Episode 62 - Dittus Cyber - Cyber Warfare Weapons Developer

[00:00:00] How's it going everyone? So before we dive into the episode, I really want to say thank you to everyone that is listening in, that's tuning in, that's enjoying this content and getting value from it. I really love that. That's why I do it. But there's a huge amount of you that are listening, that are not subscribed, not following the podcast. And I really want to encourage you to please follow and subscribe the podcast on whatever platform you are listening or viewing this on.

[00:00:31] It really helps out the podcast. It helps out the algorithm. It helps more people hear this content that you already find helpful and that they hopefully will as well. So if you go ahead and subscribe or follow the podcast on any platform that you're listening on, and please share it with your friends, that'll be great. Alright, thanks everyone. Let's get into the episode.

[00:00:53] How's it go man? It's been a while since, since we first talked and tried to get this whole thing scheduled out. It's been a terrible couple months for me like getting COVID closing on this house. It's just a pain. Are you in the new house now? No, I wish. I close on Monday. So everything's like all at once and they're like, we need this in 24 hours or we can't close. Such a mess.

[00:01:23] The market's crazy right now. Yeah, thankfully I locked everything in back in March. So I got a pretty decent rate and the house isn't like crazy price or anything. So. Awesome. Awesome. We'll say it's lucky when I, uh, when I bought my house, I bought it like just prior to COVID or right when COVID was happening. So it was like early 2020. I got really lucky.

[00:01:49] Yeah. I got a friend that actually, uh, got a house and closed and everything. I think like the first week of February in 2020, like right before COVID, right before everything, you know, got all crazy. So he was able to like actually furnish his house within a reasonable amount of time.

[00:02:09] Um, but yeah, you know, um, I, I, uh, I really wanted to hear about, you know, like how you got into it. Um, just talk to me about, uh, about that journey and take me up to where you are now. Yeah. So, I mean, I, uh, I joined the military. Uh, initially I had tried to go infantry in the Marines. Uh, I got denied due to a failed physical at MEPS and I was just not going to join the military at that.

[00:02:39] Cause you know, I was really gung ho at the time. And, um, my Marine recruiter sent my packet over to the army and I had just got online, looked at, you know, the different available jobs. Um, there was the cyber operations specialists for, uh, there was like a $26,000 sign on bonus. It sounded interesting. Yeah. So the bonus was like kind of grabbed my attention, but like reading into it.

[00:03:08] Yeah. You know, I was, I was on my computer a lot, not necessarily doing anything productive, mainly just playing games and wasting time. Um, but I had figured, you know, if I'm not going to be able to do what I want to do, then, you know, I actually could have done it in the army. Um, the reason I got denied was a shoulder blade thing. Um, I couldn't carry a rucksack cause my shoulder blade is too precision, too protrusive.

[00:03:35] Apparently. Um, didn't make sense because they sent me to the army and the army carries rucksacks. So it was just a bunch of dumb stuff. Anyways. Um, since I felt like I, you know, I wasn't going to go do that in the Marines specifically, I was going to just do something that was good for my career.

[00:03:54] Good for, you know, my future. And it was really just that, I mean, I, I didn't have any background. I didn't have any, you know, advantage, you know, advantages. I didn't have any like college. I had gone to college for like a semester for psychology. Like there was, there was really nothing going for me. Um, I just saw it and I jumped into it. They had really good training and yeah.

[00:04:14] Yeah. That's really interesting. So yeah. Like, you know, I, I, I, I've talked with a lot of military people or veterans, you know, and they go into the military, they have a fantastic, you know, job that they find interesting and that they love and everything.

[00:04:31] But as soon as soon as they get out, they realize like, Oh wait, I, I, I'm not going to be working on fighter jets. Like in a civilian world, I'm not going to be working on weapon systems in the civilian world. And if I am, it's like one out of a hundred thousand jobs. And there's a bunch of people like me applying. Um, I have a friend actually that worked on like the weapon system of the fighter jet, um, of one of the jets.

[00:05:01] Um, and he was like, yeah, I got out and I was like, yeah, I'm going to get a job. And I'm like, wait a minute, what the fuck kind of job am I going to get? And he like went through this whole, you know, dilemma and everything, but it's a very common thing. So it's really interesting. Um, you know, that you had that foresight to be like, well, I'm not going to be in the military forever. Let's get some skills that can actually be translatable to the real world post post military life.

[00:05:31] Yeah. I'm really thankful. Yeah. I'm really thankful. It didn't go through. Um, one, my quality of life is bar none terms of military standards. I'm in the army and you know, you could say that the air force would be better. Um, but like realistically, I, I, I'm barely in the military, man. I, I show up in, you know, uniform and that's, you know, I do PT.

[00:05:58] I have height and weight standards. That's basically like, other than that, I'm working right next to civilians doing a civilian job. Um, just in uniform getting paid a third of what everyone else is getting paid. Oh, wow. Yeah.

[00:06:14] Well, that's actually, uh, that probably puts you in an interesting situation then, because then you're creating a lot of contacts, you know, in the, like outside of the military that may be able to benefit you later on down the line. You know, I, I always stress like on this podcast that, you know, your network is probably more important than the experience that you're getting even.

[00:06:38] Because if you can build up a strong network, um, of people around you, like they'll just put you into positions that could potentially be a stretch for you. You know, it could be a little bit difficult for you to get without that connection. Um, but the network will just make it happen. So, so can we talk a little bit about like what in the world is a cyber operations specialist in the army?

[00:07:08] I didn't even know the army like had a, like more of a cybersecurity program. Honestly, I knew the Navy did. I think I heard of the air force having one. Yeah. Um, so everybody actually at all five branches have cyber operations. Um, a lot of it is, you know, a lot of us are working together to accomplish what we're doing. A lot of the branches work together to do, you know, what needs to be done in terms of in the cyber domain. Um, I can give you kind of like,

[00:07:38] I can give you like the army's definition of a cyber operation specialist and I can give you like a vague, uh, what I do. So the army says, uh, cyber operations specialists, you'll use your cybersecurity skills to defend the army's crucial and complex weapon systems, which includes satellites, navigation, aviation systems against foreign and domestic cyber threats. You know, that's basically, you know, very, very broad. Um, but there's, there's like a bunch of different job roles we can go into. Right.

[00:08:08] So there, we have analysts, we have, uh, developers, we have, you know, the, the operators, the, you know, the hacker man. Um, but we all work together to get the job done. Um, and a lot of it is, you know, it's just a bunch of people, a bunch of MOSs, uh, working together just to cause effects in the cyber domain, whether it's, you know, offensive or defensive, um, protecting or attacking, you know?

[00:08:38] So, okay. So does basically like you, you, you brought up, you know, there's kind of like different specialties, right? Like developers, analysts, uh, hackers and whatnot. So does everyone kind of fall under the same title of like cyber cyber operations specialist? And then once you're in and you go through the training, they determine your skills and whatnot. You kind of choose what path you want to go down.

[00:09:05] That's exactly right. You know, we're all, we're all three of those job roles are, uh, 17 Charlies, um, which is what a cyber operations specialist MOS tag is. Um, we all go through the same initial training. It's a year long. And, uh, once we get to our units, uh, they kind of, you know, they gauge our interests, you know, what do you, what do you want to do? They ask us. And we, you know, some people are perfectly fine just being an analyst.

[00:09:32] Some people, you know, they, they have higher ambitions and they voice those ambitions and usually are met with aptitude tests. And then if you score high enough on an aptitude test, you get like technical interviews, stuff like that. You do what you do the ball on that. Then you go into, you know, a qualification course, which is like anywhere from, you know, 10 months to a year.

[00:09:57] Um, or actually it could be, it could be less depending on the job role, but, um, for most the higher skills, uh, job roles are like 10 months to a year. And, you know, you pass that, then you get to your unit and you have to do more qualification training with your unit.

[00:10:17] Um, and then once you get done with that, you're officially, you know, whatever job role you were trying to do and you're taking part in the missions and getting that little extra stipend at the end of your paychecks and stuff like that. Wow. That's, um, man, that's a shit ton of training. It's an absolute, yes. It's in the worst part about all of the training, like training schools in the military is it's like a pass or you're kind of just screwed.

[00:10:46] Like, because usually you, you're just kind of needs of the military if you fail. So it's like for 17 charlies that, that, that little threat of needs of the military thing isn't as bad as for most other MOSs because needs of the military could just be literally anything. But for 17 charlie, it's a little less, um, there's less options for you.

[00:11:14] So it's not always terrible, but you never know where you're going to go. If you fail, that's the thing. It's like, so yeah, it's a lot of training. It's really hot, really fast paced and really high stakes. That's, uh, I guess that makes a lot of sense then because like my, one of my current coworkers, he just got out of the Navy and he was more on like the cyber operations side of it.

[00:11:41] And, uh, he's like, he's at such like a different level than everyone else. I mean, this guy's over there, like building his own custom SIM to handle all of the logs in our environment. And we're like, dude, what the hell? Like one, you're showing all of us up.

[00:12:03] And two, like you're, you're building, I mean, he was talking about building his own EDR and spinning up like basically his own security stack if they needed them to. And the CISO had to talk him out of it. Like, Hey, we, we actually have a budget. You know, we don't need to build everything under the sun. Right. It's crazy, man. Some of these guys are just miles above us.

[00:12:28] And you think like the, the, the field in general is just super technical people, but like, there's just people, there's just mile, there's people just miles above everyone else. And it's those, it's the people that just go home and just love doing it. You know what I mean? Yeah. It's, it's wild. You know, like I've been in the field for almost 10 years and every once in a while I'll come across someone. And that's just like, like makes me feel like I'm day one, year one, you know?

[00:12:58] And it's just like, what the hell have I been doing? Like I took a wrong turn somewhere, or maybe I'm just like literally too dumb because this guy's like, you know, training an AI model to inform his EDR. I'm like, dude, what the hell did you have to do in the military to have these skills to even think through this problem? Yeah. Yeah.

[00:13:21] And, you know, but that's the thing with like, you know, the, the cyber work roles, like the, that, that the cybersecurity field, IT in general is like, there is so much information that you're always going to have this sense of imposter syndrome. Yeah.

[00:14:14] And I think it's important for people to know that you'll never learn at all and you'll never, no one will. So just get good at one thing and you'll be that guy. You, you, if you're good at one thing, people will be like, wow, this guy's making me feel dumb because you're more read up on that specific thing than everyone else is. Right. So just get good at something. And, you know. Yeah. Yeah.

[00:14:39] That's what I tell people, you know, like when I'm mentoring people trying to get into cybersecurity, um, that have no IT experience. The first thing that I tell them is like, go get help desk experience, you know, just get an IT job just to get that experience under your belt. Learn those skills at that level. Because, you know, when you're in security, it's, it's typically pretty high stakes. You know, if you make a mistake, it could be very catastrophic for the environment.

[00:15:07] When you're on help desk, like you can make mistakes all day long. It doesn't matter. You know, like it, it matters to an extent, but like, you're not opening up a firewall that's to the external internet, you know, while you're being attacked. Right. Like, right. You need to have those skills to be able to identify what, what exactly you need to do and how to do it and all that sort of stuff.

[00:15:33] So, you know, can we, can we talk about like maybe, you know, what you do as a cyber operations specialist? So you said that there's a lot of different paths that you can go down. Can you talk about what path you went down? Potentially like what, what you even do, maybe what your day to day looks like. Yeah. I can give you like a basic, you know. Yeah. Sure. Walk through. When I got to my unit, I was an analyst.

[00:16:01] As an analyst, you know, I was on a quote unquote red team. So I was analyzing vulnerabilities. I was, you know, looking, I was given a device that this is, you know, a bad guy's device. And it's my job to just go through, you know, his services, his software versions, operating system. You know, the list goes on looking for exploitable software, exploitable versions, you know, stuff like that.

[00:16:31] And, uh, gathering that information, you know, uh, going over his network track it traffic saying, okay, here's, you know, a device I found, or here's a vulnerability I found. And here's why this device is important because it's, you know, connected to all these things and stuff like that. Like that was, that's basically what an analyst does on red team in the military. Um, then I was doing system administration stuff.

[00:16:59] Um, that was kind of a detail. It wasn't like a specialized job role. It was like, uh, we need someone to do this job. And a general just randomly pick some lower enlisted guy. And it happened to be me, but it was really cool. I got to sit on the op floor and see, you know, what everyone was doing. So I thought that was really cool. Um, I recently, you know, the route that I opted into was a developer. Um, I, I just got accepted.

[00:17:26] I passed the aptitude test last year, but miraculously I got removed from the OML and someone else got my spot just randomly. So I tried again this year, passed the aptitude test again, got a spot. And that's what I've been doing since February. Basically it's absolutely the hardest thing I've ever done in my life. And it's nonstop all day, every day. Like I get, we have a test once a week. Um, and it's from Thursday afternoon, like Thursday noon.

[00:17:56] And it's turned in on Saturday noon and it takes all 48 of those hours. I mean, I'm wow. Yeah. It's there's just this last week we got two extensions. So it got extended. The turn and got extended to Saturday on 1600 and then midnight on, on Saturday. And I used all of those hours too.

[00:18:17] So it was just like to, to say that I use all 48 of those hours is an understatement because I could use way more if they give it to us. So, um, it's, yeah, it's absolutely insane. Um, but it's really, it's really interesting. It's really cool. We're learning. It's really cool. The, the way the army trains people. Like, like I said, I, when I joined the military, I knew nothing about the backend of a computer. I knew how to play games and I knew how to watch YouTube.

[00:18:47] That was, and I did it a lot, but that was basically the extent of my, uh, computer knowledge. And they take, you know, Joe Schmoes off the street. Granted, you have to pass, you know, you have to score high on the, on the ads. You have to show some sort of aptitude, but they take people who don't know anything and they turn them into, you know, hackers. They turn them into people who can be analysts and people who can read network traffic and stuff like that. And then they do it in a short period of time.

[00:19:14] Uh, you know, to be able to work, you know, for the intelligence community and in those job fields with only a year of training is like, it sounds impossible. And it, when you're doing it, it feels impossible. Um, but yeah, so I was an analyst. I'm working on becoming a developer. I messed around with administration. Um, I had initially wanted to be an operator when I got there because that had that, you know, highest curb appeal.

[00:19:43] A hacker, hacker man type stuff. I wanted to go around and tell my friends I was a hacker. So I, you know, I sat down on the op floor. That was one of the things they did when you showed interest is they had you sit down on the op floor and, you know, shadow an operator and see what they do. And as cool as it is that the things that they're doing, doing, it is incredibly boring.

[00:20:06] It's not like what the movies portray as a hacker with 10 screens and everyone's yelling and you're reading green binary and stuff. You know what I mean? It's like, you, you have, especially in the U S military, we have so many standards and procedures, so many protocols, so many laws and regulations that, you know, there's so many gray areas that we have to get permission to do things.

[00:20:31] And it's a lot of just sitting around, you got an IP address, you know, there's a vulnerability and you're just, you're writing up a design plan for the next few days. And then you're getting, you're given a tool and you enter in an IP address and then you press enter and you, and you just monitor the tool and stuff like that. Like it's cool because like you are the one getting access to the, to the networks and, you know, ultimately you are the one breaking the things.

[00:21:00] But it's a lot of monotony. It's a lot of dry. And so it kind of pushed me away from that. That's, uh, that's really interesting because. Like I, so I, I, I've done a little bit of work, you know, with different federal agencies.

[00:21:20] So I'm, I'm used to the monotony of being like in your silo and it's like, yeah, I hit enter on this command. Here's the log. Someone else goes and does something with that. You know, like I'm not doing anything beyond hitting enter and that is it, you know? Um, and I wasn't even the one hitting enter. Someone else was hitting enter. I wasn't allowed to touch that keyboard.

[00:21:47] Um, but it's interesting to me that. Even like as a, you know, as you said, like even as a hacker or an operator, um, there's still like a lot of limitations around what you're doing, which does make sense. Because, you know, let's say that you're trying to exploit or use like a real, you know, cyber warfare weapon on a target.

[00:22:16] You want to have, you know, all of your legal checks in place. You want to make sure that you have permission to do it. Um, you know, and there's probably, probably like approvals at every step of the process. Like every command that you're typing, you're getting approval for. Yep. Yeah. Yeah. And honestly, like, I, I feel like even though the United States is so technologically advanced, we're kind of at a disadvantage in the cyber domain just because of those regulations.

[00:22:46] Um, we really care about the privacy of our citizens. Like, um, if you accidentally just pick up something that has like a U S phone number on it or something like all hell breaks. Cause it's like, you have to, you have to report stuff. Yeah. Like everything has to stop. You have to report everything. Like, it's just like, that's why it's so important that we get permission to do this and then this and then this and then this. And it slows us down a lot, but it makes us very deliberate. Um, but sometimes you do just need speed.

[00:23:15] You need to get in, get out. And, you know, some, you know, sometimes it takes, you know, months in advance to just plan it out. It takes in some cases years to even start a mission and by that time, you know, updates happen and stuff like that. You know what I mean? So. Right. Yeah. I, I, um, I, I had a podcast. I don't know.

[00:23:40] It was probably a few months ago where I was talking about, like, I felt like we had, you know, as a country, we have the skill sets, we have the tools, we have the ability to do some pretty insane things within the world, right? Like Russia goes and hacks Ukraine and they take over all of the communications. They took over the power grid, shut off the lights. Right. Like I feel like what we could do is probably child's play compared to that.

[00:24:07] And Russia could probably do, you know, like 10 times what they showed in Ukraine. Right. Like, because they have those capabilities, just assuming right outside. Um, but I, I always feel like we're being held back. Um, especially in comparison to like North Korea, China, and Russia, it just feels like those guys don't have the regulations around them that we do.

[00:24:37] Because like, we always end up pinpointing it back to like two or three people that were doing this attack. Um, with us, it would be like, oh no, I hit enter. And then the guy three rows down hit enter on the next line. And the other guy hit enter on his part. You know what I mean? Like, and it's all timed out and choreographed and everything like that with Russia. So it just feels like, it's like, yeah, this is your target. Go figure it out. Go create your exploit.

[00:25:07] Go launch it. Get us in. Do this. You know, you're good. Yeah. Is that, is that your experience as well with that? Well, so I won't, I will say that I feel like the United States is just as capable if I'm more capable to pull out cyber effects. Um, and, and, you know, to the extent that, you know, uh, would be very impactful. Uh, I don't know if it, if our capabilities are really even rivaled in terms of, you know, that type of thing.

[00:25:35] The only thing I will say though, is just the sheer speed. China will just a billion people just doing everything they fire at will type stuff. And you know what I mean? So it's like, you throw enough darts at the dartboard, you're going to hit it. If you have, if you don't really care about it, like being anonymous and stuff like that, it's like, yeah, you get a billion people.

[00:26:04] You give them, give a billion different people an IP address and said, try to get in. Like, you know what I mean? Um, it's a, it's a, it is effective. It's not, um, you know. Huh? Yeah. That's really interesting. I wonder if, I wonder if like, you know, these different countries like China, North Korea, Russia, Iran, even.

[00:26:29] I wonder if when they, let's say, give an IP to a room of a hundred people, it was like first one gets in, gets a hundred bucks. Yeah. Like I wonder if they're doing something like that because in their, in their community, that's like how they kind of reward. They're, they're people for doing better and beating out a room full of people. Right. You know?

[00:26:53] So I wonder if that thing, that kind of thing exists on those teams. Yeah.

[00:27:29] So I do think that, um, so I do think that that slow, monotonous, deliberate pace is healthy. Um, I don't think people should just be going out willy nilly accessing people's information. Um, but yeah, I mean, it is, it is something just to think about, you know? Right. Yeah.

[00:27:49] So, so, so you brought up how, you know, there's, I guess I kind of want to learn a little bit more about what a developer does like within the military cyber operations team. So when you choose your specialty, um, are you still, so you said that you're on the red team current currently, or you were in your last role before the training.

[00:28:18] So then when you say, okay, I want to be a developer and then you go through the training, are you a developer on the red team? Yes. Or is that separate? Okay. Every, every, every, you know, team quote unquote, there's different names for it in the military, but the, the easiest way to put it for the mass community is red team and blue team. Um, every team has all three roles and they all do, um, similar things.

[00:28:48] Um, there's not very many operators on blue team. Uh, they're more incident response and stuff like that, hardening of networks, but there are, there are operators on blue team for, you know, offensive stuff, you know, um, you know, like, uh, simulating attacks and things like that. Um, but yeah, I'll, I'll, I'll remain on red team as a developer. Okay.

[00:29:10] So then I would assume as a developer, you're, you're potentially like investigating targets and developing like an exploit or an attack against a potential target. And then you're like handing that off to an operator. Yep. Yep. Okay. That's right. Um, it's not always exploits, but it's just like random. Um, well we're called tool developers.

[00:29:34] So, um, you know, we, we just create, we just try to make the, the operators lives as automated as possible so that there's as little room for mistake as possible. Um, if everything's automated, you can't really mess anything up. Um, and, but yeah, there's exploit development and stuff like that as well. Oh, okay. That's really interesting. Interesting.

[00:29:59] So have you ever like been handed a target and you just couldn't get in? Like no one on your team could get in? Oh, you mean like when I was an analyst? Cause I'm still in training as a developer. I haven't. Yeah. I mean, yeah, there is, there's times where they, we just don't have, or like we're given a device that hasn't been used in months or, um, something like that. But thank you. Wife brought me some drinks.

[00:30:28] Oh, um, but yeah, there, there's, there's cases where the guy has good, you know, security precautions and stuff like that. So. Okay. That makes sense.

[00:30:43] That's, that's, that's what I would expect at least, you know, with some of the like higher level targets there, they probably have teams of people around them that are, you know, informing them of, of what to do, where to go, how to use this device properly, all that sort of stuff. Yeah. It's rare. I mean, usually like if there's a device we can't get to, we just go for another device, you know what I mean?

[00:31:09] Where you're eventually like you, you don't, you know, like I said earlier, you don't have darts at the wall, you know, you'll get something eventually. But there are times where it takes so long that it just not even, there's no point to it anymore. Hmm. Hmm. So, okay. That makes sense where it takes so long that, you know, it's probably more valuable to identify a different attack path and explore that route. Yeah. Like a different person or something. Yeah.

[00:31:39] So how do you, okay. So when you're, when you're, you know, let's, you're targeting X, right. X can be whatever. Um, are you like hand handed a phone and you're like, you know, like this is the device that they have find a way into it. Or are you given an IP and you're just trying to figure out how to get into it?

[00:32:05] Because I feel like there's a gray area when you're just given an IP, um, and you're scanning it, trying to figure out a proper attack path. Right. Like I, I don't know, there could be a gray area with that. What do you mean a gray area? Well, you know, like, like you talked about, you know, there's like a gray area where you just need a lot of permission, um, and a lot of authorizations to do different things.

[00:32:32] Well, like when I'm a new branding, a device, I'm going to use Nmap. Right. And maybe I'll use an aggressive scan or maybe I'll use a more passive scan. That's not going to raise too many alarms. Um, maybe I'm, you know, scanning it for like a web app or, you know, something like that. Right. Because that opens up different attack paths. Um, does that make sense? Or maybe I know what you're saying.

[00:33:00] And I can't really go into detail about like the, the methods we use. Um, yeah, please don't. Yeah. Um, but let's see. What I can say is that most of that stuff is vetted before it even hits my desk. So it's not something, it's not really a gray area because of those precautions that, you know, the, the government takes and the military takes to protect people.

[00:33:25] Um, usually as a, as a lower level and analyst, when I was an analyst, you know, I was an E4, I was, you know, bottom of the bottom of the totem pole in terms of authority and responsibility. So it's something at my desk that was vetted through and through. Okay. That makes sense. So. Okay. So, so you're doing this really interesting role right now with the military.

[00:33:53] Where do you see yourself, you know, going after the military? Like that's. Great question. It's a big, big question that, uh, I'm sure everyone in the military, you know, has and runs through their mind. Yeah, absolutely. Especially in our, in our field. It's right. If you stay in, people just kind of look at you sideways. Like, what are you doing? Um, but there are people that just enjoy being in the military and have that call to arms in their heart.

[00:34:20] Um, but, uh, personally, I'm going to pursue development after I get done with training. Um, I get out in 2025. Um, so I'll be getting a job in development, but I'm also standing up, you know, a little consulting business with some little side things like, you know, some apparel stuff, stuff like that.

[00:34:49] Like I, I'd like to make my own money, uh, preferably, but the CNO development makes so much money that I'll probably still do that and keep my business as a side gig. Um, but yeah, I just, I'm running, you know, I'm starting up a business. You know, I started, I started it up a couple months ago and it's, you know, I do defensive consulting for individuals. I don't do any businesses or stuff like that.

[00:35:16] It's like, I help individuals protect their digital assets, you know, their NFTs, their wallets, their email addresses, their phone numbers, their place of residence, their, you know, their employee information, that type of stuff. Cause I think all that's really important. It's really easy to dock somebody and not a lot of people think about what they're doing. Um, and then I also offer, you know, um, pathways to careers in offensive security.

[00:35:45] So somebody, you know, I'll help even, you know, a regular guy like me who, you know, wakes up or hears this podcast or whatever says, I want to be a hacker. You know, hit me up. I'll, I'll take you, I'll give you a, you know, six months to a year of just, you could work on it all day, every day. And by the end of it, you will be hireable. I promise you that. Um, and that's basically, that's, that, those are my two like services right now.

[00:36:12] Um, I do offer like a paranoid level, uh, defensive service, um, where you can, you know, learn about tour tales, anonymity, uh, procedures, IP relaying, stuff like that. Um, and then I just have some cool shirts and stuff, uh, stuff like that. That's pretty interesting.

[00:36:38] Uh, it kind of sounds like you should like start a podcast or something, you know? Yeah. Is, is, is you kind of interested in something similar? Is that, is that why you got started? Is that why you said that? Um, you, you know, why I got started was, um, I, I had a really hard time getting into cybersecurity, which was really frustrating for me because I had experience with help desk and everything.

[00:37:05] And I was trying my best to get into it, but these companies were just like, oh no, you don't have experience with Splunk. That's, you know, $1.5 million to set up just a small lab. Um, no, we're not going to hire you. Um, so that's, you know, the response that I was getting for like two and a half years. So I figured, you know, there's other people out there that are running into the same issue that I ran into for no good reason, really.

[00:37:35] So let's start the podcast and give them that help that maybe we'll get them over that edge, right? That will help them be more successful because I really feel like this field is so broad and so expansive that it has a place for a lot of different people.

[00:37:52] Um, and I really believe in taking your skills and making your own money with it, you know, because then you won't be beholden to some company CEO to, you know, make proper financial decisions. And hopefully you, you don't get laid off and all these stupid situations that can be avoidable. You know, you're taking control of your own life, of your own money and where you want to go in life. Right. So that's why I started this podcast.

[00:38:23] Um, and it also, you know, it's kind of a circle, right? Like I want to help people do that while I want to do it for myself while I'm, you know, doing this podcast. And maybe someday this podcast can, uh, turn into something that, you know, does that provides provides for me and my family. Right. Right. Yeah. It's, it's an awesome idea for sure. Yeah. It's, it's a, it's a goal. You know, it's, it's out there. Right.

[00:38:52] Um, but yeah, you know, I, I figured, um, just what you're looking to do with your company and with your experience, it would probably be beneficial to like set up some sort of, uh, I don't know, maybe a podcast or a blog, you know, something like that, where it's like, Hey, here's, you know, top 10 tips. Like that.

[00:39:19] Um, you know, you know, stuff like that, that really draws people in. I think that you have a really interesting side of the experience, right? Like there's not very many people that have your side of the experience that actually know what to do, right? Like I have MFA on everything, but that's one step in like a hundred different things that I should be doing.

[00:39:46] But I also don't know what 50 of those things are. Well, so a lot of those things are like, you have to be pretty paranoid and doing some pretty like weird shit. You know what I mean? I don't know if I can swear. To care about it, yeah. Yeah. Yeah, you can swear. Okay. Really, it's for the normal person, it's honestly super easy. Just get a password manager.

[00:40:13] Stop using the same damn password for every single thing you do in the same email address. You know what I mean? Like it's fine to use the same email address, I guess, but like get a password manager. Don't use the same password for everything. Stuff gets leaked. Like if you use the same password, okay, for one, for example, if you use the same password in email for everything, there are so many instances, just Google leak, just, you know, email leak, password leak in Google.

[00:40:42] And if you're on any of those, you know, in any of those servers, they have all of your, they have all of your passwords now just because one company messed up. So don't do that. And then, you know, I mean, aside from that, use a VPN when you're clicking links you aren't familiar with, you know? Like if you're browsing Facebook and you see an ad for some really cheaply made cool gadget

[00:41:09] that you kind of want to get your nephew, turn on a VPN real quick. Click it and then you can do whatever you want. You know what I mean? It's like, it's just like little simple things that people just don't do. It's really easy. And for the average person, it's honestly really easy to stay secure on the internet, you know? Right. But, you know, there are like very intricate things you can do if you want to be, if you want to like hide from, you know, very capable individuals.

[00:41:38] There are people who are really good at finding people and doxing people and stuff like that. And there are things you can do to hide from even them. But if you're, if you're getting doxed, I mean, I would probably just try not to put your personal information on the internet, man. You know, like your address and your phone number and you can use Google voice and put in a fake phone number for everything. You have to have a real phone number to sign up for Google voice, but you can use a fake

[00:42:06] phone number for everything where only Google voice knows your phone number or, you know, any one of those services or Apple is really good about these things. They actually have two little protocols that you can just turn on in the settings. There's IP relaying, which is like a VPN, obviously that's just always on. They also have email relaying. So anytime you click sign up with Apple, it uses some gibberish at iCloud.com and it just forwards it to your iCloud email address.

[00:42:37] Oh yeah. Oh yeah. I've, I've used that. I haven't used the IP relaying though. Yeah. It's interesting. I didn't know that, uh, that that feature like existed. Yep. Yeah. If you go into your settings and you, um, look up email relay, it's in your settings. I'd have to walk you through it, which I can, if you want me to. Maybe another time. Okay. Yeah.

[00:43:00] So, you know, what's the best way to, you know, protect like your physical location, right? Like I'm buying a house, right? What's the best way for me to protect that address from getting docs, docs? Um, you know, that's a good question. I don't know the exact steps you need to take. I know what, I know ultimately what you need to do is you need to go, you need to contact

[00:43:28] the tax office and say, I don't want my information public. Hmm. I, and I don't know if that even, I'm sure there is some way to do it. I've never even thought about that. Well, I've thought about it, but I've never looked into it. Um, but yeah, you're, you, you're absolutely right. Where if you buy a house and someone knows your name and your city, they can type that stuff into Google and get your address through taxes.

[00:43:55] Um, there has to be a way to get that offline. I would call your tax, you know? Hmm. Whatever your tax center is, this X, you know what I mean? Right. Yeah. That'll be a interesting, um, interesting process when I go through it. Yeah. Man. So, so you have this business, you know, you're still in the military.

[00:44:23] Have you ever thought about going into different agencies? Like, I feel like that would be like a natural transition, you know? Um, or you just kind of, you're kind of over the whole government, you know, kind of deal and, and want to do your own thing. Um, yeah. Um, yeah. So in terms of working for the government, it's really cushy in terms of quality of life.

[00:44:50] You know, the government and the military, you get, you know, you get a lot of paid time off. They're very understanding in terms of missing days. So like, uh, my, you know, my wife is sick. I have to stay home and watch my son today. I'm like, okay. You know, that type of thing. Um, really good retirement plans and pensions. Um, the pay is terrible in comparison to contracting and private sector. Um, it's like not even comparable.

[00:45:18] Um, so it's like, what do you, what do you, you know, what do you care about more? Do you care about your employer caring about you or do you care about money? Right. So that's basically your options. Um, if you go out in the private sector, you're going to make money, uh, in a lot of it, if you're good at your job. Um, but it's a very competitive field.

[00:45:45] Um, and it's nonstop really. The internet never stops. Um, you can always be working. So. Yeah, that's, uh, that, that's like my, my biggest. Hold back with going into the government. Right. It's, I would literally have to take a pay cut. Like 80, 85%.

[00:46:12] Like it's like an 85% pay cut just to almost kind of start over. Right. Like I, I wouldn't be like, uh, you know, a high rank or a lead on a team or anything like that, at least not in the beginning. Um, the, the work would be cool. I think the work would be interesting. It would always be, you know, intriguing. There would always be that, you know, interesting factor to me. Right.

[00:46:41] Um, but man, it, that pay cut is steep. Yeah. And I don't know how much you get paid. Um, but, um, like when I was an analyst, the civilians next to me were making like a hundred thousand a year. And I, and I was a private specialist, uh, making 35, 40,000 a year.

[00:47:06] Um, but, but like, but those are government, you know, those are government employees. So they're, they're making a hundred thousand dollars a year is working for the government. Um, but like, I don't know. I don't know. I know, I know that as in terms of like CNO development about a year and a half ago, I got contacted on LinkedIn and I don't have anywhere on my profile that I was an exploit developer or CNO developer or anything like that.

[00:47:33] I have, you know, I, I have NSA experience and I'm working on a bachelor's degree in computer science and a recruiter must've just put those two things together and thought I was a CNO developer, but he offered me a job for over 200 a year as a, in a junior position in Florida. And I was like, uh, well I have three years left and I'm not a developer. So you're going to have to go on to the next guy, but damn, I really wish I was, you know what I mean?

[00:48:00] Did that like kind of inform or mold your decision to become a developer? It honestly just made me mad because I had just found out that my spot got just ripped out from underneath me like a couple of months prior and it just like irritated me like that. I, but at the same time, it got me motivated to try again. So yeah. Yeah.

[00:48:25] I can, I can see that being really frustrating, you know, like that's politics and it's military it's just politics, you know, the right guy and you tell him and you tell him he's smart and handsome and you get, you get put into spots and other people get dropped from them. You know what I mean? Huh? Yeah. That's, that's an unfortunate side of it that I think is overlooked by a lot of people when

[00:48:53] they're considering to go into the military. Right. Like, and the only reason why I knew about it really is because I have a good friend of mine who, you know, has been in the Navy forever. And he told me like, your network in the Navy is far more important than your skills. Like you need to know the right people. What rapper said it? Your network is your net worth. Is it Jake? Who was it? I don't know. It makes sense though. It's true. Yeah.

[00:49:24] That was Drake, I think. Oh. Yeah. Yeah. Your network is your net worth. It's a good saying and it's very true. Yeah. Very true in the military for sure. Yeah. Yeah. And that's one of the best things about the military is in college too. Like I've never been a big advocate for college.

[00:49:44] Uh, but one thing that college is good for is one, it says I can, you know, choose a goal and stick to it until it's accomplished and it helps build a network and the military does the same exact thing. So I think the college and the military are good for the same reasons, except one of them pays for your college and the other one leaves you in debt. So, you know what I mean?

[00:50:12] Um, so, I mean, if you were to choose and if you're physically able, I would say join the military. Um, but it is a lot of bullshit. It is a lot of bullshit. Yeah. It's a really good way to put it, you know, that, I mean, you may not even have like direct experience through your degree in the field that you're going into. I mean, I got my degree in criminal justice, right? And now I'm in cybersecurity, not doing anything with that degree.

[00:50:42] Um, but it does show definitely that I can set a goal and stick to it, accomplish it, see it through. Like it took me five years to get the four year degree. Right. So I obviously had some failures along the way. Like I failed a whole lot. My first two years, I almost got kicked out of school. I had to convinced, convince the board to let me stay another year. And if I got anything other than an A, they were going to drop me, you know, like that

[00:51:11] was my situation. So like I proved through getting that degree that I can stick with it through the good times and the bad times. Yeah. And I think that is really important to have that, to have that, uh, proof. Uh, that's, that's proof that you're, you're, you're mentally tough and, you know, people say, you know, they compare the call at college to the military and whatever, but honestly, like it's, it's just a mental thing really.

[00:51:36] And, but yeah, in terms of like college aside from that, it's like, like you were saying a lot of times people, and even if they do, let's say you got your bachelor's degree or whatever in cyber security, and then you got out and you looked for a job in cyber security, they're going to be looking for experience. Right. So it's like, well, what was I doing that whole time? You could have, like you said, gone to the help desk, worked on some certs, um, use that

[00:52:05] as like your knowledge background and then use help desk, you know, move up in your help desk stuff to like a system administrator or something. And then you have experience as well. You have experience with network protocols and all that stuff. And you have a educational background with your certifications. Right. But, but when you do that, it's like, now you don't have the network. So it's like, I don't, it's really hard.

[00:52:31] I think that's why aren't the army is the best choice of all of them, because you get the training, you get paid, you can go to college and get paid for it. And you get the network and the experience. The thing is, though, is like, while you're in, you're treated like a child. And, you know, depending on your rank, you can go officer, you know, that, that would, that would imply that you went to college.

[00:52:57] Um, you don't have to, I guess, but yeah, I mean, I think the military is a great option. You just have to deal with a lot of stupid stuff. Yeah. I think, you know, when you go the route that, you know, you're not in the military, right. You got to be more proactive in developing your network. It took me years to develop a network. I mean, literally years.

[00:53:22] And that was me, you know, not just developing a network and internally within that company that I was at, wherever it might've been. It was also me going to, you know, a lot of different meetups besides events and talking to people again and know them. And I'm an introvert, right? So me getting into like forcing myself to go to these different talks where I know no

[00:53:47] one and I'm sitting through this thing, I'm trying to learn and I'm trying to also meet the right people that are working for companies that I want to work for. Like it was stressful, you know, but if I wouldn't have done that, I wouldn't have gotten the jobs that, you know, really put me on the map and like gave me the experience that I needed, right. Because I didn't know the right people. I wasn't putting in that extra work.

[00:54:15] And I feel like that's what separates, you know, the people that are actually going to be successful and the people that will plateau in this field. You know, like it's really easy to get in this field, get to a certain level and just plateau and stay there forever. You know, it happens all the time. I've met so many people where that is their situation where they've been at this company for 25 years.

[00:54:41] They've done the same job basically the entire time. And the company, you know, makes like a mutual agreement with them where, hey, we're never going to give you a raise. Okay. You're maxed out for the rest of your career. We will give you a bonus and you're also going to do no other role. You're not going to be promoted. You will never join another team. I literally know that to be true with a few people.

[00:55:09] And it's like, dude, I do not want to be in that situation. But how do you prevent that? Right. You got to keep growing. You got to keep meeting the right people, picking up the right skills. And guess what? If an employer isn't going to give you that opportunity to grow and expand, welcome. You got to go somewhere else. Yeah. I was just going to say, you're absolutely right about the network. You have to be working towards that. It's absolutely critical.

[00:55:38] But yeah, if you're ever in a position to where they're like, you can't move up and you're in a technical field. Yeah. Screw that guy. Just say, I'll literally take the experience you got and go put it on your next resume and go get... You can literally get paid more doing the same thing. Job hopping is huge in this industry. Right. Even if you don't have the network, don't put up with that shit at all. But you're absolutely right. If you have the network, that whole process is way easier where you can just hit up a buddy

[00:56:07] and say, hey, I'm looking for a new job. And he's like, oh, I got you. You know what I mean? Right. Yeah. It's the little things that are overlooked. And I feel like it's really paid attention to in our generation. Because we care about that. We saw our parents go through that. I'll give you an example.

[00:56:34] My dad spent somewhere around 18 years at AT&T. Right. And the recession hit. And they immediately eliminated his entire division. Even though he was about to be promoted and change teams within the company that would be on the newer tech that was coming out. Right. So they let him go. And, you know, I have two little siblings. I'm starting college.

[00:57:03] And, you know, now we have no income. Right. And the recession is happening. So no one is hiring. And that can happen to you. Not so often with our generation, I feel. Because our generation is just like, well, if they don't want to pay me what I want, fuck them. I'm going to go somewhere else. And it only works when you have the skills. You have to have the skills. But you know what I mean?

[00:57:30] Like, I feel like I feel like that situation of being stuck in a job doesn't quite pertain to our generation. It really pertains to people in their, you know, mid to late 40s, 50s even, you know, that are at the end of their career that literally did just spend 20 years in the same job.

[00:57:54] But, you know, I'm pretty sure that's probably all the time that we have today for this episode. You know, I really appreciate you coming on. Why don't you tell my audience, you know, where they can find you on social media, what your company website is, and how they can, you know, best reach out to you if they want to engage with you in any services? Sure. Yeah. My name is Dittus, which is spelled D-I-T-T-U-S.

[00:58:23] D as in Delta and then the T's are in Tango. People get those mixed up. I just want to clarify. And then, so it's my name, diddus.shop is my website where you can pick up my services, whether the defensive posturing services, the offensive security pathway, or just some cool clothes because I, you know, I wanted some clothes that I could wear without looking

[00:58:47] cringe, you know, without Guy Fawkes masks and, you know, Hacker Man meme worthy type stuff. So, you know, I got some clothes on there and a water bottle and stuff. But aside from that, my Twitter is Dittus Cyber, just at Dittus Cyber. And right now it's, those are my two things. I got Twitter and I got my website. If you want to ever just, you know, email me for whatever reason, it's just Dittus at ProtonMail. And yeah.

[00:59:18] Awesome. Well, hey, you know, I really appreciate you coming on. We'll have to figure out, you know, a great episode, a great topic to bring you back on for, I really enjoyed our conversation. Yeah, absolutely. That was fun. Awesome. Well, thanks everyone for listening. Hope you enjoyed the episode.