Original subtitles

Welcome, David.

Welcome.

It's wonderful to be here.

Thanks for having me.

Thank you so much for, for spending the time with us, and thank you for being with

us here in in the Cyber Security Podcast.

Uh, first I welcome you also, Andrea, since this is not

your first time here in Saudi.

And uh, I would like to just give us quick, brief.

Yeah, it's, it's gonna be a long story.

So let me first start off with, as you mentioned, rd.

It's beautiful to be here.

It's my first time in Rya and it, it's great to see all of the things

happening here regarding myself.

That's, Yeah, it's a long story.

So let me just start from the beginning and we can go from there.

Yes.

I'm a very curious person.

And when I got my first smartphone, I was actually nine years old and

this was kind of cool, you know, it was like tech and you could do

things there, but it wasn't much.

It was running Android, four point something.

And then for my 10th birthday, I got my first laptop.

And that's really what got me into the tech and cybersecurity

industry in the end because.

I just wanted to know how do things work.

I was so curious to figure out how do things work because

everyone was using them.

You know, everyone was using those devices.

Everyone was doing Google searches, and I asked myself like, How does work, because

it's not magic, it's only technology.

And then I also figured out that I am now living in the best age I could ever

grow up in because I can leverage that technology to learn about how it works.

And that's exactly what I did.

So I started coding because that's apparently how all

of those things were built.

And I started coding my own apps and I was uh, I think I was 11 when I backed

my dad to get like a robotic arm so I could connect that robotic arm to

a respiratory pie and then build my own software to control all of that.

It was a lot of fun back then, so that's why I learned all the basics.

And a few years after that, I was finding my first vulner.

And that was really interesting because now I could do things with the commuter

system I shouldn't be able to do, and that's that what really got me into

the industry because for one, it's super interesting to learn about a

topic of cyber security and hacking.

But on the other side, you could already see it's going to be one of the most

pressing challenges of tomorrow when we are digitalizing our, our whole life.

Basically.

It starts off with smart homes, autonomous cars, but even creating infrastructure

is fully digitalized in most parts now.

So I was seeing that and I was.

That is, I found my passion basically, and I was spending like all my time on,

on learning it and getting into the space.

So even though school wasn't the next day, I was staying up until 4:00 AM sitting in

front of my, my screen going into this.

That's amazing because I was thinking what, being the young, usually you

will drive into gaming and, and, uh, a lot of, you know, having a PlayStation

or a PC and playing with it and you decided not going there and having

your dad to buy your raspberry.

That's like, that's changed.

Like what is the passion?

Why did you decide going there?

Is it your, uh, family interested in the, the area or is it just yourself

being just passionate about it?

So, yeah, it's, it's only me and my family.

So no one in my family is into tag.

Um, no one is, , my family doesn't even speak English.

Right.

Okay.

And, and now I'm here going ahead like this.

So it was really, because that's also when I got into tech and I was , all

the good stuff was in English.

So it was like, I better learn the language right

to, to understand all of it.

So that's how I started there.

I, I don't know.

Where exactly that that passion really originates from.

But I was just curious.

I wanted to understand how it works and that's basically

how the world works nowadays.

Everything is digitalized now.

Interesting.

And that, that it was so great to first learn the, the fundamentals and then going

into cyber's security because I'm the opinion if you want to hack something,

you have to understand how it works.

Because then you're able to see what the gaps are and where

you might find your ways in.

Yes.

And also if you wanna secure something, you cannot secure it while

you don't understand the baselines.

And I think what you did is, is great.

And tell me.

The, the first vulnerability that you talked about, like, I think

you were young during that time.

Yeah, I think I was 13 or something at this point, and was actually an

S Square injection, and that is a vulnerability that has been there for,

for so long and it never goes away.

So even, even today, you have developers still building that

vulnerability and I, I don't know how.

Why, but it's, it's, it's been there for forever and it's probably also

gonna stay for quite some more time.

And it's quite funny because that's where you're able to manipulate, um,

user input to then manipulate the database that is underlying there.

So you can bypass authentication there, or you can, you can even delete the

full database and things like that.

So it was really interesting to, to discover that because then I

was able to do, Something with a system I shouldn't be able to do.

Right.

By abusing that, that vulnerability there and, and I didn't use it to cause

any, any problems or something, but it was really interesting to see that.

Yes.

Yeah.

And, and a lot of people would call that an ethical hacking is you are

responsible of finding it and then helping to fix it, not rather than just

abusing it, which is, which is great.

Then tell me why did you come here in reality and why are you here in.

So it's, it's really exciting here.

That is something.

So I'm from Germany and in Germany.

It's, Yeah, well we are, Technology and innovation isn't as present as it is here

in the region, and it's just beautiful to see you have so many young people

that are excited about creating a great future and take a look at this event.

It's the first ever blackhead in the Middle East, and it's an incredible event.

I think we have nearly 50,000 people signed up, and it's just

wonderful to see that excitement, to see that passion that is here.

that is just wonderful when you have so many passionate people in

the same room talking about the important topics that are really

gonna gonna affect our, our future.

And something to actually also continue in, in my own story here.

So I was intoa Rudy, spending all my time on it, getting really

good at it, and then I was sitting in a 10th grade in school in.

In the middle of nowhere in Germany.

I was sitting there in school.

I was 15 at this point actually.

And then I asked myself like, why should I sit here and learn Latin or do

like power analysis if I could be out there helping to protect organizations

from cyber techs, maybe even helping to protect credit infrastructure.

So it was like, have to quit.

And here's where Germany kicks in again, because in Germany you can't do it.

You have to go to school by law until you are 18.

Oh, wow.

So that is, that is something that also should be changed in my opinion.

And it was quite interesting because I, I thought there must be a way.

You know, if you code something and you have a bug in your, in your

code, you don't relax it back and you're like, Well, there's a bug.

You know, That's the way it is.

You get into it and you fix it.

So I was trying to apply the same principle there until I found someone

at the Chairman Chamber of Commerce and he kind of understood what I was saying.

So it was literally driving, He was driving to where I live and

it was in the middle of nowhere.

So like he was driving there for two hours, taking a look at what I'm

doing and speaking with me, right?

So I showed him, showed him the stuff, and then he gave me, Yeah, he gave me

a kind of special permission to only go to school one or two days a week.

So they make the legal stamp on that, and I can use the rest of

the time to, to further go ahead.

So yeah, that was, that was beautiful because then I had, You can spend

more time now studying the, the, the cybersecurity and then, and improving

yourself and skills and, and all that.

Exactly.

So, but that is something that con also continued throughout the years that in

some places, , it's, it's very limited when it comes to the will to innovate.

And to circle back to your initially question, why I'm here now in, in Rya,

because here you, you really see the will present to innovate, to change something.

And that is just, in my opinion, really beautiful to see.

Yes.

And uh, I mean, having black hat here was, was one of the anything thing that Saudis

is trying to do is to bring them and, and.

like you, like all of, I don't know if you walked around the, the black hat

and the venue, you can see the CTFs, the book bounties, the car hacking

villages, what we are gonna talk about and even the drones and lock picking,

bringing all these together is amazing.

And having them and having all 50 plus people, a thousand people are,

are here to learn and, and improve.

I see that you wrote, uh, in, in, in social media that you are, are a Tesla.

Yes, I, I'm a huge Tesla and I think yourself and, and me in the morning.

We were having fun with Tesla.

Tell me about that.

And you told me about the story you told me back then, uh, about, about how

you got into the Tesla a Absolutely.

So let's start off with, uh, being a Tesla.

And so I'm not a car guy, I'm a tech guy, but a Tesla is a computer on wheels.

So obviously that is something that is just wonderful to see.

It really in, in the core, it's softer.

It's, it's, it's not the car, it's the software that is running on it.

So that is really exciting.

Yes.

So I've been a Tesla fan for, for a number of years.

I don't have one yet, but I'm really looking forward.

So, yeah.

It was really funny this, this morning when we did all of

our tricks with, with the car.

Yes.

And I mean, for us it's fun to demonstrate it here and it's

really cool to see, but it's, it's really a critical vulnerability.

Right.

And we can directly dive into the story of how all of that unfolded.

Yes, yes, for sure.

So, uh, being a test fan, and you mentioned a lot of tech guys

like Tesla because of, it's, it's a technology that runs the car.

And some, and I would include myself is I am also a car guy and, and, and

tech, and this is a combination for me.

Have a car that does both.

Uh, and tell me about the finding and the one that you, you, the

administration did this morning.

Absolutely.

So the whole story started in January, which is a, a few months already.

Okay.

So, . Originally I didn't even plan to hack a car so that that wasn't even So

you were not just having a car to attack?

Exactly.

So I, I, I said I don't have a Tesla.

Right.

So I was just sitting there in Germany and again, it was

curiosity that striked again.

Right.

This is basically the key for cybersecurity.

You need to be curious.

Exactly, exactly.

That really is the, one of the keys there.

And I just wanted to underst.

How do things work?

Exactly, because here's something that is quite interesting.

When we take a look at modern cars, all of them call back to the

manufacturer and speak with their bag and infrastructure constantly.

That's not only limited to Tesla.

A lot of other cars also do that.

So I was thinking from, from a hackers perspective, if you can try to find

a vulnerability in wifi or Bluetooth, but then you have to be near a car.

You can only have access to one car at a time.

But if you would be able to get access to that centralized entry point that we are

creating that single attack vector on the manufacturer side that is connected to all

of the cars out there, then you would be able to have a lot more impact remotely.

Okay, so I was actually just by accident, taking a look at how some

of the things work on Tesla side.

And it's quite interesting because all of those cars communicate with something

on Tesla side called the mothership.

That is their main, main server on the backend infrastructure.

So I was just trying to understand how exactly that works.

What, what technologies are built in their.

And then I was discovering that a piece of third party code was

connected to that mothership.

So that mothership is providing interfaces for a lot of internal Tesla services.

Also some external stuff.

There was this piece of third party code connected there, so I was

trying to dig deeper into that.

You know, I, I didn't even expect to find a vulnerability.

I didn't even want to find a vulnerability.

I was just curious digging into this, um, trying to understand how it.

Exactly.

You're trying to see how things works and how things connected.

Exactly, because that, that's what you have to learn if you want

to figure out how exactly what is going on behind the scenes.

So I was taking a look at this third party piece of code and I figured

out that it's having access to some kind of digital car keys and tos,

and it's, it's also storing them.

And I figured out it's storing them.

So they haven't been encrypted so far from what I've seen.

And then they got stored into something called repo, and I thought repo is

going to be a secure storage mechanism.

It's going to be evolved, it's gonna take care of encryption and every, everything.

So I was trying to figure out what repo is and it wasn't a

secure storage mechanism at all.

It was just a normal postgre scale database.

So that was really interesting, um, to know that there was a major flag.

And then I also figured out that this piece of third party code,

you can read like some charging statistics and, and stuff like that.

So I was like, What if I, I didn't expect this to work, but what if I would be

able to craft a malicious request that is like, Hey, you know, give me the charging

statistics, but then also hop a few tables in the database and read me those

digital car keys and bring them to me.

So I was crafting that malicious request and send it.

And really to my surprise, I got back some of those digital car keys and I was

like, That is, that is really interesting.

So I was, I was pulling them and with those you can approach

the Tesla mothership and be like the, the car owner or, or Tesla,

and then issue some commands.

And those commands get sent from the mothership to the car, and the car isn't

gonna question it because it comes from, from Tesla's backend infrastructure.

Right, Exactly.

And with the, with the, with the proper.

Exactly.

So that was really interesting.

And at first I thought, you know, I can read data that that's, that's

what I thought, you know, like where a car is or what a car is doing.

But I also knew that there, there would be a way to, to run commands on, on,

on their ride, but I didn't have a car so needed to try it somewhere else.

Jump before jumping to the, the, the changes that you have

done or the commands that you.

What kind of data you've seen?

You told me that the locations and what else?

Yeah, you can see a lot of stuff.

So you can see the actual location, you can see where the car is heading to.

You can see where it's navigating to the speed you, you can see the speed,

you can see, You can even see like what, what shift is selected, like what gear

the car is in and, and things like that.

You can see if music is playing, you can see the AC settings, you.

Pretty much see all of it basically.

Yeah.

You know exactly what the car's doing and where they're heading and, and,

and even I believe even if the seats are, uh, the heaters of the seats

are running or, That's interesting.

And then now you collected all the, these data, you know, all this information, but

these are, we would call them be donley.

You are collecting.

Now what, what is the changes or the commands that you have done

exactly or we could have done, So I needed a car to test it somehow.

Right.

So I'm not quite sure.

You also drive a Tesla, right?

Yes.

So do you have, do you have a custom name set for your Tesla?

Yes, I do.

I, I put, I put a custom name for my Tesla.

Exactly.

Because a lot of Tesla owners, students, and some of them are very creative.

So I was pulling the names for those Tesla.

And there was one name that was very unique, so I was just taking that

name, putting it into Google and wrote like Tesla next to it and Google.

And then a few tweets showed up from the guy who was tweeting about his Tesla.

It was a Model X with that name.

Okay.

So I was texting him on Twitter and I was like, Hey, do you still have

your Tesla, you know, with that name?

And interesting, he actually came back and he was like, Like, what are

last six stitches of the VIN number?

Like if you actually have access.

So I was pulling that up and I sent him like the VIN number

and he was like, That is my car.

And I'm like, Great.

And if you now give me the permission please to, to run commands, that would

be great if, if we could do that.

And he was like, Yeah, I tried to do it.

Whatever.

So I was, at first I was doing homeless stuff, you know, like

honking jo Horn and flashing the lights and, and then he allowed it.

He exactly.

Feel free to do it.

Exactly.

Interesting.

And then I asked him to confirm that he's a good guy and he,

he luckily was also into tech.

A lot of Tesla owners are Yes, exactly.

So he was seeing that, that it worked and that was really, that was

surprising because, you know, that car was in California, it always has been

in California, it's its whole life.

The Tesla owner is also in California and he now, there's this random

request from Germany to like, at first honk the horn, but then also

to unlock the doors from Germany.

And it just went through.

I, I expected this to be blocked, right?

Yes, exactly.

I mean, you, why would someone send it from a different continent?

Exactly.

And sent all these requests, which is interesting that it, it allowed it.

And also, so I logged into my Twitter account and also my sum

account here in, in Saudi Arabia.

And then it showed me like those messages where it was like, Hey David, it's very

unusual that you log in from here, so please, now we just send your code.

Please put in the code.

You know, things like that.

And that wasn't present when sending commands to the commands to the car.

And you could do a lot of things.

So to you can actually also combine some of those things, which are interesting.

So you can locate where a car is, you can turn off the century mode, which is the

security mode that watches those cars.

And the one also takes the cam the videos for Exactly.

For everyone around it.

Exactly.

And then you can unlock the doors, get in, and.

Start keyless driving, which means you don't know who the owner is.

You've never seen the car before.

You just walk up.

You don't have the key, You just walk up.

You get in and you take it for a road trip.

That's, that's, that's the scary part.

Now someone can steal your car.

I mean, the keyless part is to help people.

If someone want to drive it or move it, you can allow it.

As a test owner, I can allow someone to move the car.

Exactly.

But now, Leveraged from a attacker perspective you

can, You can steal the car.

Exactly.

Which is the scare part.

Sometime you go out and then you cannot find your car cause someone

just turn it on and then left it.

Exactly.

But you can also do a lot of things to mess with the owner itself.

Right.

So let's say you have a very important business meeting you have to get to.

So you go out to your car, you unlock it, and the car just lock.

So you unlock it again.

Car locks again.

Yes.

So eventually you get into your car and you sit down and you want to start

driving, but then the triangle opens.

So you close the triangle again.

Triangle opens again, and you close it again.

And then your car randomly starts blasting music, you know, like very

loud that that would be quite an issue.

Right.

And then a YouTube video pops up, which is like, Hey, so, So your car

has been hacked and it's quite funny.

When I posted about this on Twitter, there was this one guy and he was like,

Yeah, that's the start of drive somewhere.

And I was like, What is drive somewhere?

He was like, Well, driving in ransomware combined, uh, because that

is probably what we are gonna add to because I could show you a message

to the Tesla under there and be like, Hey, so either you pay me Bitcoin

or you miss your important meeting.

And it's also quite interesting because.

Dismiss all of that and, and you, you get to start driving.

But what if I then set you a speed limit to like five kilometers power?

You're not gonna make it to your appointment on a, on a highway.

It will be dangerous as well.

It's not just messing with them.

You, it's, it's becoming also dangerous and that's, that's

when it's becoming critical.

Absolutely.

and something that's also quite interesting.

You have full control over the AC so you can just blast someone

with like 40 degrees heat.

And you know how powerful a Tesla AC is.

It's incredible.

Yes, yes.

And, and, and blasting is, is gonna be also scary if it's,

let's say in a heat area.

Let's say in Saudi we are, we have a, a heat, it's, it's very hot.

And having a heated, uh, seats on is gonna be even worse.

Uh, which is interesting.

All these components are now connected and not just Tesla, every, everyone else,

even other cars, they have the same thing.

They start putting a sticker saying this, This car can connect and send

data, and you can unlock and unlock.

It's a usability right now.

You are helping making things convenient and easier.

But it is also scary because now it's.

Uh, uh, leverage for the attackers to attack.

It's more attacking service.

Yes.

So how are we gonna protect this?

But that is actually a, a conversation that is very, that has been brought up

in cyber's acuity since, since some time.

And I like, Usability versus security.

Exactly.

Because you know, the, the customers demand, you know, like those convenience

features and the project managers warned and the management of companies also

warned because it's probably gonna bring in more revenue and things like that.

Right.

So how do we deal with that?

And that is, I don't have the final answer for this.

That is a conversation we are having as an industry, right?

How do we navigate between usability and cybersecurity?

But what was interesting to point out were two things that I think

are great learnings from this.

So one is we are connecting things that haven't been previously connected to the

internet now in a massive extent to the.

You know, we don't do this to a few hundred cars to see if it works.

Those aren't concept cars.

We are doing this to millions of cars, tens of millions of

cars within the next decade.

So that is gonna be incredible.

Right.

And you know, if, if we see the, the history, you know, like 80 years ago in

a car, there was no technology at all.

Then we had our traditional cars with Canvas, a wifi and GSM interface,

your tire pressure monitoring system.

But what we are doing now is we are connecting those cars to so

many more things, you know, like.

V tweaks, communication, like communicating with other cars,

communicating with smart roads, communicating with traffic lights, and

also over the year updates, APIs, fleet service apps, as we just talked about,

whether a third party app, an official Tesla app, or also app stores that are

known that are now getting considered.

And something that's quite interesting is the EV charging port.

Because if you fill your gas car, I mean gas goes in and that's it.

Right?

But as soon as you plug in, in an V charging port,

constant data communication.

Yes.

So that is what happening here.

We are connecting things that haven't been previously connected

to, to a massive extent.

Now the other thing is that innovation is happening so far.

I mean, innovation is exciting, right?

I'm also excited about innovation and it's wonderful to see what is happening there.

You have large companies, you have global enterprises that want to, to innovate and

release some of those cool new features.

You have a lot of startups.

Exactly.

That's, that's what I'm, that's what I'm trying to add to, because that

innovation is happening so fast now and so many exciting people are working on

it, but at some point we have to pause.

We have to take a step back and make sure the right security is implemented

and that is something that is, I.

That Tesla is already a huge cyber, physical thing.

Right.

But it's still bound to the roads.

Let's take a look at drones.

I mean, drones are gonna be a huge topic now.

Exactly.

Especially also here in the region.

Right.

So how are we gonna tackle the steer?

And as you also mentioned, smart cities, that is a very, very huge topic and

we see the exact same progress here.

You know, 80 years ago there was no technological city there.

There was nothing, It wasn't offline city.

And then we had somewhat connected cities, you know, where we pulled data from, we

got statistics from, from certain data points that we collected, and now we

are heading towards smart or cognitive cities, which are gonna be interconnected.

There's gonna be a.

IOT and OT infrastructure, there's gonna be a lot of interconnected systems that

can control certain aspects of that city.

And that's where we are gonna see the exact same challenges, but we have to

really prevent them because when we take a look at the cyber physical space, we

can't wait for a attacks to happen there.

We have to secure it.

Now let's take a look at some other things.

I always take Uber as an example.

Let's say Uber gets hacked.

I mean, what's the effect on us?

We, we, we have to call a taxi instead of using the app.

Yes.

But that's.

On cyber physical systems that is gonna have direct impact on human lives

and we have to secure it right now.

We can't wait 10 years for that, you know?

And that is something where a lot of people here agree.

I would say nearly everyone agrees here with that.

And it's quite interesting also to, just to mention that quickly, you, for

that blackhead here, you brought all the guys, like all the names, everyone,

like Chris Roberts is here, the guy who who hacked an airplane with flight.

I was just walking on the other side of.

Of the event location and you had the car hacking village from Defcon and, and

Robert Lee, Ellie and, and those people.

So, Exactly.

And also the, the drones hacking, uh, the, the smart city hacking also there

is, they have a, they built a great city, uh, and they, they try to do some

things and the lights will shut off, the signals will open, and, uh, you might

have car accidents and that's why it's, it's becoming dangerous rather than

us, let's say five, 10 years ago, it.

if the system wind down as, as you mentioned, if, if Uber winds

down, you will start going to the streets and then just having a taxi.

But now it's, it's affecting us directly and this is when it becomes dangerous.

And what you showed this morning is, is basically proof

that is, it's getting there.

We need to be prepared before we jump into it.

Uh, but I'm gonna go back few.

You did the show for the Tesla, and I saw a lot of that show we were together over

there, and a lot of high profiles come in.

How do you see that?

How do you see the people who are interested in seeing this

attacks and, and you did some chit chat, small chit chat with them.

Tell me about them because these, these are interesting people would love to hear

about them and, and see the perspective from your i from your vision also from.

How do you see?

How do they see this?

Absolutely.

So it was quite interesting because I was speaking with quite a few people

and also high profile people, and they also share that passion and that

excitement and that interest, and that was beautiful to see because you

know when you have that backing of.

High profile people like that you can accelerate all of those initiatives to,

to really make impact and drive progress.

So it was really great and I think they also love to, to see the demo

and sitting in the car and the car is doing things it shouldn't do, right?

Yes.

So it was great to have those, those conversations.

And with some people I also had long on conversations.

Right.

And it was really great to see that on a lot of things.

We are really on the same page and we are driving the progress now.

Yeah, I, I think it was, it was really great to see having those high profile

people also invested in the topic and, and wanting to put, to push something there.

And also they did also send some commands, right?

Yes.

That, that was, that was fascinating because they, they, the, not just

seeing it, but also they send the commands and seeing it on action.

And even no keys, no nothing.

Just the laptop and sending these commands.

Exactly.

It was, it was amazing.

Hands on.

Yes, it was.

So I, by the way, fun, fun fact at this point.

So when we had the Tesla honking multiple times, then nearby

executive stage, they heard it.

And I was speaking with Chris Roberts who was having a talk while our Tesla was

honking and he was, every time he had to honk, he was like, Yeah, . There we go.

This is great.

Uh, that, that's, that's the beauty of the community and this is what Black

Hat is, is bringing, is just having all these people interconnecting

with the same thoughts and they're just jumping at, and, and this is the

amazing part, uh, moving with the Tesla.

That might be like some, some of the things that, uh, I mean, you've

been into Dubai, you've been into the region, not just Saudi, uh, not

just the uae, other, other countries.

digitalization is huge.

And you mentioned a lot of that part is moving with the smart cities and

the the others, but how do you see the future of the cybersecurity?

It's, it's, I, I'd like to hear your perspective because,

uh, it's a big picture.

We don't know, it's the unknown.

We are heading there, but we, we don't know where we are going.

We know what we have now.

We can protect, protect some, some of the things that might happen.

But what, five, 10 years?

Uh, what do you think?

So it's a very broad question, and let me start off with, we are

the ones creating that future.

So it's really on us to define how it's gonna look like, and

I think it can go multiple.

and there are ways that I would prefer, and there are ways that I

really wouldn't like to to happen.

So one thing that can happen is that we are going to see some of those massive

cyber attacks happening because as we've seen it in the enterprise base, all of

those enterprises act after the hack.

Right after the hack, there's a budget to do it, but if we try to apply

the same concept for cyber physical systems, that's not gonna work because.

How is an after an airplane is crashing because of a cyber attack gonna look like,

We can't wait for that to happen, right?

So we really need to step in and accelerate.

Now we don't, we can't wait five or 10 years to have attacks like that

before we start acting in those spaces.

And that is really what we have to speak about.

You know, like, Just a few weeks ago, it was in England, uh, threat actors

managed to hack into water infrastructure and they would have been able to dump

a lot of chemicals, toxic chemicals into the water for 1.6 million people.

So attacks like that are already starting to happen, and I think as soon as those

threat actors realize how much pressure they can build by taking that, the

world is gonna look a lot different.

Because imagine you hack a company, you encrypt the data there.

That's how you build the pressure, right?

We have all of your company data of if you wanted back pay, pay us money.

But imagine you have those ransomware groups being able to call up an

airline and be like, Hey, so either you pay us a hundred million or we

are gonna crash two of your planes.

I mean, that builds a whole nother set of, of pressure, and I really fear that

as soon as the threat actors realize the value in it, they are gonna go ahead.

Because right now those things, they, they get demonstrated by security researchers.

Right?

But we are the good guys.

Yes, we do it to, to make sure that things are secure, but I feel

like the threat actors are slowly, slowly picking up there and.

We should prevent this.

So it can either go that route that we see those massive attacks, and then we

really start to, to act or we manage with the, with the backing that we have.

Um, and this is, this is gonna be a global task, right?

That's not gonna be very easy, but.

Let's say we are able to really accelerate cybersecurity now, we

are able to solve some of the press pressing problems that we have here,

and that is gonna, that is gonna come down to a few, few key pillars there.

But if we are able to do that, then we are able to build, uh, a more secure future

where cybersecurity is gonna enable.

The things that we are gonna build in the great future.

Now we, we spoke about smart cities, we spoke about drones.

Cyber security is not gonna prevent them from happening.

Cyber security is gonna enable them to operate securely and to

be an amazing experience, right?

Instead of being a total disaster, imagine a hack smart city in the Saudi

desert and someone turns off the.

That, that would, that would be a problem.

Right.

So that, that's really where now we have to accelerate and go ahead.

And for, for me, it comes down to a few things.

I mean, technology obviously is a huge part of it.

We need to build more efficient technology.

We need to automate some of the things because smart city example,

again, there will be so many data points and we, we can't just throw

people on that because they will be overwhelmed by everything coming in.

So we need to automate that.

We need to build more robust detection and prevention.

Cyber Trudy, for me, on a technical level, comes down to three things.

First one is visibility.

You need to have visibility into.

And smart city, great example.

Again, because it's so complex, you need to have visibility into

the status of your drones that are flying around in the status of your

water infrastructure, your heating.

It's, it's, you know, in a, in a enterprise environment, it's just

we have our endpoints, we have our cloud, but in a smart city,

it's also gonna look different.

Second part then is protection or, or prevention, however you want to call it.

That's why, that's why we also have to take a look at the basics, right?

A lot of high profile cyber attacks in in the past happened because the basics were.

I mean, having, having a, I'm not patching systems and a lot

of the basics is, is not there.

Exactly.

Default passwords.

Default passwords, Yeah.

Default policies instead of setting secure policies.

So that's, that's, that comes in the second pillar.

Like securing all of that.

Preventing, preventing those, those things there.

But we all know there's no 100% security, so that's why the third

pillar comes in and that's really huge.

One detection and response.

We need to be able to, Effective detection and response.

So as soon as we have a threat actor anywhere in the network, we

should be able to detect it very fast and respond to it efficiently.

But if we take a look at some of these statistics, I mean, how

long does it take for, for cies to detect threat actors in the network?

I think it, it's, it's, it's six months from, from what I've recently read.

Yes.

Some, some people, the, the time to detect, time to prevent it, it's huge.

So a lot of people.

Actors will stay there, will live there, and it's not

detected and it's, it is hard.

I mean, a lot of the things that happen during that, these attacks, and

you mentioned the detection and the response, but what if they are blinded?

Or what if the attackers advance enough to bypass all these security controls?

That's, I believe one of the things that cybersecurity talk

about is, is the security.

And is is the layer of security where you need to protect multiple layers.

But here's, here's a wonderful point to that.

I'm not quite sure where I heard it.

Um, so, but I'm, I'm gonna quote it.

So someone said, I wish I could recall who said it because it's, it's, it's

a very genius quote, but someone said, As soon as nation state actors.

You know, they have, they have capability, they have, uh, they have funding.

So as soon as nation state actors start using zero days to target to get access

to their target, then the world already made a lot of progress because right

now, nation state actors who really could go ahead and develop, develop zero days

that the world has never seen before to get access to their target, they, they

literally still use those basic security failures to get into their targets.

Right.

And that is so.

We really need to change.

So we need to up the game now and security and death is, is great, but

if we are still failing at the basics that that's what we have to talk about.

Right?

And that is something just in, in Australia there was this massive

data breach that exposed private data of millions of Australians.

You know, like credit card data, passports, driver's licenses.

A lot of sensitive stuff, and it was called a sophisticated cyber

tech and everything, but it was, again, a basic security failure.

So we have to first start really tackling this now, and then we can, we absolutely

have to talk about defense in, in depth then, And that's, that's really also where

we can take a look at ransomware, right?

Because I was pulling, I started doing that a few months ago.

I was pulling in the forensics reports of ransomware cases and I was taking a.

And it's quite funny because none of those ransomware cases was like

in initial intrusion and 10 minutes later everything was encrypted.

Most of them were like two days, three days.

So you had the initial exploitation and then the threat actors wandered around

the network for like two or three days and then they encrypted everything.

And for me, there was so many red flags in, in the timeline of

what the threat actor did, right?

I mean, if you.

If you exchange server randomly starts doing, you know, like network discovery

or is enabling your default administrator account and things like that, those are

red flags that we should be able to catch.

And I think we have great technology to do that.

So technology is, is one part.

To circle back to the, to the bigger question.

The other part really is people, talent and knowledge.

That is gonna be so incredibly important.

And, and you jump into that because I was, I was thinking about what,

when you talked about it a lot, , protecting the technologies, improving

the technologies, and having all these, But what about the people?

And you mentioned that you jump into people awareness, but what else?

The talent and Yeah, we need to develop the talent.

So I was speaking with someone, uh, who's he was, I think he

still sits on, on the board.

So he was sitting on the board of a bank and they, they had a major, So

I was asking him like, what happened?

And he was like, Well, so our intrusion detection system actually

was lighting up like a Christmas tree.

There was just no one sitting there being able to respond to it.

Wow.

And if we take a look at this globally, there definitely is skill shortage and

the lack of, of talents in, in the space.

So it's really on us, on the people who already are in the space to, to

develop that talent, to inspire those younger generations to get them in.

Because cyber security is an awesome field, you know?

Some people, uh, I can speak about it from, from a German perspective.

A lot of people in German, you have the perception know, like cybersecurity,

sitting with a hoodie in a windowless basement, never going out and, and

just sitting in front of a PC all day.

But that's not the reality, right?

I mean, just take a look around here at the event.

It's, that's wonderful.

Exactly.

And so one of the things that I, I wanna hear about it from, from your

perspective is you talked about the.

And probably a lot of, uh, the, the, the listeners now is from that

area, uh, and, and young usually.

What do you wanna tell them to improve themselves?

To, to be skilled, to be talented.

That they will help the nation, they will help their organizations

to protect from these attacks.

Uh, a lot of a lot of these questions comes from the young

saying, We don't know where to go.

We don't know what to do.

We need to jump, We have the passion, but they don't have the route.

Yes.

Tell me what do you wanna tell them?

So that is actually a huge issue that I see right now that I'm also actively

working on, um, on solving right now.

That there isn't really that, that route to get into this if you're

interested, but it's also important, really important to say that you can't

jump into cyber security straight away.

You have to start with the basics.

And we already heard in my story, right?

You have to understand how the things.

and then you're able to find a vulnerability.

So everyone who wants to get into cybers security, I really recommend

to first learn the basics of how the things work, and then you can put the

cybersecurity aspect on top because cybers security really isn't just running some

automated tools that you downloaded and then going at, that's really not it.

It's about understanding how the technology works, understanding

how the things interconnect, and then understanding where gaps.

So that, that's, that's the first part of that.

And then it's, it's an exciting field and if you develop the

passion, just, just go all in.

That is something that is so important.

You don't need to go to university, you don't need a degree, you don't need a

bootcamp, you don't need any certificates.

As long as you have the passion, you have the curiosity.

You can go ahead and you get into it.

Exactly.

And you mentioned the basics.

What are the basics?

What do you think?

What is the things that is important?

Well, it then it also, you talked about the, the programming and the coding.

Yes.

That's probably one of the major ones, but what, what others that they need to.

Absolutely.

So it kind of also depends on where exactly you want to go into the space.

So if you want to focus on web applications, you need to understand

how web application is built, how web application is deployed, and, and that's,

that's the things where you can just, you know, you can set up a web server,

just set up a virtual Linux machine, install Apache, go ahead there, right?

So you can actually use all of those technologies and then set them up, Learn,

learn how they work, learn how they inter.

So, you know, if you want to get into web applications, I was included.

Those are the points you need.

So I would recommend you learn at least one language in the

space at best, multiple, right?

So you know how web applications are built, where one abilities could be there.

You learn how the underlying infrastructure is, you know,

like how does a web server work?

How does that, that server itself work?

Like that operating system of that, right?

And then you can go ahead there if you want to learn.

App, you know, like apps for example, and the security there.

Then you can take a look at some of those programming languages and then

you can take a look at the SWIFT for, for iOS or or Java for Android.

Just build, build apps yourself.

And once you build apps yourself, you understand how they get deployed,

how they work internally, and then you're able to find those gaps.

And something that might be very interesting, if you code your first

app, you might be able to find vulnerabilities in your own app, Right.

That you just coded.

Exactly.

And, and so coding and applications, that, that is huge now because

of a lot of the, the digital.

But also I believe that the network, Yes, the networking, the, the system

admins, the, the engineering part.

Were building these systems.

Cause a lot of the configurations, as you mentioned, the the gaps that

happen is because of missing some conflicts that should be there.

Uh, these are also areas that to be improved.

Yes, Cloud is also a huge topic now, but to circle back to the networking aspect.

So what I always like to do when speaking with people is to ask

them, when you open Google, what?

And that's very interesting because the answers they, they really, they vary.

You know, some people are like, Well, you know, like Google shows up and

other people are like, Well, so the first thing that is gonna happen is

your device is gonna do a DNS request to figure out what is the IP address of

that server behind the domain google.com.

Right.

And then we are gonna have our.

Um, well, it, and some people go with it deeper, right?

Some people started with your TCP handshakes.

Yes.

And, and going ahead from there.

So, so that is a wonderful, wonderful question to ask, and if

you are able to answer that question at a, at a certain level, then.

So that is something that I would recommend anyone and

everyone out there to learn.

What happens when, when you open Google, because it's not

Google showing up, you know?

It's not that magic.

There's so much happening technically under the hood, and

just learning how that works.

It's, it's gonna give you some, some great insights, right?

Because then you learn about dns, you learn about tcp, you learn

about how those, the packets.

Exactly this, this is, this is very good example because, and,

and this is, I'm probably gonna use this question for, for the others.

Tell me how, how did you access Google, what happened?

And that, that is amazing.

So what's next for David?

And if you have final thoughts?

Yes.

Uh, you wanna tell the, the, the listeners, uh, So let me start off

with the, what's next question?

When is this podcast gonna get released so far?

It should, it should be within these, these days.

Okay.

Okay.

Uh, we'll see.

So maybe, maybe it's gonna be outdated when it's released.

Yeah, No, no, no, no.

But I'm, I'm just wondering how much I can tell because it, the question

is if it's gonna be launched when a podcast is, is getting out there, so.

Oh, interesting.

But it's, if, if, if it's gonna get out there very soon, it's not.

So I'm actually working on a project right now.

I can't speak too much about it, but after the Tesla story happened,

you know, as you mentioned, I was in Dubai, I was, uh, in Tel Aviv.

I was in the Silicon Valley for a few weeks speaking with, uh, high profile

C cells from Fortune 500 colonies to really figure out where, where

the massive gap in cyber acuity is.

And I really brought it down to a few points that I think I can start tackling.

So that's what I'm actually, that's what I'm actually

looking, looking into right now.

Um, to start a company to That's amazing.

Tackle some of those problems.

What I definitely will do is leave Germany because, I already mentioned

that technology and innovation really isn't present there.

We still use telefax machines, and then on the other side, you have awesome places.

Uh, it's, it's great what is happening in Dubai.

It's great what is happening in Riyad.

So seeing those places, seeing so many passionate people in one

place, it, it's really great.

So I'm gonna leave Germany and most certainly, it's actually gonna be

the region here that I'm moving to.

So, yeah, those are two things.

And maybe the next time when we speak, I can tell you about, Yeah, you can tell

me more about what the plan, and you are more than welcome to be here with us and,

and we will welcome you heavily on having us here in in, uh, uh, rdo, in the gcc.

Uh, last thoughts before we close this, this podcast.

So something that is really important, if we have listeners that are

young that aren't into the topic at all yet, something that is really

important is, and now listen closely.

You can do it.

That is the most important part.

You can do it, you know, hearing from, from the Tesla hiking guy or

whatever that, that sounds crazy.

But I was like all the people out there.

At one point I was just sitting there being curious about the

technology, just developing my passion, and it went from there.

And if you just follow your passion, if you have it, great

things are gonna happen, right?

And in cyber security, we have so many awesome people.

We really have awesome people here that want to help you,

that are gonna help you grow.

So, Yeah, the space is wonderful and I, I can just recommend everyone

to get into it and it's nothing you have to be afraid of or scared of.

It's a wonderful field, wonderful people, great opportunities, and no

matter who is listening, you can do it.

So yeah, I'm really excited about the future.

It's gonna be wonderful and I'm looking forward to, to what's next.

Thank you very much.

That's great.

Thank you.

Thank you for your, your time here, and I'm really happy

and thrilled to have you here.

In the podcast and I appreciate your thoughts.

I learned few things from you, uh, here and there and these stories also is, is

great to hear and hopefully, uh, everyone here listening to us is, is enjoying it.

Thank you so much David and uh, enjoy the, the show here and uh, we

will look for you to have you again.

Thank you very much.

Bye bye bye.