A dive into
Red Teaming Psychology

* * *

$ whoami

I am John Torakis

I currently work as a
/S(enio)?r.?\s+(Cloud\s+Security)|((Sec|Dev){1,2}Ops)\s+Engineer/i,

have also worked as a
/(SOC\s+Analyst)|(Pen(etration)?\s+Tester)/i

* * *

I am writing the blog securosophy.com since 2016,
I've authored a small novel and...
I currently pursue my BSc in Psychology

The Setting

  • You have performed your reckon phase and got some email addresses
  • You have deployed your C2 infra
  • You just sent a carefully crafted phishing campaign
  • And you wait...

    • How do you feel?

    The Feelings

    • Tension


    • Restlessness


    • Anxiety


    • Self-Doubt


    • Craving

    And then you get this:

    How do you feel now?

    The Feelings Now

    • Relief


    • Pleasure


    • Excitement


    • Confidence


    • More Craving?

    What about Other Jobs

    Do other jobs like ...

  • delivery service workers
  • garbage collectors (I mean the real people)
  • cooks
  • clerks
    •

    ... get such mood swings?

    Maybe they are not that passionate with their jobs?

    I believe it's something else...

    Let's try something...

    The next some slides will try to trigger emotions similar to this image...

    Ready?

    Can it be considered an Addiction?

    As of the Diagnostic and Statistical Manual of Mental Disorders (DSM-5) (2013):
  • Gambling and Internet usage are considered addictive

  • Smoking has been classified as an addictive behaviour in DSM-III (since 1974)
  • Porn usage has been studied by Psychologists as an addictive behaviour too, since around 2012

    • So, if this image creates analogous feelings to you:

    This might suggest you are indeed a shell junkie!

    The Addiction Starter Pack


    No Satiation

    Anything you get, after a while it's not enough!


    You can get a shell, a Domain Admin's NTLM, a whole DCSync dump and...
    you could feel the urge to go further...
    to not stop the test...

    The Addiction Starter Pack


    No Patience / No Giving Up

    During a Penetration Test sometimes doing nothing is the right thing!

    While...
  • ... waiting for emails to get opened and clicked
  • ... waiting for the long sleep DNS beacon to call home

    • Other times, what is tried won't work and only consumes time (and mental energy)

  • This hash will not crack. Ever...

    • The Addiction Starter Pack


    Withdrawal

    Reporting time can suck...

  • The fun part is over - reporting days feel like Blue Tuesdays
  • Reporting gets under-appreciated, failing to convey the hard work done

    • Weekends can suck too, let's fill them up with work...

  • It's often difficult to unwind from the PenTest high, leading to burnout
  • Logging-in unscheduled weekends maximizes the chance of doing something reckless
    (and getting caught)

    • Remediation Steps

    Disclaimer: personal observations here

    • Work-Life Balance

      It matters a lot who we are when not wearing the "hat"

      (Mentally) working after working-hours might seem as an advantage, but mostly burns us out

    • Self-Worth

      Feeding our self-worth with how many shells we land, also feeds anxiety and self-deprecation

    • Professionalism

      Planning for at least as long as will operate, makes the operations short and to the point
      (less possible to get caught while improvising too)

      When assessment goals are reached - it's reporting time.
      No "but"s and "what if"s...

    What I didn't have time to mention...

    ...the Psychology's foundations for this topic

    • Pavlov's Classical Conditioning

      Associating an irrelevant stimulus with a (un)pleasant experience

    • Skinner's Operant Conditioning

      Associating an irrelevant behaviour with a (un)pleasant experience

    • Reinforcement Learning

      Learning that conducting the associated behaviour leads to the desired experience

    • Random Outcomes to Behavioural Addictions

      If the learned behaviour does not always lead to the desired experience it can get us addicted.
      Think of the slots, or content quality on Social Media feeds

    References

    Mcleod, S. (2022, November 3). Behaviorism In Psychology. https://www.simplypsychology.org/behaviorism.html

    Szalavitz, M. (2016, September 8). Addicted to Anticipation. Nautilus. https://nautil.us/addicted-to-anticipation-236104/

    Perales, J. C., King, D. L., Navas, J. F., Schimmenti, A., Sescousse, G., Starcevic, V., van Holst, R. J., & Billieux, J. (2020). Learning to lose control: A process-based account of behavioral addiction. Neuroscience & Biobehavioral Reviews, 108, 771–780. https://doi.org/10.1016/j.neubiorev.2019.12.025

    Pérez Alvarez, M. (2021). WHY SHOULD WE CARE ABOUT SKINNER, THIRTY YEARS ON. https://doi.org/10.23923/pap.psicol2020.2940

    Gary Wilson (2012, May 16). The great porn experiment. TEDxGlasgow. https://www.youtube.com/watch?v=wSF82AwSDiU

    Thank You

    Let's scroll our phones again now...
    My Extended Blog Post on the topic of Red Teaming Psychology in Securosophy