Speaker 1: Get in touch with technology with tech Stuff from how
Speaker 1: stuff works dot com. Hey there, everybuddy, Welcome to tech Stuff.
Speaker 1: I'm Jonathan Strickland. I'm your host and the executive producer
Speaker 1: of this show there at how Stuff Works, and I
Speaker 1: heeart radio and a love of all things tech, and
Speaker 1: we are doing another classic episode of tech Stuff hacking
Speaker 1: for dollars. I got to talk with Shannon Morse of
Speaker 1: Hack five and we talked all about how hackers make
Speaker 1: money and both in in legal and nefarious ways. And
Speaker 1: this is going to be the last of our classic
Speaker 1: episodes covering my vacation time, I will be back in
Speaker 1: the studio recording brand new episodes. So I thank you
Speaker 1: very much for your patience. I hope you guys have
Speaker 1: enjoyed this look back on some past episodes of tech Stuff.
Speaker 1: Let's join past Jonathan and Shannon right now. Hi, how
Speaker 1: are you Jonathan, I'm doing great. How are you? I'm awesome. Yeah,
Speaker 1: thank you so much for having me on. This is
Speaker 1: a great show and I love listening to it, so
Speaker 1: I'm super happy to be on. Yeah, excellent. Now, this
Speaker 1: is of course the second time we've had you on,
Speaker 1: so I will work very hard to to increase that number.
Speaker 1: I want to at least get us up to double
Speaker 1: digits with that. But I got Shannon on the show
Speaker 1: specifically to talk about an area that she talks about
Speaker 1: a lot, the realm of hacking, and specifically I wanted
Speaker 1: to do kind of an episode about how do hacker,
Speaker 1: how do you make money? How do you make a
Speaker 1: career out of hacking? And uh and really to frame
Speaker 1: this conversation, I think one of the most important things
Speaker 1: to do is to sort of define your terms. And
Speaker 1: as it turns out, the term hacker is is actually
Speaker 1: a very broad term that can apply to a lot
Speaker 1: of different things, and not all of them are that
Speaker 1: nefarious evil infiltrate a system and steal all the corporate
Speaker 1: secrets kind of approach to hacking that Hollywood often presents
Speaker 1: right right exactly. I actually asked this question to a
Speaker 1: lot of people, especially when I first meet them. Since
Speaker 1: I'm so closely affiliated with a lot of the info
Speaker 1: set community, I want to surround myself with positive people.
Speaker 1: So you'll notice with the hacker definition, you can either
Speaker 1: get a very negative vibe from somebody or a very
Speaker 1: positive vibe. Oftentimes, with the negative vibe, you'll get somebody
Speaker 1: who says, oh, that's the person who stole my credit
Speaker 1: card data when I went to a restaurant the other day.
Speaker 1: But on the positive side, you'll get somebody that says, oh,
Speaker 1: they're the kind of people that will like break something
Speaker 1: apart and then put it back together in a way
Speaker 1: that it wasn't supposed to be put back together to
Speaker 1: make it do something cool. And that's a hack in
Speaker 1: in mainstream. Uh So that's the way I see it.
Speaker 1: I see hackers as being people who um reverse engineer
Speaker 1: different software, different hardware. It could just be a bicycle,
Speaker 1: for example, and put it back together in a way
Speaker 1: to make it harder, better, faster, and stronger. Nice the
Speaker 1: old daft punk approach, of course, Yeah, I agree entirely. Uh.
Speaker 1: The the original term hacker was really all about people
Speaker 1: who have almost an insatiable curiosity to learn how stuff works.
Speaker 1: Oddly enough, I share that quality, having worked at how
Speaker 1: stuff works for a decade. Uh. But yeah, to understand
Speaker 1: how it works and then to make stuff do things
Speaker 1: it wasn't necessarily intended to do. Not for nefarious purposes necessarily,
Speaker 1: although that could clearly be an application, but just for
Speaker 1: curiosity's sake. Can can I take these elements that are
Speaker 1: meant to do this one thing and do something completely
Speaker 1: transformative with it, whether it is hardware or software. And
Speaker 1: we've seen some really cool stuff come out of that.
Speaker 1: I mean, I would argue that a lot of the
Speaker 1: things you see in the cosplay world and the steampunk world,
Speaker 1: those are all taking elements of hacking. Maker Fair is
Speaker 1: really just a hacker's paradise when you get down to it,
Speaker 1: especially for hardware hacks. Absolutely, I'm kind of sad I'm
Speaker 1: gonna miss Make Her Fair this year. I haven't been
Speaker 1: to one yet. I've been to a small one here
Speaker 1: in Atlanta, very very modest maker Fair. Everyone there was
Speaker 1: great and passionate and intelligent, but it was, you know,
Speaker 1: a much smaller scale than something you would see in
Speaker 1: the Bay Area. But but that's the kind of thing
Speaker 1: that hacker means to me. Now that being said, in
Speaker 1: this episode, we're really going to be focusing on on
Speaker 1: sort of the computer oriented, really the software side of hacking.
Speaker 1: Uh And a large part of it's going to be
Speaker 1: on the the the bad guy, the naughty bits as
Speaker 1: I call it in our notes about hacking, simply to
Speaker 1: talk about what are the ways that hackers cause or
Speaker 1: the malicious hackers cause problems? How do they expect to
Speaker 1: profit from that? And also that, well, we'll look at
Speaker 1: ways that hackers who don't follow that path, who are
Speaker 1: looking to help people, not hurt people, how do they
Speaker 1: make a living? Because it's one of those things where
Speaker 1: you kind of take it for granted when you see
Speaker 1: the Hollywood depiction of a hacker, the person sitting down.
Speaker 1: Usually they're sitting at a keyboard and for some reason
Speaker 1: they're monitor only is monochromatic green. Yes, that's so true. Well,
Speaker 1: they're using the old Apple to E terminals. Terminals are
Speaker 1: actually written and green oftentimes, but you can change the
Speaker 1: colors to rainbow colors if you choose. That is a hack,
Speaker 1: it's a real life hack. Yeah, yeah, And usually you
Speaker 1: see them sitting down and then they cause some sort
Speaker 1: of mischief, sometimes bordering on sabotage. But then you when
Speaker 1: you think about it outside the context of that scene,
Speaker 1: you think, how did they expect to profit from this?
Speaker 1: So that's kind of what we're looking at. Yeah, Because
Speaker 1: it's always important to me to reiterate to that there
Speaker 1: are always going to be two sides of a coin.
Speaker 1: To everything in life. Of course, there are going to
Speaker 1: be bad guys in the realm in the world who
Speaker 1: do nefarious hacks, but there's also a lot of good
Speaker 1: guys too, And personally, for me, the reason why I'm
Speaker 1: so interested in researching this is because it has made
Speaker 1: me a much more privacy and security guard person. I've
Speaker 1: gotten a lot better at my own protections online, and
Speaker 1: I feel like if somebody else can understand what a
Speaker 1: hacker does on the bad side as well as the
Speaker 1: good side, they can better protect themselves too, And that's
Speaker 1: what I've always tried to teach people. Yeah, I think
Speaker 1: all you have to really do is attend one def
Speaker 1: con and really have that driven home. I have not
Speaker 1: yet gone to a def con, mostly because I don't
Speaker 1: know that I could part with my smartphone for that
Speaker 1: long and I certainly wouldn't take it with me. Bring
Speaker 1: a burner phone, you'll be fine. Yeah, that that's me Jonathan,
Speaker 1: the guy who carries the burner. Uh. It makes sense,
Speaker 1: I mean, when you're doing something like that. So, for
Speaker 1: those who don't know, def Con is a large hacker
Speaker 1: based conference largely looking at the realm of information security
Speaker 1: UM and often they will you'll have entire presentations dedicated
Speaker 1: to showing off vulnerabilities and security, again not necessarily so
Speaker 1: that people can take advantage of them, but rather to
Speaker 1: raise awareness and to kind of force the hands of
Speaker 1: the parties that are responsible for that software to take
Speaker 1: action and fix a problem. Right Like, that was what
Speaker 1: we saw with the hack about remotely taking control of
Speaker 1: a person's vehicle. Uh specifically Jeep was really having that issue.
Speaker 1: Those one of those things where the researchers were saying, look,
Speaker 1: we're bringing this to light, not so that we can
Speaker 1: create an era where people are terrified of their vehicles
Speaker 1: that someone's going to take remote control of their car,
Speaker 1: but rather to really drive home the fact that the
Speaker 1: information security is now it's important everywhere. It's not just
Speaker 1: your phone, it's not just your computer. As the Internet
Speaker 1: of Things continues to blossom, it's everything. Yes, I agree,
Speaker 1: And in that sense, those researchers were trying to use
Speaker 1: something the old school term is called responsible disclosure, where
Speaker 1: they explain some kind of vulnerability that they found to
Speaker 1: the company in hopes that the company will fix this
Speaker 1: problem before it becomes mainstream and before it gets out
Speaker 1: into the wild. In the case of Jeep. I believe,
Speaker 1: if my memory serves me right, that Jeep did not
Speaker 1: necessarily release a patch for this vulnerability. So then the
Speaker 1: researchers decided to go out publicly about the information that
Speaker 1: they found, and then Jeep decided to fix it once
Speaker 1: everybody else knew about it, right, And then sometimes that's
Speaker 1: what it takes. And then and I've had the same
Speaker 1: discussion offline with a mutual friend of ours, Brian Brushwood.
Speaker 1: Brian is a stage magician. He has a show called
Speaker 1: Scam School. It's all about social engineering. One of the
Speaker 1: things I have talked about with Brian is that his show,
Speaker 1: he often shows how to do certain types of scams
Speaker 1: or tricks, but they're mostly in the bar bet world, right, Like,
Speaker 1: not stuff that you would do to ruin someone's life,
Speaker 1: but something that you know you might want to you
Speaker 1: might win a free beer that way. Totally use some
Speaker 1: of those myself. Yeah, And he showed off. He had
Speaker 1: an episode where he showed off this guy who had
Speaker 1: was demonstrating a well known vulnerableity of a popular bike
Speaker 1: lock that has been off the market for a couple
Speaker 1: of years because of this vulnerability. But that particular vulnerability
Speaker 1: meant that you could use a regular plastic pen, remove
Speaker 1: the pen part of the pen, use the casing, and
Speaker 1: jam them into the lock and pop the lock open hole. Right.
Speaker 1: And so people were complaining in the comments. They were saying,
Speaker 1: you're you're, you're publicizing this vulnerability. And I said, guess what,
Speaker 1: the bad guys already know about this vulnerability. What they're
Speaker 1: doing is publicizing it to a public that might be
Speaker 1: still vulnerable to it so that they don't fall victim.
Speaker 1: And that, to me is a very important part of
Speaker 1: hackers across the board. They they serve a very important
Speaker 1: purpose to alert folks to potential dangers before it gets
Speaker 1: too late. Yeah. Absolutely, And and you're those hackers are
Speaker 1: the people that are generally working to make a better
Speaker 1: world for consumers, a better about a private and secure
Speaker 1: world for consumers. But then, of course, on the other hand,
Speaker 1: are the batties. Yeah, let's talk about some of them.
Speaker 1: So I kind of gave some weird little titles for
Speaker 1: this when I was typing it up, because in the
Speaker 1: middle of a week, I get bored. Shannon has to
Speaker 1: be honest, And so when I was making an outline
Speaker 1: kind of for us to work from, I started coming
Speaker 1: up with goofy subtitles. So this whole section is titled
Speaker 1: the Naughty Bits in our Notes, and the first one
Speaker 1: is malware moo law as in people who make money
Speaker 1: through the development or distribution of malware. And malware, as
Speaker 1: I've said on this show many times in order to
Speaker 1: define it, it's really software that is intended to do
Speaker 1: something that is ultimately harmful to the person who runs
Speaker 1: that software on their machine. It covers a wide array
Speaker 1: of different sub categories, like, uh, you know, this is
Speaker 1: the sort of term that we normally would have in
Speaker 1: the old days just called a computer virus, But computer
Speaker 1: virus is a very specific thing, and malware covers more
Speaker 1: stuff than just viruses, also worms and all sorts of stuff. Yeah,
Speaker 1: there's there's malware for Java and Flash. If you still
Speaker 1: have Flash installed, I highly recommend that you uninstall it
Speaker 1: if you don't need it. There's malware for browsers. There's
Speaker 1: malware for advertisements online for sponsors that you'll see like
Speaker 1: on on different websites. That was a very recent problem
Speaker 1: that a lot of news publications had with yeah, big
Speaker 1: name news publicly. Yeah, so that was a big one.
Speaker 1: But you'll see maw'd all over the place, and luckily
Speaker 1: we do have anti malware software that we can use
Speaker 1: to protect our computers from it, and we can also
Speaker 1: block certain ports on the routers that can hopefully protect
Speaker 1: you from Mauer. But there's also a lot of cases
Speaker 1: where maware is distributed and built so quickly that a
Speaker 1: lot of those anti Mauer software are not updated quick enough.
Speaker 1: So in that case, we need to do the best
Speaker 1: that we can to protect ourselves and keep Mauer from
Speaker 1: getting out from the deep web. Yeah, you know, it
Speaker 1: used to be, uh that you really all you needed
Speaker 1: to worry about was just don't go to the more
Speaker 1: seedy elements of the web, and you were generally all right, right, Yeah,
Speaker 1: It's kind of like avoiding a bad neighborhood. Like, obviously,
Speaker 1: if you don't want to get robbed, there's certain neighborhoods
Speaker 1: that you should probably shouldn't walk around in by yourself
Speaker 1: at night, right, And this is kind of similar in
Speaker 1: that case where you avoid the deep web unless you
Speaker 1: really want to be on somebody's like hit list or
Speaker 1: something like that. Yeah. Yeah, if you're if you suddenly
Speaker 1: think that you want to come across as a big shot. Look,
Speaker 1: if you're not a big shot. Don't do that. It's
Speaker 1: kind of like, kind of like walking up to someone
Speaker 1: who works in a carnival and claiming that you're with
Speaker 1: it and for it. If you don't know what that means,
Speaker 1: you do not say that. Okay, I think I just
Speaker 1: gave terrible advice to an entire population of listeners. Don't don't.
Speaker 1: Don't talk to Carney's unless you are one. Alright, so, uh,
Speaker 1: and I love you Carney's, I love you all. So.
Speaker 1: The the thing that we're getting across, though, is that
Speaker 1: today that's not as big a guarantee as it used
Speaker 1: to be. Right like ten years ago, you'd say, look,
Speaker 1: just be careful. Don't download unusual files. Don't don't run
Speaker 1: a file that's linked in your email without checking it
Speaker 1: out first. Don't don't, you know, be careful opening up
Speaker 1: emails from things that you don't recognize. Be careful with
Speaker 1: PDF files. Be careful with stuff, especially unsolicited stuff that
Speaker 1: has come to you, because that raises the chances that's
Speaker 1: something hinky is going on. It doesn't necessarily mean it's
Speaker 1: definitely a problem, but it's potentially a problem, and it's
Speaker 1: better to be safe than sorry. Make sure you have
Speaker 1: good and uh anti virus software on your computer, make
Speaker 1: sure you have a nice strong firewall, all of these
Speaker 1: kind of things. Those used to be pretty good at
Speaker 1: keeping of the malware away from you if you were
Speaker 1: being a fairly responsible ned is in these days, they
Speaker 1: definitely help these days. These days, the attacks are sometimes
Speaker 1: getting like in the case of the advertise eismans on
Speaker 1: news sites. These are attacks that are going through avenues
Speaker 1: that you want at one point would have considered perfectly safe.
Speaker 1: Not that it's happening all the time, but the fact
Speaker 1: that it can happen tells you that it requires an
Speaker 1: extra level of vigilance beyond what we used to say
Speaker 1: was was sufficient. Yeah. Absolutely, A data collection for a
Speaker 1: lot of this matare is extremely Uh. It's high sensitive
Speaker 1: in the fact that a user's data can get so
Speaker 1: much money on the on the deep web, so much
Speaker 1: money really, particularly a collection of user data. That's where
Speaker 1: the big money is, right. I did an episode once
Speaker 1: where we tried to break down how much is your
Speaker 1: personal information worth? Yeah, it really depends. It depends upon
Speaker 1: what information you're talking about, Like how extensive is that
Speaker 1: profile on a person? But yeah, it's not much in
Speaker 1: the grand scheme of things like, to you, it's worth
Speaker 1: a lot right you a person, Shannon, you as a person,
Speaker 1: that information is worth a lot of money to you
Speaker 1: because it's who you are. To someone else, it's worth
Speaker 1: pennies on the dollar, really, depending upon depending upon the
Speaker 1: amount of information. But the smellware often is giving hackers
Speaker 1: access to massive amounts of info about a huge number
Speaker 1: of people, and in numbers there is more value, and
Speaker 1: that's where they will sell that. Sometimes they sell it
Speaker 1: to companies that are just interested in getting information so
Speaker 1: that they can do targeted advertising. So it might be
Speaker 1: that the ultimate use of your information isn't as bad
Speaker 1: as it could be. It just means you're going to
Speaker 1: get some ads, but still not fun to think about
Speaker 1: and to think that you know, now these companies have
Speaker 1: access to information about you that you probably would rather
Speaker 1: they not have, particularly in targeted advertising. The famous story
Speaker 1: about target when they started sending ads to a young
Speaker 1: lady that were related to pregnancy, and then her dad
Speaker 1: got really really ticked off about it. But it turned
Speaker 1: out that little girl was pregnant, yeah, and that it
Speaker 1: was it was because the algorithms had picked up through
Speaker 1: her search habits that she was pregnant based upon the
Speaker 1: search terms she was putting in, and so they proactively
Speaker 1: sent her some coupons for pregnancy related items. The dad
Speaker 1: got very upset. Then the dad ended up apologizing to Targets,
Speaker 1: saying that he was unaware at the time of the
Speaker 1: full situation. Well, in that case, it was search algorithms.
Speaker 1: It wasn't a hacker who had gained access to stuff
Speaker 1: and then sold it. But there are other cases where
Speaker 1: that does happen, where you know, just a database of info,
Speaker 1: and a lot of times they will release this malware
Speaker 1: in something that's called an exploit kit. So generally, these
Speaker 1: exploit kits are like a batch of similar malware that
Speaker 1: will work across several different platforms. So that whether that's
Speaker 1: several different types of software like job and flash, or
Speaker 1: several different browsers. It could be several different operating systems too,
Speaker 1: So you might see an exploit kit that works on
Speaker 1: Lenox four but also works on Windows XP up through
Speaker 1: eight or something like that. Right, And what's crazy is
Speaker 1: that when you start looking at I mean, this is
Speaker 1: one of the things that hackers do, right, They'll look
Speaker 1: at operating systems and what the market penetration is for
Speaker 1: those systems because that that's that shows you where your
Speaker 1: target rich environment is. Right, So if you have Windows seven,
Speaker 1: guess what you are prime target for for malware because
Speaker 1: that is by far the largest um that that has
Speaker 1: the greatest market share of any operating system right now,
Speaker 1: Windows XP still it's number three, number three, and it
Speaker 1: has not been supported by Window formed by Microsoft for
Speaker 1: two years. This, by the way, bad thing. If you
Speaker 1: want to be really secure with your your computer information,
Speaker 1: you don't want to be using and operate system that
Speaker 1: no longer gets support from the company that made it,
Speaker 1: because because that means no vulnerabilities will be patched. From
Speaker 1: that moment forward, you're pretty much on your own. You
Speaker 1: have gone into the dark forest, and you forgot to
Speaker 1: bring your flashlight. It's pretty dangerous. UM. One of the
Speaker 1: things that you kind of uh that that I think
Speaker 1: it leads in from what you were saying before with
Speaker 1: these exploit kits. One of the most terrifying aspects of
Speaker 1: this type of malware and and the fact that that
Speaker 1: people can use it for nefarious purposes and monetary gain,
Speaker 1: is that you also have a population of people who
Speaker 1: don't even understand how the malware works. They don't even
Speaker 1: Script kitties is what I'm getting at. Script kitties, that's
Speaker 1: the term we use for people who are, uh, they're
Speaker 1: benefiting from the the work that hackers have done. Hackers
Speaker 1: are the ones who are actually putting together the software.
Speaker 1: They're the ones who have identified the vulnerability and then
Speaker 1: exploited it in some way. Script kitties are the ones
Speaker 1: who essentially they're given a set of skeleton keys, and
Speaker 1: they didn't make the skeleton keys, they're just using them. Um.
Speaker 1: And it's scary because you don't need a level of expertise.
Speaker 1: You might think, oh, well, I'm kind of safe from
Speaker 1: hackers because how many people are actually hackers? How many
Speaker 1: people really know how this system works. Well, you don't
Speaker 1: have to really know how the system works. If you
Speaker 1: have a tool that exploits a vulnerability. Oh absolutely. Although
Speaker 1: I really hate the word script kittie, I will put
Speaker 1: it out there because I feel like if you're interested
Speaker 1: in information security, and if you're interested in becoming a
Speaker 1: good hacker, then you do start somewhere. And everybody is
Speaker 1: going to start with the easy tools that are out
Speaker 1: there and that are available for free. For example, one
Speaker 1: thing that I learned how to use a couple of
Speaker 1: years back was this tool called wire shark. It easily
Speaker 1: lets you see everything that's happening on your wireless network,
Speaker 1: or you can use it for um, any computers that
Speaker 1: are on your on your network, like behind your router,
Speaker 1: so you can see everything that's going on and you
Speaker 1: don't necessarily have to learn or understand what's going on
Speaker 1: behind it to be able to read what's on your
Speaker 1: screen happening right in front of you. I think it's
Speaker 1: really important though, for people who might be called script
Speaker 1: kitties to look at as being beneficial and that they
Speaker 1: can grow from that process. They can start from being
Speaker 1: a beginner and say, okay, well I need to understand
Speaker 1: the theory. Now I can move on from being a
Speaker 1: script kittie quote unquote to becoming somebody who is an
Speaker 1: expert in some kind of information security out there. Yeah.
Speaker 1: I when I think of the term script kitty, in
Speaker 1: my mind, it's a very it's a subset of the
Speaker 1: people that typically get labeled as such. That subset being
Speaker 1: people who have little to no interest in actually learning
Speaker 1: how to hack or program. Uh, people who want a
Speaker 1: very very fast track way to gain either a reputation
Speaker 1: by being the person who took down a system by
Speaker 1: whatever means, or by making a whole lot of money
Speaker 1: really fast for relatively little effort. Those are the ones
Speaker 1: I specifically think of when I think of script kitty.
Speaker 1: But you are absolutely right, you have to start somewhere
Speaker 1: if you're interested in that is. I'm kind of defensive
Speaker 1: with that because I I was called a script katie
Speaker 1: when I first started up started off learning about hacking
Speaker 1: and information security. People would be like, oh, she's just
Speaker 1: a script katty, and I'd be like, well, I actually
Speaker 1: want to understand the theory. I want to learn how
Speaker 1: to program. I want to learn how to code. I'm
Speaker 1: no longer called that because I have learned how to
Speaker 1: write certain kinds of code. I have learned how to program.
Speaker 1: I can make my r do we know, do whatever
Speaker 1: I want. So at this point in my stage, I've
Speaker 1: surpassed that moment of being a nube and I've gone
Speaker 1: on to learning things and being able to understand specific
Speaker 1: tests and get them to do what I want them
Speaker 1: to do without finding tutorials online. Yea, so now I
Speaker 1: make my own tutorials. Seeing Now that's nice because when
Speaker 1: I started at how stuff works. They call me that
Speaker 1: weird bald guy, and today they still do. So some
Speaker 1: labels just stick, is what I'm saying. So yeah, so,
Speaker 1: so that kind of covers the malware approach. People can
Speaker 1: make money through malware, either by selling your information UM,
Speaker 1: they might do so by another method, which kind of
Speaker 1: leads into this idea of ransomware. So this would be
Speaker 1: malware specific type of malware that UM locks down your
Speaker 1: machine in some way so that you can no longer
Speaker 1: access it, and then you essentially get a message saying, hey,
Speaker 1: if you want if you want your data back, if
Speaker 1: you want access to your data, if you want to
Speaker 1: be able to do all this stuff, and you want
Speaker 1: our hands out of your business, then you've got to
Speaker 1: pay us some moolah, some money. Shannon and I will
Speaker 1: have more to say about how hackers make all the
Speaker 1: dollar dollar bills y'all in just a moment, but first
Speaker 1: let's take a quick break. Yeah. So, basically what happens
Speaker 1: with ransomware is, uh, it is just like you said,
Speaker 1: a type of aware that gets distributed in one way,
Speaker 1: shape or form onto somebody's computer and it ends up
Speaker 1: encrypting their data. It could be a whole hard drive.
Speaker 1: It could be a folder of data. It's some kind
Speaker 1: of important data that they have sitting on their computer. Uh.
Speaker 1: And in many cases, a thief the hacker will ask
Speaker 1: them in an email or maybe an encrypted text document
Speaker 1: that's now surreptitiously on their computer out of nowhere, to
Speaker 1: send them a certain amount of bitcoins, and they tell
Speaker 1: them how to set up a bitcoin wallets so that
Speaker 1: they can send the bitcoins to them for them to
Speaker 1: get a pass code to unlock their encrypted data. Now,
Speaker 1: the weird part is they already own this data is
Speaker 1: on their own hard drive. It could be anything from
Speaker 1: like kids photos, it could be tax documents. But in
Speaker 1: any case, it's going to be some kind of important
Speaker 1: information that people don't want to lose because it might
Speaker 1: be years and years of information that's just on that computer.
Speaker 1: So of course people are going to send them bitcoins.
Speaker 1: And I think last night Act to Bitcoin was a
Speaker 1: few hundred bucks, so it ends up being quite a
Speaker 1: bit of money that they have to send to get
Speaker 1: their information unlocked. Yeah, and this is this is the
Speaker 1: type of malware. When we were talking about the advertising
Speaker 1: that was targeting people through massive news sites. If I'm
Speaker 1: not mistaken. It was specifically ransomware. It was the kind
Speaker 1: of stuff that was encrypting users. Uh yeah, yeah, so
Speaker 1: it wasn't just malware. It was ransomware that was infecting computers.
Speaker 1: Because malware can do other stuff too, right, it can
Speaker 1: It can create something like a backdoor access. So yeah,
Speaker 1: hackers can take control of your machine or just monitor
Speaker 1: what you're doing. Even if they don't want to take control.
Speaker 1: They can put in key loggers so they can see
Speaker 1: what all your passwords are. Um, so you might want
Speaker 1: to think about using things like a really good password manager.
Speaker 1: UM that's what I use and and I love mine.
Speaker 1: Uh yeah, so the things where you don't have to
Speaker 1: type the password and so you don't have to worry
Speaker 1: about key loggers picking up on that kind of stuff.
Speaker 1: But we'll talk more about that in just a second.
Speaker 1: So one of the other ones I wanted to talk about,
Speaker 1: This one is kind of a gray area because, uh,
Speaker 1: this is this. I titled this section spies like us um,
Speaker 1: and by this I meant state sponsored hackers. People who
Speaker 1: are hacking on behalf of a specific state or nation
Speaker 1: or government. Um. Sometimes they may be doing so not
Speaker 1: with the Uh why should I say like, not with
Speaker 1: the express permission of the nation. It may turn out
Speaker 1: that the state says, hey, we didn't tell them to
Speaker 1: do this. They're just doing it because they love us
Speaker 1: so much and they hate and they hate you guys,
Speaker 1: and that's why they're doing it. Um. Whether that's true
Speaker 1: or not depends upon the situation. I would I would
Speaker 1: think that if I were running a government and I
Speaker 1: had employed a bunch of hackers to infiltrate or sabotage
Speaker 1: another nations systems, I also would like some plausible deniability
Speaker 1: in their Hey, I didn't tell him to do it.
Speaker 1: I just said, man, it's It's kind of like there's
Speaker 1: there's a story that a king of England once yelled out,
Speaker 1: who will rid me of this meddlesome priest? And then
Speaker 1: a couple of nights went often ridded him of his
Speaker 1: that meddlesome priest, and it turned out that he was
Speaker 1: he was just mad and just talking out loud. And
Speaker 1: then one of his dearest friends ended up being murdered
Speaker 1: by a couple of nights because they heard the guy
Speaker 1: talking and said, hey, we should get rid of them.
Speaker 1: We'll get rewarded. Um. That's why the states argue, I
Speaker 1: don't know that that's always the case. Also, by the way,
Speaker 1: for you listeners out there who recognize who I'm talking about,
Speaker 1: send me an email and prove it, because I'm a
Speaker 1: medievalist and I love that stuff. Um. But yeah, this
Speaker 1: is something that we see. You know, you often will
Speaker 1: hear stories about Chinese hackers or Russian hackers. There was
Speaker 1: a story, UH several years ago about how UH information
Speaker 1: security experts were noticing some artifacts in our power grid
Speaker 1: system that were indicative of UH people who had infiltrated
Speaker 1: that system and planted some stuff in there so that
Speaker 1: they could monitor things or perhaps even jump back into
Speaker 1: the power grid system should UH push come to shove
Speaker 1: in some sort of political situation. They had traced it
Speaker 1: back to either China or Russia. It's pretty tricky to
Speaker 1: actually figure out where attacks ultimately originate from, because if
Speaker 1: you're really good, you can cover your tracks pretty well. Um.
Speaker 1: But the United States has done it too. You might
Speaker 1: have heard about Stuck's Net. That was the that was
Speaker 1: the computer virus that was designed to um to to
Speaker 1: spin a centrifuge in a nuclear facility at a speed
Speaker 1: greater than what it was supposed to spin at, and
Speaker 1: originally I think the hope was that it would cause
Speaker 1: a catastrophic failure and perhaps perhaps even destroy the facility.
Speaker 1: As it turned out, it caused a failure, but not
Speaker 1: at that level. But that those are examples of something
Speaker 1: that's technically legal within the country because it's it's endorsed
Speaker 1: or at least permitted by a government, but you don't
Speaker 1: want it out there because it seems pretty darn shady
Speaker 1: to anybody else. Yeah. Yeah, So state sponsored hacks are
Speaker 1: more worrisome to me because they oftentimes have much larger targets.
Speaker 1: For example, they might target a large government facility, like
Speaker 1: I don't know, the Pentagon, So I worried about those
Speaker 1: because those kind of servers have a lot of information
Speaker 1: on the citizens of any sort of country. Uh So,
Speaker 1: anytime you see these in the news, it's it's always like, oh, well,
Speaker 1: this this hack was done by Chinese state sponsored hackers,
Speaker 1: or Russian state sponsored hackers, or American state sponsored hackers,
Speaker 1: and these are Korea. North Korea would be another big one. Yeah. Yeah,
Speaker 1: So so they are either it might be a tinam
Speaker 1: of hackers that are kind of comprised together in a
Speaker 1: illegitimate company who are hired by a government or like
Speaker 1: you say, where they may not necessarily have any affiliation
Speaker 1: quote unquote with the government, but the government ends them
Speaker 1: paying them in some way, shape or form for their
Speaker 1: infiltration because it ends up helping the government in some
Speaker 1: way or another. And so it's it's a very sticky
Speaker 1: scenario when you start dealing with these state sponsored hackers,
Speaker 1: because it's it's hard to understand, Um, how are we
Speaker 1: going to, you know, penalize them? Who do we penalize
Speaker 1: Do we penalize government or the hackers themselves? Are both?
Speaker 1: Like who was actually involved? It might end up being
Speaker 1: how do we address the underlying situation that led to
Speaker 1: the employment of hackers in the first place? Um, which
Speaker 1: can get pretty pretty delicate. Another great example or him
Speaker 1: not too long ago, or at least one that may
Speaker 1: or may not have been involved in may or may
Speaker 1: not have involved a state sponsored hacker I'm still somewhat
Speaker 1: skeptical of that would be the Sony hack. Oh yeah,
Speaker 1: because the Sony hack, the Wes government essentially was pointing
Speaker 1: fingers to North Korea, saying the hackers must have come
Speaker 1: from North Korea. Look at this IP address, which we
Speaker 1: don't even need to go into detail right now, except
Speaker 1: to say that an IP address does not proof make
Speaker 1: But at any rate, they're they're pointing over at North
Speaker 1: Korea saying, we think the attacks came from there. The
Speaker 1: attack appears to be politically motivated North Korea for its part,
Speaker 1: the government, which, by the way, North Korea not shy
Speaker 1: about taking credit for stuff. But they said, no, no,
Speaker 1: we didn't. We we didn't ask for this, but we're
Speaker 1: totally cool with it happening. Um, So you know, it's
Speaker 1: one of those. It's also very muddy because obviously when
Speaker 1: you're talking about things like espionage or sabotage or any
Speaker 1: of those things, Uh, you don't. You don't come out
Speaker 1: and talk more about it, you don't. That ends up
Speaker 1: being closed away. Um. In fact, I should, I should
Speaker 1: really throw that over to the stuff they don't want
Speaker 1: you to know guys and have them do an episode
Speaker 1: on it, because I would be a lot of fun. Uh.
Speaker 1: And then we've got got the the traditional at least,
Speaker 1: I would argue the traditional concept of a hacker from
Speaker 1: the Hollywood perspective. The black hats, the ones that are
Speaker 1: wearing the hoodies and they're sitting at a keyboard and
Speaker 1: they're typing really fast on a green and black screen over. Yes,
Speaker 1: they've got got some junk food snail and they have
Speaker 1: a ton of different windows popping up on their computer
Speaker 1: really really fast. You can't make out anything that's happening.
Speaker 1: It's entirely not true. That's not how it works. It's
Speaker 1: actually a somewhat slow process to get um basically, to
Speaker 1: get reconnaissance and to get into any kind of network. Uh.
Speaker 1: The only things I've done, of course, are completely legal.
Speaker 1: I've had an authorization by everybody who I have tested
Speaker 1: my my abilities on. Right. Yeah, so black hats, that's
Speaker 1: that's another awkward definition because it's not one that I
Speaker 1: like to use all the time because black hat hacker
Speaker 1: means that there's it makes hackers have more of a
Speaker 1: negative appeal to a lot of people. So I always
Speaker 1: just call them black hat thiefs. Yeah. No, that's a
Speaker 1: great way of putting it, because, uh, typically you'll see
Speaker 1: things like um uh, the idea of infiltrating a system
Speaker 1: in order to steal information, perhaps to sell it to
Speaker 1: someone else, or to hold it against the party that
Speaker 1: you've stolen it from. Um, you know, so it might
Speaker 1: be extortion as opposed to uh to stealing and selling. Uh. Also,
Speaker 1: we should go ahead and point out something else that
Speaker 1: I'll talk about in a future episode, but I've mentioned
Speaker 1: it in previous ones too. Um. Hackers don't necessarily just
Speaker 1: sit at a keyboard and type in strings of letters
Speaker 1: and numbers. They also do a lot of social engineering
Speaker 1: where or they can do a lot of social engineering
Speaker 1: where they attempt to gain access to systems, either by
Speaker 1: physically gaining access to a system, which makes it way
Speaker 1: easier than remotely doing it um, or even easier than
Speaker 1: that manipulating someone who does have access to a system,
Speaker 1: and then you get it that way. Um. And it's
Speaker 1: surprisingly easy to do if employees have not been educated
Speaker 1: on how to spot that and avoid it. Yeah, properly
Speaker 1: training your your your employees at your place of work
Speaker 1: is really important when it comes to social engineering. And
Speaker 1: it is incredibly easy to do social engineering, especially when
Speaker 1: you're a female, I would imagine. So it turns out
Speaker 1: also if you are dressed as the stereotypical I T
Speaker 1: guy and you are there to quote unquote upgrade someone's machine,
Speaker 1: really easy to get access to that machine. People are
Speaker 1: so eager. Yeah, and obviously, like social engineering, completely depends
Speaker 1: upon identifying and then exploiting a person's vulnerability and typically
Speaker 1: speaking like greed lust, those are two big ones that
Speaker 1: are exploitable, and that the people who are really good
Speaker 1: at social engineering know that, and they're very good at
Speaker 1: that leveraging that. Just as knowing what sort of vulnerabilities
Speaker 1: typically show up within code, within within programs, you need
Speaker 1: to know what vulnerabilities show up in people. UM And
Speaker 1: I also I had a little thing on here about
Speaker 1: botan net masters. Really what in this I was thinking
Speaker 1: about the people who are using malware to get that
Speaker 1: back door access to machines, to get UH, to get
Speaker 1: that administrative control over a wide array. Sometimes we call
Speaker 1: it a boton net. Sometimes we call it a zombie
Speaker 1: army of of user computers, and then utilizing that to
Speaker 1: do stuff like UH distributed denial of service attacks or
Speaker 1: de DOS attacks, where you are UH directing an army
Speaker 1: essentially to coordinate an attack against an identified target. Sometimes
Speaker 1: this is done just to cause problems. I mean, obviously,
Speaker 1: if you've ever had issues logging into like a gaming network,
Speaker 1: Xbox Live has had this happen, PlayStation has had this
Speaker 1: happen where people who are disenchanted with the service for
Speaker 1: one reason or another, or they just want to do
Speaker 1: it for the lulls. Uh, specifically around holiday times. That's
Speaker 1: a big that's a big target time to attack something
Speaker 1: like Xbox Live. They'll direct a ton of traffic to
Speaker 1: break down servers, so servers can't respond to legitimate traffic
Speaker 1: because they're too busy responding to a bunch of fake traffic. Essentially,
Speaker 1: I'm oversimplifying, but this is a basic detos attack. It is.
Speaker 1: It's such a mean thing to do to those little
Speaker 1: kids during Christmas times, turn off their xboxes so that
Speaker 1: they can't log in and they can't play their games,
Speaker 1: so they just go on Yeah, yeah, I think, break
Speaker 1: my heart. Gosh, it's it's a jerk move. It's a
Speaker 1: jerk move. Don't do it. I love the definition or
Speaker 1: I love the term zombie for bot nuts, because that's
Speaker 1: exactly what it is. Where you have a you have
Speaker 1: a zero, a patient zero, and that would be the
Speaker 1: first computer. They end up biting a few more computers,
Speaker 1: and those ones end up getting infected with the same
Speaker 1: exact infection that patient zero had, and then those ones
Speaker 1: end up biting ten each so you end up with
Speaker 1: thousands upon thousands of these computers that each have the
Speaker 1: same exact infection, and they all end up perpetrating the
Speaker 1: same exact vulnerability on whatever their target might be. Yeah,
Speaker 1: and then ultimately you end up with a situation where
Speaker 1: Nagan is standing there with a baseball bat and you
Speaker 1: don't know whose head he's gonna cave in. I might
Speaker 1: have taken that metaphor a little too far. But one
Speaker 1: of the things that Boughton net controllers might do, and
Speaker 1: in fact, this has happened on multiple occasions. It's similar
Speaker 1: to ransomware is they'll send a message to an identified
Speaker 1: target and say, hey, we we got your number. We're
Speaker 1: gonna come after you unless you pay us a certain
Speaker 1: amount of money. Um, we will unleash the dogs of
Speaker 1: war on your servers and you will be unable to
Speaker 1: do business. And there have been cases where businesses have
Speaker 1: folded to this kind of pressure, where they have in
Speaker 1: fact paid to do this because the hospital ended up
Speaker 1: doing that. Yes, yes it was. Yeah, I've seen a
Speaker 1: few cases of particularly malicious and odious acts against things
Speaker 1: like hospitals. There was one year when I was participating
Speaker 1: in a charity for children's hospitals and the charity was
Speaker 1: targeted in the middle of the event and for about
Speaker 1: three hours they were offline trying to deal with that. Um, yeah,
Speaker 1: it's and in that case, it wasn't a it wasn't
Speaker 1: an attack in an effort to get money. I don't
Speaker 1: think I think it was just someone being truly an
Speaker 1: awful human being. But we have seen cases of people
Speaker 1: trying to do this in order to extort money. So
Speaker 1: you're probably noticing some trends here extortion, stealing, uh, you know,
Speaker 1: holding things for ransom, this idea of making sure that
Speaker 1: that people are spending money for out of fear or
Speaker 1: out of a need to get back and and have
Speaker 1: access to something that belongs to them. These are all terrible,
Speaker 1: terrible motivations to make money, and as such, as such
Speaker 1: terrible motivations, you might think, well, wait a minute, how
Speaker 1: are they actually like, how are they getting paid? How
Speaker 1: is this money transfer happening? Because you would think anything
Speaker 1: that would be traceable would end up being somewhat problematic.
Speaker 1: You've got a trail that leads back to you as
Speaker 1: a person, then pretty soon law enforcement's going to get involved,
Speaker 1: or at least the I R S. So so how
Speaker 1: Shannon do hackers? How do they get the money? So
Speaker 1: there's probably some ways that I don't even know about yet,
Speaker 1: but the ones that I can think of would be
Speaker 1: treating of high value data. So that's a pretty big
Speaker 1: one where uh saya hacker collects a whole bunch of
Speaker 1: really really high value data like your SO security number,
Speaker 1: your credit card accounts, your banking account, tons of information,
Speaker 1: and they decided to go on to a deep forum
Speaker 1: sell it, and then or trade it for something else
Speaker 1: of high value, for example, a gift card. They could
Speaker 1: ask for people to give them a ton of gift
Speaker 1: cards that are like, you know, twenty five or fifty
Speaker 1: dollars each, and then use those gift cards at a
Speaker 1: retailer who is easily vulnerable to some kind of gift
Speaker 1: card scam, and in that sense they would be able
Speaker 1: to make some kind of money back through those gift
Speaker 1: cards and that trade of that high value UH data
Speaker 1: that they stole from whoever it might be, whatever company.
Speaker 1: Another way would be bitcoins. Now that's probably the most
Speaker 1: obvious one, of course, because bitcoins are very very hard
Speaker 1: to track. Yes, they are traceable in some circumstances, depending
Speaker 1: on what kind of wallet you use, but in a
Speaker 1: lot of circumstances, the bitcoins will trade wallets so many
Speaker 1: times that it will be somewhat impossible to find out
Speaker 1: where it actually came from, where it actually started. Yeah,
Speaker 1: it's kind of interesting because every single bitcoin contains with
Speaker 1: it a record of every transaction. But that does not
Speaker 1: mean that the parties involved are actually identifiable. It really
Speaker 1: is um. It's it's actually data that's used in order
Speaker 1: to allow for the mining of further bitcoins. It's a
Speaker 1: really fascinating process. But but one of the things that
Speaker 1: attracts people to bitcoins is this idea of being able
Speaker 1: to spend them anonymously and be able to purchase things, uh,
Speaker 1: whether legal or illegal, without it being traced back to
Speaker 1: that person. You often will hear about things like, you know,
Speaker 1: the old Silk Road, where you could purchase all sources
Speaker 1: of stuff, including illegal drugs or other materials, sometimes weapons,
Speaker 1: that kind of stuff, um, and you could do it
Speaker 1: through bitcoins, and people felt a high level of confidence
Speaker 1: because it was not a state backed currency. It was
Speaker 1: this independent cryptocurrency that allowed them that that freedom and
Speaker 1: had real value because people want the bitcoins. If no
Speaker 1: one wanted the bitcoins, they wouldn't be worth anything, right,
Speaker 1: and bitcoins have actually been pretty steady last time I checked,
Speaker 1: so their value has been pretty decent in late days,
Speaker 1: in recent days, So so I completely understand why hacker
Speaker 1: would want to be paid in bitcoins. It makes sense. Yeah. Yeah,
Speaker 1: there's also the old, the old deal of putting the
Speaker 1: money into the the washing machine, right, that's how money
Speaker 1: laundering work, right, Yes, money laundering. So that was something
Speaker 1: that I learned about way back in the day when
Speaker 1: I worked at a bank of all places, which also
Speaker 1: got me really interested in security before I started podcasting.
Speaker 1: But money laundering, it's very easy for somebody to go online,
Speaker 1: be able to sell this high value data, get some
Speaker 1: bitcoins or it might be some other form of currency,
Speaker 1: and then be able to resell that money or be
Speaker 1: able to trade a product to get real money, real
Speaker 1: cash at one point or another. But basically it's it's
Speaker 1: um exchanging the hands that hold that money so many
Speaker 1: times that again it's very hard to trace. Yeah, and
Speaker 1: it's it's hard to determine that the original source of
Speaker 1: that money was anything remotely illegal. And then depending on again,
Speaker 1: if you're if you're a state sponsored hacker, you're probably
Speaker 1: just drawing a salary or doing contract work, so you're
Speaker 1: actually getting paid. You get a pay check. Yeah. Yeah,
Speaker 1: so you've got money withdrawn from your paycheck to handle
Speaker 1: to support the government while you are subverting other governments.
Speaker 1: And then it looks completely legitimate. So that's a really
Speaker 1: easy way for somebody to do something that might be very,
Speaker 1: very bad. Yeah, because they are, They do have to
Speaker 1: pay the I R S, they do get a tax
Speaker 1: refund every year, they do have an employer, so it
Speaker 1: looks completely normal for them to be receiving a paycheck
Speaker 1: for whatever work this might be. Yeah, we've got a
Speaker 1: little bit more to say about how hackers make money,
Speaker 1: but first let's take another quick break to thank our sponsor.
Speaker 1: So the nice thing is there aren't just quote unquote
Speaker 1: bad guys out there doing all this kind of of
Speaker 1: work with computers, with a hacking, with discovering vulnerabilities. There
Speaker 1: are plenty of people, as as you mentioned earlier, Shannon,
Speaker 1: who are doing this in order to help others, either
Speaker 1: to make systems more secure or to inform people of
Speaker 1: how these kind of attacks happen so that they can
Speaker 1: be better prepared to defend themselves. So let's talk about
Speaker 1: some of them. Um, of course, if you have black
Speaker 1: hat hackers, right, you got the bad guys, you gotta have,
Speaker 1: you gotta the white hack hackers. These are the These
Speaker 1: are the the noble bounty hunter characters of those westerns,
Speaker 1: the ones who you know they've seen things but deep
Speaker 1: down and they have a heart of gold. Well, not
Speaker 1: all of them, but a lot of a lot of
Speaker 1: my friends are considered white hat hackers. They're the people
Speaker 1: who either they work for a company that specializes insecurity.
Speaker 1: So a lot of my friends work for these companies
Speaker 1: who will be contracted with big brands, go into their
Speaker 1: networks and then find out what the vulnerabilities are and
Speaker 1: fix them, or they will give them a report and
Speaker 1: tell them how to fix that fix it in the future.
Speaker 1: They make a lot of money. A lot of them
Speaker 1: don't like it because they have specific amounts of vulnerabilities
Speaker 1: or specific time frame set that they have to get
Speaker 1: this work done, and a lot of times hacking takes
Speaker 1: a lot of time. It takes a lot of information reconnaissance.
Speaker 1: So a lot of my friends don't necessarily appreciate having
Speaker 1: to be under these time constraints with these big brands. Well,
Speaker 1: particularly since you figure the bad guys aren't under any
Speaker 1: particular time constraints exactly, So the bad guys have tons
Speaker 1: of time to find these vulnerabilities, while the white hacks
Speaker 1: are under the stress of these time constraints to get
Speaker 1: the work done so that they make their bosses happy.
Speaker 1: In this sense, a lot of my a lot of
Speaker 1: people that I know, have created their own security companies
Speaker 1: because of this fault in the generic nature of having
Speaker 1: these security companies. So they said, you know, I'm tired
Speaker 1: of having to deal with these constraints that my boss
Speaker 1: has given me. Just gonna open my own security company,
Speaker 1: and we're going to do it even better because we
Speaker 1: won't give ourselves those time constraints. Will give us ourselves
Speaker 1: several months to find all the vulnerabilities that we absolutely
Speaker 1: can and then we'll write a report and we'll fix it.
Speaker 1: And uh, those are the ones that I would definitely
Speaker 1: work with if I had to hire a security company. Yeah,
Speaker 1: because they're the ones who are going to use the
Speaker 1: exact same kind of methodologies that bad guys are going
Speaker 1: to use. And if if you want to really be secure,
Speaker 1: you want the people to throw everything they can at
Speaker 1: your system. So that you can find out are you
Speaker 1: actually secure? If you're what do you need to do
Speaker 1: to address it? Um? If you want to see a
Speaker 1: movie that that does a very fantasy version of this
Speaker 1: very idea, there's a film that I always think back to,
Speaker 1: Sneakers had Robert Redford and Dan Ackroyd, who plays a
Speaker 1: character named mother. Ben Kingsley is in it Um. A
Speaker 1: ton of folks. River Phoenix was in it Um, and
Speaker 1: it's a It's a movie about a group of kind
Speaker 1: of almost like outcasts who have grouped together to form
Speaker 1: a company that they specifically do this. They try to
Speaker 1: infiltrate a company in order to test its security, not
Speaker 1: to exploit it, but rather to tell the company, hey,
Speaker 1: here's how we got in, here's how someone else could
Speaker 1: get in, So you need to plug this vulnerability, that
Speaker 1: kind of thing um. And then of course they get
Speaker 1: involved in all sorts of shenanigans. And in case you
Speaker 1: are interested in the methodology, I actually find it very
Speaker 1: very interesting how they get their work done, because of
Speaker 1: course they have to go through the tennis match of
Speaker 1: back and forth with a brand name company, whatever it
Speaker 1: might be, So they'll have to get a purchase order,
Speaker 1: they'll do a little bit of negotiation for an amount
Speaker 1: that they'll do the work for, and then they'll go
Speaker 1: in and they'll gather information on the network and they'll
Speaker 1: capture traffic, and they'll try to find any kind of
Speaker 1: vulnerabilities that are on that network, even with the people too.
Speaker 1: For example, they could use social engineering to get into
Speaker 1: the server rack uh physically, or they could get into
Speaker 1: a network that doesn't necessarily have a very good password
Speaker 1: on it. Uh. They could email clients that work there
Speaker 1: that are employed at the brand name company with I
Speaker 1: don't know malware written PDFs for example, and they could
Speaker 1: use wireless attacks. They could do war driving from the
Speaker 1: parking lot if they wanted to. And then what they'll
Speaker 1: do is write a very very long report so that
Speaker 1: the brand name company can see exactly what happened is
Speaker 1: on their network and exactly what they were able to
Speaker 1: do from from whatever back door they were able to
Speaker 1: get into. It's really interesting how how well they're able
Speaker 1: to put everything together in in turn hopefully save this
Speaker 1: company in the long run thousands and thousands of dollars. Yeah, yeah,
Speaker 1: I mean this is the whole Security has always been
Speaker 1: a tick talk approach, right, You've got the tick, which
Speaker 1: is where someone has identified a way of exploiting a system,
Speaker 1: and then the talk is where you find a way
Speaker 1: to correct that that vulnerability. The tick is the next
Speaker 1: time someone's found a vulnerability. Uh, you're always going to
Speaker 1: have that, right unless someone somehow designs the absolute perfect system,
Speaker 1: which as far as we know, is an impossibility. Yeah,
Speaker 1: that's impossible. Yeah, because for one thing, if people are involved,
Speaker 1: there's no such thing as a perfect system. It's always
Speaker 1: a battle. And I love my video games, so I
Speaker 1: love a battle. But also it also drives other other
Speaker 1: industries though, because we'll see things like the artificial intelligence
Speaker 1: industry improve as a result of this security battle between
Speaker 1: hackers and uh, the infosec experts who are trying to
Speaker 1: make sure that their protecting systems. And as a result,
Speaker 1: we're we're getting information that can be used in other areas,
Speaker 1: which is phenomenal. Like I remember, here's a simple one.
Speaker 1: It's it's as far as security goes. This is as
Speaker 1: low level as it gets. But the capture system, so
Speaker 1: when cap when capture was implemented, even the people who
Speaker 1: were writing capture at the time, we're not really thinking
Speaker 1: of it as being some sort of full proof security
Speaker 1: system to make sure that bots don't get into a system. Right,
Speaker 1: they weren't thinking, oh, now only human beings can get access.
Speaker 1: And if you don't know what a capture is, anytime
Speaker 1: you get your filling out a thing and you get
Speaker 1: a little picture of something and it says, uh, tell
Speaker 1: you know, write down the word or numbers that are
Speaker 1: in this picture, or even to a point of identify
Speaker 1: the pictures in this sequence that have this particular feature,
Speaker 1: like deify all the pictures that have a lake in
Speaker 1: it or something like that. That's a simply that's simply
Speaker 1: a version of capture. Um. The people who made it,
Speaker 1: they actually said, our goal was really to help push
Speaker 1: artificial intelligence because we created a system where programmers or
Speaker 1: hackers had to start coming up with uh, computer programs
Speaker 1: that could identify the same things that we humans can identify.
Speaker 1: And in turn, that means now we've got software that
Speaker 1: pushes forward artificial intelligence. Now, granted, that also means you
Speaker 1: have to improve the system you had designed to keep
Speaker 1: bots out in the first place. So again it goes
Speaker 1: to that TikTok. But there's an added benefit beyond someone
Speaker 1: being able to to automatically access systems and build you know,
Speaker 1: dozens and dozens of fake profiles on Facebook or whatever
Speaker 1: it might be, whatever that might be. Yeah, yeah, and
Speaker 1: then keep in mind, like like we've been saying here,
Speaker 1: I mean, any any systems security is only as strong
Speaker 1: as its weakest link. That we cat is pretty much
Speaker 1: always people. That's the big one, right. But I mean,
Speaker 1: I've I've read stories about hacker gaining access to a
Speaker 1: system because there was an overall security system that was
Speaker 1: really robust for the main company, but then they had
Speaker 1: a little branch office and the branch office didn't have
Speaker 1: that crazy amount of security but was still on the
Speaker 1: same network. I think I read about that story too,
Speaker 1: So I mean, these are these are things like if
Speaker 1: you identify a potential point of weakness that's now suddenly
Speaker 1: the you know, it's it's like a bank vault. If
Speaker 1: the bank vault has an enormous door with huge locks
Speaker 1: on it that you have to get through. Oh, but
Speaker 1: it also has a backdoor just for convenience sake, you're
Speaker 1: gonna aim for the back door. So but there are
Speaker 1: other ways that that hackers can can make a legitimate
Speaker 1: living that don't even involve testing security systems. It might
Speaker 1: involve education. Yeah, absolutely so education is I guess what
Speaker 1: you would say, I fall into that kind of comory.
Speaker 1: And while I I don't necessarily like to call myself
Speaker 1: a hacker because I know so many experts in the
Speaker 1: field who are much more knowledgeable than I am. I'm
Speaker 1: quite a intermediate, I would say, but I love to teach,
Speaker 1: and I love to give tutorials online, so I give
Speaker 1: tutorials on YouTube. But I also know a lot of
Speaker 1: people who have either written books about hacking UH, and
Speaker 1: they could do either specifics about penetration testing or they
Speaker 1: get to make it a very very wide based book
Speaker 1: where they explain everything that you would have to do
Speaker 1: as a penetration tester. And a penetration tester is basically
Speaker 1: one of those guys that would go into a company
Speaker 1: and UH find all the vulnerabilities and report on it.
Speaker 1: You would also have companies that administer certifications, so a
Speaker 1: lot of I'm sure a lot of your your UM
Speaker 1: listeners probably know that you have to get certifications to
Speaker 1: get a lot of UH to get into a lot
Speaker 1: of the fields with computer security and even just you know,
Speaker 1: computer networking too. Sure a lot of searts for those
Speaker 1: and they're very, very expensive. So a lot of companies
Speaker 1: just administer their certifications or they will have you take
Speaker 1: classes for a period of time until you actually take
Speaker 1: the test and get certified. But that ends up being
Speaker 1: a really good thing to put on your resume for
Speaker 1: a lot of companies whenever you do intend to get
Speaker 1: a job in network security. And then lastly, we have
Speaker 1: the publishers. So that's the YouTubers, the that's the people
Speaker 1: that make podcast That's the people that um might be
Speaker 1: creating other forms of entertainment that not only educate but
Speaker 1: also entertain their users and their listeners so that they
Speaker 1: get excited about being a part of information security. Uh.
Speaker 1: And that's what I like to do. I like to
Speaker 1: teach people in a way that makes it exciting. So
Speaker 1: I do a lot of hands on stuff. I I make,
Speaker 1: I make jokes, and I explain things in a very
Speaker 1: natural light and it helps it helps again foster that
Speaker 1: desire to learn how things work right. That does so
Speaker 1: again that that same fascination, like if you were ever
Speaker 1: a kid that took apart a watch or a radio
Speaker 1: or some other piece of equipment, because you really want
Speaker 1: to know what's the magic that makes this thing do
Speaker 1: what it does? Uh, hackers have that, I mean, that's
Speaker 1: the that's that's the defining quality in my mind of
Speaker 1: a hacker is ultimately it's someone who is fascinated with
Speaker 1: the way something works. Uh. We've largely been focusing on software,
Speaker 1: but that is just as legitimate as any hardware hack.
Speaker 1: It's the idea of how does this It might not
Speaker 1: even just be the software, might be a full system,
Speaker 1: like how does the system work? What are all the
Speaker 1: interlocking parts? How do they communicate with each other. I
Speaker 1: just had a random memory from when I was younger
Speaker 1: and in school. I took apart my first iPod because
Speaker 1: I had no clue how it worked, and I was
Speaker 1: very curious about what what the interior of it was.
Speaker 1: So I just I took it apart. I couldn't put
Speaker 1: it back together, So I was not hacker in any sense.
Speaker 1: We um we for for an article I was writing,
Speaker 1: We've got a first edition Launch Day Nintendo three D
Speaker 1: s and it was my job to disassemble it and
Speaker 1: take photos of all the pieces. So first I took
Speaker 1: a picture of it whole and shared it online on
Speaker 1: Twitter and said look what I have, and everyone got
Speaker 1: excited and then by the end of it, I had
Speaker 1: a little had a little black cauldron at my desk
Speaker 1: that was left over from a Halloween thing, and then
Speaker 1: I put all the different pieces because there was no
Speaker 1: way this thing was going back together after I took
Speaker 1: it apart. For one thing, Nintendo is pretty careful about
Speaker 1: sealing stuff in such a way that's not meant to
Speaker 1: come aboard, so um, so you have to have he
Speaker 1: was a little force in some cases in order to
Speaker 1: get to stuff. And then I showed a picture. I'm like,
Speaker 1: I'm like, look what I did to the thing. I
Speaker 1: made the entire Internet cry. Yeah, although ultimately I think
Speaker 1: the three DS most people are like, oh whatever. But
Speaker 1: at the time when it was brand new, people were
Speaker 1: freaking out. And of course there's there's also another role
Speaker 1: for for hackers out there. It may not be a
Speaker 1: steady gig, but we are seeing more and more of
Speaker 1: the Hollywood productions out there actually talk with people in
Speaker 1: the industry so that the depictions that we're getting are
Speaker 1: more accurately reflecting what really happens. Mr Robot is probably
Speaker 1: the example that immediately leaps to my mind, and that
Speaker 1: it's it's a show that tries very hard to take
Speaker 1: a more realistic approach to the world of hacking as
Speaker 1: opposed to um. You type in three passwords, the third
Speaker 1: one gets you in, and then you're navigating through a
Speaker 1: vector graphics three D dungeon and you encounter a skull
Speaker 1: and cross bones. That's not how hacking works. It sounds
Speaker 1: like you were talking about hackers hack the planet. I
Speaker 1: might have been education. Just bring it back. But professors,
Speaker 1: I didn't leave you guys out. I'm sorry. I love
Speaker 1: you guys. You are the reason why I'm here now.
Speaker 1: If I didn't take my computer courses in college with
Speaker 1: my professors, I would not be doing what I'm doing now.
Speaker 1: So professors are like at the top of that education
Speaker 1: list because and you can take a lot of computer
Speaker 1: security courses in college and sometimes in high schools if
Speaker 1: you're lucky. But yeah, technical assistance. So technical assistance are
Speaker 1: people that will come on board with a Hollywood movie
Speaker 1: or a TV show or what have you, and they
Speaker 1: will explain to the network how the hacking actually happens.
Speaker 1: So I know a few, uh, they will They'll come
Speaker 1: to some of their hacker friends or they will be
Speaker 1: a hacker themselves and they will say okay uh. In
Speaker 1: this season, I know that they want to do X,
Speaker 1: Y and Z on camera, and I need to make
Speaker 1: it look legitimate, so they will come up with the script.
Speaker 1: They will come up with the hack and the actual
Speaker 1: keyboard commands that the actor has to type in on
Speaker 1: camera so that they are actually doing legitimate hacks. So
Speaker 1: that way, they're not only making it look cool for
Speaker 1: a wider audience because an audience is actually going to
Speaker 1: see how a hack works, but they're also getting that
Speaker 1: credibility with the info set community too. So Mr Robot
Speaker 1: is huge with the infoset community because it is legitimate.
Speaker 1: Like I've watched several of those episodes and I've seen
Speaker 1: a lot of the hacks that they do. They've even
Speaker 1: used some of our hack fi products on the show,
Speaker 1: and they're actually using legit hacks. And it is so
Speaker 1: much fun to see it on TV and see them
Speaker 1: get so many good reviews from a wider consumer audience,
Speaker 1: because it makes me feel like many more people are
Speaker 1: getting interested in info sex because they see what's happening
Speaker 1: on camera and they see that this is actually how
Speaker 1: you do it. Yeah, it's nice to see it go
Speaker 1: beyond uh. The the niche that I would argue, info
Speaker 1: sec and hacking has largely inhabited for the past three decades,
Speaker 1: right the people who have been interested. When it's first started,
Speaker 1: it was essentially your hobbyists, and often those hobbyists were
Speaker 1: isolated individuals. Uh. You got to the phone freaking days
Speaker 1: where there was a little bit of a small subculture
Speaker 1: of people who were interested in hacking the telephone system
Speaker 1: using all sorts of stuff, including a whistle from Captain Crunch. Uh.
Speaker 1: You had you had the the early hack days where
Speaker 1: people were just trying to create interesting programs for their
Speaker 1: computers or to see how some of the programs that
Speaker 1: were coming out, how did those work? Um, but it
Speaker 1: was largely a tiny slice of the folks who were
Speaker 1: even aware of personal computers, and and even that group
Speaker 1: was still a tiny slice of the overall population. We're
Speaker 1: seeing that tiny slice grow over time, and largely because
Speaker 1: so many of us are so dependent upon computers these
Speaker 1: days that it benefits us to have an awareness to
Speaker 1: make sure that we remain safe. But also because of
Speaker 1: things like Mr Robot showing how this wre x and
Speaker 1: sparking the imagination of people who perhaps before they saw
Speaker 1: that never thought, Yeah, it's kind of cool. I would
Speaker 1: love to be able to manipulate code in such a
Speaker 1: way that I could do something new or unexpected or
Speaker 1: help people. Uh. And it's really encouraging to see that
Speaker 1: kind of thing happen right now. I kind of wish
Speaker 1: it had happened ten years ago, but I love seeing
Speaker 1: it happen now. Same. I actually feel like there was
Speaker 1: a little bit of negativity in in the aspect that
Speaker 1: we we used to have all these really fancy graphics
Speaker 1: happening on in these Hollywood movies and these TV shows,
Speaker 1: and now they're actually seeing the reality that is hacking,
Speaker 1: and it is not super colorful. It's not super quick,
Speaker 1: fast paced and exciting like it looks like it is
Speaker 1: on those old school shows. So I'm hoping that now
Speaker 1: that they're actually seeing it, people will try it to
Speaker 1: Like if they see um, the main actor on Mr.
Speaker 1: Robot do a specific command line option, they'll go to
Speaker 1: their computer and try it themselves and see that it
Speaker 1: actually does work, and then they'll be like, oh, I
Speaker 1: really want to try some new stuff too, so they'll
Speaker 1: start googling and see what else they can find out.
Speaker 1: That's the kind of inspiration that I wish happened thirty
Speaker 1: years ago, and it didn't, so I want to see
Speaker 1: more of that now, and I'm really happy that, for example,
Speaker 1: Mr Robot has done a great job with it. Yeah,
Speaker 1: it's it's and you not to not to poop all
Speaker 1: over Hollywood because I do loves mo Hollywood's but but
Speaker 1: it is. And to understand where they were coming from,
Speaker 1: they were trying to find a way to create an
Speaker 1: exciting visual depiction of something that doesn't necessarily necessarily lend
Speaker 1: itself to that in order for to create a dramatic effect.
Speaker 1: So I get it. It's very similar to the way
Speaker 1: Hollywood portrayed virtual reality back in the nineties, way before
Speaker 1: virtual reality was ready for public consumption, and it's what
Speaker 1: largely killed VR for a decade before the various video
Speaker 1: game systems started to make the very the components cheap
Speaker 1: enough for people to play in that space again, and
Speaker 1: now we're on the verge of another VR revolution. The
Speaker 1: same sort of thing is true of hacking, Like how
Speaker 1: do you show hacking in a way that gets across
Speaker 1: what is happening to an audience and makes it interesting?
Speaker 1: I think largely you have to do that through really
Speaker 1: good writing of your characters, and once you do that,
Speaker 1: then everything else follows. I think if if you can
Speaker 1: show that the characters in a movie or in a
Speaker 1: TV show are actually real people that have real relationships,
Speaker 1: they have real jobs and real lives, and they have
Speaker 1: hobbies outside of just hacking, you can really you can
Speaker 1: start to relate to that character in a very real
Speaker 1: sense in the fact that hey, they are humans too,
Speaker 1: because here's our people too. That was actually a documentary. Nice. Yeah,
Speaker 1: because again, when when you're when you're thinking about in
Speaker 1: the abstract, you're really it becomes that us versus them mentality,
Speaker 1: where by by its very nature, it's dehumanizing. But that's
Speaker 1: probably a topic for a show that's not about technology,
Speaker 1: So I will just leave it be. Shannon Morse, thank
Speaker 1: you so much for joining me today. Please let everyone
Speaker 1: know where they can find all of your stuff. Jonathan Strickland,
Speaker 1: thank you. So it was a little it was a little,
Speaker 1: it was a little laden. Yeah. Yeah, I've been watching
Speaker 1: Star Trek lately, way way too much Star Trek. So
Speaker 1: you can find me. Um. The most direct path is
Speaker 1: on Twitter. I'm at snubs and that's s n U
Speaker 1: b S. And then my shows specifically our Tech Thing
Speaker 1: over at t e k thing dot com and Hack
Speaker 1: five over at h K five dot org. Yeah, so
Speaker 1: go check those shows out. They are awesome. Shannon and
Speaker 1: her co hosts are all awesome. I gotta get Corn.
Speaker 1: I gotta get Darren on this. Yeah, no, you are cooler,
Speaker 1: but someday I gotta get Darren on the show. Um.
Speaker 1: I don't think Darren and I have ever I think
Speaker 1: we may have been on one of Tom Merritt's shows
Speaker 1: at the same time, but otherwise I don't think we've
Speaker 1: ever done a show together at any rate. Yeah, I know,
Speaker 1: it's crazy, right that happen. Let's let's do that. Let's
Speaker 1: do that. And that wraps up this classic episode of
Speaker 1: tech Stuff. I hope you guys enjoyed this look back
Speaker 1: on some of the episodes that I've done over the
Speaker 1: past couple of years. These are more recent than some
Speaker 1: of our other classic episodes. We've been running on Fridays,
Speaker 1: and like I said before, I should be back in
Speaker 1: the office recording brand new stuff. You're gonna hear a
Speaker 1: whole arc of episodes about our relationship with media and
Speaker 1: how media has changed over time, how the business of
Speaker 1: media has changed, how our consumption of media has changed.
Speaker 1: It's a huge, huge topic and it spans multiple episodes,
Speaker 1: so I hope you enjoy that. It's been fascinating for
Speaker 1: me to jump into that research and kind of break
Speaker 1: this out, and um, it was actually I didn't know
Speaker 1: how big a bite I was taking at the time
Speaker 1: when I started. And uh, I hope you you enjoy
Speaker 1: it when you start hearing those episodes. If you have
Speaker 1: any suggestions for future episodes of tech Stuff, send me
Speaker 1: a message. The email address is tech stuff at how
Speaker 1: stuff works dot com. Drop on by our website that's
Speaker 1: tech stuff podcast dot com. There you'll find an archive
Speaker 1: of all of our episodes. You'll find links to our
Speaker 1: social media presence, and you'll find a link to our
Speaker 1: online store, where every purchasing make goes to help the show.
Speaker 1: And we greatly appreciate it. And I'll talk to you
Speaker 1: again really soon for more on this and thousands of
Speaker 1: other topics. Is it how stuff works dot com.