You are either technical, or you are not.

What does it mean?

Many tried to answer that borderline philosophical question, but as far as I know no one is really able to pin it down to specifics. This is because it’s one of these things where ‘you know it when you see it’. The depth of our knowledge about different subjects varies and there is absolutely not a single list, or ultimate criteria that can be applied to tag someone as ‘technical’ or ‘non-technical’.

Where does it leave us?

You are either technical, or you are not.

What does it mean?

For every aspect of infosec there exist a practitioner layer, often manifesting itself by an individual’s capability to deliver. You can master this level and still not be ‘technical’. Because being ‘technical’ means being fluent on this practitioner layer, plus more. For example:

• Can use existing tools to deliver, but can also validate the tools’ output, or even write better tools
• Sees gaps in existing tools and either improves the tools, or changes methodology
• Sees events on multiple levels of abstractions (f.ex. thanks to knowing protocols, knowing how org works, how malware works, how advanced authentication protocols work, etc. aka knows what happens ‘under the hood’)
• Sees connections where others don’t
• Actually reads the fucking manuals and RFCs
• Experiments and ‘has itchy fingers’

You are either technical, or you are not.

What does it mean?

You are technical when you are one upping yourself against the average of your peers…

It’s not about knowing to program, reverse engineering code, analyzing packets, or discovering vulnerabilities. It’s about optimization, pioneering solutions, knowing the tools best for both their best and their worst, being inquisitive, finding out, then leading and sharing knowledge. It’s about not being an arsehole, but the waterhole. It’s about being the inspiration as much as being easy to be inspired. It’s not about being ‘technical’ at all. It’s about spotting ‘more technical than you’ and… following, raising the bar, challenging the status quo.

A ‘technical’ person is always a disruptor and a game changer.

In his book Beyond Fear: Thinking Sensibly About Security in an Uncertain World, Bruce Schneier tells us that:

a) 9/11 was a evilish, but brilliant plan,
b) risk assessment is hard, but most importantly,
c) У страха глаза велики (Fear Has Big Eyes).

SolarWinds hack is a evil genius, and even if the fallout is going to last for months we do need to pause to contemplate the technical capability involved. If you follow me on Twitter or read my stuff here, you know that I absolutely detest the word capability. It is a buzzword of people who don’t understand technology, and anti-buzzword for people like me – who are civilians, never served and can’t think in strategic, military terms, but are at least bad programmers.

The capability is not coding per se, of course. It is not even staying under radar of security solutions for a few months, or even for more than a year. The real capability is making the backdoor code seamlessly integrated with a code base so that it can be compiled with no errors, and/or compiling your own version of the binary and swapping it at a right time so that it can be signed by the building environment.

The finesse of this maneuver cannot be understated / overlooked.

Now… malicious modification of a source code is actually not that uncommon and not that hard to pull off. Every web site defacement of the past included changing some source files (HTML /ok, not code, but always/, PHP, ASP, etc.). Many e-commerce hacks, especially within PCI space include some sort of modification of the web site’s source code (e.g. add event handler to form submission events to steal credit card details, etc.). Zeus and other infostealers’ injects were genius too.

BUT

Somehow, code modification of the standalone, non-web site component, that is, a source code that is compiled into a binary executable is much harder. You know that if you ever tried to compile a source code taken from github or Code Project. So many things can go wrong. I have yet to encounter a source code that compiles on my box w/o any error from a compiler. To make FaaS work it took me good 3 days of troubleshooting.

This brings me back to capability. The surgical operation that (according to what is known) relies on a code injection into a pretty large software source code live branch – source code that changes constantly and is very dynamic in nature, is the skill and tradecraft one has to respect. Is it on the same level as Stuxnet? Definitely not, but it is way above your average red team pay grade.

People coding botnets, rogue anti-spyware, bank infostealers are good malware programmers. People developing 0days and injecting source code into live code branches are very good malware programmers. There is just a few in the world that can really offer this capability. It’s sad, because they will never be able to travel, live in other places, and enjoy any sort of freedom we average people enjoy.

Kowtow and RIP – you will be pwned one day.