Speaker 1: Welcome to tech Stuff, a production from iHeartRadio. Hey there,
Speaker 1: and welcome to tech Stuff. I'm your host, Jonathan Strickland.
Speaker 1: I'm an executive producer with iHeartRadio and how the tech area. Y'all,
Speaker 1: it is time for a classic tech Stuff episode. This
Speaker 1: is one where my friend Shannon Morse joined the show.
Speaker 1: Shannon is a really talented communicator of technology. She's a hacker,
Speaker 1: She's fantastic. She's got a ton of content out there online.
Speaker 1: So highly recommend you check out Shannon if you are
Speaker 1: unfamiliar with her work. She's great. And on this episode
Speaker 1: we talked about hacking for dollars, the various ways that
Speaker 1: hackers make money by being you know, hackers, and this
Speaker 1: episode public on Star Wars Day back in twenty sixteen.
Speaker 1: That of course is May the fourth on twenty sixteen.
Speaker 1: Sit back and enjoy. The term hacker is actually a
Speaker 1: very broad term that can apply to a lot of
Speaker 1: different things, and not all of them are that nefarious
Speaker 1: evil infiltrate a system and steal all the corporate secrets
Speaker 1: kind of approach to hacking that Hollywood often presents right
Speaker 1: right exactly. I actually ask this question to a lot
Speaker 1: of people, especially when I first meet them. Since I'm
Speaker 1: so closely affiliated with a lot of the infoset community,
Speaker 1: I want to surround myself with positive people. So you'll
Speaker 1: notice with the hacker definition, you can either get a
Speaker 1: very negative vibe from somebody or a very positive vibe. Oftentimes,
Speaker 1: with the negative vibe, you'll get somebody who says, oh,
Speaker 1: that's the person who stole my credit card data when
Speaker 1: I went to a restaurant the other day. But on
Speaker 1: the positive side, you'll get somebody that says, oh, they're
Speaker 1: the kind of people that will break something apart and
Speaker 1: then put it back together in a way that it
Speaker 1: wasn't supposed to be put back together to make it
Speaker 1: do something cool. And that's a hack in mainstream. So
Speaker 1: that's the way I see it. I see hackers as
Speaker 1: being people who reverse engineer different software, different hardware. It
Speaker 1: could just be a bicycle, for example, and put it
Speaker 1: back together in a way to make it harder, better, faster,
Speaker 1: and stronger. Nice the old daft punk approach. Of course, Yeah,
Speaker 1: I agree entirely. The original term hacker was really all
Speaker 1: about people who have almost an insatiable curiosity to learn
Speaker 1: how stuff works. Oddly enough, I share that quality having
Speaker 1: worked at how stuff works for a decade, but yeah,
Speaker 1: to understand how it works and then to make stuff
Speaker 1: do things it wasn't necessarily intended to do. Not for
Speaker 1: nefarious purposes necessarily, although that could clearly be an application,
Speaker 1: but just for curiosity's sake. Can I take these elements
Speaker 1: that are meant to do this one thing and do
Speaker 1: something completely transformative with it, whether it is hardware or software.
Speaker 1: And we've seen some really cool stuff come out of that.
Speaker 1: I mean, I would argue that a lot of the
Speaker 1: things you see in the cosplay world and the steampunk world,
Speaker 1: those are all taking elements of hacking. Maker Fair is
Speaker 1: really just a hacker's paradise when you get down to it,
Speaker 1: especially for hardware hacks. Absolutely, I'm kind of sad I'm
Speaker 1: going to miss maker Fair this year. I haven't been
Speaker 1: to one yet. I've been to a small one here
Speaker 1: in Atlanta, a very modest maker Fair. Everyone there was
Speaker 1: great and passionate and intelligent, but it was, you know,
Speaker 1: a much smaller scale than something you would see in
Speaker 1: the Bay Area. Yeah, but that's the kind of thing
Speaker 1: that hacker means to me. Now that being said, in
Speaker 1: this episode, we're really going to be focusing on sort
Speaker 1: of the computer oriented, really the software side of hacking,
Speaker 1: and a large part of it's going to be on
Speaker 1: the bad guy, the naughty bits, as I call it
Speaker 1: in our notes about simply to talk about what are
Speaker 1: the ways that hackers cause or the malicious hackers cause problems,
Speaker 1: how do they expect to profit from that? And also
Speaker 1: we'll look at ways that hackers who don't follow that path,
Speaker 1: who are looking to help people, not hurt people, how
Speaker 1: do they make a living Because it's one of those
Speaker 1: things where you kind of take it for granted when
Speaker 1: you see the Hollywood depiction of a hacker, the person
Speaker 1: sitting down. Usually they're sitting at a keyboard and for
Speaker 1: some reason, their monitor only is monochromatic green. Yes, that's
Speaker 1: so true. Well, yeah, they're using the old Apple to
Speaker 1: ems terminals are actually written and green oftentimes, but you
Speaker 1: can change the colors to rainbow colors if you choose.
Speaker 1: That is a hack, it's a real life hack. Yeah, yeah,
Speaker 1: And usually you see them sitting down and then they
Speaker 1: cause some sort of mischief, sometimes bordering on sabotage. But
Speaker 1: then you when you think about it outside of the
Speaker 1: context of that scene, you think, Oh, how did they
Speaker 1: expect to profit from this? Yeah, so that's kind of
Speaker 1: what we're looking at. Yeah, because it's always important to
Speaker 1: me to reiterate too that there are always going to
Speaker 1: be two sides of a coin to everything in life.
Speaker 1: Of course, there are going to be bad guys in
Speaker 1: the in the world who do nefarious hacks, but there's
Speaker 1: also a lot of good guys too, And personally, for me,
Speaker 1: the reason why I'm so interested in researching this is
Speaker 1: because it has made me a much more privacy and
Speaker 1: security guarded person. I've gotten a lot better at my
Speaker 1: own protections online, and I feel like if somebody else
Speaker 1: can understand what a hacker does on the bad side
Speaker 1: as well as the good side, they can better protect
Speaker 1: themselves too, And that's what I've always tried to teach people. Yeah,
Speaker 1: I think all you have to really do is attend
Speaker 1: one def con and really have that driven home. I
Speaker 1: have not yet gone to a def con, mostly because
Speaker 1: I don't know that I could part with my smartphone
Speaker 1: for that long and I certainly wouldn't take it with me.
Speaker 1: Bring a burner phone, you'll be fine. Yeah, that's me Jonathan,
Speaker 1: the guy which carries the burner. It makes sense, I
Speaker 1: mean when you're doing something like that. So for those
Speaker 1: who don't know, Defcon is a large hacker based conference
Speaker 1: largely looking at the realm of information security, and often
Speaker 1: they will you'll have entire presentations dedicated to showing off
Speaker 1: vulnerabilities and security, again not necessarily so that people can
Speaker 1: take advantage of them, but rather to raise awareness and
Speaker 1: to kind of force the hands of the parties that
Speaker 1: are responsible for that software to take action and fix
Speaker 1: a problem. Right like that was what we saw with
Speaker 1: the hack about remotely taking control of a person's vehicle,
Speaker 1: specifically Jeep was really having that issue. Those one of
Speaker 1: those things where the researchers were saying, look, we're bringing
Speaker 1: this to light, not so that we can create an
Speaker 1: era where people are terrified of their vehicles that someone's
Speaker 1: going to take remote control of their car, but rather
Speaker 1: to really drive home the act that the information security
Speaker 1: is now it's important everywhere. It's not just your phone,
Speaker 1: it's not just your computer. As the Internet of Things
Speaker 1: continues to blossom, it's everything. Yes, I agree, And in
Speaker 1: that sense, those researchers were trying to use something the
Speaker 1: old school term is called responsible disclosure where they explain
Speaker 1: some kind of vulnerability that they found to the company
Speaker 1: in hopes that the company will fix this problem before
Speaker 1: it becomes mainstream and before it gets out into the wild.
Speaker 1: In the case of Jeep, I believe, if my memory
Speaker 1: serves me right, that Jeep did not necessarily release a
Speaker 1: patch for this vulnerability. So then the researchers decided to
Speaker 1: go out publicly about the information that they found, and
Speaker 1: then Jeep decided to fix it once everybody else knew
Speaker 1: about it, right, And sometimes that's what it takes. And
Speaker 1: I've had the same discussion offline with a mutual friend
Speaker 1: of ours, Brian Brushwood. Brian is a stage magician. He
Speaker 1: has a show called Scam School. It's all about social engineering.
Speaker 1: One of the things I have talked about with Brian
Speaker 1: is that his show, he often shows how to do
Speaker 1: certain types of scams or tricks, but they're mostly in
Speaker 1: the barbet world, right, Like, not stuff that you would
Speaker 1: do to ruin someone's life, but something that you know
Speaker 1: you might want to you might win a free beer
Speaker 1: that way. Yeah, And he showed off He had an
Speaker 1: episode where he showed off this guy who had was
Speaker 1: demonstrating a well known vulnerability of a popular bike lock
Speaker 1: that has been off the market for a couple of
Speaker 1: years because of this vulnerability. But that particular vulnerability meant
Speaker 1: that you could use a regular plastic pen, remove the
Speaker 1: pen part of the pen, use the casing, and jam
Speaker 1: that into the lock and pop the lock open. Oh
Speaker 1: that's horrible, right, And so people were complaining in the comments,
Speaker 1: they were saying, you're you're, you're publicizing this vulnerability, And
Speaker 1: I said, guess what, the bad guys already know about
Speaker 1: this vulnerability. What they're doing is publicizing it to a
Speaker 1: public that might be still vulnerable to it so that
Speaker 1: they don't fall victim. And that, to me is a
Speaker 1: very important part of hackers across the board. They serve
Speaker 1: very important purpose to alert folks to potential dangers before
Speaker 1: it gets too late. Yeah. Absolutely, And you're those hackers
Speaker 1: are the people that are generally working to make a
Speaker 1: better world for consumers at about a private and secure
Speaker 1: world for consumers. But then, of course, on the other hand,
Speaker 1: are the batties. Yeah, let's talk about some of them.
Speaker 1: So I kind of gave some weird little titles for
Speaker 1: this when I was typing it up, because in the
Speaker 1: middle of the week. I get bored, Shannon. Let's to
Speaker 1: be honest, and so when I was making an outline
Speaker 1: kind of for us to work from, I started coming
Speaker 1: up with goofy subtitles. So this whole section is titled
Speaker 1: the Naughty Bits in our Notes, and the first one
Speaker 1: is malware moolaw as in people who make money through
Speaker 1: the development or distribution of malware. And malware, as I've
Speaker 1: said on this show many times in order to define it,
Speaker 1: it's really software that is intended to do something that
Speaker 1: is ultimately harmful to the person who runs that software
Speaker 1: on their machine. It covers a wide array of different subcategories, like, uh,
Speaker 1: you know, this is the sort of term that we
Speaker 1: normally would have in the old days just called a
Speaker 1: computer virus, But computer virus is a very specific thing,
Speaker 1: and malware covers more stuff than just viruses, also worms
Speaker 1: and all sorts of stuff. Yeah, there's there's malware for
Speaker 1: Java and Flash. If you still have Flash, install it,
Speaker 1: I highly recommend that you uninstall it if you don't
Speaker 1: need it. There's malware for browsers. There's malware for advertisements
Speaker 1: online for sponsors that you'll see like on different websites
Speaker 1: that was a very recent problem that a lot of
Speaker 1: news publications had with yeah, big name news publication, but yeah,
Speaker 1: so that was a big one. But you'll see malware
Speaker 1: all over the place, and luckily we do have anti
Speaker 1: mal where software that we can use to protect our
Speaker 1: computers from it, and we can also block certain ports
Speaker 1: on or routers that can hopefully protect you from MAUER.
Speaker 1: But there's also a lot of cases where Mauer is
Speaker 1: distributed and built so quickly that a lot of those
Speaker 1: anti Mauer software are not updated quick enough. So in
Speaker 1: that case, we need to do the best that we
Speaker 1: can to protect ourselves and keep MAUER from getting out
Speaker 1: from the deep web. Yeah, you know, it used to
Speaker 1: be that you really all you needed to worry about
Speaker 1: was just don't go to the more seedy elements of
Speaker 1: the web, and you were generally all right, right, Yeah,
Speaker 1: It's kind of like avoiding a bad neighborhood, Like, yeah, obviously,
Speaker 1: if you don't want to get robbed, there are certain
Speaker 1: neighborhoods that you should probably shouldn't walk around in by
Speaker 1: yourself at night, right, And this is kind of similar
Speaker 1: in that case where you avoid the deep web unless
Speaker 1: you really want to be on somebody's like hit list
Speaker 1: or something like that. Yeah. Yeah, if you suddenly think
Speaker 1: that you want to come across as a big shot,
Speaker 1: look if you're not a big shot, don't do that.
Speaker 1: It's kind of like, kind of like walking up to
Speaker 1: someone who works in a carnival and claiming that you're
Speaker 1: with it and for it. If you don't know what
Speaker 1: that means, you do not say that. Okay, I think
Speaker 1: I just gave terrible advice to an entire population of listeners. Yeah, don't, don't.
Speaker 1: Don't talk to Carney's unless you are one, all right, so,
Speaker 1: uh and I love you Carney's, I love you all So.
Speaker 1: The the thing that we're getting across, though, is that
Speaker 1: today that's not as big a guarantee as it used
Speaker 1: to be. Right like ten years ago, you'd say, look,
Speaker 1: just be careful. Don't download unusual files. Don't don't run
Speaker 1: a file that's linked in your email without checking it
Speaker 1: out first, don't. Don't, you know, be careful opening up
Speaker 1: emails from things that you don't recognize. Be careful with
Speaker 1: PDF files, Be careful with stuff, especially unsolicited stuff that
Speaker 1: has come to you, because that raises the chances that
Speaker 1: something hinky is going on. It doesn't necessarily mean it's
Speaker 1: definitely a problem, but it's potentially a problem, and it's
Speaker 1: better to be safe than sorry. Make sure you have
Speaker 1: good antivirus software on your computer, make sure you have
Speaker 1: a nice strong firewall. All of these kind of things.
Speaker 1: Those used to be pretty good at keeping nine of
Speaker 1: the malware away from you if you were being a
Speaker 1: fairly responsible Netaicin these days, they definitely help. These days,
Speaker 1: these days, the attacks are sometimes getting like in the
Speaker 1: case of the advertisements on news sites. These are attacks
Speaker 1: that are going through avenues that you want at one
Speaker 1: point would have considered perfectly safe. Right, Not that it's
Speaker 1: happening all the time, but the fact that it can
Speaker 1: happen tells you that it requires an extra level of
Speaker 1: vigilance beyond what we used to say was sufficient. Yeah. Absolutely,
Speaker 1: A data collection for a lot of this malware is
Speaker 1: extremely It's high sensitive in the fact that a user's
Speaker 1: data can get so much money on the on the
Speaker 1: deep web, so much money, really, particularly a collection of
Speaker 1: user data, that's where the big money is, right. I
Speaker 1: did an episode once where we tried to break down
Speaker 1: how much is your personal information worth? It? Really bucks? Yeah,
Speaker 1: it really depends. It depends upon what information you're talking about,
Speaker 1: Like how extensive is that profile on a person? But yeah,
Speaker 1: it's not much in the grand scheme of things. Like
Speaker 1: to you, it's worth a lot, right you as a person, Shannon, Right,
Speaker 1: you as a person, that information is worth a lot
Speaker 1: of money to you, Yeah, because it's who you are.
Speaker 1: To someone else, it's worth pennies on the dollar, really
Speaker 1: depending up, depending upon the amount of information. But the
Speaker 1: malware often is giving hackers access to massive amounts of
Speaker 1: info about a huge number of people, and in numbers
Speaker 1: there is more value, and that's where they will sell that.
Speaker 1: Sometimes they sell it to companies that are just interested
Speaker 1: and getting information so that they can do targeted advertising.
Speaker 1: So it might be that the ultimate use of your
Speaker 1: information isn't as bad as it could be. It just
Speaker 1: means you're going to get some ads, but still not
Speaker 1: fun to think about and to think that you know,
Speaker 1: now these companies have access to information about you that
Speaker 1: you probably would rather they not have, particularly in targeted advertising.
Speaker 1: The famous story about target when they started sending ads
Speaker 1: to a young lady that were related to pregnancy yep,
Speaker 1: and then her dad got really really ticked off. About it.
Speaker 1: But it turned out that little girl was pregnant, yeah,
Speaker 1: and that it was because the algorithms had picked up
Speaker 1: through her search habits that she was pregnant based upon
Speaker 1: the search terms she was putting in, and so they
Speaker 1: proactively sent her some coupons for pregnancy related items. The
Speaker 1: dad got very upset. Then the dad ended up apologizing
Speaker 1: to Target, saying that he was unaware at the time
Speaker 1: of the full situation. Well, in that case, it was
Speaker 1: search algorithm, wasn't a hacker who had gained access to
Speaker 1: stuff and then sold it. But there are other cases
Speaker 1: where that does happen, Yeah, where you know, just a
Speaker 1: database of info and a lot of times they will
Speaker 1: release this malware in something that's called an exploit kit.
Speaker 1: So generally, these exploit kits are like a batch of
Speaker 1: similar malware that will work across several different platforms, So
Speaker 1: that whether that's several different types of software like job
Speaker 1: and flash, or several different browsers. It could be several
Speaker 1: different operating systems too, So you might see an exploit
Speaker 1: kit that works on Linux fourteen O four but also
Speaker 1: works on Windows XP up through eight or something like that. Right,
Speaker 1: And what's crazy is that when you start looking at
Speaker 1: I mean, this is one of the things that hackers do, right,
Speaker 1: They'll look at operating systems and what the market penetration
Speaker 1: is for those systems, because that's that shows you where
Speaker 1: your target rich environment is. Right. So if you have
Speaker 1: Windows seven, guess what you are prime target for malware
Speaker 1: because that is by far the largest that has the
Speaker 1: greatest market share of any operating system right now. Ye,
Speaker 1: Windows XP Still it's number three, number three, and it
Speaker 1: has not been supported by wind formed by Microsoft for
Speaker 1: two years. This, by the way, bad thing. If you
Speaker 1: want to be really secure with your your computer information,
Speaker 1: you don't want to be using an operating system that
Speaker 1: no longer gets support from the company that made it,
Speaker 1: because because that means no vulnerabilities will be patched. From
Speaker 1: that moment forward, you're pretty much on your own. You
Speaker 1: have gone into the dark forest, and you forgot to
Speaker 1: bring your flashlight. It's pretty dangerous. One of the things
Speaker 1: that you kind of I think leads in from what
Speaker 1: you were saying before with these exploit kits. One of
Speaker 1: the most terrifying aspects of this type of malware and
Speaker 1: and the fact that that people can use it for
Speaker 1: nefarious purposes and monetary gain. Is that you also have
Speaker 1: a population of people who don't even understand how the
Speaker 1: malware works. They don't even Script kitties is what I'm
Speaker 1: getting at. Script kitties, that's the term we use for
Speaker 1: people who are they're benefiting from the work that hackers
Speaker 1: have done. Hackers are the ones who are actually putting
Speaker 1: together the software. They're the ones who have identified the
Speaker 1: vulnerability and then exploited it in some way. Script kitties
Speaker 1: are the ones who essentially they're given a set of
Speaker 1: skeleton keys, and they didn't make the skeleton keys, they're
Speaker 1: just using them. And it's scary because you don't need
Speaker 1: a level of expertise. You might think, oh, well, I'm
Speaker 1: kind of safe from hackers because how many people are
Speaker 1: actually hackers? How many people really know how this system works. Well,
Speaker 1: you don't have to really know how the system works.
Speaker 1: If you have a tool that exploits a vulnerability, oh absolutely.
Speaker 1: Although I really hate the word script kitty, I will
Speaker 1: put it out there because I feel like if you're
Speaker 1: interested in information security, and if you're interested in becoming
Speaker 1: a good hacker, then you do start somewhere and everybody
Speaker 1: is going to start with the easy tools that are
Speaker 1: out there and that are available for free. For example,
Speaker 1: one thing that I learned how to use a couple
Speaker 1: years back was this tool called wire shark. It easily
Speaker 1: lets you see everything that's happening on your wireless network,
Speaker 1: or you can use it for any computers that are
Speaker 1: on your network, like behind your router, so you can
Speaker 1: see everything that's going on and you don't necessarily have
Speaker 1: to learn or understand what's going on behind it to
Speaker 1: be able to read what's on your screen happening right
Speaker 1: in front of you. I think it's really important though,
Speaker 1: for people who might be called script kitties to look
Speaker 1: at as being beneficial and that they can grow from
Speaker 1: that process. They can start from being a beginner and say, okay,
Speaker 1: well I need to understand the theory. Now I can
Speaker 1: move on from being a script kittie quote unquote to
Speaker 1: becoming somebody who is an expert in some kind of
Speaker 1: information security out there. Yeah. When I think of the
Speaker 1: term script kitty, in my mind, it's a it's a
Speaker 1: subset of the people that typically get labeled as such. Yeah,
Speaker 1: that subset being people who have little to no interest
Speaker 1: in actually learning how to hack or program people who
Speaker 1: want a very very fast track way to gain either
Speaker 1: a reputation by being the person who took down a
Speaker 1: system by whatever means, or by making a whole lot
Speaker 1: of money really fast for relatively little effort. Those are
Speaker 1: the ones I specifically think of when I think of
Speaker 1: script kitty. But you are absolutely right, you have to
Speaker 1: start somewhere if you're interesting it is. I'm kind of
Speaker 1: defensive with that because I was called a script kitty
Speaker 1: when I first started up started off learning about hacking
Speaker 1: and information security. People would be like, Osh, she's just
Speaker 1: a script kitty, and I'd be like, well, I actually
Speaker 1: want to understand the theory. I want to learn how
Speaker 1: to program. I want to learn how right code. I'm
Speaker 1: no longer called that because I have learned how to
Speaker 1: certain kinds of code. I have learned how to program.
Speaker 1: I can make my Arduino do whatever I want. So
Speaker 1: at this point in my stage, I've surpassed that moment
Speaker 1: of being a nube, and I've gone on to learning
Speaker 1: things and being able to understand specific tasks and get
Speaker 1: them to do what I want them to do without
Speaker 1: finding tutorials online. Yeah, so now I make my own tutorials.
Speaker 1: Seeing that's nice because when I started at How Stuff Works,
Speaker 1: they call me that weird bald guy, and today they
Speaker 1: still do. Shannon and I will be back to talk
Speaker 1: more about hacking for dollars in just a moment, but
Speaker 1: first let's take this quick break so that kind of
Speaker 1: covers the malware approach. People can make money through malware,
Speaker 1: either by selling your information, they might do so by
Speaker 1: another method, which kind of leads into this idea of ransomware.
Speaker 1: So this would be malware specific type of malware that
Speaker 1: locks down your machine in some way so that you
Speaker 1: can no longer access it, and then you essentially get
Speaker 1: a message saying, hey, if you want if you want
Speaker 1: your data back, if you want access to your data,
Speaker 1: if you want to be able to do all this stuff,
Speaker 1: and you want our hands out of your business, then
Speaker 1: you've got to pay us some mulah. Yeah. So basically
Speaker 1: what happens with ransomware is it is, just like you said,
Speaker 1: a type of malware that gets distributed in one way,
Speaker 1: shape or form onto somebody's computer and it ends up
Speaker 1: encrypting their data. It could be a whole hard drive,
Speaker 1: it could be a folder of data. It's some kind
Speaker 1: of important data that they have sitting on their computer.
Speaker 1: And in many cases, a thief the hacker will ask
Speaker 1: them in an email or maybe an unencrypted text document
Speaker 1: that's now surreptitiously on their computer out of nowhere, to
Speaker 1: send them a certain amount of bitcoins, and they tell
Speaker 1: them how to set up a bitcoin wallet so that
Speaker 1: they can send the bitcoins to them for them to
Speaker 1: get a pass code to unlock their encrypted data. Now,
Speaker 1: the weird part is they already owned this data. It's
Speaker 1: on their own hard drive. It could be anything from
Speaker 1: like kids photos, it could be tax documents. But in
Speaker 1: any case, it's going to be some kind of important
Speaker 1: information that people don't want to lose because it might
Speaker 1: be years and years of information that's just on that computer.
Speaker 1: So of course people are going to send them bitcoins.
Speaker 1: And I think last I checked, a bitcoin was a
Speaker 1: few hundred bucks, so it ends up being quite a
Speaker 1: bit of money that they have to send to get
Speaker 1: their information unlocked. Yeah, and this is this is the
Speaker 1: type of malware. When we were talking about the advertising
Speaker 1: that was targeting people through massive news sites, if I'm
Speaker 1: not mistaken, it was specifically ransomware. It was the kind
Speaker 1: of stuff that was encrypting users. Yeah. Yeah, so it
Speaker 1: wasn't just malware. It was ransomware that was infecting computers.
Speaker 1: Because malware can do other stuff too, right, it can
Speaker 1: It can create something like a backdoor access Oh yeah, yeah,
Speaker 1: can take control of your machine or just monitor what
Speaker 1: you're doing. Even if they don't want to take control,
Speaker 1: they can put in key loggers so they can see
Speaker 1: what all your passwords are. So you might want to
Speaker 1: think about using things like a really good password manager. Yeah,
Speaker 1: that's what I use and I love mine. Yeah, so
Speaker 1: the things where you don't have to type the password
Speaker 1: in so you don't have to worry about key loggers
Speaker 1: picking up on that kind of stuff. But we'll talk
Speaker 1: more about that in just a second. So one of
Speaker 1: the other ones I wanted to talk about. This one's
Speaker 1: kind of a gray area because this is this I
Speaker 1: titled this section spies like Us, and by this I
Speaker 1: meant state sponsored hackers. People who are hacking on behalf
Speaker 1: of a specific state or nation or government. Sometimes they
Speaker 1: may be doing so not with the what should I say, like,
Speaker 1: not with the express permission of the nation. It may
Speaker 1: turn out that the state says, hey, we didn't tell
Speaker 1: them to do this. They're just doing it because they
Speaker 1: love us so much and they hate and they hate
Speaker 1: you guys. Yea, and that's why they're doing it. Whether
Speaker 1: that's true or not depends upon the situation. I would
Speaker 1: I would think that if I were running a government
Speaker 1: and I had employed a bunch of hackers to infiltrate
Speaker 1: or sabotage another nation's systems, I also would like some
Speaker 1: plausible deniability in there. Hey, I didn't tell him to
Speaker 1: do it. I just said, man, it's kind of like
Speaker 1: there's there's a story that a king of England once
Speaker 1: yelled out, who will rid me of this meddlesome priest?
Speaker 1: And then a couple of nights went off and ridded
Speaker 1: him of that meddlesome priest and it turned out that
Speaker 1: he was he was just mad and just talking out loud.
Speaker 1: And then one of his dearest friends ended up being
Speaker 1: murdered by a couple of nights because they heard the
Speaker 1: guy talking and said, hey, we should get rid of them.
Speaker 1: We'll get rewarded. That's why the States argue, I don't
Speaker 1: know that that's always the case. Also, by the way,
Speaker 1: are you listeners out there who recognize who I'm talking
Speaker 1: about send me an email and prove it because I'm
Speaker 1: a medievalist and I love that stuff. But yeah, this
Speaker 1: is something that we see. You know, you often will
Speaker 1: hear stories about Chinese hackers or Russian hackers. There was
Speaker 1: a story several years ago about how information security experts
Speaker 1: were noticing some artifacts in our power grid system that
Speaker 1: were indicative of people who had infiltrated that system and
Speaker 1: planted some stuff in there so that they could monitor
Speaker 1: things or perhaps even jump back into the power grid
Speaker 1: system should push come to shove in some sort of
Speaker 1: political situation. They had traced it back to either China
Speaker 1: or Russia. It's pretty tricky to actually figure out where
Speaker 1: attacks ultimately originate from, because if you're really good, you
Speaker 1: can cover your tracks pretty well. But the United States
Speaker 1: has done it too. You might have heard about Stuck's Net.
Speaker 1: That was the that was the computer virus that was
Speaker 1: designed to to spin a centrifuge and nuclear facility at
Speaker 1: a speed greater than what it was supposed to spin at.
Speaker 1: And originally I think the hope was that it would
Speaker 1: cause a catastrophic failure and perhaps even destroy the facility.
Speaker 1: As it turned out, it caused a failure, but not
Speaker 1: at that level, but that those are examples of something
Speaker 1: that's technically legal within the country because it's it's endorsed
Speaker 1: or at least permitted by a government, but you don't
Speaker 1: want it out there because it seems pretty darn shady
Speaker 1: to anybody else. Yeah. Yeah, So state sponsored hacks are
Speaker 1: more worrisome to me because they oftentimes have much larger targets.
Speaker 1: For example, they might target a large government facility, like
Speaker 1: I don't know, the Pentagon, So I worry about those
Speaker 1: because those kind of servers have a lot of information
Speaker 1: on the citizens of any sort of country. So many
Speaker 1: time you see these in the news, it's always like, oh, well,
Speaker 1: this this hack was done by Chinese state sponsored hackers,
Speaker 1: or Russian state sponsored hackers, or American state sponsored hackers,
Speaker 1: and these are North Korea would be another big one. Yeah. Yeah,
Speaker 1: So so they are either it might be a Tinama
Speaker 1: hackers that are kind of comprised together in a illegitimate
Speaker 1: company who are hired by a government, or like you say,
Speaker 1: where they may not necessarily have any affiliation quote unquote
Speaker 1: with the government, but the government ends them paying them
Speaker 1: in some way, shape or form for their infiltration because
Speaker 1: it ends up helping the government in some way or another.
Speaker 1: So it's it's a very sticky scenario when you start
Speaker 1: dealing with these state sponsored hackers, because it's it's hard
Speaker 1: to understand, how are we going to, you know, penalize them.
Speaker 1: Who do we penalize? Do we penalize government or the
Speaker 1: hackers themselves? Are both like who was actually involved? It
Speaker 1: might end up being how do we address the un
Speaker 1: d lying situation that led to the employment of hackers
Speaker 1: in the first place, which can get pretty pretty delicate.
Speaker 1: Another great example not too long ago, or at least
Speaker 1: one that may or may not have been involved in
Speaker 1: may or may not have involved a state sponsored hacker
Speaker 1: I'm still somewhat skeptical of that would be the Sony hack.
Speaker 1: Oh yeah, because the Sony hack, the US government essentially
Speaker 1: was pointing fingers to North Korea, saying the hackers must
Speaker 1: have come from North Korea. Look at this IP address,
Speaker 1: which we don't even need to go into detail right now,
Speaker 1: except to say that an IP address does not proof
Speaker 1: make but at any rate, they're pointing over at North
Speaker 1: Korea saying we think the attacks came from there. The
Speaker 1: attack appears to be politically motivated North Korea for its part,
Speaker 1: the government, which, by the way, North Korea not shy
Speaker 1: about taking credit for stuff, but they said, no, no,
Speaker 1: we didn't, we didn't ask for this, but we're totally
Speaker 1: cool with it happening. So you know, it's one of those.
Speaker 1: It's also very muddy because obviously when you're talking about
Speaker 1: things like espionage or sabotage or any of those things,
Speaker 1: you don't you don't come out and talk more about it,
Speaker 1: you don't. That ends up being closed away. Yeah, in fact,
Speaker 1: I should, I should really throw that over to the
Speaker 1: stuff they don't want you to know guys and have
Speaker 1: them do an episode on it, because that would be
Speaker 1: a lot of fun. And then we've got got the
Speaker 1: the traditional at least, I would argue the traditional concept
Speaker 1: of a hacker from the Hollywood perspective. The black hats,
Speaker 1: the ones that they are wearing the hoodies, and they're
Speaker 1: sitting at a keyboard and they're typing really fast on
Speaker 1: a green and black screen over Yes, they got like,
Speaker 1: got some junk food food around them. Yeah, mail, and
Speaker 1: they have a ton of different windows popping up on
Speaker 1: their computer. Really, you're really fast, so you can't make
Speaker 1: out anything that's happening. It's entirely not true. That's not
Speaker 1: how it works. It's actually a somewhat slow process to
Speaker 1: get UM basically, to get reconnaissance and to get into
Speaker 1: any kind of net work. The only things I've done,
Speaker 1: of course, are completely legal. I've had an authorization by
Speaker 1: everybody who I have tested my abilities on. Right. Yeah,
Speaker 1: so black hats. That's That's another awkward definition because it's
Speaker 1: not one that I like to use all the time
Speaker 1: because black hat hacker means that there's it makes hackers
Speaker 1: have more of a negative appeal to a lot of people.
Speaker 1: So I always just call them black hat thieves. Yeah. Now,
Speaker 1: that's a great way of putting it, because typically you'll
Speaker 1: see things like um uh, the idea of infiltrating a
Speaker 1: system in order to steal information, perhaps to sell it
Speaker 1: to someone else, or to hold it against the party
Speaker 1: that you've stolen it from. Um, you know, so it
Speaker 1: might be extortion as opposed to to stealing and selling. Also,
Speaker 1: we should go ahead and point out something else that
Speaker 1: I'll talk about it in a future episode, but I've
Speaker 1: mentioned it in previous ones too. Hackers don't necessarily just
Speaker 1: sit at a keyboard in type and strings of letters
Speaker 1: and numbers. They also do a lot of social engineering
Speaker 1: where or they can do a lot of social engineering
Speaker 1: where they attempt to gain access to systems, either by
Speaker 1: physically gaining access to a system, which makes it way
Speaker 1: easier than remotely doing it, or even easier than that
Speaker 1: manipulating someone who does have access to a system, and
Speaker 1: then you get it that way, and it's surprisingly easy
Speaker 1: to do if employees have not been educated on how
Speaker 1: to spot that and avoid it. Yeah, properly training your
Speaker 1: employees at your place of work is really important when
Speaker 1: it comes to social engineering. And it is incredibly easy
Speaker 1: to do social engineering, especially when you're a female, I
Speaker 1: would imagine. So it turns out also if you are
Speaker 1: dressed as the stereotypical it guy and you are there too. Yeah,
Speaker 1: quote unquote upgrade someone's machine. Really easy to get access
Speaker 1: to that machine. Yeah, people are so eager. Yeah. And obviously,
Speaker 1: like social engineering completely depends upon identifying and then exploiting
Speaker 1: a person's vulnerability and typically speaking like greed lust, those
Speaker 1: are two big ones that are exploitable and that the
Speaker 1: people who are really good at social engineering know that,
Speaker 1: and they're very good at that leveraging that. Just as
Speaker 1: knowing what sort of vulnerabilities typically show up within code
Speaker 1: within programs, you need to know what vulnerabilities show up
Speaker 1: in people. And I also I had a little thing
Speaker 1: on here about botnet masters. Really what in this I
Speaker 1: was thinking about the people who are using malware to
Speaker 1: get that backdoor access to machines, to get to get
Speaker 1: that administrative control over a wide array. Sometimes we call
Speaker 1: it a botnet, sometimes we call it a zombie army
Speaker 1: of user computers, and then utilizing that to do stuff
Speaker 1: like distributed denial of service attacks so our de dos
Speaker 1: attacks where you are directing an army essentially to coordinate
Speaker 1: an attack against an identified target. Sometimes this is done
Speaker 1: just to cause problems. I mean obviously if you've ever
Speaker 1: had issues logging into like a gaming network. Xbox Live
Speaker 1: has had this happen, PlayStation has had this happen, where
Speaker 1: people who are disenchanted with the service for one reason
Speaker 1: or another, or they just want to do it for
Speaker 1: the lulls, specifically around holiday times. That's a big that's
Speaker 1: a big target time to attack something like Xbox Live.
Speaker 1: They'll direct a ton of traffic to break down servers,
Speaker 1: so servers can't respond to legitimate traffic because they're too
Speaker 1: busy responding to a bunch of fake traffic. Essentially, I'm oversimplifying,
Speaker 1: but this is a basic detos attack. It is. It's
Speaker 1: such a mean thing to do to those little kids
Speaker 1: during Christmas time, just turn off their xboxes so that
Speaker 1: they can't log in and they can't play their games,
Speaker 1: so they just go on. Yeah, yeah, I think, break
Speaker 1: my heart. Gosh, it's a move. It's a jerk move.
Speaker 1: Don't do it. Yeah. I love the definition, or I
Speaker 1: love the term zombie for botnets, because that's exactly what
Speaker 1: it is. Where you have a you have a zero,
Speaker 1: a patient zero, and that would be the first computer.
Speaker 1: They end up biting a few more computers, and those
Speaker 1: ones end up getting infected with the same exact infection
Speaker 1: that patient zero had, and then those ones end up
Speaker 1: biting ten each, So you end up with thousands upon
Speaker 1: thousands of these computers that each have the same exact infection,
Speaker 1: and they all end up perpetrating the same exact vulnerability
Speaker 1: on whatever their target might be. Yeah, and then ultimately
Speaker 1: you end up with a situation where Nagan is standing
Speaker 1: there with a baseball bat and you don't know whose
Speaker 1: head he's gonna cave in. I might have taken that
Speaker 1: metaphor a little too far. But one of the things
Speaker 1: that botnet controllers might do, and in fact, this has
Speaker 1: happened on multiple occasions. It's similar to ransomware is they'll
Speaker 1: send a message to an identified target and say, hey,
Speaker 1: we we got your number. We're going to come after you.
Speaker 1: Unless you pay us a certain amount of money, we
Speaker 1: will unleash the dogs of war on your servers and
Speaker 1: you will be unable to do business. And there have
Speaker 1: been cases where businesses have folded to this kind of pressure,
Speaker 1: where they have in fact paid to do this because
Speaker 1: the hospital. Yes, yes, it was. Yeah, I've seen a
Speaker 1: few cases of particularly malicious and odious acts against things
Speaker 1: like hospitals. There was one year when I was participating
Speaker 1: in a charity for children's hospitals and the charity was
Speaker 1: targeted in the middle of the event and for about
Speaker 1: three hours they were offline trying to deal with that. Yeah,
Speaker 1: it's and in that case it wasn't. It wasn't an
Speaker 1: attack in an effort to get money. I don't think.
Speaker 1: I think it was just someone being truly an awful
Speaker 1: human being. But we have seen cases of people trying
Speaker 1: to do this in order to extort money. So you're
Speaker 1: probably noticing some trends here extortion, stealing, you know, holding
Speaker 1: things for a ransom, this idea of making sure that
Speaker 1: people are spending money out of fear or out of
Speaker 1: a need to get back and have access to something
Speaker 1: that belongs to them. These are all terrible, terrible motivations
Speaker 1: to make money, and as such, as such terrible motivations,
Speaker 1: you might think, well, wait a minute, how are they
Speaker 1: actually like, how are they getting paid? How is this
Speaker 1: money transfer happening? Because you would think anything that would
Speaker 1: be traceable would end up being somewhat problematic. You've got
Speaker 1: a trail that leads back to you as a person,
Speaker 1: then pretty soon law enforcement's going to get involved, or
Speaker 1: at least the irs. So how Shannon do hackers? How
Speaker 1: do they get the money? So there's probably some ways
Speaker 1: that I don't even know about yet, but the ones
Speaker 1: that I can think of would be trading of high
Speaker 1: value data. So that's a pretty big one, where say
Speaker 1: a hacker collects a whole bunch of really really high
Speaker 1: value data like your SO security number, your credit card accounts,
Speaker 1: your banking account tons of information and they decide to
Speaker 1: go on to a deep web forum sell it, and
Speaker 1: then or trade it for something else of high value,
Speaker 1: for example, a gift card. They could ask for people
Speaker 1: to give them a ton of gift cards that are,
Speaker 1: like you, twenty five or fifty dollars each, and then
Speaker 1: use those gift cards at a retailer who is easily
Speaker 1: vulnerable to some kind of gift card scam, and in
Speaker 1: that sense they would be able to make some kind
Speaker 1: of money back through those gift cards and that trade
Speaker 1: of that high value data that they stole from whoever
Speaker 1: it might be, whatever company. Another way would be bitcoins.
Speaker 1: Now that's probably the most obvious one, of course, because
Speaker 1: bitcoins are very very hard to track. Yes, they are
Speaker 1: traceable in some circumstances, depending on what kind of wallet
Speaker 1: you use, but in a lot of circumstances, the bitcoins
Speaker 1: will trade wallets so many times that it'll be somewhat
Speaker 1: impossible to find out where it actually came from, where
Speaker 1: it actually started. Yeah, it's kind of interesting because every
Speaker 1: single bitcoin contains with it a record of every transaction,
Speaker 1: but that does not mean that the parties involved are
Speaker 1: actually identifiable. Yeah, exactly. It really is. It's actually data
Speaker 1: that's used in order to allow for the mining of
Speaker 1: further bitcoins. It's a really fascinating process. But one of
Speaker 1: the things that attracts people to bitcoins is this idea
Speaker 1: of being able to spend them anonymously and be able
Speaker 1: to purchase things, whether legal or illegal, without it being
Speaker 1: traced back to that person. You often will hear about
Speaker 1: things like, you know, the old Silk Road, where you
Speaker 1: could purchase all sources of stuff, including illegal drugs or
Speaker 1: other materials, sometimes weapons, that kind of stuff, and you
Speaker 1: could do it through bitcoins, and people felt a high
Speaker 1: level of confidence because it was not a state backed currency.
Speaker 1: It was this independent cryptocurrency that allowed them that freedom
Speaker 1: and had real value because people want the bitcoins. If
Speaker 1: no one wanted the bitcoins, they wouldn't be worth anything, right,
Speaker 1: And bitcoins have actually been pretty steady last time I checked,
Speaker 1: so their value has been pretty decent in late days,
Speaker 1: in recent days, So I completely understand why hacker would
Speaker 1: want to be paid in bitcoins. It makes sense. Yeah. Yeah,
Speaker 1: there's also the old, the old deal of putting the
Speaker 1: money into the washing machine. Right, that's how money laundering works, right, Yes,
Speaker 1: money laundering. So that was something that I learned about
Speaker 1: way back in the day when I worked at a
Speaker 1: bank of all places, which also got me really interested
Speaker 1: in security before I started podcasting. But money laundering, it's
Speaker 1: very easy for somebody to go online, be able to
Speaker 1: sell this high value data, get some bitcoins or it
Speaker 1: might be some other form of currency, and then be
Speaker 1: able to resell that money or be able to trade
Speaker 1: a product to get real money, real cash at one
Speaker 1: point or another. But basically it's it's um exchanging the
Speaker 1: hands that hold that money so many times that again
Speaker 1: it's very hard to trace, yeah, and it's it's hard
Speaker 1: to determine that the original source of that money was
Speaker 1: anything remotely illegal. And then depending on again, if you're
Speaker 1: if you're a state sponsored hacker, you're probably just drawing
Speaker 1: a salary or doing contract work, so you're actually getting paid.
Speaker 1: You get a pay check, yeah, yeah, so you got
Speaker 1: money withdrawn from your paycheck to handle to support the
Speaker 1: government while you are subverting other governments, and then it
Speaker 1: looks completely legitimate. So that's a really easy way for
Speaker 1: somebody to do something that might be very very bad. Yeah,
Speaker 1: because they are they do have to pay the I rs.
Speaker 1: They do get a tax refund every year, they do
Speaker 1: have an employer, so it looks completely normal for them
Speaker 1: to be receiving a paycheck for whatever work this might be. Yeah,
Speaker 1: So the nice thing is there aren't just quote unquote
Speaker 1: bad guys out there doing all this kind of work
Speaker 1: with computers, with a hacking, with discovering vulnerabilities. There are
Speaker 1: plenty of people, as as you mentioned earlier, Shannon, who
Speaker 1: are doing this in order to help others, either to
Speaker 1: make systems more secure or to inform people of how
Speaker 1: these kind of attacks happen so that they can be
Speaker 1: better prepared to defend themselves. So let's talk about some
Speaker 1: of them. Of course, if you have black hat hackers, right,
Speaker 1: you got the bad guys you gotta have, you gotta
Speaker 1: have the white white hat white hack hackers. These these
Speaker 1: are the noble bounty hunter characters of those westerns, the
Speaker 1: ones who you know they've seen things, but deep down
Speaker 1: they have a heart of gold. Well, not all of them,
Speaker 1: but a lot of my friends are considered white hat hackers.
Speaker 1: They're the people who either they work for a company
Speaker 1: that specializes insecurity. So a lot of my friends work
Speaker 1: for these companies who will be contracted with big brands,
Speaker 1: go into their networks and then find out what the
Speaker 1: vulnerabilities are and fix them, or they will give them
Speaker 1: a report and tell them how to fix them fix
Speaker 1: it in the future. They make a lot of money.
Speaker 1: A lot of them don't like it because they have
Speaker 1: specific amounts of vulnerabilities or specific timeframe set that they
Speaker 1: have to get this work done, and a lot of
Speaker 1: times hacking takes a lot of time. It takes a
Speaker 1: lot of information reconnaissance. So a lot of my friends
Speaker 1: don't necessarily appreciate having to be under these time constraints
Speaker 1: with these big brands well, particularly since you figure the
Speaker 1: bad guys aren't under any particular time constraints exactly. So
Speaker 1: the bad guys have tons of time to find these vulnerabilities,
Speaker 1: while the white hacks are under the stress of these
Speaker 1: time constraints to get the work done so that they
Speaker 1: make their bosses happy. In this sense, a lot of
Speaker 1: a lot of people that I know have created their
Speaker 1: own security companies because of this fault in the generic
Speaker 1: nature of having these security companies. So they said, you know,
Speaker 1: I'm tired of having to deal with these constraints that
Speaker 1: my boss has given me. Just going to open my
Speaker 1: own security company, and we're going to do it even
Speaker 1: better because we won't give ourselves those time constraints. We'll
Speaker 1: give us ourselves several months to find all the vulnerabilities
Speaker 1: that we absolutely can and then we'll write a report
Speaker 1: and we'll fix it. And those are the ones that
Speaker 1: I would definitely work with if I had to hire
Speaker 1: a security company. Yeah, because they're the ones who are
Speaker 1: going to use the exact same kind of methodologies, right
Speaker 1: the bad guys are going to use. And if if
Speaker 1: you want to really be secure, you want the people
Speaker 1: to throw everything they can at your system so that
Speaker 1: you can find out are you actually secure? If you're not,
Speaker 1: what do you need to do to address it? If
Speaker 1: you want to see a movie that does a very
Speaker 1: fantasy version of this very idea, there's a nineteen ninety
Speaker 1: two film that I always think back to. Sneakers had
Speaker 1: Robert Redford and Dan Ackroyd, who plays a character named mother.
Speaker 1: Ben Kingsley is in it, a ton of folks, River
Speaker 1: Phoenix was in it, and it's a It's a movie
Speaker 1: about a group of kind of almost like outcasts who
Speaker 1: have grouped together to form a company that they specifically
Speaker 1: do this. They try to infiltrate a company in order
Speaker 1: to test its security, not to exploit it, but rather
Speaker 1: to tell the company, hey, here's how we got in,
Speaker 1: here's how someone else could get in, so you need
Speaker 1: to plug this vulnerability that kind of thing. And then
Speaker 1: of course they get involved in all sorts of shenanigans.
Speaker 1: And in case you are interested in the methodology, I
Speaker 1: actually find it very very interesting how they get their
Speaker 1: work done, because of course they have to go through
Speaker 1: the tennis match of back and forth with a brand
Speaker 1: name company, whatever it might be. So they'll have to
Speaker 1: get a purchase order, they'll do a little bit of
Speaker 1: negotiation for an amount that they'll do the work for,
Speaker 1: and then they'll go in and they'll gather information on
Speaker 1: the network, and they'll capture traffic, and they'll try to
Speaker 1: find any kind of vulnerabilities that are on that network,
Speaker 1: even with the people too. For example, they could use
Speaker 1: social engineering to get into the server rack physically, or
Speaker 1: they could get into a network that doesn't necessarily have
Speaker 1: a very good password on it. They could email clients
Speaker 1: that work there, that are employed at the brand name
Speaker 1: company with I don't know malware written PDFs for example,
Speaker 1: and they can use why list attacks. They could do
Speaker 1: war driving from the parking lot if they wanted to.
Speaker 1: And then what they'll do is write a very very
Speaker 1: long report so that the brand name company can see
Speaker 1: exactly what happens on their network and exactly what they
Speaker 1: were able to do from whatever back door they were
Speaker 1: able to get into. It's really interesting how well they're
Speaker 1: able to put everything together in turn hopefully save this
Speaker 1: company in the long run thousands and thousands of dollars.
Speaker 1: We will be back to talk a little bit more
Speaker 1: about hacking for that cold hard cash after we take
Speaker 1: another quick break. Security has always been a tick talk approach, Right,
Speaker 1: You've got the tick, which is where someone has identified
Speaker 1: a way of exploiting a system, and then the talk
Speaker 1: is where you find a way to correct that vulnerability.
Speaker 1: The tick is the next time someone's found of vulnerability,
Speaker 1: you're always going to have that, right unless someone somehow
Speaker 1: designs the absolute perfect system, which as far as we know,
Speaker 1: is an impossibility. Yeah. Yeah, because for one thing, if
Speaker 1: people are involved, there's no such thing as a perfect system. Yeah,
Speaker 1: it's always a battle, and I love my video game,
Speaker 1: so I love a battle. But yeah, it also drives
Speaker 1: other other industries though, because we'll see things like the
Speaker 1: artificial intelligence industry improve as a result of this security
Speaker 1: battle between hackers and the infosec experts who are trying
Speaker 1: to make sure to their protecting systems. And as a result,
Speaker 1: we're getting information that can be used in other areas,
Speaker 1: which is phenomenal. Like I remember, here's the simple one.
Speaker 1: It's as far as security goes, This is as low
Speaker 1: level as it gets. But the capture system. So when
Speaker 1: capture was implemented, even the people who were writing capture
Speaker 1: at the time, we're not really thinking of it as
Speaker 1: being some sort of full proof security system to make
Speaker 1: sure that bots don't get into a system, right. They
Speaker 1: weren't thinking, oh, now only human beings can get access.
Speaker 1: And if you don't know what a capture is, anytime
Speaker 1: you get you're filling out a thing and you get
Speaker 1: a little picture of something and it says tell you
Speaker 1: write down the word or numbers that are in this picture,
Speaker 1: or even to a point of identify the pictures in
Speaker 1: this sequence that have this particular feature, like identify all
Speaker 1: the pictures that have a lake in it or something
Speaker 1: like that. That's simply that's simply a version of capture.
Speaker 1: The people who made it, they actually said, our goal
Speaker 1: was really to help push artificial intelligence, because we created
Speaker 1: a system where programmers or hackers had to start coming
Speaker 1: up with computer programs that could identify the same things
Speaker 1: that we humans can identify. And in turn, that means
Speaker 1: now we've got software that pushes forward artificial intelligence. Now, granted,
Speaker 1: that also means you have to improve the system you
Speaker 1: had designed to keep bots out in the first place.
Speaker 1: So again it goes to that TikTok, But there's an
Speaker 1: added benefit beyond someone being able to to automatically access
Speaker 1: systems and build, you know, dozens and dozens of fake
Speaker 1: profiles on Facebook or whatever it might be, whatever that
Speaker 1: might be. Yeah, yeah, And and keep in mind, like
Speaker 1: like we've been saying here, I mean, any any systems
Speaker 1: security is only as strong as its weakest link. That
Speaker 1: weakest link is pretty much always people. That's the big one, right.
Speaker 1: But I mean, I've I've read stories about a hacker
Speaker 1: gaining access to a system because there was an overall
Speaker 1: security system that was really robust for the main company,
Speaker 1: but then they had a little branch office, and the
Speaker 1: branch office didn't have that crazy amount of security but
Speaker 1: was still on the same network. I think I read
Speaker 1: about that story too, So I mean, these are these
Speaker 1: are things like if you identify a potential point of
Speaker 1: weakness that's now suddenly the you know it's it's like
Speaker 1: a bank vault. If the bank vault hasn't enormous door
Speaker 1: with huge locks on it that you have to get through. Oh,
Speaker 1: but it also has a backdoor. Just for convenience sake,
Speaker 1: You're going to aim for the backdoor. But there are
Speaker 1: other ways that hackers can make a legitimate living that
Speaker 1: don't even involve testing security systems. It might involve education. Yeah,
Speaker 1: absolutely so education is I guess what you would say,
Speaker 1: I fall into that kind of category. And while I
Speaker 1: don't necessarily like to call myself a hacker because I
Speaker 1: know so many experts in the field who are much
Speaker 1: more knowledgeable than I am, I'm quite a intermediate, i
Speaker 1: would say. But I love to teach, and I love
Speaker 1: to give tutorials online, so I give tutorials on YouTube.
Speaker 1: But I also know a lot of people who have
Speaker 1: either written books about hacking, and they could do either
Speaker 1: specifics about penetration testing, or they get to make it
Speaker 1: a very very wide based book where they explain everything
Speaker 1: that you would have to do as a penetration tester,
Speaker 1: and a penetration tester is basically one of those guys
Speaker 1: that would go into a company and find all the
Speaker 1: vulnerabilities and report on it. You would also have companies
Speaker 1: that administer certifications, so a lot of I'm sure a
Speaker 1: lot of your listeners probably know that you have to
Speaker 1: get certifications to get a lot to get into a
Speaker 1: lot of the fields with computer security and even just
Speaker 1: you know, computer networking too. There's a lot of searts
Speaker 1: for those and they're very, very expensive. So a lot
Speaker 1: of companies just administer their certifications or they'll will have
Speaker 1: you take classes for a period of time until you
Speaker 1: actually take the test and get certified. But that ends
Speaker 1: up being a really good thing to put on your
Speaker 1: resume for a lot of companies whenever you do intend
Speaker 1: to get a job in network security. And then lastly,
Speaker 1: we have the publishers. So that's the YouTubers, that's the
Speaker 1: people that made podcasts, That's the people that might be
Speaker 1: creating other forms of entertaining mint that not only educate
Speaker 1: but also entertain their users and their listeners so that
Speaker 1: they get excited about being a part of information security.
Speaker 1: And that's what I like to do. I like to
Speaker 1: teach people in a way that makes it exciting. So
Speaker 1: I do a lot of hands on stuff. I make,
Speaker 1: I make jokes, and I explain things in a very
Speaker 1: natural light and it helps. It helps, again foster that
Speaker 1: desire to learn how things work. Yeah, right, that does
Speaker 1: so again that that same fascination, Like if you were
Speaker 1: ever a kid that took apart a watch or a
Speaker 1: radio or some other piece of equipment, because you really
Speaker 1: want to know what's the magic that makes this thing
Speaker 1: do what it does. Hackers have that, I mean, that's
Speaker 1: the that's that's the defining quality in my mind of
Speaker 1: a hacker is ultimately it's someone who is fascinated with
Speaker 1: the way something works. We've largely been focusing on software,
Speaker 1: but that is just as legitimate as any hardware hack.
Speaker 1: It's the idea of how does this It might not
Speaker 1: even just be the software, It might be a full system,
Speaker 1: like how does this system work? What are all the
Speaker 1: interlocking parts? How do they communicate with each other? I
Speaker 1: just had a random memory from when I was younger
Speaker 1: and in school, I took apart my first iPod because
Speaker 1: I had no clue how it worked, and I was
Speaker 1: very curious about what the interior of it was. Yeah,
Speaker 1: so I just I took it apart. I could have
Speaker 1: put it back together, So I was not hacker in
Speaker 1: any sense. For an article I was writing, we got
Speaker 1: a first edition Launch Day Nintendo three DS, and it
Speaker 1: was my job to disassemble it and take photos of
Speaker 1: all the pieces. So first I took a picture of
Speaker 1: it whole and shared it online on Twitter and said
Speaker 1: look what I have, and everyone got excited. And then
Speaker 1: by the end of it, I had a little had
Speaker 1: a little black cauldron at my desk that was leftover
Speaker 1: from a Halloween thing. And then I put all the
Speaker 1: different pieces because there was no way this thing was
Speaker 1: going back together after I took it apart. For one thing,
Speaker 1: Nintendo is pretty careful about sealing stuff in such a
Speaker 1: way that it's not meant to come apart, so so
Speaker 1: you have to have it was a little force in
Speaker 1: some cases in order to get to stuff. And then
Speaker 1: I showed a picture. I'm like, I'm like, look what
Speaker 1: I did to the thing. The entire internet cry. Yeah,
Speaker 1: although ultimately I think the three DS most people were like,
Speaker 1: oh whatever, But at the time when it was brand new,
Speaker 1: people were freaking out. And of course there's there's also
Speaker 1: another role for hackers out there. It may not be
Speaker 1: a steady gig, but we are seeing more and more
Speaker 1: of the Hollywood productions out there actually talk with people
Speaker 1: in the industry so that the depictions that we're getting
Speaker 1: are more accurately reflecting what really happens. Mister Robot is
Speaker 1: probably the example that immediately leaps to my mind, and
Speaker 1: that it's it's a show. It tries very hard to
Speaker 1: take a more realistic approach to the world of hacking,
Speaker 1: as opposed to you type in three passwords, the third
Speaker 1: one gets you in, and then you're navigating through a
Speaker 1: vector graphics three D dungeon and you encounter a skull
Speaker 1: and cross bones. That's not how hacking works. Sounds like
Speaker 1: you were talking about hackers hack the planet. I might
Speaker 1: have been. I mentioned too with education, Just to bring
Speaker 1: it back a bit, professors, I didn't leave you guys out.
Speaker 1: I'm sorry. I love you guys. You are the reason
Speaker 1: why I'm here now. If I didn't take my computer
Speaker 1: courses in college with my professors, I would not be
Speaker 1: doing what I'm doing now. So professors are like at
Speaker 1: the top of that educational list because oh sure, and
Speaker 1: you can take a lot of computer security courses in
Speaker 1: college and sometimes in high schools if you're lucky. But yeah,
Speaker 1: technical assistance. So technical assistance are people that will come
Speaker 1: on board with a Hollywood movie or a TV show
Speaker 1: or what have you, and they will explain to the
Speaker 1: network how the hacking actually happens. So I know a
Speaker 1: few they will. They'll come to some of their hacker
Speaker 1: friends or they will be a hacker themselves and they
Speaker 1: will say, Okay, in this season, I know that they
Speaker 1: want to do X, Y and Z on camera, and
Speaker 1: I need to make it look legitimate, so they will
Speaker 1: come up with the script. They will come up with
Speaker 1: the hack and the actual keyboard commands that the actor
Speaker 1: has to type in on camera so that they are
Speaker 1: actually doing legitimate hacks. So that way, they're not only
Speaker 1: making it look cool for a wider audience because an
Speaker 1: audience is actually going to see how a hack works,
Speaker 1: but they're also getting that credibility with the infoset community too.
Speaker 1: So mister Robot is huge with the infoset community because
Speaker 1: it is legitimate. Like I've watched several of those episodes,
Speaker 1: and I've seen a lot of the hacks that they do.
Speaker 1: They've even used some of our hack fi products on
Speaker 1: the show, and they're actually using legit hacks, And it
Speaker 1: is so much fun to see it ont be and
Speaker 1: see them get so many good reviews from a wider
Speaker 1: consumer audience, because it makes me feel like many more
Speaker 1: people are getting interested in info sex because they see
Speaker 1: what's happening on camera and they see that this is
Speaker 1: actually how you do it. Yeah, it's nice to see
Speaker 1: it go beyond the niche that I would argue info
Speaker 1: SEC and hacking has largely inhabited for the past three decades.
Speaker 1: Right the people who had been interested when it's first started,
Speaker 1: it was essentially your hobbyists, and often those hobbyists were
Speaker 1: isolated individuals. You got to the phone freaking days where
Speaker 1: there was a little bit of a small subculture of
Speaker 1: people who were interested in hacking the telephone system using
Speaker 1: all sorts of stuff, including a whistle from Captain Crunch.
Speaker 1: You had the early hack days where people were just
Speaker 1: trying to create interesting programs for their computers or to
Speaker 1: see how some of the programs that were coming out,
Speaker 1: how did those work? But it was largely a tiny
Speaker 1: slice of the folks who were even aware of personal computers,
Speaker 1: and even that group was still a tiny slice of
Speaker 1: the overall population. We're seeing that tiny slice grow over time,
Speaker 1: and largely because so many of us are so dependent
Speaker 1: upon computers these days that it benefits us to have
Speaker 1: an awareness to make sure that we remain safe, but
Speaker 1: also because of things like mister Robot showing how this
Speaker 1: works and sparking the imagination of people who perhaps before
Speaker 1: they saw that, never thought, yeah, it's kind of cool.
Speaker 1: I would love to be able to manipulate code in
Speaker 1: such a way that I could do something new or
Speaker 1: unexpected or help people. And it's really encouraging to see
Speaker 1: that kind of thing happen right now. I kind of
Speaker 1: wish it had happened ten years ago, but I love
Speaker 1: seeing it happen now same. I actually feel like there
Speaker 1: was a little bit of negativity in the aspect that
Speaker 1: we used to have all these really fancy graphics happening
Speaker 1: in these Hollywood movies and these TV shows, and now
Speaker 1: they're actually seeing the reality that is hacking, and it
Speaker 1: is not super colorful. It's not super quick, fast paced
Speaker 1: and exciting, like it looks like it is on those
Speaker 1: old school shows, So I'm hoping that now that they're
Speaker 1: actually seeing it, people will try it too. Like if
Speaker 1: they seem the main actor on Mister Robot do a
Speaker 1: specific command line option, they'll go to their computer and
Speaker 1: try it themselves and see that it actually does work,
Speaker 1: and then they'll be like, oh, I really want to
Speaker 1: try some new stuff too, so they'll start googling it
Speaker 1: and see what else they can find out. That's the
Speaker 1: kind of inspiration that I wish happened thirty years ago,
Speaker 1: and it didn't, So I want to see more of
Speaker 1: that now, and I'm really happy that, for example, mister
Speaker 1: Robot has done a great job with it. Yeah it's
Speaker 1: it's and you not to poop all over Hollywood, because
Speaker 1: I do lovesm hollywoods, but but it is to understand
Speaker 1: where they were coming from. They were trying to find
Speaker 1: a way to create an exciting visual depiction of something
Speaker 1: that doesn't necessarily necessarily lend itself to that in order
Speaker 1: to create a dramatic effect. So I get it. It's
Speaker 1: very similar to the way Hollywood portrayed virtual reality back
Speaker 1: in the nineties, way before virtual reality was ready for
Speaker 1: public consumption and it's what largely killed VR for a
Speaker 1: decade before the various video game systems started to make
Speaker 1: the components cheap enough for people to play in that
Speaker 1: space again, and now we're on the verge of another
Speaker 1: VR revolution. The same sort of thing is true of hacking, Like,
Speaker 1: how do you show hacking in a way that gets
Speaker 1: across what is happening to an audience and makes it interesting.
Speaker 1: I think largely you have to do that through really
Speaker 1: good writing of your characters. And once you do that,
Speaker 1: then everything else follows. I think if you can show
Speaker 1: that the characters in a movie or in a TV
Speaker 1: show are actually real people that have real relationships, they
Speaker 1: have real jobs and real lives, and they have hobbies
Speaker 1: outside of just hacking, you can really you can start
Speaker 1: to relate to that character in a very real sense
Speaker 1: in the fact that, hey, they are humans too, because
Speaker 1: here's our people too. That was actually a documentary nice. Yeah,
Speaker 1: because again, when when you're when you're thinking about it
Speaker 1: in the abstract, you're really it becomes that us versus
Speaker 1: them mentality, where by its very nature it's dehumanizing. But
Speaker 1: that's probably a topic for a show that's not about technology.
Speaker 1: So I will just leave it be. Shannon Morse, thank
Speaker 1: you so much for joining me today. Please let everyone
Speaker 1: know where they can find all of your stuff. Jonathan Strickland,
Speaker 1: thank you. So yeah, it was a little it was
Speaker 1: a little curt it was a little laden. Yeah. Yeah,
Speaker 1: I've been watching Startrek lately. Way wait too much starts Trek,
Speaker 1: So you can find me. The most direct path is
Speaker 1: on Twitter. I'm at snubs and that's snubs and then
Speaker 1: my shows, specifically Our tech Thing over at tek thing
Speaker 1: dot com and Hack five over at HK five dot org.
Speaker 1: Well that wraps up this classic episode of tech Stuff.
Speaker 1: Hope you enjoyed it. It was great having Shannon on
Speaker 1: the show. I've had her on a few times over
Speaker 1: the years, and I would actually I would love to
Speaker 1: have her on again. There's always an open invitation to Shannon.
Speaker 1: She is a very busy woman. She's got a lot
Speaker 1: going on. So if I can find a time to
Speaker 1: schedule her so that we can have her on and
Speaker 1: share her expertise, that would be wonderful because she's got
Speaker 1: a deep and practical knowledge in fields where I just
Speaker 1: have kind of a general awareness. So she's always great
Speaker 1: to have on the show. If you have suggestions for
Speaker 1: topics I should cover in future episodes of tech Stuff,
Speaker 1: Please reach out to me and let me know what
Speaker 1: those are. One way to do that at is to
Speaker 1: download the iHeartRadio app. It's free to download, it's free
Speaker 1: to use. He can navigate over to the tech Stuff
Speaker 1: part by just putting tech Stuff into that little search bar.
Speaker 1: It'll take you to the podcast page and you'll see
Speaker 1: a little microphone icon. If you click on that microphone icon,
Speaker 1: you can leave me a voice message up to thirty
Speaker 1: seconds in length and let me know what you would
Speaker 1: like to hear in the future, or if you prefer,
Speaker 1: you can go on over to Twitter and send me
Speaker 1: a tweet. The handle for the show is tech Stuff
Speaker 1: HSWU and I'll talk to you again really soon. Tech
Speaker 1: Stuff is an iHeartRadio production. For more podcasts from iHeartRadio,
Speaker 1: visit the iHeartRadio app, Apple Podcasts, or wherever you listen
Speaker 1: to your favorite shows.