This week, Zac sits down with Hoang Bui. Hoang specializes in reverse engineering, while dabbling in penetration testing and red teaming. Zac and Hoang discuss the levels of abstraction and different approaches for writing and breaking programs. Hoang tells a unique story of bypassing EDR, blogging about it, and getting himself into hot water in the process!
Are you hiring a researcher or reverse engineering specialist? Hire Hoang! Hoangprod@gmail.com
Episode Summary
In Episode 17 of War Stories, host Zac Davis talks with Hoang Bui, who specializes in reverse engineering while working across penetration testing and red teaming. They talk about levels of abstraction in writing and breaking software, why IDA Pro is the only answer to the favorite tool question, and the night an EDR product blocked him so precisely that he had to take it apart.
Hoang came into security from a development background, starting as an intern who admits his first project did not go well. Over time he moved deeper into low-level work and reverse engineering, and he estimates he has spent three to four thousand hours in IDA Pro, the disassembler he uses to understand how applications really work under the hood.
His war story is a 3 a.m. moment on an internal engagement. He had found a machine where a domain admin was logged in and had admin credentials on that box, so the last step should have been dumping the domain admin's credentials from memory. Instead, Cylance's EDR blocked the attempt and reported exactly why. Hoang reverse engineered how the protection worked, found it was running inside his own process where he had full control, patched it out, and got the credentials. When he later published his research in a blog post, a Cylance reseller tracked him down and called to say Cylance was not happy.
In This Episode
- Hoang Bui's path from developer and intern to reverse engineer
- Levels of abstraction in writing and breaking software
- Why IDA Pro is his essential reverse engineering tool
- LSASS credential dumping and how EDR products try to stop it
- Bypassing EDR protections and the fallout from publishing security research
Is Your EDR as Strong as You Think?
EDR is a critical layer, but it is not a guarantee. SEVN-X runs red team engagements and purple team exercises that test how well your endpoint defenses and detection hold up against real attacker techniques, alongside penetration tests. Talk with our team about scoping a test for your organization.
