Conference Launch and Keynote

The Good, Bad, and Ugly: An Origin Story in Cybersecurity

Speakers: John Hammond, Research & Development Threat Operations Team, Huntress; Huxley Barbee (Organizer); Shweta Jain (Head of Mathematics and Computer Science Department, John Jay College)

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=F-FNc1kQkgE

Overview

John Hammond's keynote at BSides NYC 2024, titled "The Good, Bad, and Ugly: An Origin Story," offers a deeply personal and unusually candid look into the non-linear path to a successful career in cybersecurity. Far from a typical technical deep dive, Hammond, a prominent cybersecurity researcher, educator, and content creator at Huntress, shares his journey from an aspiring "hacker" to a respected industry figure, detailing the unexpected detours, significant failures, and pivotal moments that shaped his professional life. This talk serves as a powerful reminder that the road to success is rarely straight and often paved with invaluable lessons learned from mistakes.

The talk is particularly significant for its honest portrayal of vulnerability and resilience. Hammond doesn't shy away from recounting his expulsion from the U.S. Coast Guard Academy just before graduation, an event stemming from a series of disciplinary infractions and a "significant cyber violation." This raw account provides a unique perspective on integrity, accountability, and the transformative power of pursuing one's true passion, even when faced with seemingly insurmountable setbacks. For an audience of cybersecurity professionals and aspiring enthusiasts, Hammond’s origin story underscores the importance of perseverance, continuous learning, and finding one's unique place in a dynamic and challenging field.

Background

▶ Watch: Welcome, Code of Conduct, and Session Rules (0:00)

John Hammond's journey into cybersecurity began with a childhood fascination, much like many in the industry: a desire to "make video games" and later, to "become a hacker" as depicted in Hollywood. His initial foray into the field was sparked by an article titled "How to Become a Hacker" by Eric S. Raymond, which advocated for learning scripting and programming, notably Python, and experimenting with Linux. This early self-driven exploration laid the foundational interest that would later define his career.

However, Hammond's path diverged significantly during his pursuit of higher education and military service. Driven by a desire for service and a risk-averse approach to traditional college debt, he sought admission to a U.S. military service academy. He ultimately accepted an appointment to the U.S. Coast Guard Academy, an institution that, at the time, lacked a dedicated computer science program. This presented an immediate challenge, forcing him to pursue an electrical engineering degree—a field he openly admits had little relevance to his burgeoning passion for cybersecurity.

Despite the institutional constraints, Hammond relentlessly sought avenues to engage with technology. He continued to produce YouTube content, albeit on hold, and actively looked for opportunities to integrate cybersecurity into his demanding military cadet life. A pivotal moment arrived with the formation of the Coast Guard Academy's first cyber team, a concept that required "swindling some admirals and generals" into recognizing cybersecurity as a "sport" for their mandatory athletic time. This extracurricular activity, spurred by events like CyberStakes — a competition organized by DARPA (now with the Army Cyber Institute) — provided Hammond and his peers with their first exposure to competitive cybersecurity challenges, specifically Capture The Flag (CTF) events. These early experiences, though marked by initial struggles, were crucial in igniting his passion and providing a practical outlet for his technical interests, ultimately steering him towards the career he has today.

Key Findings

▶ Watch: Importance of Conference Survey for Future Improvements (3:25)

While Hammond's keynote is a personal narrative rather than a presentation of novel research, it delivers several profound "findings" or lessons critical for anyone navigating a career in cybersecurity or any challenging field. The primary finding is the non-linear and often unpredictable nature of success. Hammond vividly illustrates how his perceived "traditional path" through the Coast Guard Academy, intended to provide a secure future, ultimately led to his expulsion. This experience fundamentally reshaped his understanding of achievement, demonstrating that failures and detours are not just obstacles but can be catalysts for discovering a more authentic and fulfilling professional trajectory.

A second key finding revolves around the transformative power of passion and self-directed learning. Despite being in an environment that initially offered no direct path to cybersecurity, Hammond's unwavering dedication to learning, practicing, and teaching others through the nascent cyber team ultimately became his lifeline. This highlights that true passion can create opportunities where none explicitly exist, fostering skills and networks that prove invaluable outside conventional structures. His ability to build a successful YouTube presence concurrently with his academy struggles further underscores the importance of independent initiative and leveraging alternative platforms for growth and skill development.

Finally, the talk implicitly reveals the critical importance of mentorship and community support in navigating professional challenges. Hammond's eventual outreach to Kyle, the "chief janitor" (CEO) of Huntress, through a "cold call outreach to some stranger on the internet," was a direct result of him actively seeking guidance and connection after his military career path dissolved. This interaction ultimately led to his current role, emphasizing that networking, even in unconventional forms, and the willingness of others to offer support, are vital components of career advancement, especially after significant setbacks. These insights collectively form a compelling argument for resilience, adaptability, and the courage to redefine one's own definition of success.

Technical Deep Dive

▶ Watch: Sponsor Passport Game for Raffle Prizes (5:05)

While John Hammond's keynote explicitly states it is not an "extremely technical" talk, it provides valuable insights into the technical elements that shaped his journey into cybersecurity and the practical application of defensive measures. His initial interest in hacking led him to Python as his first programming language, a foundational skill that remains critical in modern cybersecurity for scripting, automation, and exploit development. Concurrently, he experimented with Linux, a ubiquitous operating system in security, providing a robust environment for security tools and practices distinct from mainstream consumer operating systems.

A significant portion of his technical development occurred within the context of Capture The Flag (CTF) competitions. These competitive events were his introduction to practical cybersecurity, encompassing diverse challenges such as:

• Jeopardy-style challenges: These involve solving a variety of isolated problems across different categories.
• Binary breaking: Reverse engineering and exploiting compiled executables, a core skill in vulnerability research and exploit development.
• Web application security: Identifying and exploiting vulnerabilities in web applications (e.g., SQL injection, XSS, insecure direct object references).
• Cryptography: Solving challenges related to encryption, decryption, and cryptographic protocols.

These CTFs, including CyberStakes, CDX (Cyber Defense Exercise), and NCX (NSA Cyber Exercise), provided a hands-on learning environment, allowing him to "cut his teeth" on real-world security problems. This practical exposure was crucial, especially given the lack of a formal computer science program at the Coast Guard Academy.

One specific technical demonstration he recalls preparing for VIPs at the academy was an exercise related to the Heartbleed vulnerability. This critical flaw (CVE-2014-0160) in OpenSSL allowed attackers to read portions of a server's memory, potentially exposing sensitive data. Hammond's simplified demonstration involved a command-line interface where users would input a word (e.g., "apple") and declare its length. If the declared length was significantly greater than the actual length (e.g., claiming "apple" was 500 characters long), the program would "spit back some more data" from memory, visually replicating the data leakage characteristic of Heartbleed without requiring deep technical understanding from the VIP audience. This anecdote highlights the challenge of translating complex vulnerabilities into understandable concepts for non-technical stakeholders.

A critical "blunder" in his journey involved the use of NirSoft tools. NirSoft offers a collection of legitimate utilities for Windows, many of which are designed for system diagnostics, password recovery from cached data, and network analysis. Hammond admits to "stupidly" running one of these password recovery tools on an academy computer while on "busy work" in the IT shop. This action triggered an alert from the Host-Based Security System (HBSS), a suite of security products (often McAfee-based) deployed on endpoints to detect and prevent malicious activity. HBSS is designed to monitor system integrity, detect intrusions, and enforce security policies. Hammond's use of a tool that could "uncover passwords" was flagged as a "significant cyber violation," leading to further disciplinary action and his ultimate removal from the Coast Guard. This incident serves as a stark reminder of how endpoint security solutions monitor and respond to suspicious activities, even when performed by authorized personnel without malicious intent.

These technical mentions, while not forming a "deep dive" into a specific research topic, collectively illustrate the diverse technical landscape an aspiring cybersecurity professional must navigate, from foundational programming to understanding complex vulnerabilities and the mechanisms of endpoint detection.

Demo / Proof of Concept

▶ Watch: Introduction of Professor Shweta Jain from John Jay College (6:08)

The primary demonstration discussed by John Hammond in his keynote was a simplified replication of the Heartbleed vulnerability (CVE-2014-0160). This proof of concept was designed to be accessible to VIPs and high-ranking military officials who were "very detached from technology and cyber security."

The demonstration utilized a command-line interface that Hammond had developed. The core concept was to illustrate how an attacker could request more data than legitimately available from a server's memory, leading to a "leak" of unintended information. Hammond explained it using an analogy to the popular XKCD comic that depicted Heartbleed.

Here's how the demo worked:

1. User Input: The VIP would be prompted to enter a word, for example, "apple."
2. Declared Length: The user would then declare the length of that word. For "apple," the correct length is five letters.
3. Vulnerability Simulation: If the user declared a length significantly larger than the actual word length—for instance, stating that "apple" (5 characters) was "500 characters long"—the application, simulating the Heartbleed bug, would not just return "apple" but would "spit back some more data." This additional data would be random bytes from the server's memory, demonstrating the information leakage.

Hammond recounted an amusing anecdote from one such demo: a high-ranking official was handed a wireless keyboard but held it backwards, unaware of how to use it. This incident underscored the significant gap in technological understanding between cybersecurity practitioners and some decision-makers, highlighting the challenge of effective communication and demonstration in the security field.

This demonstration, while rudimentary in its implementation, effectively conveyed the essence of Heartbleed's impact—the unauthorized disclosure of memory contents—in a concrete and understandable manner for a non-technical audience. It served as a practical example of how complex vulnerabilities can be simplified to educate and raise awareness among critical stakeholders.

Defensive Implications

▶ Watch: John Jay's NSA Center of Excellence and Student Leaders (7:50)

John Hammond's personal origin story, particularly his "blunders" and the establishment of the cyber team, offers several valuable defensive implications for individuals and organizations.

Firstly, the incident involving NirSoft tools and the subsequent detection by HBSS (Host-Based Security System) is a direct lesson in endpoint security monitoring and policy enforcement. Even without malicious intent, running tools capable of password recovery (like some NirSoft utilities) on a managed system can trigger alerts from host-based intrusion prevention/detection systems. This highlights:

• Importance of HBSS/EDR: Robust endpoint detection and response (EDR) solutions are crucial for identifying anomalous or policy-violating activities, even from trusted insiders.
• Clear Policies and Training: Organizations must have clear policies regarding the use of unauthorized tools, even those that seem benign. Regular training on these policies is essential to prevent accidental violations by personnel, especially those in IT or security roles who might be tempted to use such tools for convenience.
• Principle of Least Privilege: Granting users, even IT staff, only the necessary permissions and tools for their specific tasks can mitigate the impact of accidental misuse.

Secondly, Hammond's journey with the Coast Guard Academy's cyber team underscores the critical need for talent identification, development, and retention within organizations, especially those in critical infrastructure or government. Even in environments without formal cybersecurity programs, fostering extracurricular activities like CTFs can:

• Cultivate Practical Skills: CTFs provide invaluable hands-on experience in areas like binary analysis, web exploitation, and cryptography, which are often difficult to teach in traditional academic settings.
• Build a Cyber Workforce Pipeline: By identifying individuals with a passion for cybersecurity, organizations can proactively develop internal talent, creating a dedicated workforce that understands the unique operational context.
• Promote Innovation: Allowing individuals to explore and experiment, even if initially outside formal structures, can lead to innovative solutions and a more adaptable security posture. The cyber team's eventual success in national competitions (CDX, NCX, CyberStakes) demonstrates the tangible benefits of investing in such initiatives.

Finally, Hammond's overall narrative emphasizes integrity and accountability as foundational pillars of cybersecurity defense. His expulsion stemmed from a series of "honor violations," culminating in a "significant cyber violation." This serves as a reminder that technical proficiency alone is insufficient; ethical conduct, adherence to rules, and personal accountability are paramount in a field entrusted with protecting sensitive data and critical systems. Organizations must foster a culture where integrity is valued as highly as technical skill, as a lapse in the former can undermine all defensive efforts.

Key Takeaways

• Success is Not a Straight Line: John Hammond's journey exemplifies that career paths, especially in dynamic fields like cybersecurity, are often unpredictable, filled with detours, and shaped by unexpected failures. Embrace the "good, bad, and ugly" as part of your unique origin story.
• Passion Drives Perseverance: Despite institutional barriers and a lack of formal computer science education at the Coast Guard Academy, Hammond's deep passion for cybersecurity led him to create opportunities (like the cyber team and YouTube content) and persist through significant setbacks.
• Learn from Mistakes and Failures: His candid sharing of disciplinary actions and his eventual expulsion highlights that mistakes, even severe ones, can be powerful learning experiences and catalysts for redirection if approached with reflection and a commitment to growth.
• Practical Experience through CTFs is Invaluable: Competitive cybersecurity events like Capture The Flag (CTF) challenges provide essential hands-on learning, allowing individuals to develop and sharpen real-world skills in areas such as binary exploitation, web application security, and cryptography.
• Endpoint Security Matters (HBSS/EDR): The incident with NirSoft tools triggering HBSS alerts demonstrates the practical function of host-based security systems in detecting policy violations and suspicious activity, even from insiders. It underscores the importance of robust EDR and clear security policies.
• Mentorship and Community are Crucial: Hammond's eventual "cold call" outreach that led to his role at Huntress emphasizes the power of networking, seeking mentorship, and leveraging community connections to navigate career transitions and find new opportunities.

About the Speaker(s)

John Hammond is a highly respected cybersecurity researcher, educator, and content creator. He currently serves on the Research & Development Threat Operations team at Huntress, where he focuses on analyzing malware and making "hackers earn their access." Prior to his role at Huntress, Hammond was an instructor at the Department of Defense Cyber Training Academy, where he taught both civilians and military members offensive Python, PowerShell, and other scripting techniques. He is also a well-known YouTube personality, recognized for his programming tutorials, CTF video walkthroughs, and broader cybersecurity content. His origin story includes significant time at the U.S. Coast Guard Academy, where he founded and captained their cyber team, despite the institution not having a formal computer science program at the time.

Huxley Barbee is the dedicated organizer for BSides NYC. He opened the conference, welcoming attendees and setting the tone for the event, including outlining the code of conduct, logistical details, and acknowledging the sponsors.

Shweta Jain is a Professor and the Head of the Mathematics and Computer Science Department at John Jay College. She spoke on behalf of John Jay College, the event's primary sponsor, highlighting the college's diversity, its recent designation as an NSA Center of Excellence in Cyber Defense, and its commitment to fostering talent, including their active Computer Science Society. She played a key role in introducing John Hammond as the keynote speaker.