Security Confidential S18 E2 Husam Shbib

Manoj Tandon:
Hello everyone, this is your host, Manoj Tandon. Welcome to another episode of Dark Rhiino Security’s Security Confidential. We have a veteran back with us today, an alumnus from a prior show. But before I announce him, please hit the like and subscribe button. It helps us out—show us a little love so we can keep bringing you these fantastic guests.

Today we are honored to welcome back Husam Shbib, all the way from Saudi Arabia. You might remember his last episode—Season 17, Episode 9, The Hacker’s Playbook. We’ll link to it if you want to check it out. For those joining us for the first time, Husam is, first of all, a great guy, and he is a true expert and practitioner in cybersecurity. He is a consummate consultant specializing in penetration testing, digital forensics—which we’re going to talk about today—malware analysis, programming, and OSINT. He has spoken globally at places like Black Hat EMEA, ASF, FSM, and 3D Forensics.

Thank you, Husam, for being on the show. Welcome back.

Husam Shbib:
Thank you so much, Manoj. Last time the session flew by—I didn’t even notice the time because I was really enjoying the conversation. Thank you for having me back on Security Confidential. Let’s have another great discussion.

Manoj Tandon:
Let’s start where we couldn’t get to last time. But before that, is there anything new you want to bring to the table since we last spoke? Anything noteworthy happening in cybersecurity?

Husam Shbib:
In cybersecurity, honestly, things happen every day—every hour even. You constantly have to keep up with new developments and protect the industries and companies we work for, while also contributing to the community. Some companies have been hacked, some data has been leaked—no names mentioned. We always need to improve security in our organizations and understand there’s no such thing as 100% security, but we must apply as much as possible while balancing usability. Too much security can make systems unusable for employees.

On a personal note, I revamped my website, HusamShbib.com, and I’ve started offering free cybersecurity consultations every Tuesday. I really want to give back to the community and share what I’ve learned.

Manoj Tandon:
Fantastic—we’ll link it in the show notes. So your consultations—are they dialogues about cybersecurity or specific technical issues? What’s the format?

Husam Shbib:
Usually people book a consultation call to share their difficulties. Some are fresh graduates, others are working in digital forensics, incident response, ethical hacking, and so on. They come with questions or issues they’re stuck on. Based on my experience, I try to guide them in the right direction. It’s usually a one-hour call.

Manoj Tandon:
Excellent. I want to ask you about a company in the news—Jaguar Land Rover. They’ve been going through very serious cybersecurity issues, to the point of needing a public bailout. Have you kept up with what happened?

Husam Shbib:
To be honest, I didn’t go deep into that case, because other major incidents were happening at the same time. For example, leaked emails involving millions of users—that caught my attention more because we all use email and our data could be affected.

Manoj Tandon:
How does something like that happen? And how do you even find it?

Husam Shbib:
This falls under threat intelligence. Sometimes APTs—Advanced Persistent Threats—leak data or exfiltrate information after sitting inside a system for months or even years. Recently, a security vendor was compromised. The APT was inside their systems for a full year without detection. That’s mind-blowing—a security vendor being silently breached for that long.

The attackers extracted part of their source code. APT groups, especially nation-state ones, are extremely sophisticated. But in many recent cases, APTs have started using ChatGPT or similar AI tools to generate malware to avoid attribution. If they generate code with AI, it becomes harder to link it to a specific country or APT group, because the malware style isn’t unique.

Manoj Tandon:
But tools like ChatGPT can’t create something like the SolarWinds attack. That required deep expertise, right?

Husam Shbib:
Correct. For high-level attacks like SolarWinds, APTs still develop highly sophisticated custom malware—memory-resident payloads, EDR evasion, kernel-level stealth. AI today mostly helps with generic payload creation or modifying existing code to mask attribution. True advanced attacks still require skilled engineers.

Manoj Tandon:
So how would you, as a forensics expert, detect something like a hollowed-out process that looks legitimate but isn’t?

Husam Shbib:
Great question. I actually built a website—HusamShbib.com—focused entirely on memory forensics, with tutorials, samples, and challenges.

In process hollowing, an attacker creates a legitimate process—like notepad.exe—suspends it, replaces its memory with malicious code, then resumes it. On the surface, everything appears normal.

To detect it, memory forensics is essential. We look at things like: Whether a DLL is loaded from an unusual path, whether a process has an unexpected parent-child relationship, whether duplicate processes exist that shouldn’t (e.g., two LSASS processes), and whether a process has suspicious memory regions.

Tools like Volatility are extremely powerful. They have plugins that detect process hollowing, code injection, and anomalous memory sections. In memory, malware cannot hide—once it runs, traces exist somewhere.

Manoj Tandon:
As a non-software architect, I wonder—shouldn’t Microsoft or other platforms enforce rules such as requiring processes to declare what they will spawn and require everything to be signed?

Husam Shbib:
In theory, yes. In practice, many legitimate programs are not signed. If we enforced signing strictly, many programs wouldn’t run. And attackers don’t usually begin with process injection—they start with vulnerabilities, phishing, social engineering, or credential theft. Hollowing and injection typically happen after they’re already inside.

Reducing the attack surface early—before foothold—is far more effective than trying to regulate process creation afterward.

Manoj Tandon:
You just described defense in depth.

Husam Shbib:
Exactly. Developers usually focus on coding, but coding is the third or fourth stage in the software lifecycle. Security should be incorporated from design—not tacked on at the end. Unfortunately, many developers are unaware of secure design principles, and that leads to vulnerable products.

Manoj Tandon:
And with open-source dependencies, many companies inherit vulnerabilities without even knowing.

Husam Shbib:
Absolutely. We don’t reinvent the wheel—we reuse libraries. But we must verify and apply layered security so that if one layer fails, others still protect the system. A single point of failure is unacceptable.

Manoj Tandon:
I’ve seen systems with database credentials in plain text, internal communications not encrypted, massive flaws in transaction handling…

Husam Shbib:
Yes, and worse—sometimes even with encryption, if an attacker compromises the person who manages the encryption keys, the attacker can decrypt everything. Key management must be handled extremely carefully.

Manoj Tandon:
Have you ever encountered a company you couldn’t hack?

Husam Shbib:
Honestly, no. Every company I’ve tested, I’ve found high-critical vulnerabilities—CVSS scores from 8 to 10. In some cases, over 40 vulnerabilities. I prefer manual testing rather than automated tools. Tools can help enumerate, but true exploitation requires creativity and technique.

Manoj Tandon:
During penetration tests, were your fingerprints ever picked up by EDR, SOC, SIEM—anything?

Husam Shbib:
In penetration testing, the SOC usually knows you’re testing, so stealth is not essential. In red-team assessments, yes, you must remain stealthy. But in production environments, you also must be careful not to break availability. So you reduce noise but still proceed carefully.

Manoj Tandon:
Yet APTs have stayed undetected for a year inside security companies. Where would you begin the forensics on something like that?

Husam Shbib:
Digital forensics is a long, legally sensitive process. It must follow chain of custody and integrity verification. After incident response finishes containment and recovery, forensic investigators receive drives or remote access.

We perform triage across all devices—including those believed to be uninfected—to ensure nothing was missed.

Digital forensics can involve Corporate insider threat investigations, Data exfiltration, and Criminal cases like homicide where digital artifacts are crucial.

I recently handled a large exfiltration case where drives were shipped to me. I prepared a legally admissible report that could be defended in court. That’s how deep and formal digital forensics needs to be.

Manoj Tandon:
We’re almost out of time, but I’d like to propose something—you prepare a mini digital forensics workshop, maybe 20 minutes or longer, and we’ll host it. No questions from us—you just teach.

Husam Shbib:
I’d be happy to, but 20 minutes is too short. A proper hands-on case could take an hour or more. I’ll need to prepare sanitized sample files. But yes, let’s do it. It would be fun.

Manoj Tandon:
Absolutely—we’ll plan for that. It’s always fun talking to you, Husam.

Husam Shbib:
Thank you, Manoj. I really enjoyed this conversation—maybe even more than the previous one. I hope the audience learns something valuable.

Manoj Tandon:
Before we go, give everyone your websites again.

Husam Shbib:
My main website is HusamShbib.com. I just posted a new article about challenges in analyzing Linux-based memory dumps.

Manoj Tandon:
Fantastic. Husam, it was wonderful having you, and I look forward to our next conversation.

Husam Shbib:
Likewise, Manoj. Thank you so much.