How secure is your application? Do you know the main vulnerabilities that most apps suffer from?
How would you even start to answer these questions? On this episode of Talk Python to Me,
Justin Seitz is here to tell us all about it. This is episode number 37, recorded December 2nd,
2015. Now, before I play the theme music, I have a little something special for you guys.
This week only, instead of developers, developers, developers, we have Secrets from the Future by
MC Frenolot. It's a great song about the futility of computer security over time. You can catch the
entire song at the end of this episode.
Welcome to Talk Python to Me, a weekly podcast on Python, the language, the libraries, the ecosystem,
and the personalities. This is your host, Michael Kennedy. Follow me on Twitter where I'm at,
mkennedy. Keep up with the show and listen to past episodes at talkpython.fm and follow the show on
Twitter via at Talk Python. This episode is brought to you by Hired and Codeship. Thank them for
supporting the show on Twitter via at Hired underscore HQ and at Codeship. Hey, everyone.
Thanks for listening today. Let me introduce Justin. Justin Seitz is a respected cybersecurity
expert who has trained and consulted with Fortune 500s, law enforcement agencies, and governments
around the world. He's the author of two Python books that were translated into seven languages.
He's helped teach tens of thousands of people how to write code to automate computer hacking and OSINT
tasks. In October 2014, he presented a unique method for tracking ISIS supporters on Twitter.
Justin, welcome to the show.
Thank you very much for having me.
Yeah, I'm pretty excited to talk about this whole world of computer security and breaking software and
understanding where vulnerabilities are in your software. So I'm just happy you're on the show to
talk about that.
That's great. Normally you have builders and now you have a breaker. So that's awesome.
Yeah, that's right. Normally we have the builders on here, but I think
it's super important to see that side of the story, right? Like if you build a website and you put it out
there, how do you know, you know, I kind of feel like it's safe. Is it safe? I don't know. Like you
should understand, you know, what the people who are trying to break into your systems are,
what, what, how would that even happen? Right. So that's, I think it's going to be really valuable
to builders in addition to everyone else.
Cool.
Cool. So we're going to talk a lot about that, but let's get started with where you got in a program in
Python. What's your story?
So how I got programming in Python was a good buddy of mine, Dave Falloon. I'll never forget
him peering over my shoulder when we worked together at a startup at one point. And I was doing everything
in PHP. And, you know, he kind of said, you know, dude, it's really lame that you're using PHP to do
all this stuff. You should really look into Python. So I did. And, you know, I'm one of those old dogs,
new tricks kind of guy. So I was like, oh man, you know, I'm not truth be told, not the strongest
developer. I had the pleasure of working in a couple of different companies with some really
top notch developers who just kind of blew my mind on a daily basis. And, you know, I knew that I was
never going to be like that. But I found with Python that I kind of went from zero to actually knowing
what I was doing awfully quick. And, and kind of around this time, as I was, you know, spending time
in kind of hacker forums and reverse engineering forums and stuff. You know, it was, it was kind
of strange, but Python seemed to almost become the de facto language for people to start using in the
hacking community. So between Dave kind of goading me into learning it and kind of the hacking community
beginning to adopt it as really, as, as the language we were all going to kind of standardize ourselves
on for the most part, that's really what kickstarted my journey into a Python coding.
I think that's the way a lot of people get started in Python is it's kind of the easy path to get
started, but unlike a lot of other easy paths, it doesn't seem to have a real strong upper pound,
right? Like you can build rich, high end systems, but you can also get started easy. And that's,
that's kind of unique to this whole ecosystem, right?
Yeah, I totally agree. I mean, I've seen some of the most, you know, the craziest systems built
completely in pure Python. And I've seen some of the most beautifully simple scripts that do amazing
stuff that are, you know, 10 lines long, which is great because I think 10 years ago, there's always
the, the argument of, you know, performance and compiled languages versus things like .NET when it was kind
of going through its renaissance period. And now I think we're to the point where we're kind of like,
you know, unless you're processing billions of transactions a second, which I bet you there are
Python installations out there that are doing that. We're okay. Everybody's kind of accepted that
there's many ways to skin these cats. And Python is just a great way to, to literally go from zero to
60 very, very quickly.
Yeah, definitely agree. So that's kind of how you got into Python. That's, that's really interesting. But
you took a sort of different path, right? You got into sort of analyzing systems and checking them for
vulnerabilities and offensive security and all that kind of stuff. That's a pretty different path than,
you know, I'm going to start building a websites in charge to build, you know, people's homepages or
whatever, right? Tell me the story there.
Yeah, yeah, sure. So I actually did spend a period of time being a web developer, again, hence why I
was into PHP. But, you know, the big thing for me was that I was at this startup that was
amazingly good, had a fantastic engineering team that kind of looked at talent and said,
you know, you are good at this particular job, do you want to do it? And for me, I got into quality
assurance and totally by accident. I was originally hired on there to, to fix printers, believe it or
not. But this was one of these really progressive kind of funky startups. And very quickly, I was leading
the QA team, which was very small. And soon, it turned out that I was really good at breaking
software. Now, I'd spent a number of years kind of in and out of, you know, kind of the hacking scene
and, you know, doing research on my own, but never really took it very seriously, never really took it
like something that it was, you know, that I wanted to do as a career. I didn't even know that it was
actually a career at the time. So as I got further and further along in this QA stuff, they realized that
we should actually get Justin spending all of his time breaking stuff. Because I seem to have this
kind of weird ability to find the bugs that nobody else would find. And to also, because I was into
reverse engineering, that I could assist the development staff in tracking down particularly
nasty bugs that they couldn't figure out other ways. So I basically, eventually became just a breaker.
So they brought in someone to run the overall QA team, and I was able to step aside and just simply
focus on that. And around this time, probably in 2006, 2007, I became more and more active
on reverse engineering forums and started sharing code and kind of networking with people. It was around
this time that I also decided, hey, I think I actually want to write a book, because I was writing some
tools in Python specifically for reverse engineering. And then immunity, where I spent seven years, sponsored a
competition, I believe in 2007, that was writing a plugin for what was called immunity debugger, which is a
debugger specifically designed to, for reverse engineering, primarily geared towards exploit development.
development. So I ended up writing a plugin for that, of course, in Python. And I won that competition. And shortly
thereafter, immunity hired me on in 2008. And from that point forward, I was doing all kinds of development
work. So their products were all written in Python. So I was working on penetration testing product there,
called Canvas, and also doing a lot of consulting and other work. And that's kind of what carried me down
that path. So I've been very fortunate that I've had a number of employers that kind of allowed me a bit
of free reign and allowed me to kind of chase the stuff that I found interesting. So I've been really
fortunate over the past 10 or 15 years to have that.
It's really great when you get to pursue what you're super interested in, right? It's almost like
you get paid to be on vacation or to do your hobby or something, right?
Yeah, absolutely. Absolutely.
Yeah, it's great. So you talked about your books. The first one you wrote was called
Grey Hat Python. Is that right?
That's correct. Yeah.
Yeah. So can you tell us kind of what topics you covered in there? And what's the story of that book?
So Grey Hat Python was definitely more heavily geared towards lower level reverse engineering and
exploit development and also looking at building tools to assist you in identifying vulnerabilities.
So in the security world, a lot of us employ a technique called fuzzing, which just basically
means generating random or semi-random inputs for a piece of software to process. So if you think of
a traditional server written in C that kind of takes packets in and dissects this proprietary protocol,
what we would do is we'd write fuzzers that would basically try to break how that protocol is parsed by that software
in the hopes that we would find vulnerabilities. So Grey Hat Python kind of takes you through
how to build some tools to assist on the back end, which means trapping bugs or using an automated kind of
debugging system to trap bugs, all the way up to building the fuzzers and building some of the other tools
to help you find bugs. So it was definitely more of a low level book, but it leveraged Python all the way
through to build tools to assist you.
Oh, that's really cool. So is that like looking for buffer overflows and SQL injection attacks and things like
that or other stuff as well?
Yeah, exactly. So I mean, 10 years ago, and still somewhat today, but things have changed a bit.
10 years ago, we were definitely looking for memory corruption bugs, which would be buffer overflows,
heap overflows, and you know, there's a myriad of other bugs. But you're right, we also,
most of us in the community that are writing tools, we're building stuff too, that's looking for SQL injection
bugs or looking for, you know, cross site scripting vulnerabilities. So much the same that we would be
focused on fuzzing software. We also built tools that would fuzz web applications as well.
I suspect a lot of the listeners know what buffer overflows are and what SQL injection
vulnerabilities are. But maybe, you know, there's probably a decent number of people who don't.
Could you maybe just talk about those two terms? Those are probably the two big,
super bad problems you can introduce into your code, right?
Sure, sure. So a buffer overflow is really where you're kind of shoving more data into a spot in
memory than it can handle. So if you think of a string in memory that is, you know, we can treat
it like a bucket. So this bucket can hold a maximum of 50 letters, or if you wanted to treat it like water,
it could be 50 liters of water. So typically, what you want to do when you're a programmer and you're using
a language like C, is that you want to ensure that you can never have even 51 liters of water or 51 letters
in that bucket. So what happens in a buffer overflow situation is that we are able to literally kind of
overflow the bucket. And depending on how we overflow that bucket, we can actually then control how your
program executes from there. So it's a very common vulnerability. But some of it is definitely starting
to go away because things like Visual Studio, the tool chains are starting to build in protections
in an attempt to deal with those programming flaws. And they're also trying to prevent you from using
functions like stir copy or mem copy in unsafe ways. So we're starting to get away from it. But that's
kind of the general feeling or general explanation of how a buffer overflow looks.
Now for a SQL injection vulnerability, we're not so much concerned with kind of shoveling too much data
in. But if you've ever written SQL code in like a PHP application, or even in Python,
and you concatenate strings together, for example, so you have your select statement, and you say,
where ID equals, then you have your quote, and you know, plus, and then some piece of input from the user.
Now, what we can do is we can substitute in a quote or single quote, or potentially other characters that
can actually allow us to control how that SQL statement is executed. So by injecting our own SQL,
that means that we could potentially extract data, you know, maybe you're only doing a select against
the products database. But when we send in our injection code, if we're successful in getting it in,
potentially, we could then begin mapping out all of the tables in the database, or we could begin
extracting data, not from the products table, but from the users table, where we could grab
usernames and passwords. Or in some cases, you can even begin executing commands directly on the
operating system straight from that little SQL injection vulnerability.
Yeah, and that might be like the text box for your password.
Yeah, exactly.
That's the command line to the remote box, right? It's less good when it's used that way, I think.
Yeah, that's right. And I think, you know, what it all boils down to is either just input
sanitization problems, right? So again, there's a lot of, you know, platforms are starting to get better,
and tool chains are getting better at forcing programmers to write code in a certain way.
And then on top of it, you know, there are a number of frameworks that are trying to make it so that
these kind of class of vulnerabilities are going to go the way of the dodo.
Yeah, that's really nice that the systems and the compilers are taking care of it, you know,
somewhat that helps, right? As well as the ORMs, right? So like SQLAlchemy,
or other high-level ORMs that don't accept string SQL, definitely help mitigate that some.
Have you Googled or have you seen the XKCD exploits of a mom, little Bobby tables?
Oh, yes.
For those of you who don't know what a SQL injection attack is, make sure you take the time to Google
for little Bobby tables and you'll get the XKCD exploits of a mom. I'll put it in the link of the
show notes, but I won't say any more. I'll let you check it out.
That's great. Yeah, it's a lot of books.
Did you really name your son that? Yes.
So I mentioned the two vulnerabilities that are like well-known to me because I, you know,
take account for them when I write web apps and stuff. But what else is out there that are sort
of on that scale that we should be aware of as developers to like just know that we should make
sure we don't do that? Well, again, I think the big thing is, you know, paying attention to every
place that input comes in from a user and assume that every user is extremely evil. So a lot of people,
you know, again, they're checking the SQL injection stuff. People treat it very seriously. So you,
along with a number of other developers, might be spending a lot of time taking a hard look at where
they interact with their database or using an ORM like SQLAlchemy. But there's a number of other
vulnerabilities like site scripting, which means that I'm able to pass in JavaScript to a piece of
input on your web application and have your web application kind of echo that JavaScript back out.
Now, this is not as sexy as a SQL injection because I can't directly attack your server. But what it does
allow me to do is potentially social engineer users of your system or even you as the administrator of
the system to click on a link that includes some JavaScript in that link. When you visit the link,
because you're not filtering the input properly, my JavaScript that I've included in the URL gets executed
in the context of your browser. So now effectively, I have the ability to make your browser do stuff
that you probably don't want me to do. You can pair this with other vulnerabilities as well. So that's,
you know, again, a common one is cross site scripting. Now, you know, again, these are all things that
if you Google for like the OWASP top 10, these are all things you're going to be looking for. But typically,
in my experience as someone who spent a lot of time hacking into systems,
a lot of our big wins where we were able to really compromise applications didn't necessarily involve
some of these classic attacks, it might be something as simple as not validating that a user account
should have access to a particular set of data. So if you and I both use the same system, and I'm user
ID one, and your user ID two, and there's a set of documents in this system, that you're assigned,
maybe the first 10 documents, and I'm assigned the last 10. What in a lot of cases, what we found was that, you know,
they're not properly checking and validating that I should only be allowed to access particular documents.
So now I'm able to access all of the sensitive information that you are,
in some cases, just by incrementing one number by walking through all of the various document IDs.
So is this an architectural flaw? Yes. Is it an input sanitization flaw, which are the most common or
previously most common? No. So it's a bit more nefarious, because you as a developer, as you're
paying attention to escaping all input and double checking your SQL queries and all that stuff,
some of these more architectural flaws are a little bit more subtle and a little bit more nefarious.
Yeah. So interesting. So for example, if I've got a relational database with a primary key that's
an integer and auto incrementing for all of my resources in my web app, and I have a user account,
it's very likely I can enumerate, you know, all of that type of data. So I might be slash users slash 271.
Well, it looks like I could just try a bunch of numbers between one and 10,000 and look for users and
see what I can see about them, right? Or documents or whatever, yeah?
Absolutely. And, you know, it sounds completely simple, but it's worked in a number of cases.
So, you know, this is where, again, you know, things like using GUIDs, so very big, long,
unique numbers that are randomized, are really helpful, because then it becomes very difficult for me,
the attacker to begin enumerating GUIDs, because they're tremendously big, right? It's not just a
simple integer. So when you're passing information around a web app, you know, in your user ID one,
you should really reference that user by GUID that's really big and unique, because it makes it
tough for an attacker to do some of those enumeration techniques.
Yeah, that's great advice.
This episode is brought to you by Hired. Hired is a two-sided, curated marketplace that connects the
world's knowledge workers to the best opportunities. Each offer you receive has salary and equity presented
right up front, and you can view the offers to accept or reject them before you even talk to
the company. Typically, candidates receive five or more offers in just the first week, and there are
no obligations, ever. Sounds pretty awesome, doesn't it? Well, did I mention there's a signing bonus?
Everyone who accepts a job from Hired gets a $2,000 signing bonus, and as Talk Python listeners,
it gets way sweeter. Use the link Hired.com slash Talk Python to me, and Hired will double the signing
bonus to $4,000. Opportunity's knocking. Visit Hired.com slash Talk Python to me and answer the call.
Okay, so what else was in the Grey Hat Python?
So that was basically, you know, we've kind of run the gamut for Grey Hat Python, and it was really
heavily focused on the reverse engineering and exploit writing stuff.
So that sounds like it's focused on kind of the application level.
That's right.
There's the whole sort of infrastructure, the way apps are put together, you know, the network,
those types of things that maybe you didn't talk about in that book, right?
That's right. Yeah. So I didn't talk a whole lot about that in that book, but that's where
I decided to write a second book, which was Black Hat Python, which is a more traditional penetration
test view of writing tools. So getting people to write tools that interact on the network. So just
fundamentally understanding how you write a client and server in Python is actually going to help you
understand how to write tools to do network attacks. So I teach people how to do that. And then I also
teach them how to use some more powerful libraries in Python, like Scatty, that allows you to execute
more complex attacks and allows you to do things like pet sniffing, allows you to, you know, kind of
analyze some of the data you capture in tools like Wireshark. I also spend time teaching people how to
write tools to attack web applications. So whether that's unique kind of brute forcers or using something
like Burp Suite, which is a popular web application hacking tool that a lot of people use. So I teach you
how to write plugins for Burp Suite. And then later on in the book, I start to move into more and more
offensive techniques. So I teach people actually how to write a Trojan or a virus that leverages GitHub
for command and control. So that means that this virus doesn't actually communicate to you. It
communicates only to GitHub, which in most corporate environments will bypass all the firewalls,
because most corporate environments allow people to go to GitHub.
Right. GitHub is fine. It's HTTP. It's outbound. How could that be wrong?
Exactly. Well, it's actually HTTPS, which is even better because then a lot of the
inline antivirus products are blind when it's an SSL connection. So they can't actually inspect any of
the traffic that's going by. So you have this HTTPS, this encrypted session to GitHub. And then
basically, you know, this Trojan is designed to retrieve its commands from GitHub. Also, it will do,
if the Trojan does not have a library, say like Win32, you can push that library to your GitHub repo,
and your Trojan will try to import it. And I actually hook into the import mechanism so that it reaches out
to GitHub for all of its imports that it can't resolve locally. So it'll retrieve them over the network and
import them that way. And then after it executes the task, like say, takes a screenshot of the target
system, it then actually re-uploads the results back to your GitHub repo. So techniques like that,
which I really wanted to show people that number one, writing these tools in Python is amazingly simple.
And when you sit back and realize you just wrote a Trojan that bypasses pretty much every firewall and
antivirus product out there in like 100 lines of Python or less, it's pretty neat. But also as a way to
help people understand from the network perspective, how simple it is for attackers to write tools like
this and how we need to get better at detecting them. So I start to get more offensive there. And
then kind of the tail end of the book is where I teach people, which, you know, is happening more and
more commonly where attackers are managing to get into host systems that host a number of virtual machines.
So I've seen people who are kind of paranoid, so they only will perform like their web browsing inside a
virtual machine, right? And so the last part of the book, I teach you how to use a forensics framework
called volatility. That's pure Python, how to use this forensics framework to actually analyze the RAM for a
running virtual machine and then inject code into it so that we can compromise the virtual machine,
which would allow us to then kind of climb inside it and see what the user is up to inside that machine.
So it covers a kind of a wide sweeping range from the network to web applications to Trojans and
kind of offensive forensics. But it's also a very short book. So I give you the code, I give you the
explanation and the why as to what we're doing. And there's really no fluff outside of that. It's really
about developing that Python muscle memory.
Yeah, so that has me a little scared to use my computer. But I think it was really interesting.
Some of the stuff that you did in that book, I think it's really neat. Like, for example, you talk about
if you understand how to use raw sockets in Python, that will take you a really long ways, right?
Yep, absolutely. Yeah. And again, I mean, that module by learning how to use raw sockets. And for example,
learning how to take something that comes off a raw socket and turn it into an actual IP structure,
like you would have done in C 20 years ago, you're learning a ton of great concepts, you're learning
about the network, you're learning about how to use C types to create structures in memory. And you're
learning about some of the more fundamental pieces of networking, which is how packets are
actually built from the ground up. And you're learning it in this really easy way, like it's
really accessible. It's not, it's not like C or C++, which I still don't understand why people write
code in it.
Yeah, it's definitely accessible, right? Like a lot of the code samples are like 20 lines of Python.
That's right. Yeah. And it's really, you know, again, I, I really want people to be able to write
it and then sit back and say, okay, what if I did this and just go out and start doing it? So give
them the, give them the fundamentals, give them the capability, but don't, you know, don't lead them
down the entire path. I really like people having a, I love it when people email me and say, yo, I took
the example in chapter three, and I did this with it. What do you think? That means that I, that I,
that people appreciate that style of writing.
Yeah. Yeah. That's really great. You talked a little bit about the malware type of stuff. You said
you had some experience actually taking Python to like understand some piece of malware. So like,
suppose I find some suspicious file on my program, on my computer, what, what can I do to understand
whether that's just some random binary or if it's a real problem?
So there's a, there's a number of tools and frameworks out there. And again, you know,
things like I mentioned previously, volatility is, is very quickly becoming one of the big tools that
forensic and malware people use to examine what is a piece of malware doing to your machine and what
artifacts is it leaving behind? And what is it modifying inside the memory of your machine? Which is
really critical. but there's a number of other things that you can do. For example, a lot of most,
you know, most modern malware is looking at how to defend itself against you. So it doesn't particularly
want anybody to reverse engineer it. because then it prevents, you know, if it can guard itself,
then it prevents people from, developing defenses against it. So, a number of years ago,
actually myself and a guy by the name of Neil, the hippie killer, built a, built a framework
called Muffy, which was designed, it was a Python framework that ran inside of immunity debugger.
And it was designed to actually, completely, remove the protections or a number of protections
that malware would have in place that would prevent you from analyzing it. So this is all an automated
and scriptable framework built on top of immunity debugger that, it would, for example,
a lot of malware wants to know, am I being debugged? So am I currently being run under debugger?
And so our framework would actually, reach into the malware and begin to undo those checks.
Um, and it had multiple ways of doing that. Another thing that malware will do, for example,
is that it will walk the list of running processes on the system, looking for antivirus products,
looking for, debugging products. and so what Muffy would do is again, it would go in there
and it'd basically, start removing things from the list or it could actually patch out
the malware's ability to check for those processes. So aside from, you know, some of those big ones,
and again, primarily I'm, I didn't spend most of my career being a, malware analyst and I do some now.
But the, the big thing to me was that, with all of these tools like debuggers and,
even things like Ida Pro having Python built in, it allows you to kind of, if you're, if you're seeing the same thing in malware sample after malware sample after malware sample,
instead of spending five hours undoing some protection every time you spend five hours,
once writing code to automatically do it for you. And then, you know, that's fixed for you kind of for,
for life. You can kind of deploy that code whenever you need it. And Python's wonderful for that.
So you build up like a set of libraries that perform these functions, you know, take down the debugger defenses,
take down the antivirus protection and just chain them together and go after it, uncloak it. So then you can understand it. Yeah.
Yeah, that's exactly it. And then there's, you know, there's other cases too, where you might be analyzing a piece of malware that implements some very simple,
like XOR encryption. and maybe it, you know, it's, it's got some special little routine that it does. so lots of times what we'll do is,
you know, we're always dealing in assembly code. So we'll look at the assembly and, and say, okay, they have this decryption function here.
that's got maybe 10 or 20 assembly instructions. It will actually convert that directly into Python.
and we can then begin, you know, executing any string or any piece of data that comes across the network.
we can begin actually processing it directly in Python rather than letting the malware have to run through the decryption routine itself.
It's been a long time since I've had some kind of virus or malware that I know of on my, on any of my machines.
But I, the last time I remember that I did have one, yeah, the way I found out was very bizarre. I had a, a firewall, like, oh my gosh,
what was it called? One of the original firewalls you could put on windows XP and it would have been like zone alarm.
Yes. Thank you. Zone alarm. And I rebooted my computer at work and it said,
notepad wants to act as a server on your network. I thought, oh, that can't be good.
I'm like, oh my God. And that looks weird. I go and run it and it looks like notepad, but you can bet it wasn't right.
That's awesome.
We went in and checked and a lot of our computers at this office were letting notepad run as a server.
That was not good.
So my question, my question was, you know, there were antivirus things we installed and they said,
oh, we removed the problem. If something like this happens, do you think it's ever safe to use your computer again?
Or does it just require like a format straight away?
I don't know. It's, you know, it's really tough to say, you know,
the amazing thing about the security community is that it always seems like every year we want to one up, ourselves.
So, you know, it used to be that, yeah, you get an infection, just remove it.
And then people are like, ah, no, you know, actually, they figured out how to persist, you know,
in the BIOS or whatever it is. you know, and then, and then it's like, okay, well, maybe let's,
let's format. And it's like, oh, well, format actually doesn't solve the whole BIOS problem.
Uh, okay. So maybe it's format and, and reflash the BIOS.
And then guys started infecting the hard drive controllers.
So they're actually on the chip that controls the hard drive. Well, how do you get rid of that?
Um, so it's one of those things that I think depending on the strain and when I say strain,
I mean, really what that means is that most antivirus products are looking at the hash of the file and
they're saying, Hey, this is bad. so if you get infected by a known kind of variant and,
and you have a good idea of, and in most cases you can just go read the report on what that particular,
you know, what that malware actually does. If there's never been evidence that that malware
actually downloads and installs a root kit or some other low level, tool, then I think,
yeah, a full kind of hard drive, format is going to do the trick for you. But in some cases,
that's not going to be enough. you know, it's, it's, it's, it's one of those things.
I don't remember the last time, I don't remember the last time I personally have been
infected with something, but, I'm on OSX and one of my good friends, Russell Nolan just
did a, a, a great presentation on OSX malware and how he kind of hunted it using, kind of big
data sets and Python, oddly enough, using pandas. and so some of the stuff that, some of the stuff
that Russ, and you can check that out at the, it was at a conference called countermeasure.
so you can check out his talk. The talks will be posted. it, you know, some of the stuff that,
that Russ was finding was, was pretty impressive, impressive stuff that, that they're writing for
OSX as well. Yeah. So what you're telling me is that even formatting the computer is not enough. I
need to smash it and buy a new one. Yeah, I would totally, totally smash it, throw it out in your
backyard, turn the hose on it and, you know, go, go buy a new one. Crazy. Make it as expensive as
possible for yourself. Cause then it'll totally make you like way more
vigilant in the future. The next time I'm definitely not opening that, that document
with the cat videos. Yeah, that was from me.
This episode is brought to you by CodeShip. CodeShip has launched organizations, create teams,
set permissions for specific team members, and improve collaboration in your continuous delivery
workflow. Maintain centralized control of your organization's projects and teams with CodeShip's
new organizations plan. And as Talk Python listeners, you can save 20% off any premium plan for the next
three months. Just use the code Talk Python, all caps, no spaces. Check them out at CodeShip.com and tell
them thanks for supporting the show on Twitter where they're at CodeShip.
So another thing that you're into is something that you said was called open source intelligence. And
I'm guessing this is not like GPL licensed intelligence.
No, that's right. So open source intelligence is kind of like, it's a general term for gathering
information from open sources. So non-classified sources, not involving, you know, spies on the ground
and not involving satellites in space. But what can we gather from sources like the news, social media,
even things like mobile applications? What kind of intelligence can we gather in general? So that's kind of
something that in the security community, you use it all the time, because when you're modeling
a particular target for a penetration test, you want to learn everything there is to know about that target.
And especially when it comes to social engineering and phishing attacks, being able to perform open source
intelligence, for example, if I wanted to attack you, I would want to figure out where's your Facebook page?
Where's your Twitter page? What do you have on LinkedIn? Can I find out information about your hobbies,
your kids, all this stuff? And basically, I'm going to model you as a target.
And I'm going to watch for things that seem to kind of emotionally register with you, so that when I write
you an email, or I send you a Twitter direct message, or, you know, I'm communicating with you in some way
that includes a link, meaning I want you to click on this link, that I'm communicating to you in a way that
you are going to definitely click on that link. So open source intelligence plays a huge,
a huge role in that, among other areas.
Sure. So make it feel familiar. And then you're much more likely to get that first step into the
whole social side of things, right?
Yeah, that's right. I mean, and that's the specific use case for OSINT for the security community. But
it's really used in a whole bunch of other ways. You know, if there's a riot in a city,
police forces are using OSINT to take a look at what's going on, what are they talking about? Are there
people gathering in a particular location? Same thing when we had the Paris attacks here a couple
of weeks ago? You know, a lot of it is open source information, you can go to bellingcat.com, for
example, and they have like a detailed analysis on, on one of the Paris attackers and the information
they found out about him only through open source means, for example. So it's kind of this amazing
hammer that you can hit many different nails with.
Interesting. And speaking of nails, you said you'd actually use this technique to find extremist
supporters.
On Twitter? Yes, that's right.
Yeah, yeah, on Twitter, right.
So last year I did a presentation at a conference where I used Python, because again, I can't really
program in much else, to be honest.
So I used Python to base.
Why would you want to?
Yeah, why would you want to, right? What I did was, I was looking at how to, how to identify
ISIS supporters on, on Twitter. And so this, this was kind of before, you know, I'd been
doing some of this stuff and some of this research on the side for a number of years, probably long
before it was kind of vogue. There's lots of people doing it now. But basically, I was, I was kind of,
the question I had was, well, how do I do this when I can't speak or read Arabic, right?
This is a big deal, because as you know, this is a terrorist group that has people from all walks
of life, speak all kinds of different languages. Text analysis has always kind of seemed like been,
you know, and sentiment analysis to go with it. Like, that's kind of the sexy thing people do
when they're analyzing Twitter networks. And for me, what I did instead was, I said, well, you know
what, actually, I think images are the way to go, because images don't require language, right?
So what I set out to do is use Python, along with OpenCV, which is a computer vision platform
with Python bindings. And I built a classifier that would detect that black flag of ISIS.
So it was quite common for people who supported ISIS or were actually part of the group to use that black
flag in their profile picture on Twitter, or to use it in imagery, like propaganda videos, for example.
Not uncommon when you have a video of, you know, some Syrian army tank blowing up that you see the black
flag in the top right-hand corner of the video. So this classifier's job was just to find that black flag.
So then on top of it, I wrote Python to interact with the Twitter API. So what this thing would do is
basically, I would just point it anywhere. And part of it as well was asking the question of, like,
the six degrees of Kevin Bacon. So I wanted to know how far away the nearest terrorist was in my social
network. So I literally just pointed this tool at my Twitter account. And it just basically ripped
through all of my friends and followers looking for the black flag. And then it went through all of
their friends and followers. And then as you can see, this kind of grows out exponentially until it
started finding, started finding that black flag in propaganda or in profile pictures.
And so actually, this worked really well for me, because in a very short period of time, I was able to
build up a database of two or 3000 extremist accounts.
Now, the trick was that this was actually semi-automatically, because if you've ever used
OpenCV before to do kind of image detection or this kind of logo detection stuff, if you're not a
computer vision expert, which I definitely am not, you're going to run into kind of this high rate
of false positives. So there were cases where it would pick up a black cat and say, hey, that's
a nice supporter.
It could have been an evil cat. You never know.
It could have totally been an evil cat. So what I did was I actually used Python to solve the
semi-automatic problem, too. So after it was done crawling everything, let's say it had, you know,
a few thousand images and there was, you know, maybe a few hundred that might be kind of garbage.
So what I wanted to do is to filter through them very quickly by hand.
So I used WX Python and I wrote a little game. And all this game did was I would pull in all of the
images from this directory where I stored them. And then I could hit space bar if it was an ISA
supporter and enter if it was not. So very quickly, I could cycle through all the images very quickly,
kind of playing Duck, Duck, Goose. And amazingly enough, you know, it sounds like a lot like where
you're like, oh, man, like you did that with thousands of images. And I'm like, yeah, but it took like 10 minutes
because you very quickly, you know, it becomes this very quick game that you play and it is very,
very fast to cycle through all of them. So I use Python to kind of help me deal with that. Now,
you know, any computer vision experts who are listening to this, they already have like their
head in their hands like, oh, man, I can't believe you did that. But it worked for me. It was fast.
And then, you know, kind of on top of that, the tail end of my presentation is really about how,
again, using Python to push all of this data into Elasticsearch. And then just, you know,
because it's the Elasticsearch bindings for Python are beautiful. It's like one line of code,
you can take a dictionary and shovel it into a database. You know, like that is, for those of
us who've been around the block long enough, that was one of the most eye-opening, amazing thing I'd
ever seen. Like, you import this thing and you do es.index and like literally you're done.
There's no schema design. There's nothing else you had to do. So I thought it was just
amazingly wonderful when I discovered Elasticsearch. And so it was actually a friend of mine,
Chris Gashler, who had said, you've got to check out Elasticsearch. It's totally easy to get data
into, not so easy to get data out of, which was totally true. But then I was able to do some
interesting stuff where I could look at, you know, the geotagging of tweets and I could see where there were
concentrations of supporters and I could begin to do analysis like, hey, what was the most popular
cell phone they used to tweet with, for example. So it was really, it was a great use of Python
and open source intelligence. And it was, you know, it was really well received.
Yeah. It sounds really, really interesting. I'm sure it was. What was the number,
your index, like your Kevin Bacon number?
It was really low.
I'm sure.
It was like, it was like three, I believe. Three or less than three. Now I actually, but that's,
it was kind of a biased sample because I follow a number of counterterrorism researchers and a number
of terrorists like to follow counterterrorism researchers so they know what they're saying,
right?
Of course, of course. It's a little self-selecting, but still, right?
It was, but it's actually, it was shocking because I did pick other accounts and it was very,
I didn't know what the answer was going to be, which is always the exciting thing about research
when you actually set out to, when you truly have no idea what the answer is going to be.
But it was very low. It was always like three or sub three anywhere I ran it. So that was kind of,
that was kind of interesting to me.
That is interesting. It doesn't really surprise me, but yeah, it doesn't make you feel warm and fuzzy
either, I suppose.
No, not really. No, it's true.
So you have a, a cool course on a sort of automating open source intelligence and kind of
taking people through a lot of the techniques that you were kind of employing there, right?
Yeah, yeah, I do. So, I run a course at automatingosync.com. I have a blog as well
where I'm teaching people how to use Python, and, and like just a hint of JavaScript when required,
I know, but, I'm teaching them how to, you know, automate the collection of tweets. How do we
find all the friends and followers for an account? And then how do we do, you know, Instagram and
YouTube and thinking about how people, journalists, law enforcement, data scientists are approaching
some of these data sets and then boiling that down into very kind of digestible kind of small,
uh, lessons that people can take, so that they can learn how to do some of this stuff.
Because again, whether you're a marketer or you're someone who's a counterterrorism analyst,
um, the same data can have very quite, you know, looking at it through different lenses, is
really, really fascinating. So that's kind of the whole, purpose of the course is to just teach
people how, how to do some of this stuff, how to use Python. And, and honestly, some of it is me
teaching them, you know, here's how you debug a Python script and here's, you know, don't be afraid
of coding, that this is really not that scary. And, and you can, you know, literally I've taken
people who've never written a line of code in their life and they're sending me screenshots of,
uh, of Cabana loaded up with, tweets in an elastic search instance. And they're like,
yo dude, check this out. Like I can, I can tell that you tweet way more on Wednesdays. And I'm like,
that's really creepy and awesome at the same time. But, you know, stuff like that, that,
that this is a, it's just, I have a real passion for open source intelligence stuff,
uh, and for Python. And so it was just natural for me that I'm like, you know what? I have like,
I don't know, hundreds of scripts that I've written. just like just one offers and stuff
I did to support research that I was doing that had nothing to do with my day job. And I'm like,
you know, I should start transferring some of this knowledge to other people because I think it would
be useful. So it is, it's totally amazing. I have people who are using it to, track criminals.
I have people who are using it to collect information on war crimes in Syria. I have students who are,
who are protecting some of the, working on protecting some of the largest, most well-known
household company names that we all use their products. you know, and they're, they're using
it to protect their infrastructure and, and find out if hackers are talking about them online. And,
uh, so it's really, it's an amazing field for sure.
Yeah, it's really cool. And that's a, like a asynchronous type course, right? So you sign up and
you can take it from anywhere online more or less, right?
Yeah, that's right. And it's just driven by videos and, and then written material and code samples.
And then you have a skill testers where I get you to go out and solve problems with Python.
Uh, then you have to submit them to me for grading. and then once a month I run, I run student
sessions where I hop online with, whatever students can make it. I hop online for an hour
and I field questions. And then I usually try to teach something that is not in the course. So,
uh, last month actually I taught people, how to connect Python to the Tor network so that
you can actually scrape, web pages inside of Tor, for example.
Oh yeah, that's really cool. Yeah. I'll be sure to put a link to your course in the show notes.
Awesome. Thank you.
Yeah, you bet. So we have time for a few more questions. Let's see. So
sure.
He must've, you know, over the years seen a lot of crazy stuff. What's the,
the most unusual or entertaining thing that you've kind of run across in this whole space?
Oh man, that's a, that is a very good question. So I think,
you know, I saw when I was doing some of this ISIS, research, I found a Twitter account,
uh, who actually showed up initially as an extremist. And then I found, he was actually,
uh, a satirist. but he would literally write some of the most like convincing kind of
tweets and, and he would take, for example, images that, that ISIS would use to kind of instill
fear and then he'd make them like hilarious. Right. And so I found this account and, and,
and as I'm reading through it, there's like these, you know, these jihadis who are
not very happy with him. They're like trying to get him kicked off of Twitter, but Twitter
won't really kick him off. And they're like, you know, threatening him and he's kind of responding
back with like pictures of goats and other stuff, you know? so I thought it was great. Like
I thought this is this, this person, number one's got guts and number two is like completely
counteracting, their message. I mean, nobody was really paying attention to his account,
which is unfortunate. I think if we had more people paying attention to that guy's account,
than we did paying attention to the ISIS guys, we'd be winning. but it was really
hilarious because, this guy was like a never ending source of entertainment for me that
I could go back and check on him. Yeah. It seems like a really nice brush of fresh air with all
that sort of, you know, negativity out there to just turn it around and like, here, let me put
a cat picture on top of your tank or something. Yeah, exactly. Exactly. It was pretty funny.
Yeah. How funny. One thing I wanted to ask you about, because as a programmer, I have one view of
the world and I, you know, run a lot of non-programmers. So I see their view, but from a
computer security type person, you may have a different perspective and that's sort of like
computer hacking in sort of cybersecurity in the popular media.
Right. Yeah. You're already laughing.
Yeah. I'm just thinking of, you know, some quote, like I'm going to write a VB script that's going
to track down the IP address. What are you even saying? Right.
Well, I mean, that's the thing, right? Is I think that, you know, you look at the original
kind of hackers movie, you know, sneakers was probably more realistic than people give it
credit for more so than a lot of other stuff. For the most part, like in popular media, it's,
it's pretty much 99% of it is garbage. And then within the last year we had the Mr. Robot series
come out, which was a complete game changer. And, you know, it's, they, they really fundamentally
get what it's about. And part of that is actually, they have a guy on their staff. His name is Michael
Pazell. He's a very popular guy in the open source intelligence world. And he's kind of the main
technical guy behind it. So he's the one who's driving a lot of the kind of technical and hacky
type stuff. And I can personally attest that, you know, Michael is a very smart guy. He knows what
he's talking about. And so this is the whole key to me is that having someone like that who is like,
you know what, we're not going to put a bunch of BS with like 3d cubes and, you know, whatever
people hacking on touch screens and like whatever virtual reality, because that's not how hackers
work, right? It's like mundane. And it's through the terminals, you know, for the most part. So I think
that finally that for me was I, I was like, Oh, finally, somebody is actually covering this properly.
But I can tell you that most hackers, you would not want to look over the shoulder while they work,
because it really is like, it is mind numbingly mundane stuff picking through 1000s of lines of
code looking for a bug. You can do that for two weeks before you hit that one place in the code that
you know, Oh, man, right there is exactly what I'm looking for. And then it gets exciting. But it can
totally be the most mundane work ever. And you know, that's just not good TV.
No, it's not. I think you're totally right about Mr. Robot. I love that series. I think I have just
the final episode to watch still. And I'll put the trailer in the show notes so people can check it out.
But you know, I started watching that I saw, you know, they're talking about tour VPNs, there's Linux,
there's the command line, they the previous show, I just had the PyCharm guys on there. There's like
segments of the show where they're working in PyCharm. Like this is a really good show. It's,
it's obviously fiction. And it's on the outer edge of, you know, believable fiction. But at the same
time, it's not based in like funky 3d cubes that like mean nothing, right? Yeah, exactly. Yeah,
yeah. Very cool. Very cool. One other quick question in this sort of non fictional space,
but kind of popular culture. There have been, it seems like increasingly many security breaches,
you know, Target, Home Depot, just, you know, one after another. Are things becoming less secure,
more secure? What are your what's your like general feeling when you're out on the internet? Fear or
generally? Okay.
I mean, I'm Yeah, I really don't. I'm not that I'm not full of fear. That's for sure. But I used to joke
when I when I'd have to do, like press interviews for like, okay, you know, it's December, actually,
this time of year, it'd be perfect, because they would they would call us up and say, what's your
predictions for 2016? Right? And I would say, whatever happened in 2015, it's going to just happen
again, maybe bigger, maybe smaller. So just copy out whatever I told you last year and just use it
again. And sadly, that's really where we're at, right? Like whether it's Target, whether it's Ashley
Madison, whatever it is, securing your data is an incredibly difficult thing to do. And so for me,
I was always breaking stuff, not necessarily fixing or defending stuff. And the defenders have an
incredibly difficult job. So for me, I don't think things are getting better or worse. I think
there are parts of the underlying security infrastructure that are getting better. I think
there are parts of the philosophy of security that are getting worse. Bring your own device,
for example, BYOD is one of the perfect examples of the worst idea ever, never, ever let anybody do it.
But people are still doing it. Oh, you want to bring your laptop from from home in and connect it to
the corporate network? You know, what's the worst that could happen? So to me, it's like there's these
opposing forces at times where we're getting better on the technology front,
I think. But the philosophy front, I think we have a ways to go. But again, it's it's very tough. I mean,
the the there's going to be no shortages of breaches and and database dumps in 2016, like we saw in 2015.
I don't think that's going to change.
Yeah, that's a really, really great answer. Thanks.
I have two questions before you before you get out of here. And the first one is if you're going to write some Python code, what editor do you open up?
Hands down,
I have been using it for I don't even know how many years, a long time.
All of my students, when you sign up for one of my courses, you get wing IDE pro as part of the course. I standardize all of my videos on it. Everything I do is in wing. And anytime someone asks me, you know, what should I use? 100% wing. The big thing for me is that the debugging capabilities are just out of this world. Love it.
They have a great team there. They have an accessible support staff. I don't even remember actually last time I had to file a ticket with them. So I yeah, hands down, it's weighing that being said, I know you had the PyCharm guys on here. People speak very highly of PyCharm. But for me, the inertia to try a different IDE when I need to be really productive every day. It's just too much for me to to have to even try to give it a fair shake. But I hear lots of good stuff about it.
I've used wing a little bit, not a lot, but I'm, I'm definitely a fan of the IDE side of the story. So yeah, I'd like to hear that. Cool. Final question. What's your favorite PI PI package or library out there?
Oh, man. Okay. I mean, requests is probably the one I use the most, which is just awesome. But the other day, I found a library called date util. And maybe the entire internet knows about date util already. But date util allows you to just like feed it.
Any kind of date string, like in any format. And it basically gives you back a date time object, which is amazing. You don't have to use format strings. You don't have to use any crazy, you know, conversions or string splitting to clean it up. It just does it.
That's awesome. Yeah, I hate working with dates, like in pretty much any language. It's always seems to be painful. And so that sounds really cool. I'm gonna check it out. Date util. Okay, date util. Get it. It's awesome.
All right. I'm definitely gonna check it out. Justin, this has been a fascinating look inside of a world that most of us don't really look at that often. So thank you for sharing the story.
Hey, thank you very much for having me on. This is this has been great.
Yep, you bet. And I'll make sure all the cool stuff we talked about in the show notes. So talk to you later. Thanks again.
Fantastic. Thanks, Michael.
This has been another episode of Talk Python to Me. Today's guest was Justin Seitz. And this episode has been sponsored by Hired and CodeShip. Thank you guys for supporting the show.
Hired wants to help you find your next big thing. Visit Hired.com slash Talk Python to me to get five or more offers with salary and equity presented right up front and a special listener signing bonus of $4,000.
CodeShip wants you to always keep shipping. Check them out at CodeShip.com and thank them on Twitter via at CodeShip.
Don't forget the discount code for listeners. It's easy. Talk Python. All caps. No spaces.
You can find the links from today's show at talkpython.fm/episodes slash show slash 37.
And be sure to subscribe to the show. Open your favorite podcatcher and search for Python. We should be right at the top.
You can also find the iTunes and direct RSS feeds in the footer of the website.
This week's theme music was Secrets from the Future by MC Frontalot.
He has at least four excellent albums in this genre that he created called Nerdcore.
Check him out at Frontalot.com.
His song Zero Day is also a perfect match for this episode.
So, thanks for listening.
Here's the full song, Secrets from the Future.
Enjoy and I'll see you next time.
See you next time.
Get your most closely kept personal thought.
Put it in the word block with a password lock.
Stock it deep in the raw with extraction precluded by the ludicrous length and the strength of a reputed live.
Dictionary attack.
Proof string of characters.
This imperative to what?
All that is leverages of privacy.
The NSA and homeliness.
You better PGP the raw because so far they ain't impressed.
You better take the PGP and print the hex of it out.
Scan that into a tiff.
Then if you secret doubt for your data, scramble up the order of the pixels.
We're the one time pad that describes the fun time had.
But the thick soul boot wearing stomper who dance to produce random clap trap.
All the intervals in between which set in tandem with the stomps themselves.
Be got a seed of math unguessable.
Ain't no complaint about the cipher that's redressable.
Best of all your secret.
Nothing extant could extract it.
By 2025 a children speak and spell could crack it.
You can't hide secrets from the future with math.
You can try but I bet that in the future they laugh at the half-fast schemes and algorithms amassed.
Doing voice cryptographs in the past.
You can't hide secrets from the future with math.
You can try but I bet that in the future they laugh at the half-fast schemes and algorithms amassed.
To enforce cryptographs in the past.
And future people do not give a damn about your shopping.
Your visa number SSL to cherry popping hot grandpa action.
Websites that you visit or pass were protected partitions.
No matter how illicit and this it would seem is your saving grace.
Like amazing haste of people to forget your name, your face.
Lit in this list of indefensible indiscretions.
In fact the only way that you could pray to make impression on the era ahead.
Is if instead of being notable you make the data describing you undecodable.
The script kid is sifting in that relic.
Called the internet seeking latches on treasure chests.
If they could reckon seconds would it.
And yet get a chance to queue up for disassembly.
To discover and crack the cover like a crumbrelate.
They'll glance you over I guess.
And then for a bare moment you persist.
You exist.
Almost seem like you're there don't it?
But you're not.
You're here.
Your name will fade as front's will.
That's in the future.
They don't know our crypt to bury it.
And still.
You can't hide secrets from the future.
With math.
You can try.
But I bet that in the future they laugh.
At the half fast schemes.
And algorithms amassed.
You'll enforce cryptographs in the past.
You can't hide secrets from the future.
With math.
You can try.
But I bet that in the future they laugh.
With the half fast schemes.
And now the rhythms amassed.
To enforce cryptographs in the past.
Now it's an enigma machine.
A code yelled out at hot bongs.
Into a tin can with a thin string.
And that ain't all you do.
To broadcast clear text of your intention.
Send an email to the government.
Pledging your abstention from vote fraud.
This time.
Next time.
You ain't promised.
You don't get a visit from the department of piranets.
Be honest.
You ain't hacking those.
It'd be too easy.
Setting up the next president.
Pretending that you were through freezing.
When you're nothing but warming up.
To do list in your diary.
Better keep for a long time.
In the long time.
Better be tiring.
Into the distribution of electrical brains.
That's a guessing every unsalted hash that ever came.
They got alien technology.
To make the rainbow tables.
With an in an afternoon.
A glance and have them secrets.
Don't resist the loving codes.
Of the mathematical calculation.
Heart of your mystery.
Sent free fall into palpitation.
Pump your tunnel rise up in the dump.
A free agent.
Nobody knows the future.
Now go find out.
Be patient.
You can't hide secrets from the future.
With a favorite tribe.
And I bet that in the future.
They don't have bad schemes.
And I won't be honest.
You can't hide secrets from the future.