130: Jason's Pen Test

Key takeaways

Curiosity can lead to unexpected career trajectories; Jason's initial foray into the underground paved the way to a respected position in cybersecurity.
Penetration testing encompasses both ethical hacking and a thorough understanding of vulnerabilities to enhance security measures.
Humor and creativity are essential tools in the cybersecurity field that can help professionals navigate challenging scenarios.
Real-world consequences of poor cybersecurity practices can impact individuals and organizations, underscoring the importance of vigilant security testing.
The role of penetration testers is crucial in identifying vulnerabilities that could leave organizations exposed to cyber threats.

Summary

Navigating the Dark Side of the Internet

In this segment, Jason Haddix shares his early experiences diving into the world of cybersecurity and computer hacking. He recounts his time as a member of Shadow Crew, a prominent darknet forum, where he learned tricks for creating fake IDs. This curiosity and experimentation led him down a path of understanding both the potential and pitfalls of unauthorized access, which culminated in a pivotal experience that made him reconsider his journey into the underground.

The Evolution of a Penetration Tester

After his experiences with Shadow Crew, Jason transitioned into a legitimate career in cybersecurity, taking courses and eventually becoming a penetration tester. He narrates his progress as he engaged in various penetration tests, detailing his responsibilities at HP and the numerous assessments he conducted for Fortune 500 companies. This section highlights the growth of Jason from a curious teenager to a professional navigating the complexities of cybersecurity while maintaining ethical standards.

Uncovering Major Security Flaws

Jason shares his memorable experiences during penetration tests, particularly focusing on a mobile banking app where he discovered serious vulnerabilities. He explains the technical details of these findings, emphasizing both network and application testing as critical areas of focus. The anecdote about an open Amazon S3 bucket storing sensitive check images dives into the real-world implications of poor security practices, showcasing the vital role penetration testers play in protecting data.

Humor in the Field of Security

The discussion also explores lighter moments from his career, including stories about the unique methods he employed during physical penetration tests, such as using a blow-up doll to bypass security mechanisms. These anecdotes not only provide comic relief but also illustrate the creativity required in the field of penetration testing. Jason reflects on the importance of humor in a high-stakes environment while shedding light on the ethical dilemmas and challenges faced by security professionals.

Show notes

Join us as we sit down with Jason Haddix (https://twitter.com/Jhaddix), a renowned penetration tester who has made a name for himself by uncovering vulnerabilities in some of the world’s biggest companies. In this episode, Jason shares his funny and enlightening stories about breaking into buildings and computers, and talks about the time he discovered a major security flaw in a popular mobile banking app.