All language subtitles for qais arabic srt

Welcome, David.

Welcome.

It's wonderful to be here.

Thanks for having me.

Thank you so much for, for spending the
time with us, and thank you for being with

us here in in the Cyber Security Podcast.

Uh, first I welcome you also,
Andrea, since this is not

your first time here in Saudi.

And uh, I would like to
just give us quick, brief.

Yeah, it's, it's gonna be a long story.

So let me first start off
with, as you mentioned, rd.

It's beautiful to be here.

It's my first time in Rya and it,
it's great to see all of the things

happening here regarding myself.

That's, Yeah, it's a long story.

So let me just start from the
beginning and we can go from there.

Yes.

I'm a very curious person.

And when I got my first smartphone,
I was actually nine years old and

this was kind of cool, you know,
it was like tech and you could do

things there, but it wasn't much.

It was running Android,
four point something.

And then for my 10th birthday,
I got my first laptop.

And that's really what got me
into the tech and cybersecurity

industry in the end because.

I just wanted to know how do things work.

I was so curious to figure
out how do things work because

everyone was using them.

You know, everyone was
using those devices.

Everyone was doing Google searches, and I
asked myself like, How does work, because

it's not magic, it's only technology.

And then I also figured out that I am
now living in the best age I could ever

grow up in because I can leverage that
technology to learn about how it works.

And that's exactly what I did.

So I started coding because
that's apparently how all

of those things were built.

And I started coding my own apps and I
was uh, I think I was 11 when I backed

my dad to get like a robotic arm so
I could connect that robotic arm to

a respiratory pie and then build my
own software to control all of that.

It was a lot of fun back then, so
that's why I learned all the basics.

And a few years after that, I
was finding my first vulner.

And that was really interesting because
now I could do things with the commuter

system I shouldn't be able to do, and
that's that what really got me into

the industry because for one, it's
super interesting to learn about a

topic of cyber security and hacking.

But on the other side, you could already
see it's going to be one of the most

pressing challenges of tomorrow when we
are digitalizing our, our whole life.

Basically.

It starts off with smart homes, autonomous
cars, but even creating infrastructure

is fully digitalized in most parts now.

So I was seeing that and I was.

That is, I found my passion basically,
and I was spending like all my time on,

on learning it and getting into the space.

So even though school wasn't the next day,
I was staying up until 4:00 AM sitting in

front of my, my screen going into this.

That's amazing because I was thinking
what, being the young, usually you

will drive into gaming and, and, uh, a
lot of, you know, having a PlayStation

or a PC and playing with it and you
decided not going there and having

your dad to buy your raspberry.

That's like, that's changed.

Like what is the passion?

Why did you decide going there?

Is it your, uh, family interested in
the, the area or is it just yourself

being just passionate about it?

So, yeah, it's, it's
only me and my family.

So no one in my family is into tag.

Um, no one is, , my family
doesn't even speak English.

Right.

Okay.

And, and now I'm here
going ahead like this.

So it was really, because that's also
when I got into tech and I was , all

the good stuff was in English.

So it was like, I better
learn the language right

to, to understand all of it.

So that's how I started there.

I, I don't know.

Where exactly that that
passion really originates from.

But I was just curious.

I wanted to understand how
it works and that's basically

how the world works nowadays.

Everything is digitalized now.

Interesting.

And that, that it was so great to first
learn the, the fundamentals and then going

into cyber's security because I'm the
opinion if you want to hack something,

you have to understand how it works.

Because then you're able to
see what the gaps are and where

you might find your ways in.

Yes.

And also if you wanna secure
something, you cannot secure it while

you don't understand the baselines.

And I think what you did is, is great.

And tell me.

The, the first vulnerability that
you talked about, like, I think

you were young during that time.

Yeah, I think I was 13 or something
at this point, and was actually an

S Square injection, and that is a
vulnerability that has been there for,

for so long and it never goes away.

So even, even today, you have
developers still building that

vulnerability and I, I don't know how.

Why, but it's, it's, it's been there
for forever and it's probably also

gonna stay for quite some more time.

And it's quite funny because that's
where you're able to manipulate, um,

user input to then manipulate the
database that is underlying there.

So you can bypass authentication there,
or you can, you can even delete the

full database and things like that.

So it was really interesting to,
to discover that because then I

was able to do, Something with a
system I shouldn't be able to do.

Right.

By abusing that, that vulnerability
there and, and I didn't use it to cause

any, any problems or something, but
it was really interesting to see that.

Yes.

Yeah.

And, and a lot of people would call
that an ethical hacking is you are

responsible of finding it and then
helping to fix it, not rather than just

abusing it, which is, which is great.

Then tell me why did you come here
in reality and why are you here in.

So it's, it's really exciting here.

That is something.

So I'm from Germany and in Germany.

It's, Yeah, well we are, Technology and
innovation isn't as present as it is here

in the region, and it's just beautiful
to see you have so many young people

that are excited about creating a great
future and take a look at this event.

It's the first ever blackhead in the
Middle East, and it's an incredible event.

I think we have nearly 50,000
people signed up, and it's just

wonderful to see that excitement,
to see that passion that is here.

that is just wonderful when you
have so many passionate people in

the same room talking about the
important topics that are really

gonna gonna affect our, our future.

And something to actually also
continue in, in my own story here.

So I was intoa Rudy, spending
all my time on it, getting really

good at it, and then I was sitting
in a 10th grade in school in.

In the middle of nowhere in Germany.

I was sitting there in school.

I was 15 at this point actually.

And then I asked myself like, why
should I sit here and learn Latin or do

like power analysis if I could be out
there helping to protect organizations

from cyber techs, maybe even helping
to protect credit infrastructure.

So it was like, have to quit.

And here's where Germany kicks in again,
because in Germany you can't do it.

You have to go to school
by law until you are 18.

Oh, wow.

So that is, that is something that
also should be changed in my opinion.

And it was quite interesting because
I, I thought there must be a way.

You know, if you code something
and you have a bug in your, in your

code, you don't relax it back and
you're like, Well, there's a bug.

You know, That's the way it is.

You get into it and you fix it.

So I was trying to apply the same
principle there until I found someone

at the Chairman Chamber of Commerce and
he kind of understood what I was saying.

So it was literally driving, He
was driving to where I live and

it was in the middle of nowhere.

So like he was driving there for
two hours, taking a look at what I'm

doing and speaking with me, right?

So I showed him, showed him the stuff,
and then he gave me, Yeah, he gave me

a kind of special permission to only
go to school one or two days a week.

So they make the legal stamp on
that, and I can use the rest of

the time to, to further go ahead.

So yeah, that was, that was beautiful
because then I had, You can spend

more time now studying the, the, the
cybersecurity and then, and improving

yourself and skills and, and all that.

Exactly.

So, but that is something that con also
continued throughout the years that in

some places, , it's, it's very limited
when it comes to the will to innovate.

And to circle back to your initially
question, why I'm here now in, in Rya,

because here you, you really see the will
present to innovate, to change something.

And that is just, in my opinion,
really beautiful to see.

Yes.

And uh, I mean, having black hat here was,
was one of the anything thing that Saudis

is trying to do is to bring them and, and.

like you, like all of, I don't know if
you walked around the, the black hat

and the venue, you can see the CTFs,
the book bounties, the car hacking

villages, what we are gonna talk about
and even the drones and lock picking,

bringing all these together is amazing.

And having them and having all 50
plus people, a thousand people are,

are here to learn and, and improve.

I see that you wrote, uh, in, in, in
social media that you are, are a Tesla.

Yes, I, I'm a huge Tesla and I think
yourself and, and me in the morning.

We were having fun with Tesla.

Tell me about that.

And you told me about the story you
told me back then, uh, about, about how

you got into the Tesla a Absolutely.

So let's start off
with, uh, being a Tesla.

And so I'm not a car guy, I'm a tech
guy, but a Tesla is a computer on wheels.

So obviously that is something
that is just wonderful to see.

It really in, in the core, it's softer.

It's, it's, it's not the car, it's
the software that is running on it.

So that is really exciting.

Yes.

So I've been a Tesla fan
for, for a number of years.

I don't have one yet, but
I'm really looking forward.

So, yeah.

It was really funny this, this
morning when we did all of

our tricks with, with the car.

Yes.

And I mean, for us it's fun to
demonstrate it here and it's

really cool to see, but it's, it's
really a critical vulnerability.

Right.

And we can directly dive into the
story of how all of that unfolded.

Yes, yes, for sure.

So, uh, being a test fan, and
you mentioned a lot of tech guys

like Tesla because of, it's, it's
a technology that runs the car.

And some, and I would include myself
is I am also a car guy and, and, and

tech, and this is a combination for me.

Have a car that does both.

Uh, and tell me about the finding
and the one that you, you, the

administration did this morning.

Absolutely.

So the whole story started in January,
which is a, a few months already.

Okay.

So, . Originally I didn't even plan to
hack a car so that that wasn't even So

you were not just having a car to attack?

Exactly.

So I, I, I said I don't have a Tesla.

Right.

So I was just sitting there
in Germany and again, it was

curiosity that striked again.

Right.

This is basically the
key for cybersecurity.

You need to be curious.

Exactly, exactly.

That really is the, one of the keys there.

And I just wanted to underst.

How do things work?

Exactly, because here's something
that is quite interesting.

When we take a look at modern
cars, all of them call back to the

manufacturer and speak with their
bag and infrastructure constantly.

That's not only limited to Tesla.

A lot of other cars also do that.

So I was thinking from, from a hackers
perspective, if you can try to find

a vulnerability in wifi or Bluetooth,
but then you have to be near a car.

You can only have access
to one car at a time.

But if you would be able to get access to
that centralized entry point that we are

creating that single attack vector on the
manufacturer side that is connected to all

of the cars out there, then you would be
able to have a lot more impact remotely.

Okay, so I was actually just by
accident, taking a look at how some

of the things work on Tesla side.

And it's quite interesting because all
of those cars communicate with something

on Tesla side called the mothership.

That is their main, main server
on the backend infrastructure.

So I was just trying to
understand how exactly that works.

What, what technologies
are built in their.

And then I was discovering that
a piece of third party code was

connected to that mothership.

So that mothership is providing interfaces
for a lot of internal Tesla services.

Also some external stuff.

There was this piece of third party
code connected there, so I was

trying to dig deeper into that.

You know, I, I didn't even
expect to find a vulnerability.

I didn't even want to
find a vulnerability.

I was just curious digging into this,
um, trying to understand how it.

Exactly.

You're trying to see how things
works and how things connected.

Exactly, because that, that's
what you have to learn if you want

to figure out how exactly what
is going on behind the scenes.

So I was taking a look at this third
party piece of code and I figured

out that it's having access to some
kind of digital car keys and tos,

and it's, it's also storing them.

And I figured out it's storing them.

So they haven't been encrypted
so far from what I've seen.

And then they got stored into something
called repo, and I thought repo is

going to be a secure storage mechanism.

It's going to be evolved, it's gonna take
care of encryption and every, everything.

So I was trying to figure out
what repo is and it wasn't a

secure storage mechanism at all.

It was just a normal
postgre scale database.

So that was really interesting, um,
to know that there was a major flag.

And then I also figured out that
this piece of third party code,

you can read like some charging
statistics and, and stuff like that.

So I was like, What if I, I didn't expect
this to work, but what if I would be

able to craft a malicious request that is
like, Hey, you know, give me the charging

statistics, but then also hop a few
tables in the database and read me those

digital car keys and bring them to me.

So I was crafting that
malicious request and send it.

And really to my surprise, I got back
some of those digital car keys and I was

like, That is, that is really interesting.

So I was, I was pulling them
and with those you can approach

the Tesla mothership and be like
the, the car owner or, or Tesla,

and then issue some commands.

And those commands get sent from the
mothership to the car, and the car isn't

gonna question it because it comes from,
from Tesla's backend infrastructure.

Right, Exactly.

And with the, with the, with the proper.

Exactly.

So that was really interesting.

And at first I thought, you know,
I can read data that that's, that's

what I thought, you know, like where
a car is or what a car is doing.

But I also knew that there, there would
be a way to, to run commands on, on,

on their ride, but I didn't have a car
so needed to try it somewhere else.

Jump before jumping to the,
the, the changes that you have

done or the commands that you.

What kind of data you've seen?

You told me that the
locations and what else?

Yeah, you can see a lot of stuff.

So you can see the actual location, you
can see where the car is heading to.

You can see where it's navigating to
the speed you, you can see the speed,

you can see, You can even see like what,
what shift is selected, like what gear

the car is in and, and things like that.

You can see if music is playing,
you can see the AC settings, you.

Pretty much see all of it basically.

Yeah.

You know exactly what the car's doing
and where they're heading and, and,

and even I believe even if the seats
are, uh, the heaters of the seats

are running or, That's interesting.

And then now you collected all the, these
data, you know, all this information, but

these are, we would call them be donley.

You are collecting.

Now what, what is the changes or
the commands that you have done

exactly or we could have done, So
I needed a car to test it somehow.

Right.

So I'm not quite sure.

You also drive a Tesla, right?

Yes.

So do you have, do you have a
custom name set for your Tesla?

Yes, I do.

I, I put, I put a custom
name for my Tesla.

Exactly.

Because a lot of Tesla owners, students,
and some of them are very creative.

So I was pulling the
names for those Tesla.

And there was one name that was very
unique, so I was just taking that

name, putting it into Google and wrote
like Tesla next to it and Google.

And then a few tweets showed up from the
guy who was tweeting about his Tesla.

It was a Model X with that name.

Okay.

So I was texting him on Twitter and
I was like, Hey, do you still have

your Tesla, you know, with that name?

And interesting, he actually came
back and he was like, Like, what are

last six stitches of the VIN number?

Like if you actually have access.

So I was pulling that up and
I sent him like the VIN number

and he was like, That is my car.

And I'm like, Great.

And if you now give me the permission
please to, to run commands, that would

be great if, if we could do that.

And he was like, Yeah, I tried to do it.

Whatever.

So I was, at first I was doing
homeless stuff, you know, like

honking jo Horn and flashing the
lights and, and then he allowed it.

He exactly.

Feel free to do it.

Exactly.

Interesting.

And then I asked him to confirm
that he's a good guy and he,

he luckily was also into tech.

A lot of Tesla owners are Yes, exactly.

So he was seeing that, that it
worked and that was really, that was

surprising because, you know, that car
was in California, it always has been

in California, it's its whole life.

The Tesla owner is also in California
and he now, there's this random

request from Germany to like, at
first honk the horn, but then also

to unlock the doors from Germany.

And it just went through.

I, I expected this to be blocked, right?

Yes, exactly.

I mean, you, why would someone
send it from a different continent?

Exactly.

And sent all these requests, which is
interesting that it, it allowed it.

And also, so I logged into my
Twitter account and also my sum

account here in, in Saudi Arabia.

And then it showed me like those messages
where it was like, Hey David, it's very

unusual that you log in from here, so
please, now we just send your code.

Please put in the code.

You know, things like that.

And that wasn't present when sending
commands to the commands to the car.

And you could do a lot of things.

So to you can actually also combine some
of those things, which are interesting.

So you can locate where a car is, you can
turn off the century mode, which is the

security mode that watches those cars.

And the one also takes the
cam the videos for Exactly.

For everyone around it.

Exactly.

And then you can unlock
the doors, get in, and.

Start keyless driving, which means
you don't know who the owner is.

You've never seen the car before.

You just walk up.

You don't have the key, You just walk up.

You get in and you take
it for a road trip.

That's, that's, that's the scary part.

Now someone can steal your car.

I mean, the keyless
part is to help people.

If someone want to drive it
or move it, you can allow it.

As a test owner, I can allow
someone to move the car.

Exactly.

But now, Leveraged from a
attacker perspective you

can, You can steal the car.

Exactly.

Which is the scare part.

Sometime you go out and then you
cannot find your car cause someone

just turn it on and then left it.

Exactly.

But you can also do a lot of things
to mess with the owner itself.

Right.

So let's say you have a very important
business meeting you have to get to.

So you go out to your car, you
unlock it, and the car just lock.

So you unlock it again.

Car locks again.

Yes.

So eventually you get into your car
and you sit down and you want to start

driving, but then the triangle opens.

So you close the triangle again.

Triangle opens again,
and you close it again.

And then your car randomly starts
blasting music, you know, like very

loud that that would be quite an issue.

Right.

And then a YouTube video pops up,
which is like, Hey, so, So your car

has been hacked and it's quite funny.

When I posted about this on Twitter,
there was this one guy and he was like,

Yeah, that's the start of drive somewhere.

And I was like, What is drive somewhere?

He was like, Well, driving in
ransomware combined, uh, because that

is probably what we are gonna add to
because I could show you a message

to the Tesla under there and be like,
Hey, so either you pay me Bitcoin

or you miss your important meeting.

And it's also quite interesting because.

Dismiss all of that and, and
you, you get to start driving.

But what if I then set you a speed
limit to like five kilometers power?

You're not gonna make it to your
appointment on a, on a highway.

It will be dangerous as well.

It's not just messing with them.

You, it's, it's becoming also
dangerous and that's, that's

when it's becoming critical.

Absolutely.

and something that's
also quite interesting.

You have full control over the
AC so you can just blast someone

with like 40 degrees heat.

And you know how powerful a Tesla AC is.

It's incredible.

Yes, yes.

And, and, and blasting is, is
gonna be also scary if it's,

let's say in a heat area.

Let's say in Saudi we are, we have
a, a heat, it's, it's very hot.

And having a heated, uh, seats
on is gonna be even worse.

Uh, which is interesting.

All these components are now connected
and not just Tesla, every, everyone else,

even other cars, they have the same thing.

They start putting a sticker saying
this, This car can connect and send

data, and you can unlock and unlock.

It's a usability right now.

You are helping making
things convenient and easier.

But it is also scary because now it's.

Uh, uh, leverage for
the attackers to attack.

It's more attacking service.

Yes.

So how are we gonna protect this?

But that is actually a, a conversation
that is very, that has been brought up

in cyber's acuity since, since some time.

And I like, Usability versus security.

Exactly.

Because you know, the, the customers
demand, you know, like those convenience

features and the project managers warned
and the management of companies also

warned because it's probably gonna bring
in more revenue and things like that.

Right.

So how do we deal with that?

And that is, I don't have
the final answer for this.

That is a conversation we are
having as an industry, right?

How do we navigate between
usability and cybersecurity?

But what was interesting to point
out were two things that I think

are great learnings from this.

So one is we are connecting things that
haven't been previously connected to the

internet now in a massive extent to the.

You know, we don't do this to a few
hundred cars to see if it works.

Those aren't concept cars.

We are doing this to millions
of cars, tens of millions of

cars within the next decade.

So that is gonna be incredible.

Right.

And you know, if, if we see the, the
history, you know, like 80 years ago in

a car, there was no technology at all.

Then we had our traditional cars with
Canvas, a wifi and GSM interface,

your tire pressure monitoring system.

But what we are doing now is we
are connecting those cars to so

many more things, you know, like.

V tweaks, communication, like
communicating with other cars,

communicating with smart roads,
communicating with traffic lights, and

also over the year updates, APIs, fleet
service apps, as we just talked about,

whether a third party app, an official
Tesla app, or also app stores that are

known that are now getting considered.

And something that's quite
interesting is the EV charging port.

Because if you fill your gas car,
I mean gas goes in and that's it.

Right?

But as soon as you plug
in, in an V charging port,

constant data communication.

Yes.

So that is what happening here.

We are connecting things that
haven't been previously connected

to, to a massive extent.

Now the other thing is that
innovation is happening so far.

I mean, innovation is exciting, right?

I'm also excited about innovation and it's
wonderful to see what is happening there.

You have large companies, you have global
enterprises that want to, to innovate and

release some of those cool new features.

You have a lot of startups.

Exactly.

That's, that's what I'm, that's what
I'm trying to add to, because that

innovation is happening so fast now and
so many exciting people are working on

it, but at some point we have to pause.

We have to take a step back and make
sure the right security is implemented

and that is something that is, I.

That Tesla is already a
huge cyber, physical thing.

Right.

But it's still bound to the roads.

Let's take a look at drones.

I mean, drones are gonna
be a huge topic now.

Exactly.

Especially also here in the region.

Right.

So how are we gonna tackle the steer?

And as you also mentioned, smart cities,
that is a very, very huge topic and

we see the exact same progress here.

You know, 80 years ago there
was no technological city there.

There was nothing, It wasn't offline city.

And then we had somewhat connected cities,
you know, where we pulled data from, we

got statistics from, from certain data
points that we collected, and now we

are heading towards smart or cognitive
cities, which are gonna be interconnected.

There's gonna be a.

IOT and OT infrastructure, there's gonna
be a lot of interconnected systems that

can control certain aspects of that city.

And that's where we are gonna see the
exact same challenges, but we have to

really prevent them because when we take
a look at the cyber physical space, we

can't wait for a attacks to happen there.

We have to secure it.

Now let's take a look
at some other things.

I always take Uber as an example.

Let's say Uber gets hacked.

I mean, what's the effect on us?

We, we, we have to call a
taxi instead of using the app.

Yes.

But that's.

On cyber physical systems that is
gonna have direct impact on human lives

and we have to secure it right now.

We can't wait 10 years for that, you know?

And that is something where
a lot of people here agree.

I would say nearly everyone
agrees here with that.

And it's quite interesting also to,
just to mention that quickly, you, for

that blackhead here, you brought all
the guys, like all the names, everyone,

like Chris Roberts is here, the guy
who who hacked an airplane with flight.

I was just walking on the other side of.

Of the event location and you had the
car hacking village from Defcon and, and

Robert Lee, Ellie and, and those people.

So, Exactly.

And also the, the drones hacking, uh,
the, the smart city hacking also there

is, they have a, they built a great
city, uh, and they, they try to do some

things and the lights will shut off, the
signals will open, and, uh, you might

have car accidents and that's why it's,
it's becoming dangerous rather than

us, let's say five, 10 years ago, it.

if the system wind down as, as
you mentioned, if, if Uber winds

down, you will start going to the
streets and then just having a taxi.

But now it's, it's affecting us directly
and this is when it becomes dangerous.

And what you showed this
morning is, is basically proof

that is, it's getting there.

We need to be prepared
before we jump into it.

Uh, but I'm gonna go back few.

You did the show for the Tesla, and I saw
a lot of that show we were together over

there, and a lot of high profiles come in.

How do you see that?

How do you see the people who
are interested in seeing this

attacks and, and you did some chit
chat, small chit chat with them.

Tell me about them because these, these
are interesting people would love to hear

about them and, and see the perspective
from your i from your vision also from.

How do you see?

How do they see this?

Absolutely.

So it was quite interesting because I
was speaking with quite a few people

and also high profile people, and
they also share that passion and that

excitement and that interest, and
that was beautiful to see because you

know when you have that backing of.

High profile people like that you can
accelerate all of those initiatives to,

to really make impact and drive progress.

So it was really great and I think
they also love to, to see the demo

and sitting in the car and the car is
doing things it shouldn't do, right?

Yes.

So it was great to have
those, those conversations.

And with some people I also
had long on conversations.

Right.

And it was really great to
see that on a lot of things.

We are really on the same page and
we are driving the progress now.

Yeah, I, I think it was, it was really
great to see having those high profile

people also invested in the topic and, and
wanting to put, to push something there.

And also they did also
send some commands, right?

Yes.

That, that was, that was fascinating
because they, they, the, not just

seeing it, but also they send the
commands and seeing it on action.

And even no keys, no nothing.

Just the laptop and
sending these commands.

Exactly.

It was, it was amazing.

Hands on.

Yes, it was.

So I, by the way, fun,
fun fact at this point.

So when we had the Tesla honking
multiple times, then nearby

executive stage, they heard it.

And I was speaking with Chris Roberts
who was having a talk while our Tesla was

honking and he was, every time he had to
honk, he was like, Yeah, . There we go.

This is great.

Uh, that, that's, that's the beauty of
the community and this is what Black

Hat is, is bringing, is just having
all these people interconnecting

with the same thoughts and they're
just jumping at, and, and this is the

amazing part, uh, moving with the Tesla.

That might be like some, some of
the things that, uh, I mean, you've

been into Dubai, you've been into
the region, not just Saudi, uh, not

just the uae, other, other countries.

digitalization is huge.

And you mentioned a lot of that part
is moving with the smart cities and

the the others, but how do you see
the future of the cybersecurity?

It's, it's, I, I'd like to
hear your perspective because,

uh, it's a big picture.

We don't know, it's the unknown.

We are heading there, but we, we
don't know where we are going.

We know what we have now.

We can protect, protect some, some
of the things that might happen.

But what, five, 10 years?

Uh, what do you think?

So it's a very broad question,
and let me start off with, we are

the ones creating that future.

So it's really on us to define
how it's gonna look like, and

I think it can go multiple.

and there are ways that I would
prefer, and there are ways that I

really wouldn't like to to happen.

So one thing that can happen is that we
are going to see some of those massive

cyber attacks happening because as we've
seen it in the enterprise base, all of

those enterprises act after the hack.

Right after the hack, there's a budget
to do it, but if we try to apply

the same concept for cyber physical
systems, that's not gonna work because.

How is an after an airplane is crashing
because of a cyber attack gonna look like,

We can't wait for that to happen, right?

So we really need to
step in and accelerate.

Now we don't, we can't wait five or
10 years to have attacks like that

before we start acting in those spaces.

And that is really what
we have to speak about.

You know, like, Just a few weeks ago,
it was in England, uh, threat actors

managed to hack into water infrastructure
and they would have been able to dump

a lot of chemicals, toxic chemicals
into the water for 1.6 million people.

So attacks like that are already starting
to happen, and I think as soon as those

threat actors realize how much pressure
they can build by taking that, the

world is gonna look a lot different.

Because imagine you hack a company,
you encrypt the data there.

That's how you build the pressure, right?

We have all of your company data of
if you wanted back pay, pay us money.

But imagine you have those ransomware
groups being able to call up an

airline and be like, Hey, so either
you pay us a hundred million or we

are gonna crash two of your planes.

I mean, that builds a whole nother set
of, of pressure, and I really fear that

as soon as the threat actors realize the
value in it, they are gonna go ahead.

Because right now those things, they, they
get demonstrated by security researchers.

Right?

But we are the good guys.

Yes, we do it to, to make sure
that things are secure, but I feel

like the threat actors are slowly,
slowly picking up there and.

We should prevent this.

So it can either go that route that we
see those massive attacks, and then we

really start to, to act or we manage
with the, with the backing that we have.

Um, and this is, this is
gonna be a global task, right?

That's not gonna be very easy, but.

Let's say we are able to really
accelerate cybersecurity now, we

are able to solve some of the press
pressing problems that we have here,

and that is gonna, that is gonna come
down to a few, few key pillars there.

But if we are able to do that, then we are
able to build, uh, a more secure future

where cybersecurity is gonna enable.

The things that we are gonna
build in the great future.

Now we, we spoke about smart
cities, we spoke about drones.

Cyber security is not gonna
prevent them from happening.

Cyber security is gonna enable
them to operate securely and to

be an amazing experience, right?

Instead of being a total disaster,
imagine a hack smart city in the Saudi

desert and someone turns off the.

That, that would, that would be a problem.

Right.

So that, that's really where now
we have to accelerate and go ahead.

And for, for me, it comes
down to a few things.

I mean, technology obviously
is a huge part of it.

We need to build more
efficient technology.

We need to automate some of the
things because smart city example,

again, there will be so many data
points and we, we can't just throw

people on that because they will be
overwhelmed by everything coming in.

So we need to automate that.

We need to build more robust
detection and prevention.

Cyber Trudy, for me, on a technical
level, comes down to three things.

First one is visibility.

You need to have visibility into.

And smart city, great example.

Again, because it's so complex,
you need to have visibility into

the status of your drones that are
flying around in the status of your

water infrastructure, your heating.

It's, it's, you know, in a, in a
enterprise environment, it's just

we have our endpoints, we have
our cloud, but in a smart city,

it's also gonna look different.

Second part then is protection or, or
prevention, however you want to call it.

That's why, that's why we also have
to take a look at the basics, right?

A lot of high profile cyber attacks in in
the past happened because the basics were.

I mean, having, having a, I'm
not patching systems and a lot

of the basics is, is not there.

Exactly.

Default passwords.

Default passwords, Yeah.

Default policies instead
of setting secure policies.

So that's, that's, that
comes in the second pillar.

Like securing all of that.

Preventing, preventing
those, those things there.

But we all know there's no 100%
security, so that's why the third

pillar comes in and that's really huge.

One detection and response.

We need to be able to, Effective
detection and response.

So as soon as we have a threat
actor anywhere in the network, we

should be able to detect it very
fast and respond to it efficiently.

But if we take a look at some
of these statistics, I mean, how

long does it take for, for cies to
detect threat actors in the network?

I think it, it's, it's, it's six months
from, from what I've recently read.

Yes.

Some, some people, the, the time to
detect, time to prevent it, it's huge.

So a lot of people.

Actors will stay there, will
live there, and it's not

detected and it's, it is hard.

I mean, a lot of the things that
happen during that, these attacks, and

you mentioned the detection and the
response, but what if they are blinded?

Or what if the attackers advance enough
to bypass all these security controls?

That's, I believe one of the
things that cybersecurity talk

about is, is the security.

And is is the layer of security where
you need to protect multiple layers.

But here's, here's a
wonderful point to that.

I'm not quite sure where I heard it.

Um, so, but I'm, I'm gonna quote it.

So someone said, I wish I could recall
who said it because it's, it's, it's

a very genius quote, but someone
said, As soon as nation state actors.

You know, they have, they have capability,
they have, uh, they have funding.

So as soon as nation state actors start
using zero days to target to get access

to their target, then the world already
made a lot of progress because right

now, nation state actors who really could
go ahead and develop, develop zero days

that the world has never seen before to
get access to their target, they, they

literally still use those basic security
failures to get into their targets.

Right.

And that is so.

We really need to change.

So we need to up the game now and
security and death is, is great, but

if we are still failing at the basics
that that's what we have to talk about.

Right?

And that is something just in, in
Australia there was this massive

data breach that exposed private
data of millions of Australians.

You know, like credit card data,
passports, driver's licenses.

A lot of sensitive stuff, and it
was called a sophisticated cyber

tech and everything, but it was,
again, a basic security failure.

So we have to first start really tackling
this now, and then we can, we absolutely

have to talk about defense in, in depth
then, And that's, that's really also where

we can take a look at ransomware, right?

Because I was pulling, I started
doing that a few months ago.

I was pulling in the forensics reports
of ransomware cases and I was taking a.

And it's quite funny because none
of those ransomware cases was like

in initial intrusion and 10 minutes
later everything was encrypted.

Most of them were like
two days, three days.

So you had the initial exploitation and
then the threat actors wandered around

the network for like two or three days
and then they encrypted everything.

And for me, there was so many
red flags in, in the timeline of

what the threat actor did, right?

I mean, if you.

If you exchange server randomly starts
doing, you know, like network discovery

or is enabling your default administrator
account and things like that, those are

red flags that we should be able to catch.

And I think we have great
technology to do that.

So technology is, is one part.

To circle back to the,
to the bigger question.

The other part really is
people, talent and knowledge.

That is gonna be so incredibly important.

And, and you jump into that because
I was, I was thinking about what,

when you talked about it a lot,
, protecting the technologies, improving

the technologies, and having all
these, But what about the people?

And you mentioned that you jump into
people awareness, but what else?

The talent and Yeah, we
need to develop the talent.

So I was speaking with someone,
uh, who's he was, I think he

still sits on, on the board.

So he was sitting on the board of a
bank and they, they had a major, So

I was asking him like, what happened?

And he was like, Well, so our
intrusion detection system actually

was lighting up like a Christmas tree.

There was just no one sitting
there being able to respond to it.

Wow.

And if we take a look at this globally,
there definitely is skill shortage and

the lack of, of talents in, in the space.

So it's really on us, on the people
who already are in the space to, to

develop that talent, to inspire those
younger generations to get them in.

Because cyber security is
an awesome field, you know?

Some people, uh, I can speak about
it from, from a German perspective.

A lot of people in German, you have the
perception know, like cybersecurity,

sitting with a hoodie in a windowless
basement, never going out and, and

just sitting in front of a PC all day.

But that's not the reality, right?

I mean, just take a look
around here at the event.

It's, that's wonderful.

Exactly.

And so one of the things that I, I
wanna hear about it from, from your

perspective is you talked about the.

And probably a lot of, uh, the,
the, the listeners now is from that

area, uh, and, and young usually.

What do you wanna tell
them to improve themselves?

To, to be skilled, to be talented.

That they will help the nation,
they will help their organizations

to protect from these attacks.

Uh, a lot of a lot of these
questions comes from the young

saying, We don't know where to go.

We don't know what to do.

We need to jump, We have the passion,
but they don't have the route.

Yes.

Tell me what do you wanna tell them?

So that is actually a huge issue that
I see right now that I'm also actively

working on, um, on solving right now.

That there isn't really that, that
route to get into this if you're

interested, but it's also important,
really important to say that you can't

jump into cyber security straight away.

You have to start with the basics.

And we already heard in my story, right?

You have to understand how the things.

and then you're able to
find a vulnerability.

So everyone who wants to get into
cybers security, I really recommend

to first learn the basics of how the
things work, and then you can put the

cybersecurity aspect on top because cybers
security really isn't just running some

automated tools that you downloaded and
then going at, that's really not it.

It's about understanding how the
technology works, understanding

how the things interconnect, and
then understanding where gaps.

So that, that's, that's
the first part of that.

And then it's, it's an exciting
field and if you develop the

passion, just, just go all in.

That is something that is so important.

You don't need to go to university, you
don't need a degree, you don't need a

bootcamp, you don't need any certificates.

As long as you have the
passion, you have the curiosity.

You can go ahead and you get into it.

Exactly.

And you mentioned the basics.

What are the basics?

What do you think?

What is the things that is important?

Well, it then it also, you talked about
the, the programming and the coding.

Yes.

That's probably one of the major ones,
but what, what others that they need to.

Absolutely.

So it kind of also depends on where
exactly you want to go into the space.

So if you want to focus on web
applications, you need to understand

how web application is built, how web
application is deployed, and, and that's,

that's the things where you can just,
you know, you can set up a web server,

just set up a virtual Linux machine,
install Apache, go ahead there, right?

So you can actually use all of those
technologies and then set them up, Learn,

learn how they work, learn how they inter.

So, you know, if you want to get into
web applications, I was included.

Those are the points you need.

So I would recommend you learn
at least one language in the

space at best, multiple, right?

So you know how web applications are
built, where one abilities could be there.

You learn how the underlying
infrastructure is, you know,

like how does a web server work?

How does that, that server itself work?

Like that operating system of that, right?

And then you can go ahead
there if you want to learn.

App, you know, like apps for
example, and the security there.

Then you can take a look at some of
those programming languages and then

you can take a look at the SWIFT
for, for iOS or or Java for Android.

Just build, build apps yourself.

And once you build apps yourself,
you understand how they get deployed,

how they work internally, and then
you're able to find those gaps.

And something that might be very
interesting, if you code your first

app, you might be able to find
vulnerabilities in your own app, Right.

That you just coded.

Exactly.

And, and so coding and applications,
that, that is huge now because

of a lot of the, the digital.

But also I believe that the network,
Yes, the networking, the, the system

admins, the, the engineering part.

Were building these systems.

Cause a lot of the configurations,
as you mentioned, the the gaps that

happen is because of missing some
conflicts that should be there.

Uh, these are also areas
that to be improved.

Yes, Cloud is also a huge topic now, but
to circle back to the networking aspect.

So what I always like to do when
speaking with people is to ask

them, when you open Google, what?

And that's very interesting because the
answers they, they really, they vary.

You know, some people are like, Well,
you know, like Google shows up and

other people are like, Well, so the
first thing that is gonna happen is

your device is gonna do a DNS request
to figure out what is the IP address of

that server behind the domain google.com.

Right.

And then we are gonna have our.

Um, well, it, and some people
go with it deeper, right?

Some people started with
your TCP handshakes.

Yes.

And, and going ahead from there.

So, so that is a wonderful,
wonderful question to ask, and if

you are able to answer that question
at a, at a certain level, then.

So that is something that I
would recommend anyone and

everyone out there to learn.

What happens when, when you
open Google, because it's not

Google showing up, you know?

It's not that magic.

There's so much happening
technically under the hood, and

just learning how that works.

It's, it's gonna give you some,
some great insights, right?

Because then you learn about dns,
you learn about tcp, you learn

about how those, the packets.

Exactly this, this is, this is
very good example because, and,

and this is, I'm probably gonna use
this question for, for the others.

Tell me how, how did you
access Google, what happened?

And that, that is amazing.

So what's next for David?

And if you have final thoughts?

Yes.

Uh, you wanna tell the, the, the
listeners, uh, So let me start off

with the, what's next question?

When is this podcast
gonna get released so far?

It should, it should be
within these, these days.

Okay.

Okay.

Uh, we'll see.

So maybe, maybe it's gonna be
outdated when it's released.

Yeah, No, no, no, no.

But I'm, I'm just wondering how much
I can tell because it, the question

is if it's gonna be launched when a
podcast is, is getting out there, so.

Oh, interesting.

But it's, if, if, if it's gonna
get out there very soon, it's not.

So I'm actually working
on a project right now.

I can't speak too much about it,
but after the Tesla story happened,

you know, as you mentioned, I was
in Dubai, I was, uh, in Tel Aviv.

I was in the Silicon Valley for a few
weeks speaking with, uh, high profile

C cells from Fortune 500 colonies
to really figure out where, where

the massive gap in cyber acuity is.

And I really brought it down to a few
points that I think I can start tackling.

So that's what I'm actually,
that's what I'm actually

looking, looking into right now.

Um, to start a company to That's amazing.

Tackle some of those problems.

What I definitely will do is leave
Germany because, I already mentioned

that technology and innovation
really isn't present there.

We still use telefax machines, and then on
the other side, you have awesome places.

Uh, it's, it's great what
is happening in Dubai.

It's great what is happening in Riyad.

So seeing those places, seeing
so many passionate people in one

place, it, it's really great.

So I'm gonna leave Germany and most
certainly, it's actually gonna be

the region here that I'm moving to.

So, yeah, those are two things.

And maybe the next time when we speak,
I can tell you about, Yeah, you can tell

me more about what the plan, and you are
more than welcome to be here with us and,

and we will welcome you heavily on having
us here in in, uh, uh, rdo, in the gcc.

Uh, last thoughts before we
close this, this podcast.

So something that is really important,
if we have listeners that are

young that aren't into the topic at
all yet, something that is really

important is, and now listen closely.

You can do it.

That is the most important part.

You can do it, you know, hearing
from, from the Tesla hiking guy or

whatever that, that sounds crazy.

But I was like all the people out there.

At one point I was just sitting
there being curious about the

technology, just developing my
passion, and it went from there.

And if you just follow your
passion, if you have it, great

things are gonna happen, right?

And in cyber security, we
have so many awesome people.

We really have awesome people
here that want to help you,

that are gonna help you grow.

So, Yeah, the space is wonderful
and I, I can just recommend everyone

to get into it and it's nothing you
have to be afraid of or scared of.

It's a wonderful field, wonderful
people, great opportunities, and no

matter who is listening, you can do it.

So yeah, I'm really
excited about the future.

It's gonna be wonderful and I'm
looking forward to, to what's next.

Thank you very much.

That's great.

Thank you.

Thank you for your, your time
here, and I'm really happy

and thrilled to have you here.

In the podcast and I
appreciate your thoughts.

I learned few things from you, uh, here
and there and these stories also is, is

great to hear and hopefully, uh, everyone
here listening to us is, is enjoying it.

Thank you so much David and uh,
enjoy the, the show here and uh, we

will look for you to have you again.

Thank you very much.

Bye bye bye.