Mapping the Cybercrime Ecosystem With Andrew Northern of Censys

Then I became a firewall jockey and was on call for about four years. So really cut my teeth on that, deployed about, I want to say, 88 firewalls at geographically distributed locations. So that it was a lot of fun writing all the policy, doing all that. And then I said, hey, I kind of want to become a, a red teamer. And so with all that knowledge that I had developed about defending organizations, I kind of could get into the mindset of an attacker. And I got really interested in web application penetration testing and did that for a while, did standard red team engagements and then maybe a victim of my own success there. The company that I was working for makes consumer electronics. They make fitness devices, aviation devices, marine devices, as well as things for automotive. And so they asked me to start becoming a physical penetration tester against those products before they would go to market. And so that's been cool.

Yeah, it was really cool. It was neat to be able to look at like, autopilot systems and to think about how I could abuse those in a manner that would be threatening to not only the brain of the company, but also like life and limb and all those emergency services and things. So I did that, did that for quite a while and had a great time doing it. But then I said, hey, I think it's time that I come back to the the good side, so to speak. And now that I was kind of thinking about how an attacker might function and what they might go through having done all those exercises.

I got into digital forensics and instant response and was a responder there. And because the program is still developing, I just kind of naturally fell into almost a cert role where I was ingesting Finnish intelligence and helping to write reports internally. And from there I moved on to proof Point and I was a researcher at proof point for four years where I was doing strictly E crime related tracking. So I would track like what I consider to be some of the apex predators of the E crime landscape, extremely large volume.

And now I'm at census and I'm doing something similar over there. I'm the principal there and I I'm still very interested in tracking the large scale of crime as well as some of the nation enabled actors as well. That's a pretty cool trajectory. Easy for me to say there from I can, having not looked at your resume, I can think of the company that you were describing that makes fitness devices and all those other devices. But going from a three person security team to a sixty person security team is kind of bananas. I mean, that's like if you're on a three person security team, even at like a fairly mature organization, you're still probably doing a lot of different things, right? By the time you get to 20 or 30 or definitely 60, you're like you're probably like very specialized in doing your, your one thing I would imagine.

Oh yeah, for sure. And I'm really grateful for that, that experience and for the people who believed in me and were able to take the time to mentor me and to show me, you know, the ropes and allow me to explore the discipline and learn what it was that I was truly interested in. And yeah, along with that, you know that experience get getting to learn to be an administrator for all the systems, deploy all those things, configure and but also like monitor and really gave me AI think a really well-rounded background when it comes to understanding security in general.

Well, you mentioned the firewall, firewall jockey deploying firewalls all over the place, which does not sound fun to me, especially in the current environment where edge security devices are like targets instead of being, you know, well, defensive system still. But like attackers are just looking at edge devices and firewalls is like, OK, I know that I've got at least one bug in this device. Let's let's go. You know that's that's not a simple job. Not at all.

And I'll tell you, I had a lot of sleepless nights, but when I was, you know, I think I'm, oh, did I make sure to enable or disable this particular port and protocol that I was using like during the configuration, things of that nature. So yeah, definitely a lot of really good experience, but a lot of difficult experience. Yeah, and I'd like the I'm sure that I read some of your reports when you were at proof point, whether I knew it or not, read a lot of their research over the years. It's it's always good stuff.

What was the difference between tracking, you know, those, those cybercrime groups and say, you know, the nation state AP TS that you know, everybody likes to you sort of paint as the apex predators now. Yeah. So that, that's a really interesting question. I think that we we kind of have to circle back to what that definition of APT is and talk about that a little bit to break that down. I like to use the term nation enabled when it comes to that particular branch, like the espionage and those particular goals, because what we're seeing anymore is that there's a lot of crossover between those E crime groups and those nation enabled groups.

And that's because you may have something that a nation that has a formalized military branch that is has like a cyber wing to it that is doing these operations and that is would be implicitly task folks. But then you also have the folks that are going to essentially be allowed to operate with immunity as long as they're aligned with the goals of the country. And so that that comes into like that protectivism and allowing the, as we've seen recently, it's really hard to get our hands on some of those ransomware operators that are in countries that aren't friendly with the United States for that extradition. So as far as the the difference goes, what I would see is that a lot of there are a lot of attacks of opportunity that happened when it with E crime, whereas the nation state or nation enabled actors, they are very much more targeted, so a lot less volume and in in many

cases the tradecraft is a lot quieter. So they're they're more patient, not as much of A smash and grab mentality. Yeah, that's a great point that I think for people who don't necessarily eat and breathe this everyday like you and I do, the those, a lot of those terms kind of get, you know, smushed together and there's a lot of overlap and people are like, OK, there's just bad people doing bad things. They might be affiliated with the government or their cybercrime groups.

And there's definitely some overlap there, especially, you know, say in Russia and I would say in North Korea as well. But that distinction between, you know, nation backed groups, you know, say a Gru wing that's doing offensive cyber operations or a ransomware group that's based in Russia that gets actively ignored by the government, you know, those are it's two different things. But you know, it's an important distinction. I think that was that was a good point. Yeah.

And something interesting about that is you start to see that crossover either intentionally or just because these techniques become popularized, that you'll see these particular technologies, techniques, attack chains, even the toolkits that are being used. You'll see crossover in between what could be asserted with high level of confidence to be nation state activity versus the E crime activity. It's almost like the the hand of capitalism, so to speak that like drives that innovation for those E crime threat actors, drives that development and development cycle very quickly.

And we're we start to see a lot of innovation there and then some of that will get adopted by the nation estate actors as well. Yeah, that's an excellent point too. I mean, when there's money to be made or stolen or whatever the case may be, people are going to innovate. They're going to find ways to go and get that with new tools, new tactics, whatever it is. And if those proved to be successful, other people are going to adopt them. I mean, just ransomware broadly went from like a very niche like consumer targeted problem like, you know, 678 years ago to like the biggest problem in the world for enterprises. Like almost overnight, you know, within about less than a year, you know, it just became this massive, massive problem. Once, once a bunch of different cybercrime groups and even some AB TS discovered like, oh hey, this is a great way to steal a bunch of money and maybe fund our military programs in some cases, you know?

Yeah, absolutely. And and the same like is true when it like comes between the different various different E crime groups. Like there was a group that I tracked really heavily called TA 569 is what their track does by proof point. But generally speaking, those are the folks that pioneered the fake updates. So those are going to be originally the fake Adobe updates. I'm kind of showing my age there now. And then we had the fake Chrome updates and Firefox and everything of that nature.

And that eventually evolved into what we now call like the fake captchas and the click fix attacks and all of those other techniques that have been popularized. But what I've seen along with that, and this is some of the reporting that I've written recently, is that we're seeing a diverse group of actors all copy those same techniques. And so it's even more difficult to distinguish between them simply based upon the tradecraft. Yeah, you see that a lot in the threat and tell reports and rightly so with people saying, listen, this activity is consistent with what we've seen from, you know, threat actor, whatever it happens to be. But it also overlaps with stuff we've seen from this other group that might be aligned with them.

But it's hard to tell because it's China and everybody's kind of mixed up and you know, it's you're seeing a lot less, I think like ultra confidence in, in like we know exactly who this is doing this one thing. It's more like it's a China, China Nexus actor that's using the same kind of tools that we've seen in these other campaigns. And so it's probably them, but I don't know, it might be somebody else too. You know, there's a lot of overlap everywhere. I like to think about the crime landscape specifically more like a pick up basketball because there's like a a lot of folks who have skills and they may, you know, they may not have gotten the result that they wanted with their previous team, so to speak.

And, you know, there's a lot of a lot of trading that goes on and that makes the attribution particularly difficult. That's absolutely true. One of the things that I'm always interested in when I, when I talk to people that have done the kind of work you've done is how much, and I've, I've asked this of, you know, people on the defender side, you know, that have been targeted by these groups, how much they really care about the attribution piece of it as a defender, Like how much do you necessarily care who's coming after you and why they're coming after you as opposed to how did they come after me? Like they were getting in through this bug or they use this identity based attack or you know, they hit our help desk provider and got in.

I'm sure it's a sliding scale depending on the organization, but what's your experience there? So I think that there's like a duality to that answer where if you're a really mature organization, you can start to think about doing that attribution to people or group that requires a capability of human intelligence or human, whereas most cybersecurity organization shops don't have those capabilities. They're not tracking individuals across the globe. And so it's more of the discipline of like SIGINT or signals intelligence, where we're have a collection plan and we've decided what it is that we're going to collect and we're going to distill that information and make judgments based off of that.

So I'm of the school where I like to do attribution based upon activity clusters more so like what's the old adage and information security? They say you want your servers to be like farm animals and not like pets, right? You know, because if, if you, if you give it a name, then it used to become biased and tied to it. So I like to. Just do it, yeah. Yeah, I'd like just like to give these clusters numbers so that way I can say I don't I don't create that intelligence that where every time that I come up against something that looks similar, I don't have to like hold it up and say, does this fit into this bucket or this bucket? And then when I have 100 buckets, I'm spending all day like just making sure that doesn't fit into that. Whereas I can have like a cyclical sense of going back after a while and say, hey, maybe this bucket is kind of like this bucket.

Even though I've just been kind of putting stuff out there. I can merge these clusters and now a narrative starts to emerge in to to get to your question here, I think that there is value in understanding who is coming after you because they have different motivations. For example, that and that'll inform your defensive posture on what type of exactly what your exposure is, what your attack surface is and also based upon their capabilities or published capabilities.

And then also what exactly it is that you need to guard yourself against, whether that's, you know, trying to keep your network from getting locked by protecting the domain administrator or your AWS cloud accounts or various different things. It's a much different ball game than just trying to stop the exfiltration of the trace amount of data for like espionage and things of that nature. So there is value to it there. But I do think that a lot of folks by folks, I mean, organizations get a little too caught up on it where they should be more to your point, focused on like, what are the techniques, what are the technologies? Can we detect it?

Can we respond to it? Can we stop it? Yeah, I mean, a lot of that does come back to, you know, just the basics of information security. Like if you're doing most of the things right, most of the time you'll be OK most of the time, you know, like stuff is going to get through. You know, there's exceptions to every rule. But if you're doing the basics pretty well, you're probably in good shape for the most part. You know, if you're patching when you can and when you should and paying attention to all the other sort of hygiene stuff, especially in the identity infrastructure, I think, you know, for the most part you'll be OK. But yeah, if you're if you're dealing with the apex predators, you know, they're playing a different game than you are, even if you are a mature, you know, team of defenders. Yeah, I think that like there's a lot of things that can be said about that.

Like what? What's the saying that you, you don't have to be faster than the bear, you have to be faster than the slowest person. But at the same time, you have to remember the human nature of the defenders. If that motivation is high enough, they will stick around. But the situation is that there are a lot less secure companies or organizations out there that a minimum level of effort and frustration may be enough to cause an attacker or an operator to move on to a different target.

Yeah. You mentioned at the beginning that you you were you would have the opportunity to have some mentors that sort of helped you along in your career. Tell me a little bit about that and how much of a difference that made in, you know, not just the success of your your career, but maybe the past paths that you took during the, during your career so far? Yeah, I, I definitely wouldn't be where I am today without the mentorship that I've received, both formal and just their friendships that I've made and and more importantly, people who just saw my drive and motivation and wanted to take a chance on me.

Again, being the third person on that brand new security team with very little experience other than drive in motivation, that was a big risk that they took. But fortunately, they were there to answer all the stupid questions for me every day. And I'll tell you, I still have them every day. A lot of stupid questions, but that's yeah, that's just one of those things like to, to have someone that's that's willing to give you the room to make mistakes, but also be there to help you to learn from them.

That's incredibly valuable as well. And I've just just had some really strong mentors in, in that regard, besides the the first gentleman who was the first manager I had there on that security and he was fantastic. But later on in my career, I had some really sage wisdom from a director who sat me down and said, Andrew, you really have to decide what it is that you want to specialize in. He's like you. You've got the skills and all these different areas.

But if you want to reach the level that you want to reach and go do the things that you want to do, you need to kind of decide which direction that you're going to need to go in. And so he said, you don't need to tell me now, but you just need to think about it a bit and come back to me. And he's like, I'll, I'll help you figure that out. Yeah, I think that's a really important conversation that good managers have with their employees. Or even if that's not your direct report, but somebody that, you know, works in your organization somewhere, especially in the security field where there are so many separate disciplines. You know, you you mentioned several different ones that you've worked in, you know, red team, blue team, firewall, you know, help desk, all of that.

Each one of those could be a career very easily, you know, and if you, if you have a good manager, a good mentor that sits you down and says, OK, I see your strengths as this, this could be a great path for you. But tell me what you want to do. What do you think your strengths are? What what what really motivates you? Like what gets you excited about coming and doing this work every day? That's going to go a long way towards you building, you know, healthy, strong career over time and not just sort of a short term.

Let's go make a bunch of money in cyber type career. Yeah, absolutely. And I think that having those people who are willing to not only, let's say like give you the the opportunity, but also give you the room to explore that, I think those are exceedingly rare as well. So I'm really grateful for that. And on the other hand, I think that being a mentor is also equally as important as finding the strong mentors once you get your legs under you.

Yeah, it very, very true in that one. I think one of the difficult parts in security especially is you need room to make mistakes, as in in any career. The problem in security is that mistakes can sometimes be, you know, very serious, you know, and they can be very public, depending on what kind of role you're in in security, you know, And if you make those mistakes too often, you're not going to be around very long. You know, you end up in the news, and then things go badly. Yeah, I, I think that like an important part of mentorship in that way is that if you are a mentoring someone and you do want to give them that latitude to make mistakes, you don't want to put them in a, a, a critical position where those mistakes would be catastrophic, right.

Yeah. Yeah. Maybe something like, hey, why don't you go and try to configure this in the lab by yourself first, you know? Yeah, before. We detonate the network with with this problem. Yeah, I've seen over the years that there's kind of a sometimes a, a, a friction or a push and pull in the that sort of mentor relationship where people, some people really enjoy passing on their skills and their knowledge and their sort of like, you know, that they've obtained over the years to a younger generation.

But some people guard that very jealously, especially I found in this community, for whatever reason. It's sort of like Arcane. I had to work really hard to to figure this stuff out. So you should have to work really hard to do it too. Have you run into it? Have you seen that in your own career? Absolutely. This is a kind of a funny story that I tell about what the opposite of being a good mentor is. I was when I was young in my career, there was someone that I was assigned to that was supposed to give me a hand with things when I was trying to figure things out. And he said to me one day, quote what Andrew, what is it that you don't know how to do?

Now? We'll say quote one day. And so all I could do was laugh at that. And I just said, I'm never going to be like that. And and I think that that also made me think, you know, like, was that a deeper, A deeper, like a philosophical question? What is it that I don't know how to do now? A lot, honestly. Yeah, exactly. What are you talking about? Yeah. And, and you know, along with that, I just wanted to add that like I got involved because probably because of that honestly, like having such a bad experience with that that person, I actually got involved with a really great program called Cyber Patriots. Are you familiar with it?

I've heard of them, yeah. Yeah, so the the United States Air Force has this program where they hold these competitions for middle school and high school kids where they compete to secure networks. And I was a mentor for probably a dozen or so teams over the course of five years. And I had some really great students starting in 6th grade, 7th grade, and then all the way through high school. And some of those kids I'm still in contact with occasionally who've gotten into the career, they actually work at a place that I used to work at. It was really cool to see that kind of coming up like that. That's very cool, yeah.

Yeah, so sorry to your point about people guarding all of their secrets, so to speak. I just, you know, if you, if you become the dragon and you're laying on your pile of gold, you know, it's kind of easy to lay there, right? Yeah. But but what I say to that is that if you, if you had a second version of yourself, if you were able to clone yourself and go to work with two of you, would there be enough stuff for both of you to do? The answer is like likely yes, that there are things that you'd rather do that you didn't have to do.

And I look at mentoring that way, not because I'm lazy and I don't want to do something, but rather that I'd rather be able to work on these other things or to have somebody to work with or to have a peer or even the opportunity to make sure I really know what I'm talking about because I have to explain it to somebody. And then the other piece of that is the benefit of young blood coming into this industry that might be enthusiastic about technologies that I just haven't had the energy to keep up on anymore.

And I learn stuff from them as well. Yeah. Yeah, no, that's a great way of putting it. I like that cloning analogy because I was going to say, I was thinking as you were talking, there's always going to be enough security problems for and not enough people to solve them. Like we've got more to more than enough work for everyone that wants to get into security. You know, we always hear about how many open cybersecurity roles there are. And yeah, those might be junior sock analyst roles or whatever the case may be, but there's plenty of bad things going on.

We need people trying to solve those problems. And, you know, we don't have too many security pros, that's for sure. Oh, that's, that's absolutely correct. And I'll tell you that the, the criminals are like weeds. There's no shortage of them. And then if you flip over to the other side of the coin, you know, we were talking about the nation state actors. You know, I, I, I would have to look this up again to make sure that these numbers are accurate. But I know that there are buildings in in China that have thousands of operators in them that are dedicated to carrying out these operations, these missions, which depending on if you're on this side, if you're the one receiving the receiving end of those missions, you would call those them attackers, right?

And there's always room for more defenders when it when it comes to that scale. Yeah. And the, the thing that you mentioned about, you know, things that you just haven't had the time or energy to keep up with, you know, new technology, you know, technology is constantly accelerating and new stuff is coming in all the time. We were talking about AI before we started recording. I can remember early, early in my career, there were folks that had come up in the, you know, early 80s and 90s that were, you know, absolute Wizards with Unix and then later Linux systems.

And then when Windows, you know, became popular, they were like, I don't have time for that shit. I got all this, you know, I'm not going to mess with that. I'm not going to learn that. And, you know, a few years later they're like, damn, I kind of wish I'd learned Windows. You know, it's just like, that's an extreme example, but those folks definitely existed. And there's always going to be somebody younger than you coming along, so you might as well help them. Like this is all a collective thing we're trying to do here. You know it's not a, it's not a 0 sum game. Like, if you're doing well, that doesn't mean someone else is doing poorly. Oh, absolutely.

And I, you know, to that point, I, I've been in that position myself many times before where it wasn't Windows, I refused to learn. But I, you know, I'm, I, I was just basically like, I, I know enough languages, I don't need to keep learning new languages to write the same scripts and over and over again or, and things like that. But that was unfortunately not the case that I I needed to continue to learn because reverse engineering malware, I'll tell you that it they keep they keep writing new and exotic malware in different languages. And you they sure do.

Yeah. Yeah. What the day that I discovered that the strings aren't terminated and Golang was a a terrible day for me. Yeah. As I said, there's always new stuff happening and you can't keep up with all of it. Like it's, it's literally not possible. I mean, yeah. So you mentioned earlier that you're you're working at Census now, where I worked for a few months that I absolutely loved it. It's a great team. What's your focus there now?

What's your specific thing that you're you're spending your time on? Yeah. So I'm, I'm tracking a lot of the web-based attacks. So, you know, since this is, has this map of the Internet, right, a high fidelity map of the Internet. And I was looking at it from a holistic approach that if you talk to people, just people in general who use the Internet, they're not necessarily thinking about like ports and protocols or these different ways that these machines talk to each other, but rather as citizens of the Internet, they're thinking about web pages and how they interact with the web.

And then I was thinking about how the threat actors are leveraging that. And I mentioned this before about the various different fake update pages and things of that nature. So I've really been digging deeply into the web-based threats. So the JavaScript injections, these social networking or there's a term that I recently wrote about that I coined called Living off the Web, which is the idea of exploiting all of these things that people are used to doing as just usual, people who use the Internet like we've been conditioned to click yes when we get on a website because we don't care what the cookie policy is. We, we care to see the content.

We, we aren't thrown off when we see a cloud flare CAPTCHA because we just want to see the content, right? We don't, we're willing to click through a cap show or follow instructions because we we just don't have time for all of these things. And these are the things that we've been conditioned to do. So rather than the concept of social engineering where we're abusing the trust of a particular brand to entice someone into doing something for fear of something bad happening or for fear of missing out on a reward. Two of the major motivations of social engineering. Instead what we have is this preconditioning of the Internet as regular people know it, and they threat actors using those same mechanisms to deliver malware. So that's where my focus has been as of late. Yeah, that's a that's a really good description of it. We are very much, you know, as web users condition to click yes, get this out of my face so

that I can read the story or watch the video or whatever it is. I don't have time to read whatever that says in the dialogue box. Just let let's get going. Like, you know, And yeah, attackers play off of that. Like anything else, any kind of conditioned human behavior, they'll find a way to exploit it. Yeah, I mean, I don't want to give any threat actors any ideas, but if, if there was, if there was a way to initiate an attack chain by skipping an advertisement on a video, I'm sure.

Oh yeah, listen, I would be the first victim, I promise you, because I like literally everything like skip intro, skip ad, like I just cannot wait to hit those buttons. Like I not that I have anything better to do, I just, I cannot sit there and watch an ad. Just drives me crazy. Yeah, for sure. Yeah. All right. Well, Andrew, thank you so much for your time, man, I really enjoyed this. It was great getting to know you. And I look forward to reading more of your work at Census. Yeah, thank you very much for your time. It was a pleasure being here. All right, man, take care.

Yeah. Thank you.