood out in one of those challenges that felt you were never going to get past?

[00:02:44] Edna Jonsson: it was an attack in defense CTF there was a lot of coding involved in different languages. my team, they all had different.

Parts of the puzzle. somebody was working on programming go while somebody else was working on, c somebody else on JavaScript or Python. It was such a rush when the pieces started to work the code started to run we started to get the flags coming in.

it was. figuring out how the different APIs worked what it was that we were grabbing. I know, for me, I was looking at one challenge I'm looking at the front end trying to see what is the right diviv that has the information that we're trying to grab from. you would see there was a bit of information here or there, then finally it's all the way down here is what we're looking for.

it was trying to find the needle in haystack.

[00:03:36] Mikey Pruitt: I've actually never done a ctf. Okay. I'm curious, the way you're describing it, it sounds you're maybe doing some, a little bit of everything, you're doing your reverse engineering APIs, maybe you're doing a little bit of, HTML processing to figure out, you mentioned the DIB that you were looking for.

Is that, what is an A CTF like? should I do one?

[00:03:59] Edna Jonsson: definitely do one. 'cause they're fun. A CTF. It's a competition for finding flags there's different kinds of challenges in ctf. this was an attack in defense ctf, there's also ery set dial, CTFs, or king the hill. Different versions that you can play.

I starting with an Osint CTF for, when I'm recommending people starting because you use your Google food skills to, find information, there's a lot of different CTFs out there. There is re reverse engineering. There is, you can do scenography trying to find information that's in pictures.

it's solve this challenge then you get the flag then if you submit the flag it comes at that's the right one, then you get the points for it. different challenges have different ways of doing things. Sometimes you get more points if you're the first one to get it, that will be called First Blood.

it's a great time.

[00:04:58] Mikey Pruitt: you're looking at exit data of images, things that.

[00:05:03] Edna Jonsson: You could be looking.

[00:05:04] Mikey Pruitt: how do you know, which strategy to, to apply? Or is that part of the challenge?

[00:05:10] Edna Jonsson: Sometimes the name of the challenge will give you some kind of a hint.

you look at the information that's presented to you. If you need to, connect to a server somewhere or connect to. IP address, you're gonna need to do some terminal commands. As time goes on, I recommend making notes of how you solve challenges, because you'll need to use that again in the future.

There is you'll start to see there's a theme between challenges. it's okay, now I'm in here. What do I need to do to get to the next step? having notes will help.

[00:05:45] Mikey Pruitt: History doesn't repeat, but it rhymes. how did you get started learning all these skills? These aren't just something you just.

Or born with, you don't graduate high school knowing how to run in MAP or anything. How did that happen?

[00:05:57] Edna Jonsson: I started, when I was in school, I went to WGU I got involved with the cyber club there they have a very active, CTF team I joined. They have the NA, national Cyber League Challenges.

That's both in the spring the fall. twice a year, there is. CCDC, which is the collegiate cyber defense competition, which that's a little bit more than a CTF, that definitely helped in the learning journey. I have such great friends that we play CTFs over over again.

We competed in the meta CTF Row to Cyber Bay, a couple of days ago. I saw,

[00:06:37] Mikey Pruitt: I saw that you still participate with the owls on different CTFs, kinda a mentor role, is that right?

[00:06:44] Edna Jonsson: I help with, helped people with mentoring CTFs stuff that.

I'm the alumni club's, the cyber club alumni officer. I'm the president of the cyber club there, I help with student activities. I'm now the assistant coach for the CCDC team.

[00:07:03] Mikey Pruitt: That's great that you still have that connection with the people that are coming out of school.

what do you what is on the top of their minds, to learn or things that you're encouraging them to learn to get into the field of cybersecurity?

[00:07:18] Edna Jonsson: I recommend getting as much hands-on practice as possible 'cause that helps them to do when they land a role. There ways that they can do that.

doing, try hack me and hack the box. Setting up their own home lab environment or, they, at my school, they have the nice challenges. getting involved in that because that gives you here's a situation that you have as a corporation and how would you solve this situation, as an employee of this company.

And then you get access to this. Lab environment that's mocked up to be this corporate environment. And you get to go through all of the configurations of how would you solve this?

[00:07:59] Mikey Pruitt: Let's talk about day jobs for a second. You're a soc analyst by day and community organizer by night,

[00:08:07] Edna Jonsson: yes.

[00:08:08] Mikey Pruitt: How do, things you learn at work benefit. Your community role?

[00:08:13] Edna Jonsson: I'm able to bring a lot of the experience from work to the community when, for example, giving advice on getting, breaking into the field and, also what kind of things people might expect once they get a job.

'cause a lot of times when you have no experience, you wanna know what's it gonna be? And what do I need to be focusing on if I. Gonna break into this career.

[00:08:41] Mikey Pruitt: What are the, what are, pretend I'm in school now, what should I focus on? What do you think?

[00:08:45] Edna Jonsson: it depends on what you wanna do.

If you're going into the soc, I would recommend getting familiar with different theme products, particularly Microsoft and Splunk. You can see those in a lot of environments. And you can get free training on both of those, on their websites and that can kinda help you with distinguishing yourself because if you've seen the products that are used, in the environment, that kinda helps you when you go into an interview, when people ask you questions about it.

[00:09:15] Mikey Pruitt: And you can install those products or similar on your home lab.

[00:09:20] Edna Jonsson: Yes, exactly.

[00:09:24] Mikey Pruitt: What do you think is, things that you've seen at work or in the wild or during your capture the flag escapades that are new and emerging? Threats that we're seeing out there.

[00:09:35] Edna Jonsson: Emerging threats, I would say click fix right now is pretty big.

that is for when somebody goes to a website they think they're on some company's website, they see a caption people have this capcha fatigue 'cause it's everywhere. they click on the capcha it says, okay now to verify press control. Or no, sorry, windows R then Ctrl V then enter.

when you do that, you run a command on your system, as whatever user you're logged in as. it gives the attackers, command control access, they could steal your credentials, all kinds of things that. Because you ran a command on your computer. You don't know what it is 'cause you, it you click control V ran it.

There's social engineering attacks. I would say the deep fakes are definitely an emergent trend, where people take voice samples from you on. Anywhere you've posted video, you might have somebody take your voice then copy it, they can either do it in a work setting. Let's say your boss calls you says, oh, I need you to do this.

you do the task for your boss, it wasn't your boss. You can encounter this at home where somebody pretends to be you calls your grandparents, says that you're in trouble you need. they send money because they didn't know that was you. those are some things to look out for.

[00:11:06] Mikey Pruitt: it's funny that you mentioned the PowerShell attack you would call it. We've seen on the DNSFilter network, we did a case study with one of our customers they had seen a benign power show event.

It's What does benign mean? it's the actual command from their sock.

Said, benign. this person went to go investigate pulled up their DNSFilter logs saw that they had gone, the user had gone to, first it was a banking website, which was not abnormal. That banking website happened to have mal advertising on it, a Google, fake Google. It was a real Google ad, malware injected into it.

when they clicked on that, something that interested them, they clicked on it, then they were presented with this fake cap that they didn't know. Had them do the PowerShell, open their PowerShell, run a command, then try to download Luma Steeler, which is a nasty piece of software.

Luckily we blocked that. But the crazy part is, after we talked to this person we had dug back in our logs for about a month and saw that this domain had been hit. 23 times, in the very short period, and four people actually went through and got to the payload step. you and I talking and people listening to this are would never do that, would never run a random command from a Google ad in their power, in their, shell.

[00:12:30] Edna Jonsson: But

[00:12:31] Mikey Pruitt: people do it all the time,

[00:12:32] Edna Jonsson: a good

[00:12:32] Mikey Pruitt: one to watch out more.

[00:12:34] Edna Jonsson: people, they don't realize that this is malicious while they're doing it. They're I'm doing what the page tells me to do, and I see a logo that I recognize as a brand name logo. This must be

Fine. it ends up getting them.

[00:12:50] Mikey Pruitt: they're tired from captions that they try to power through. It's when you used to install software and you'd be next finish. No one, it's get this away from me. people's, annoyance is reaching a peak where they're willing to compromise themselves in their companies.

You, you also mentioned, social engineering. I feel social engineering would be one of your favorite acts, is that right?

[00:13:13] Edna Jonsson: I enjoy social engineering. I, started a whole village for social engineering. The social engineering Adventure village,

[00:13:23] Mikey Pruitt: that's at one of the, DEFCON events that you assist with.

[00:13:26] Edna Jonsson: that is the, those are the ones that I run are. At BSides.

it's a traveling village basically any BSides that wants to host us. We, I'm working with a couple now, besides Delaware besides, Southwest Florida to, to start there, My office.

[00:13:42] Mikey Pruitt: you mean are you designing the social engineering, let's call it the, the box that people can, or the flag that people can capture?

[00:13:50] Edna Jonsson: We have, a vision challenge and it's actually calling an ai, so it's not calling actual people. if somebody is nervous about.

Making phone calls. This is perfect way to start because, the challenge involves calling and getting secrets that using tactics that you would use in actual social engineering calls, but against the AI until you get the flag. this is great.

[00:14:19] Mikey Pruitt: that's very interesting. You just gave me so many ideas.

My brain was going crazy, I was thinking. Sales teams, maybe they're not comfortable on the phone. Why don't they go pitch an AI to try to sell the software? Or the managed service provider who doesn't like sales calls or something like that.

[00:14:37] Edna Jonsson: Or

[00:14:37] Mikey Pruitt: training anybody to, I was on the phone earlier today.

I worked, do some volunteer work for a nonprofit some of that is, involves asking for donations. I lended my time to call a few people, no one likes doing that, you could train yourself. With AI to do a thing that you're not super comfortable with. That's there's a lot of applications for that.

Including Hacking the Box. Yes. what are some of the things that you're. Having this AI do, what's the, what does the prompt look like? What is the prompt trying to, go back to the person with,

[00:15:14] Edna Jonsson: the goal is when you call you, you start with the customer service rep when you first call the company, then you need to.

Convince that, customer rep

[00:15:26] Mikey Pruitt: person

[00:15:26] Edna Jonsson: yes. Person in quotes, to give up a phone number, so you're trying to re be able to reach somebody else. then once you call that next number, there is a keyword that you need to tell them so that you get to the next phone number. you go through, I believe we have five numbers that you go through.

And then there will be a point where you get to a certain person and now you gotta go back a step and call the other person back 'cause you've got information, then you need to go back. it's figuring out. Who do I need to call? What information do I need to provide? And, at the end, you end up with the flag.

And then, because our village is pirate themed, we have a certificate o completion, for everybody that finishes the challenge. And it's on this treasure map, pirate looking, page. it's pretty fun.

[00:16:18] Mikey Pruitt: Hold it up, get their picture taken on stage.

With the O pirate. That's awesome.

[00:16:22] Edna Jonsson: it's a nice little adventure.

[00:16:24] Mikey Pruitt: That's really clever. What are some of the other fun challenges you've designed over the years?

[00:16:29] Edna Jonsson: I don't know. I've been very involved with, Career Village, I've been doing, I did for, besides Orlando, I made a career village Bingo, which is a bingo card that you get and it has activities to network with people. And then once you complete, you get a bingo, you can come back for a raffle pri ticket to win the prize. And that was really fun. And some of the things on there were silly, it was go out there and go talk to people and get involved and have a good time.

that one was a very fun.

[00:17:03] Mikey Pruitt: another good use of your AI phone call tool is people practicing interviewing.

[00:17:11] Edna Jonsson: That's a good point.

[00:17:12] Mikey Pruitt: All kind of use cases. If you're listening to that, don't steal it. Me and Edna are gonna make

[00:17:15] Edna Jonsson: something.

[00:17:17] Mikey Pruitt: you mentioned a bunch of, a bunch about community and with BSides and

the WGU Cyber Club. There's a conference you work on called Death Con. I don't, I dunno what that one's all about. go. Tell me about Death Con real quick.

[00:17:34] Edna Jonsson: Death Con, that's the. Detection, engineering and Threat Hunting conference.

[00:17:39] Mikey Pruitt: Oh, it's an acronym. I gotcha.

[00:17:40] Edna Jonsson: instead of fronting conference, it's Def Con, it's very metal.

It's such a great conference. It, everything is workshop based. So all of the presentations, there's a video and then there's hands-on activities to go with the video. And we have, labs, lab environments for all of. The attendees, it's both a virtual conference and then we have some onsite, conferences as well.

I host the one in Orlando and it's just a great time to, learn things, hands-on, share knowledge with other, death practitioners, detection engineers and threat hunters. I have such a fun time learning with people and so many new ideas come up when you're doing this, kind of stuff because you'll be sharing things and oh, I, I've seen this in my environment and now I can do it differently.

And then as they have, as people have new ideas and share it, and it just. Makes everybody's job easier when you're able to share these kind of knowledge and have a place to, to learn together.

[00:18:50] Mikey Pruitt: So do you think the biggest benefit of the community work that you do is that, human to human connection and just learning from each other in a way that we can't do with ai?

I think so. I think it's definitely a great way to connect with others and help each other learn and grow.

So I understand that, privacy is a really big with you. I think you're, I think I've seen you talk about it on a podcast and I was looking up your, the company you work for on LinkedIn, which is, doesn't exist.

I guess it's redacted or something. I was Oh, this is not the company you work for, which I appreciate. So I assume that privacy is a big concern for you as it should be for everybody. Is that right?

[00:19:33] Edna Jonsson: Yes.

[00:19:34] Mikey Pruitt: So what are some practical tips you can give people, to be a bit more private, obviously not listing the company you work for in LinkedIn?

This is a good start.

[00:19:43] Edna Jonsson: I love not listing the company that I work for because then I don't get as many spam emails in my work inbox.

[00:19:48] Mikey Pruitt: the company you do work for Redacted has a pretty good logo. I was maybe it is real.

[00:19:53] Edna Jonsson: I made that in can. Thank you.

[00:19:55] Mikey Pruitt: It's good. Good job.

[00:19:57] Edna Jonsson: Thanks.

[00:19:58] Mikey Pruitt: You should start a business profile for redacted too, have a fake whole office, hundreds of people can work there.

That can be your next community.

Employees have redacted.

[00:20:07] Edna Jonsson: Yes. as to your question, I do, care about privacy other people that are trying to be more privacy conscious.

I definitely recommend using signal for communication, going through your app permissions making sure that things are not overly permissive sometimes, apps they change, Instagram recently made a change where they put publicly your location when you post pictures. Be aware when, there are changes, stay up to date with that kind of stuff.

you can take proactive steps to stop sharing the location when it all of a sudden opts you into something you didn't choose.

[00:20:46] Mikey Pruitt: I didn't realize, I didn't realize Instagram did that. I believe they did that early, everywhere. Did that early, I remember four Square a bunch of those I'm here apps.

It's what a terrible privacy

[00:20:57] Edna Jonsson: abuse. there was,

[00:20:59] Mikey Pruitt: Instagram used to do that. This is where the location was of this photo was, then they got rid of it. Now they brought it back.

[00:21:06] Edna Jonsson: there was a change that was rolled out they said that you would opt into it, a lot of people were finding that they had already been pre opted into it, the people were having to go back in turn that off.

[00:21:18] Mikey Pruitt: Interesting. What other kind of privacy gaps do you think still need attention?

[00:21:24] Edna Jonsson: There's, that's a good question. There's. Things everywhere. I'm trying to think what would be, I

[00:21:32] Mikey Pruitt: imagine when you go by a kiosk or something somewhere and it's enter to win, you never do this.

[00:21:39] Edna Jonsson: When you enter to win, a lot of times the these fine print to that is you're signing up for all of the marketing and then your information is getting sold to data brokers.

That's

[00:21:50] Mikey Pruitt: why you're getting all that junk mail.

[00:21:52] Edna Jonsson: That win a free cruise it, your chances of winning that free cruise is very low, but your chances of ending up on a hundred data broker websites is very high.

[00:22:03] Mikey Pruitt: If you want to go on a cruise, just pay for it.

[00:22:05] Edna Jonsson: Exactly. I would

[00:22:06] Mikey Pruitt: recommend a Disney cruise, especially if you have children.

They love it.

[00:22:09] Edna Jonsson: Disney does such a great job with, making a wonderful experience, definitely.

[00:22:14] Mikey Pruitt: Do have you, I know you live in Orlando. Have you ever been to the Mouse's Kingdom down there?

[00:22:18] Edna Jonsson: I've been to Disney.

[00:22:20] Mikey Pruitt: Are you a huge fan or just a,

[00:22:22] Edna Jonsson: I'm not a huge fan, but I do enjoy going every once in a while.

[00:22:27] Mikey Pruitt: Yeah.

[00:22:28] Edna Jonsson: Yeah.

[00:22:30] Mikey Pruitt: Yeah. I, I have, I got, I, what would you say Dodge, the bullet, going to Disneyland or Disney World? In, or in Orlando, because I took the Disney cruise, so now I have a three or four year weight on the actual land part of the Disney experience. Ah. So that was my strategy. Gotcha. So you mentioned, we're talking a little bit about threats on the radar.

So you, mentioned a few, but I'm curious, have you seen anything come across, that's AI related? I know you mentioned. That you created an AI kind of a voice to talk back and forth for fun, but have you seen things like that in the wild or do you expect to see things like that?

[00:23:15] Edna Jonsson: I have not encountered it in the wild yet.

I do know that is happening a lot. There's an increase of. Phone calls being made with, AI bots trying to convince you to do different things. I've heard that there's sales calls or they'll call and, say you owe them money for parking tickets or something.

I definitely think it's gonna increase. There's. There was a competition at, DEFCON, at the social engineering community where they did the bot versus bot competition. they did that competition for the first time this year because they're seeing that is an increase of activity in that arena and definitely something that they wanna bring awareness to for people too.

Know what that could be like.

[00:24:04] Mikey Pruitt: they were programming AI to, to communicate and I guess get some information from another ai,

Bot versus bot. How did,

[00:24:14] Edna Jonsson: the bot, the AI bot is making calls to, in the vision competition, two companies. So they're Oh, okay. the bots are competing against each other.

So

[00:24:27] Mikey Pruitt: I'm telling you this AI voice thing has legs for use cases. Other than malicious. I've got one more question about, career focused people. We're all in this space where there's a lot of burnout. I guess you could see

[00:24:43] Edna Jonsson: People getting

[00:24:43] Mikey Pruitt: a little overwhelmed, we're looking at screens all day, and I'm curious, how do you manage the mental resilience and then continuing to be enthusiastic you are, and continuing to learn.

finding that balance between, the work itself and then the exuberance for the career.

[00:25:05] Edna Jonsson: I've definitely felt burnout in my career and I think the key is to, find something else that brings you joy other than cybersecurity, have hobbies outside of. This career, don't make it your entire life.

I go take walks every so often. That helps me to get out of my head. it's a meditation too, being able to not be in front of a screen and, breakaway. I think taking vacation time is very important because being able to take a week or two and do something else,

it's very important, just I imagine

[00:25:45] Mikey Pruitt: Going to see the mouse doesn't hurt.

And a lot of the community events that you participate in, while related are not necessarily work. Exactly.

[00:25:55] Edna Jonsson: And they bring me a lot of joy, I enjoy going and seeing people and talking.

[00:26:00] Mikey Pruitt: finding your tribe and helping them and

and letting them help you.

[00:26:05] Edna Jonsson: Yes. Exactly.

[00:26:07] Mikey Pruitt: Alright, Edna, thank you much for joining me today. I really appreciate it.

[00:26:11] Edna Jonsson: Thank you. Thank you for having me. I'm glad to be here.

[00:26:13] Mikey Pruitt: And we're gonna talk about

that. We're gonna talk about the super secret idea later. Okay?

[00:26:16] Edna Jonsson: Oh, okay. Yes.

[00:26:18] Mikey Pruitt: All right.