Keynote - John Hammond

The Infosec Yard Sale: Navigating the Overabundance of Everything

Speakers: John Hammond, Security Researcher, Huntress

Conference: SAINTCON

YouTube: https://www.youtube.com/watch?v=7HbedwAAfCI

Overview

John Hammond's keynote at SAINTCON, titled "The Infosec Yard Sale or Overabundance of Everything," delivers a thought-provoking exploration of the overwhelming volume of information, tools, vulnerabilities, and career paths within the cybersecurity industry. Hammond, a security researcher at Huntress and a popular online content creator, uses the metaphor of a sprawling, cluttered yard sale to illustrate the sheer scale of data and resources that both new entrants and seasoned professionals must contend with. The talk addresses the pervasive feelings of analysis paralysis, impostor syndrome, and burnout that arise from attempting to absorb "everything" in a field that is simply too vast for any single individual to master.

This presentation is particularly salient for anyone involved in cybersecurity, from those just starting their journey to veterans grappling with the rapid pace of change. Hammond argues that while the overabundance can be daunting, it also represents a net positive: an unprecedented wealth of free educational resources and a thriving, accessible hacker culture. He challenges the audience to shift their perspective, moving from a mindset of trying to know it all to one of selective focus, passion-driven learning, and community contribution. By highlighting practical examples of community-driven knowledge bases and a specific social engineering attack vector, Hammond provides both a philosophical framework and tactical advice for navigating the "infosec yard sale" effectively.

Background

▶ Watch: Introduction and the 'infosec yard sale' concept (0:00)

The cybersecurity landscape is characterized by an exponential growth in data, threats, and technological complexity. This relentless expansion creates a unique challenge for professionals: the feeling that one must constantly learn and keep up with an ever-increasing flow of information. Hammond vividly captures this sentiment, noting that the field is "too big," with "too much stuff to learn, too much to keep track of." This leads to a state of analysis paralysis, particularly for newcomers eager to enter the industry but unsure where to begin.

A prime example of this overwhelming complexity is the often-circulated "cybersecurity roadmap" of certifications and training. Hammond presents an "old picture" of such a roadmap, dating back to July 2024, highlighting its unhelpfulness due to its sheer density and the implication that one must follow a rigid, exhaustive path. This visual reinforces the idea that the industry presents an "overwhelming too much stuff," including "too many vendors, job requirements, thought leaders, influencers, conferences, acronyms, alerts, buzzwords, vulnerabilities, threat actors, checklists, certifications, products, and layoffs." The common lament, "In cyber security, there are too many blank," is easily filled by the audience with myriad examples, underscoring the universal experience of information overload.

This constant pressure to know everything often culminates in a "triforce" of negative consequences: stress, burnout, and impostor syndrome. Professionals are made to feel inadequate if they cannot track every new vulnerability, every emerging threat actor, or every latest buzzword. Hammond suggests that this problem stems from a traditional view of "hacker culture" where knowledge was once seen as "voodoo witchcraft dark arts," accessible only to a select few "wizards." This perception fostered an environment where information was hoarded, making the learning curve steep and exclusive. The modern era, however, has fundamentally changed this dynamic, leading to the "overabundance of everything" that is both a curse and a blessing.

Key Findings

▶ Watch: Imposter syndrome and 'no cybersecurity experts' argument (2:00)

Despite the apparent chaos of the "infosec yard sale," Hammond posits a crucial reframe: the overabundance of resources, particularly free resources, is a net positive for the industry. Contrary to the nostalgic view that "hacker culture" has declined, Hammond, echoing sentiments from entities like VX Underground, argues that it is "better now and more alive than it's ever been." This is attributed to the proliferation of accessible educational materials: websites, war games, cyber ranges, university lectures, conferences, and content creators. This accessibility has democratized knowledge, moving away from the "wizardry" of the past to an era where anyone can "cut their teeth and learn and get sharp" on cybersecurity skills.

The core insight is that while you "can't absorb all of it" or "know everything in cyber security," you don't have to. The solution lies not in attempting to consume the entire "fire hose" of information, but in selective focus and specialization. Hammond advises professionals to "get what you like," to pursue areas that genuinely interest them and that they find fun, as this is the only sustainable way to maintain passion and avoid burnout. This approach allows individuals to carve out their own "roadmap," prioritizing knowledge that aligns with their career goals (e.g., a blue teamer might not need to delve into web3 blockchain or industrial control systems).

Furthermore, the talk emphasizes the critical role of community contribution. By documenting one's learning, taking notes, and then sharing those "gems" with others, individuals can help curate the vast "yard sale" of information. This collective effort transforms the overwhelming noise into valuable signals, making the industry more navigable for everyone. Hammond's call to action is for individuals to share their knowledge, no matter how "simple and small and stupid" it might seem, because it contributes to a shared understanding that benefits the entire community, much like the collaborative projects he highlights.

Technical Deep Dive

▶ Watch: Overwhelming 'yard sale' of infosec knowledge for newcomers (4:00)

While the talk's overarching theme is philosophical, Hammond grounds his arguments in concrete technical examples, demonstrating how community-driven efforts have transformed the accessibility of critical security knowledge. He highlights a series of "Living Off the Land" (LOL) projects, which are invaluable resources for both offensive and defensive security practitioners.

The first examples are LOLBins (Living Off the Land Binaries and Scripts) and GTFOBins (GTFO Binaries). LOLBins, also known as LOLBAS (Living Off the Land Binaries, Scripts, and Libraries), are collections of native Windows programs and applications that can be "used and abused by threat actors, hackers, cyber criminals to do more post-exploitation or lateral movement or exfiltration." These are not malware in themselves but legitimate tools pre-installed on the operating system that can be weaponized. GTFOBins is the Linux equivalent, cataloging Unix binaries that can be exploited for privilege escalation, arbitrary code execution, and other malicious activities, often leveraging set UID binaries or sudo privileges. These resources are critical because they detail techniques that are not always caught by traditional signature-based antivirus, requiring behavioral EDR solutions to detect their abuse.

Hammond then expands on the "LOL" trend, showcasing how this concept has branched out into specialized areas:

• LOL.Farm: A meta-resource that collects and catalogs various "Living Off the Land" projects, extending beyond just Windows or Linux binaries to cover Active Directory environments, common false positives for security products (SIEM, EDR, XDR), and more.
• LOL Drivers (Living Off the Land Drivers): A project that lists vulnerable kernel drivers, including their hashes (e.g., SHA256), that can be exploited for privilege escalation on endpoints. This resource is crucial for understanding how adversaries can gain deep system access and for informing efforts like Microsoft's kernel driver blocklist.
• LOL Trusted Sites (Living Off the Land Trusted Sites): This project focuses on how threat actors can leverage legitimate, trusted third-party cloud services and online applications (e.g., Dropbox, Google Drive, GitHub) for command and control (C2), data exfiltration, or phishing. Defenders can use this information to configure network traffic rules and limit the attack surface by blocking or monitoring unusual activity to/from services not typically used by their organization.
• LOL C2 (Living Off the Land Command and Control): A collection of applications that can be repurposed for C2, essentially turning legitimate software into remote access tools. Hammond humorously notes that "anything could be a C2" if one tries hard enough, even mentioning Counter-Strike as an example.

Beyond these curated lists, Hammond also points to GitHub Awesome Lists as another vast, free repository of categorized resources covering diverse areas like cyber deception, honeypots, AI security, web3, IoT, embedded systems, and operational technology (OT/ICS).

The talk culminates in a detailed anecdote about a specific social engineering attack technique known as ClickFix or Recaptcha Fish. This attack leverages "weaponized copy-paste" by tricking users into executing malicious commands through seemingly innocuous steps. Hammond describes a variant seen in August or September 2024, utilized by Llama Stealer malware. The attack works by presenting a fake CAPTCHA on a website, instructing the user to "verify you're human" by pressing Windows key + R, then Ctrl+V, and finally Enter. Crucially, the malicious website has already "pre-poisoned the contents inside of your clipboard" using JavaScript, which web browsers permit. This means the Ctrl+V action pastes a pre-defined malicious command into the Windows Run dialog box (Win+R), which is then executed upon pressing Enter.

Hammond admits to creating a more "fulfilling, more realistic Google recapture" PoC for this technique and sharing it on GitHub, intending to raise awareness. However, this PoC was subsequently adopted by "thousands" of threat actors, as reported by Proofpoint, leading to a significant increase in its real-world use. This highlights the double-edged sword of sharing offensive techniques for educational purposes. He notes that the ClickFix idea isn't new, with variations like FileFix (pasting into File Explorer), DownloadFix (HTTP smuggling/drive-by downloads), and TerminalFix (Linux/Mac keystrokes for command execution) having been observed previously. The underlying simplicity of ClickFix – it's "not some leap kernel zeroday VM escape browser sandbox whatever exploit" but "stupid" and "dumb" – makes it effective against less technically savvy users, underscoring the importance of basic security awareness.

Inspired by the impact of his Recaptcha Fish PoC, Hammond collaborated with Michael Haggus (M. Haggus), a threat researcher at Splunk and maintainer for projects like Atomic Red Team, LOL Drivers, and LOL RMM. Together, they integrated the ClickFix techniques into Haggus's ClickGrab project, creating a community-driven wiki for documenting and tracking new variants of these social engineering lures. This collaborative effort exemplifies Hammond's call for community members to contribute to the "yard sale" by sharing their findings and helping distill the signal from the noise.

Demo / Proof of Concept

▶ Watch: Critiquing the overwhelming cybersecurity roadmap of certifications (6:00)

The most tangible "demo" discussed in the talk revolves around John Hammond's personal involvement in creating a more polished Recaptcha Fish proof of concept. After observing early, somewhat crude implementations of the "weaponized copy-paste" technique by threat actors (specifically Llama Stealer in August/September 2024), Hammond undertook an "insomnia project" to improve its realism.

He describes developing a version that was "a little bit more fulfilling, more realistic to the Google recapture," complete with "cutesy realistic graphic colors." A key enhancement was a "little trick where we would comment out at the very end of the payload in the run dialogue box," ensuring that the user wouldn't visibly see the underlying PowerShell or command prompt command being executed. This made the social engineering lure even more convincing, as the user would only perceive the initial instructions to press Win+R, Ctrl+V, and Enter without the suspicious command being fully displayed in the Run box.

Hammond candidly admits that he "put it out on GitHub like an idiot," intending it as an educational tool to raise awareness about how "fake capture runs malware." He even created a YouTube video demonstrating the technique. However, the impact was far greater than anticipated. He recounts a conversation with Selena Larson from Proofpoint, who informed him that "thousands" of threat actors were subsequently utilizing his enhanced Recaptcha Fish PoC. This demonstrates the power and danger of open-sourcing offensive tools, even with good intentions, as they can quickly be adopted by malicious actors.

This "demo" serves as a powerful illustration of how a seemingly simple, non-zero-day technique can be highly effective when combined with clever social engineering, especially against users who are "desensitized" to CAPTCHA prompts. It also underscores the rapid dissemination of offensive tradecraft within the cybercriminal underworld, once a viable PoC is made public. The incident directly led to the community-driven ClickGrab project incorporating these techniques, transforming a demonstration of an attack into a defensive knowledge base.

Defensive Implications

▶ Watch: Universal feeling: 'too much stuff' in cybersecurity (audience shouts) (7:45)

The insights shared by John Hammond offer several critical implications for cybersecurity defenders, urging a shift in strategy from exhaustive coverage to focused, community-driven defense.

Firstly, understanding the concept of the "infosec yard sale" helps defenders manage their own expectations and avoid burnout. Recognizing that no one can be an "expert" in every facet of cybersecurity encourages specialization. Defenders should identify their organization's specific threat landscape and asset inventory, then prioritize learning and tools that directly address those unique needs. This selective focus prevents wasted effort on extraneous areas, allowing for deeper expertise in critical domains like endpoint detection, network security, or cloud defense.

Secondly, the emphasis on "Living Off the Land" (LOL) projects provides actionable intelligence for defensive strategies.

• LOLBins/LOLBAS and GTFOBins: Defenders must be aware that legitimate system binaries and scripts can be weaponized. This necessitates moving beyond signature-based detection to behavioral analytics and EDR (Endpoint Detection and Response) solutions that can identify anomalous usage of these tools. Security teams should regularly audit their environments for the presence of known vulnerable drivers (using LOL Drivers) and implement Microsoft's recommended blocklists.
• LOL Trusted Sites: Organizations should scrutinize their use of third-party cloud services. By understanding which trusted sites are commonly abused for C2 or exfiltration, defenders can implement stricter network egress filtering, monitor traffic to unusual cloud storage providers, and educate users about the risks of interacting with legitimate services in suspicious contexts.
• LOL C2: This highlights the need for robust network segmentation and traffic analysis to detect unusual communication patterns, even if they leverage seemingly legitimate applications.

Thirdly, the ClickFix / Recaptcha Fish anecdote serves as a stark warning about the effectiveness of simple social engineering. Defenders must prioritize user education and awareness training that goes beyond theoretical concepts. Training should specifically address "weaponized copy-paste" techniques, instructing users never to paste commands from untrusted sources into system utilities like the Run dialog box or command prompt, regardless of how official the prompt appears. Organizations should also consider technical controls that might restrict clipboard access from web browsers or monitor for suspicious Win+R activity followed by rapid execution. The collaboration with the ClickGrab project demonstrates how defenders can contribute to and leverage community resources to stay informed about emerging social engineering tactics.

Finally, Hammond's call to document and share knowledge is a direct defensive strategy. By curating and contributing to shared knowledge bases (whether internal wikis or public projects), defenders can collectively build a more comprehensive understanding of threats and effective countermeasures. This collaborative approach helps distill "signal from the noise" in the vast "infosec yard sale," ensuring that valuable insights are not lost and that the community as a whole becomes more resilient.

Key Takeaways

• Embrace Selective Focus: The cybersecurity field is too vast for anyone to be an expert in everything. Prioritize learning and specializing in areas that align with your interests and career goals to avoid burnout and impostor syndrome.
• Leverage Free Resources: The "overabundance of everything" includes a wealth of free and accessible educational materials, community projects (like LOLBins, GTFOBins, GitHub Awesome Lists), and online training platforms that democratize security knowledge.
• Understand Living Off the Land (LOL) Techniques: Be aware that legitimate system tools and trusted services can be weaponized by adversaries. Utilize LOL projects (LOL Drivers, LOL Trusted Sites, LOL C2) to enhance behavioral detection and hardening strategies.
• Guard Against Weaponized Copy-Paste: Simple social engineering tactics, such as the Recaptcha Fish/ClickFix technique, are highly effective. Educate users never to paste commands from unknown sources into system utilities and implement technical controls where feasible.
• Document and Share Your Knowledge: Contribute to the community by documenting your learnings, findings, and experiences. This collective curation helps transform the overwhelming "noise" of information into actionable "signal" for everyone.
• Find Your Passion: Sustain your engagement and growth in cybersecurity by focusing on what you enjoy and find fun. This intrinsic motivation is key to long-term success and resilience against the industry's inherent challenges.

About the Speaker(s)

John Hammond is a distinguished Keynote Speaker and a Security Researcher at Huntress. His professional journey in cybersecurity began with the Coast Guard, where he gained foundational experience. He subsequently contributed to the Department of Defense Cyber Training Academy and the Defense Threat Reduction Agency before finding his current home at Huntress. In his role as a security researcher, Hammond is dedicated to "chasing hackers and cut[ting] up malware," primarily focusing on endpoint detection response and managed security platforms. Beyond his day job, he is widely recognized for his significant online presence, particularly his popular YouTube videos, where he shares his knowledge and insights with a broad audience, fostering a community of learners and enthusiasts in the cybersecurity space. Hammond openly acknowledges struggling with impostor syndrome, a testament to his humility despite his extensive experience and contributions to the field.