Speaker 1: Get Technology with text stuff from Stam. Hey there, and
Speaker 1: welcome to tex Stuff. I'm your host, Jonathan Strickland, and
Speaker 1: today joining me virtually in the studio is a dear
Speaker 1: friend of mine and awesome YouTuber and amazing podcaster, someone
Speaker 1: I genuinely admire and who gives amazing hugs. Shannon Morris.
Speaker 1: Thank you for coming back to the show. Hi. How
Speaker 1: are you, Jonathan? I'm doing great. How are you? I'm awesome? Yeah,
Speaker 1: thank you so much for having me on. This is
Speaker 1: a great show and I love listening to it, so
Speaker 1: I'm super happy to be on. Yeah. Excellent. Now this is,
Speaker 1: of course the second time we've had you on, so
Speaker 1: I will work very hard to to increase that number.
Speaker 1: I want to at least get us up to double digits.
Speaker 1: But I got Shannon on the show specifically to talk
Speaker 1: about an area that she talks about a lot, the
Speaker 1: realm of hacking, and specifically I wanted to do kind
Speaker 1: of an episode about how do hacker? How do you
Speaker 1: make money? How do you make a career out of hacking?
Speaker 1: And uh, and really to frame this conversation, I think
Speaker 1: one of the most important things to do is to
Speaker 1: sort of define your terms and as it turns out,
Speaker 1: the term hacker is actually a very broad term that
Speaker 1: can apply to a lot of different things, and not
Speaker 1: all of them are that nefarious, evil infiltrated system and
Speaker 1: steal all the corporate secrets kind of approach to hacking
Speaker 1: that Hollywood often presents right right exactly. I actually asked
Speaker 1: this question to a lot of people, especially when I
Speaker 1: first meet them. Since I'm so closely affiliated with a
Speaker 1: lot of the info set community, I want to surround
Speaker 1: myself with positive people. So you'll notice with the hacker definition,
Speaker 1: you can either get a very negative vibe from somebody
Speaker 1: or a very positive vibe. Oftentimes, with the negative vibe,
Speaker 1: you'll get somebody who says, oh, that's the person who
Speaker 1: stole my credit card data when I went to a
Speaker 1: restaurant the other day. But on the positive side, you'll
Speaker 1: get somebody that says, oh, they're the kind of people
Speaker 1: that will like break something apart and then put it
Speaker 1: back together in a way that it wasn't supposed to
Speaker 1: be put back together to make it do something cool,
Speaker 1: and that's a hack in in mainstream. Uh So that's
Speaker 1: the way I see it. I see hackers as being
Speaker 1: people who um reverse engineer different software, different hardware. It
Speaker 1: could just be a bicycle, for example, and put it
Speaker 1: back together in a way to make it harder, better, faster,
Speaker 1: and stronger. Nice the old daft punk approach, of course, Yeah,
Speaker 1: I agree entirely. Uh. The the original term hacker was
Speaker 1: really all about people who have almost an insatiable curiosity
Speaker 1: to learn how stuff works. Oddly enough, I share that quality,
Speaker 1: having worked at how stuff works for a decade. Uh.
Speaker 1: But yeah, to understand how it works, and then to
Speaker 1: make stuff do things it wasn't necessarily intended to do.
Speaker 1: Not for nefarious purposes necessarily, although that could clearly be
Speaker 1: an application, but just for curiosity's sake. Can can I
Speaker 1: take these elements that are meant to do this one
Speaker 1: thing and do something completely transformative with it, whether it
Speaker 1: is hardware or software. And we've seen some really cool
Speaker 1: stuff come out of that. I mean, I would argue
Speaker 1: that a lot of the things you see in the
Speaker 1: cosplay world, in the steampunk world, those are all taking
Speaker 1: elements of hacking. Maker Fair is really just a hacker's
Speaker 1: paradise when you get down to it, especially for hardware hacks. Absolutely,
Speaker 1: I'm kind of sad. I'm gonna miss maker Fair this year.
Speaker 1: I haven't been to one yet. I've been to a
Speaker 1: small one here in Atlanta, very a very modest maker Fair.
Speaker 1: Everyone there was great and passionate and intelligent, but it was,
Speaker 1: you know, a much smaller scale than something you would
Speaker 1: see in the Bay Area. But but that's the kind
Speaker 1: of thing that hacker means to me. Now that being said,
Speaker 1: in this episode, we're really going to be focusing on
Speaker 1: on sort of the computer oriented, really the software side
Speaker 1: of hacking um and a large part of it's going
Speaker 1: to be on the bad guy, the naughty bits as
Speaker 1: I call it in our notes about hacking, simply to
Speaker 1: talk about what are the ways that hackers cause or
Speaker 1: the malicious hackers cause problems, how do they expect to
Speaker 1: profit from that? And also that well, we'll look at
Speaker 1: ways that hackers who don't follow that path, who are
Speaker 1: looking to help people, not hurt people, how do they
Speaker 1: make a living? Because it's one of those things where
Speaker 1: you kind of take it for granted when you see
Speaker 1: the Hollywood depiction of a hacker, the person sitting down,
Speaker 1: usually they're sitting at a keyboard and for some reason,
Speaker 1: their monitor only is monochromatic. Green. You know, they're using
Speaker 1: the old Apple to E terminals. Terminals are actually written
Speaker 1: and green oftentimes, but you can change the colors to
Speaker 1: rainbow colors if you choose. That is a hack. It's
Speaker 1: a real life hack. Yeah, Yeah, And usually you see
Speaker 1: them sitting down and then they cause some sort of
Speaker 1: miss you sometimes bordering on sabotage. But then you when
Speaker 1: you think about it outside the context of that scene,
Speaker 1: you think, how did they expect to profit from this?
Speaker 1: So that's kind of what we're looking at. Yeah, because
Speaker 1: it's always important to me to reiterate to that there
Speaker 1: are always going to be two sides of a coin
Speaker 1: to everything in life. Of course, there are going to
Speaker 1: be bad guys in the real in the world who
Speaker 1: do nefarious hacks, but there's also a lot of good
Speaker 1: guys too, And personally, for me, the reason why I'm
Speaker 1: so interested in researching this is because it has made
Speaker 1: me a much more privacy and security guarded person. I've
Speaker 1: gotten a lot better at my own protections online, and
Speaker 1: I feel like if somebody else can understand what a
Speaker 1: hacker does on the bad side as well as the
Speaker 1: good side, they can better protect themselves too, And that's
Speaker 1: what I've always tried to teach people. Yeah, I think
Speaker 1: all you have to really do is attend one def
Speaker 1: con and really have that driven home. I have not
Speaker 1: yet gone to a def con, mostly because I don't
Speaker 1: know that I could part with my smartphone for that
Speaker 1: long and I certainly wouldn't take it with me. Bring
Speaker 1: a burner phone, you'll be fine. Burn Yeah, that that's
Speaker 1: me Jonathan, the guy which carries the burner. Uh, it
Speaker 1: makes sense, I mean when you're doing something like that. So,
Speaker 1: for those who don't know, def Con is a large
Speaker 1: hacker based conference largely looking at the realm of information
Speaker 1: security UM and often they will you'll have entire presentations
Speaker 1: dedicated to showing off vulnerabilities and security. Again not necessarily
Speaker 1: so that people can take advantage of them, but rather
Speaker 1: to raise awareness and to kind of force the hands
Speaker 1: of the parties that are responsible for that software to
Speaker 1: take action and fix a problem. Right Like that was
Speaker 1: what we saw with the hack about remotely taking control
Speaker 1: of a person's vehicle. Uh, specifically Jeep was really having
Speaker 1: that issue. Those one of those things where the researchers
Speaker 1: were saying, look, we're bringing this to light, not so
Speaker 1: that we can create an era where people are terrified
Speaker 1: of their vehicles that someone's going to take remote control
Speaker 1: of their car. But rather to really drive home the
Speaker 1: fact that the information security is now, it's important everywhere.
Speaker 1: It's not just your phone, it's not just your computer.
Speaker 1: As the Internet of Things continues to blossom, it's everything. Yes,
Speaker 1: I agree, And in that sense, those researchers were trying
Speaker 1: to use something the old school term is called responsible disclosure,
Speaker 1: where they explain some kind of vulnerability that they found
Speaker 1: to the company in hopes that the company will fix
Speaker 1: this problem before it becomes mainstream and before it gets
Speaker 1: out into the wild. In the case of Jeep, I believe,
Speaker 1: if my memory serves me right, that Jeep did not
Speaker 1: necessarily release a patch for this vulnerability. So then the
Speaker 1: researchers decided to go out publicly about the information that
Speaker 1: they found, and then Jeep decided to fix it once
Speaker 1: everybody else knew about it, right, And and sometimes that's
Speaker 1: what it takes. And then and I've had the same
Speaker 1: discussion offline with a mutual friend of ours, Brian Brushwood.
Speaker 1: Brian is a stage magician. He has a show called
Speaker 1: Scam School. It's all about social engineering. One of the
Speaker 1: things I have talked about with Brian is that his show,
Speaker 1: he often shows how to do certain types of scams
Speaker 1: or tricks, but they're mostly in the bar bet world, right, Like,
Speaker 1: not stuff that you would do to ruin someone's life,
Speaker 1: but something that you know you might want to you
Speaker 1: might win a free beer that way. Yeah, And he
Speaker 1: showed off he had an episode where he showed off
Speaker 1: this guy who had had was demonstrating a well known
Speaker 1: vulnerability of a popular bike lock that has been off
Speaker 1: the market for a couple of years because of this vulnerability.
Speaker 1: But that particular vulnerability meant that you could use a
Speaker 1: regular plastic pen, remove the pen part of the pen,
Speaker 1: use the casing, and jam that into the lock and
Speaker 1: pop the lock open. Right. And so people were complaining
Speaker 1: in the comments, they were saying, you're you're you're publicizing
Speaker 1: this vulnerability. And I said, guess what the bad guys
Speaker 1: already know about this vulnerability. What they're doing is publicizing
Speaker 1: it to a public that might be still vulnerable to
Speaker 1: it so that they don't fall victim. And that to
Speaker 1: me is a very important part of hackers across the board.
Speaker 1: They they serve very important purpose to alert folks to
Speaker 1: potential dangers before it gets too late. Yeah. Absolutely, And
Speaker 1: and you're those hackers are the people that are generally
Speaker 1: working to make a better world for consumers, a better
Speaker 1: a better private and secure world for consumers. But then,
Speaker 1: of course, on the other hand, are the batties. Yeah,
Speaker 1: let's talk about some of them. So I kind of
Speaker 1: gave some weird little titles for this when I was
Speaker 1: typing it up, because in the middle of a week,
Speaker 1: I get bored. Shannon has to be honest, and so
Speaker 1: when I was making an outline kind of for us
Speaker 1: to work from, I started coming up with goofy subtitles.
Speaker 1: So this whole section is titled the Naughty Bits in
Speaker 1: our Notes, And the first one is malware moo law,
Speaker 1: as in people who make money through the development or
Speaker 1: distribution of malware and malware. As I've said on this
Speaker 1: show many times in order to define it, it's really
Speaker 1: software that is intended to do something that is ultimately
Speaker 1: harmful to the person who runs that software on their machine.
Speaker 1: It covers a wide array of different subcategories like, uh,
Speaker 1: you know, this is the sort of term that we
Speaker 1: normally would have in the old days just called a
Speaker 1: computer virus, but computer virus is a very specific thing,
Speaker 1: and malware covers more stuff than just viruses, also worms
Speaker 1: and all sorts of stuff. Yeah, there's there's malware for
Speaker 1: Java and Flash. If you still have Flash installed, I
Speaker 1: highly recommend that you uninstall it if you don't need it.
Speaker 1: There's malware for browsers. There's malware for advertisements online for
Speaker 1: sponsors that you'll see like on on different websites. That
Speaker 1: was a very recent problem that a lot of news
Speaker 1: publications had with Yeah, big name news public Yeah, so
Speaker 1: that was a big one. But you'll see maw. We're
Speaker 1: all over the place. And luckily we do have anti
Speaker 1: mauware software that we can use to protect our computers
Speaker 1: from it, and we can also block certain ports on
Speaker 1: the routers that can hopefully protect you from MAUER. But
Speaker 1: there's also a lot of cases where maure is distributed
Speaker 1: and built so quickly that a lot of those anti
Speaker 1: Mauer software are not updated quick enough. So in that case,
Speaker 1: we need to do the best that we can to
Speaker 1: protect ourselves and keep MAUER from getting out from the
Speaker 1: deep web. Yeah. You know, it used to be, uh
Speaker 1: that you really all you needed to worry about was
Speaker 1: just don't go to the more seedy elements of the web,
Speaker 1: and you were generally all right, right, Yeah, it's kind
Speaker 1: of like avoiding a bad neighborhood. Like, obviously, if you
Speaker 1: don't want to get robbed, there's certain neighborhoods that you
Speaker 1: should probably shouldn't walk around in by yourself at night.
Speaker 1: And this is kind of similar in that case where
Speaker 1: you avoid the deep web unless you really want to
Speaker 1: be on somebody's like hit list or something like that. Yeah. Yeah,
Speaker 1: if you're if you suddenly think that you want to
Speaker 1: come across as a big shot, look if you're not
Speaker 1: a big shot, don't do that. It's kind of like
Speaker 1: kind of like walking up to someone who works in
Speaker 1: a carnival and claiming that you're with it and for it.
Speaker 1: If you don't know what that means, you do not
Speaker 1: say that. Okay, I think I just gave terrible advice
Speaker 1: to an entire population of listeners. Um, don't don't. Don't
Speaker 1: talk to Carney's unless you are one, alright, so uh
Speaker 1: and I love you Carney's. I love you all. So.
Speaker 1: The the thing that we're getting across, though, is that
Speaker 1: today that's not as big a guarantee as it used
Speaker 1: to be right, like ten years ago, you'd say, look,
Speaker 1: just be careful. Don't download unusual files, don't don't run
Speaker 1: a file that's linked in your email without checking it
Speaker 1: out first. Don't don't you know, be careful opening up
Speaker 1: emails from things that you don't recognize. Be careful with
Speaker 1: PDF files. Be careful with stuff that especially unsolicited stuff
Speaker 1: that has com to you, because that raises the chances
Speaker 1: that something hinky is going on. It doesn't necessarily mean
Speaker 1: it's definitely a problem, but it's potentially a problem, and
Speaker 1: it's better to be safe than sorry. Make sure you
Speaker 1: have good and uh anti virus software on your computer.
Speaker 1: Make sure you have a nice strong firewall. All of
Speaker 1: these kind of things. Those used to be pretty good
Speaker 1: at keeping of the malware away from you, if you
Speaker 1: were being a fairly responsible Nedicin these days, they definitely help.
Speaker 1: These days, these days, the attacks are are sometimes getting
Speaker 1: like in the case of the advertisements on news sites.
Speaker 1: These are attacks that are going through avenues that you
Speaker 1: want at one point would have considered perfectly safe. Not
Speaker 1: that it's happening all the time, but the fact that
Speaker 1: it can happen tells you that it requires an extra
Speaker 1: level of vigilance beyond what we used to say was
Speaker 1: was sufficient. Yeah. Absolutely, a data collection for a lot
Speaker 1: of this malware is extremely Uh, it's high sensitive in
Speaker 1: the fact that a user's data can get so much
Speaker 1: money on the on the deep web, so much money really,
Speaker 1: particularly a collection of user data. That's where the big
Speaker 1: money is, right. I did an episode once where we
Speaker 1: tried to break down how much is your personal information worth?
Speaker 1: And yeah, it really depends. It depends upon what information
Speaker 1: you're talking about, Like how extensive is that profile on
Speaker 1: a person? But yeah, it's not much in the grand
Speaker 1: scheme of things. Like to you, it's worth a lot,
Speaker 1: right you as a person, Shannon, You as a person,
Speaker 1: that information is worth a lot of money to you
Speaker 1: because it's who you are. To someone else, it's worth
Speaker 1: pennies on the dollar really, depending upon depending upon the
Speaker 1: amount of information. But the smellware often is giving hackers
Speaker 1: access to massive amounts of info about a huge number
Speaker 1: of people, and a number is there is more value
Speaker 1: and that's where they will sell that. Sometimes they sell
Speaker 1: it to companies that are just interested in getting information
Speaker 1: so that they can do targeted advertising. So it might
Speaker 1: be that the ultimate use of your information isn't as
Speaker 1: bad as it could be. It just means you're going
Speaker 1: to get some adsum but still not fun to think
Speaker 1: about and to think that you know, now these companies
Speaker 1: have access to information about you that you probably would
Speaker 1: rather they not have, particularly in targeted advertising. The famous
Speaker 1: story about Target when they started sending ads to a
Speaker 1: young lady that were related to pregnancy, and then her
Speaker 1: dad got really really ticked off about it. But it
Speaker 1: turned out that little girl was pregnant, yeah, and that
Speaker 1: it was it was because the algorithms had picked up
Speaker 1: through her search habits that she was pregnant based upon
Speaker 1: the search terms she was putting in, and so they
Speaker 1: proactively sent her some coupons for pregnancy related items. The
Speaker 1: dad got very upset. Then the dad ended up apologizing
Speaker 1: to Target, saying that he was unaware at the time
Speaker 1: of the full situation. Well, in that case, it was
Speaker 1: search algorithms. It wasn't a hacker who had gained access
Speaker 1: to stuff and then sold it. But there are other
Speaker 1: cases where that does happen, where you know, just a
Speaker 1: database of info, and a lot of times they will
Speaker 1: release this malware in something that's called an exploit kit.
Speaker 1: So generally, these exploit kits are like a batch of
Speaker 1: similar malware that will work across several different platforms, so
Speaker 1: that whether that's several different types of software like job
Speaker 1: and flash, or several different browsers, it could be several
Speaker 1: different operating systems too, So you might see an exploit
Speaker 1: kit that works on Linux four four but also works
Speaker 1: on Windows XP up through eight or something like that. Right,
Speaker 1: And what's crazy is that when you start looking at
Speaker 1: I mean, this is one of the things that hackers do, right,
Speaker 1: They'll look at operating systems and what the market penetration
Speaker 1: is for those systems because that that's that shows you
Speaker 1: where your target rich environment is. Right, So if you
Speaker 1: have Windows seven, guess what you are prime target for
Speaker 1: for malware because that is by far the largest UM
Speaker 1: that that has the greatest market share of any operating
Speaker 1: system right now, Windows XP still it's number three, number three,
Speaker 1: and it has not been supported by Window formed by
Speaker 1: Microsoft for two years. This, by the way, bad thing.
Speaker 1: If you want to be really secure with your your
Speaker 1: computer information, you don't want to be using and operate
Speaker 1: system that no longer gets support from the company that
Speaker 1: made it. UM because because that means no vulnerabilities will
Speaker 1: be patched. From that moment forward, you're pretty much on
Speaker 1: your own. You have gone into the dark forest, and
Speaker 1: you forgot to bring your flashlight. It's pretty dangerous. Um.
Speaker 1: One of the things that you kind of uh that
Speaker 1: that I think leads in from what you were saying
Speaker 1: before with these exploit kits. One of the most terrifying
Speaker 1: aspects of this type of malware and and the fact
Speaker 1: that that people can use it for nefarious purposes and
Speaker 1: monetary gain, is that you also have a population of
Speaker 1: people who don't even understand how the malware works. They
Speaker 1: don't even Script kitties is what I'm getting at. Script kitties,
Speaker 1: that's the term we use for people who are, uh,
Speaker 1: they're benefiting from the the work that hackers have done.
Speaker 1: Hackers are the ones who are actually putting together the software.
Speaker 1: They're the ones who have identified the vulnerability and then
Speaker 1: exploited it in some way. Script kitties are the ones
Speaker 1: who essentially they're given a set of skeleton keys, and
Speaker 1: they didn't make the skeleton keys, they're just using them. UM.
Speaker 1: And it's scary because you don't need a level of expertise.
Speaker 1: You might think, oh, well, I'm kind of safe from
Speaker 1: hackers because how many people are actually hackers? How many
Speaker 1: people really know how this system works. Well, you don't
Speaker 1: have to really know how the system works if you
Speaker 1: have a tool that exploits a vulnerability. Oh absolutely. Although
Speaker 1: I really hate the words of Katie, I will put
Speaker 1: it out there because I feel like if you're interested
Speaker 1: in information security, and if you're interested in becoming a
Speaker 1: good hacker, then you do start somewhere, and everybody is
Speaker 1: going to start with the easy tools that are out
Speaker 1: there and that are available for free. For example, one
Speaker 1: thing that I learned how to use a couple of
Speaker 1: years back was this tool called wire shark. It easily
Speaker 1: lets you see everything that's happening on your wireless network,
Speaker 1: or you can use it for um, any computers that
Speaker 1: are on your on your network, like behind your router,
Speaker 1: so you can see everything that's going on and you
Speaker 1: don't necessarily have to learn or understand what's going on
Speaker 1: behind it to be able to read what's on your
Speaker 1: screen happening right in front of you. I think it's
Speaker 1: really important though, for people who might be called script
Speaker 1: kitties to look at as being beneficial and that they
Speaker 1: can grow from that process. They can start from being
Speaker 1: a beginner and say, okay, well I need to understand
Speaker 1: the theory. Now I can move on from being a
Speaker 1: script kittie quote unquote to becoming somebody who is an
Speaker 1: expert in some kind of information security out there. Yeah.
Speaker 1: I when I think of the term script kitty, in
Speaker 1: my mind, it's a very it's a subset of the
Speaker 1: people that typically get labeled as such. That subset being
Speaker 1: people who have little to no interest in actually learning
Speaker 1: how to hack or program. Uh, people who want a
Speaker 1: very very fast track way to gain either a reputation
Speaker 1: by being the person who took down a system by
Speaker 1: whatever means, or by making a whole lot of money
Speaker 1: really fast for relatively little effort. Those are the ones
Speaker 1: I specifically think of when I think of script kitty.
Speaker 1: But you are absolutely right, you have to start somewhere
Speaker 1: if you're interested in this is I'm kind of defensive
Speaker 1: with that because I I was called a script kitty
Speaker 1: when I first started up started off learning about hacking
Speaker 1: and information security. People would be like, Oh, she's just
Speaker 1: a script kitty, and I'd be like, I actually want
Speaker 1: to understand the theory. I want to learn how to program.
Speaker 1: I want to learn how to code. I'm no longer
Speaker 1: called that because I have learned how to write certain
Speaker 1: kinds of code. I have learned how to program. I
Speaker 1: can make my r doin no, do whatever I want.
Speaker 1: So at this point in my stage, I've surpassed that
Speaker 1: moment of being a nube and I've gone on to
Speaker 1: learning things and being able to understand specific tests and
Speaker 1: get them to do what I want them to do
Speaker 1: without finding tutorials online. Yea, so now I make my
Speaker 1: own tutorials. Seeing Now that's nice because when I started
Speaker 1: at how Stuff Works, they call me that weird bald guy,
Speaker 1: and today they still do. So some labels just stick,
Speaker 1: is what I'm saying. So yeah, So, so that kind
Speaker 1: of covers the malware approach. People can make money through malware,
Speaker 1: either by selling your information UM, they might do so
Speaker 1: by another method, which kind of leads into this idea
Speaker 1: of ransomware. So this would be malware specific type of
Speaker 1: malware that UM locks down your machine in some way
Speaker 1: so that you can no longer access it, and then
Speaker 1: you essentially get a message saying, hey, if you want,
Speaker 1: if you want your data back, if you want access
Speaker 1: to your data. If you want to be able to
Speaker 1: do all this stuff and you want our hands out
Speaker 1: of your business, then you've got to pay us some
Speaker 1: moolah money. Yeah. So basically what happens with ransomware is, uh,
Speaker 1: it is just like you said, a type of aware
Speaker 1: that gets distributed in one way, shape or form onto
Speaker 1: somebody's computer and it ends up encrypting their data. It
Speaker 1: could be a whole hard drive, it could be a
Speaker 1: folder of data. It's some kind of important data that
Speaker 1: they have sitting on their computer. Uh. And in many cases,
Speaker 1: a thief the hacker will ask them in an email
Speaker 1: or maybe an encrypted text document that's now surreptitiously on
Speaker 1: their computer out of nowhere, to send them a certain
Speaker 1: amount of bitcoins, and they tell them how to set
Speaker 1: up a bitcoin wallets so that they can send the
Speaker 1: bitcoins to them for them to get a pass code
Speaker 1: to unlock their encrypted data. Now, the weird part is
Speaker 1: they already owned this data. It's on their own hard drive.
Speaker 1: It could be anything from like kids photos, it could
Speaker 1: be tax documents. But in any case, it's going to
Speaker 1: be some kind of important information that people don't want
Speaker 1: to lose because it might be years and years of
Speaker 1: information that's just on that computer. So of course people
Speaker 1: are going to send them bitcoins, and I think last
Speaker 1: I checked, a bitcoin was a few hundred bucks, so
Speaker 1: it ends up being quite a bit of money that
Speaker 1: they have to send to get their information unlocked. Yeah,
Speaker 1: and this is this is the type of malware. When
Speaker 1: we were talking about the the advertising that was targeting
Speaker 1: people through massive news sites. If I'm not mistaken, it
Speaker 1: was specifically ransomware. It was the kind of stuff that
Speaker 1: was encrypting users. Uh yeah, yeah, so it wasn't just malware.
Speaker 1: It was ransomware that was infecting computers. Because malaware can
Speaker 1: do other stuff too, right, it can It can create
Speaker 1: something like a backdoor access. So yeah, hackers can take
Speaker 1: control of your machine or just monitor what you're doing.
Speaker 1: Even if they don't want to take control, they can
Speaker 1: put in key loggers so they can see what all
Speaker 1: your passwords are. Um, so you might want to think
Speaker 1: about using things like a really good password manager. UM
Speaker 1: that's what I use and and I love mine. Uh yeah,
Speaker 1: So the things where you don't have to type the
Speaker 1: password in so you don't have to worry about key
Speaker 1: loggers picking up on that. Kind of stuff. Um. But
Speaker 1: we'll talk more about that in just a second. So
Speaker 1: one of the other ones I wanted to talk about,
Speaker 1: this one is kind of a gray area because, uh,
Speaker 1: this is this. I titled this section spies like us um,
Speaker 1: and by this I meant state sponsored hackers. People who
Speaker 1: are hacking on behalf of a specific state or nation
Speaker 1: or government. Um. Sometimes they may be doing so not
Speaker 1: with the uh what should I say, Like, not with
Speaker 1: the express permission of the nation. It may turn out
Speaker 1: that the state says, Hey, we didn't tell them to
Speaker 1: do this. They're just doing it because they love us
Speaker 1: so much and they hate and they hate you guys,
Speaker 1: and that's why they're doing it. Um. Whether that's true
Speaker 1: or not depends upon the situation. I would I would
Speaker 1: think that if I were running a government and I
Speaker 1: had employed a bunch of hackers to infiltrate or sabotage
Speaker 1: another nation's systems, I also would like some plausible deniability
Speaker 1: in there. Hey, I didn't tell him to do it.
Speaker 1: I just said, man, it's it's kind of like there's
Speaker 1: there's a story that a king of England once he
Speaker 1: yelled out, who will rid me of this meddlesome priest,
Speaker 1: and then a couple of nights went off and ridded
Speaker 1: him of his of that meddlesome priest, and it turned
Speaker 1: out that he was he was just mad and just
Speaker 1: talking out loud. And then one of his dearest friends
Speaker 1: ended up being murdered by a couple of nights because
Speaker 1: they heard the guy talking and said, hey, we should
Speaker 1: get rid of them. We'll get rewarded. That's what the
Speaker 1: States argue. I don't know that that's always the case. Also,
Speaker 1: by the way, for you listeners out there who recognize
Speaker 1: who I'm talking about, send me an email and prove it,
Speaker 1: because I'm a medievalist and I love that stuff. Um.
Speaker 1: But yeah, this is something that we see. You know,
Speaker 1: you often will hear stories about Chinese hackers or Russian hackers.
Speaker 1: There was a story UH several years ago about how
Speaker 1: UH information security experts were noticing some artifacts in our
Speaker 1: power grid system that were indicative of UH people who
Speaker 1: had infiltrated that system and planted some stuff in there
Speaker 1: so that they could monitor things or perhaps even jump
Speaker 1: back into the power grid system should UH push come
Speaker 1: to shove in some sort of political situation. They had
Speaker 1: traced it back to either China or Russia. It's pretty
Speaker 1: tricky to actually figure out where attacks ultimately originate from,
Speaker 1: because if you're really good, you can cover your tracks
Speaker 1: pretty well. Um, but the United States has done it too.
Speaker 1: You might have heard about Stuck's Net. That was the
Speaker 1: That was the computer virus that was designed to um
Speaker 1: to to spin a centrifuge in a nuclear facility at
Speaker 1: a speed greater than what it was supposed to spend
Speaker 1: at And originally I think the hope was that it
Speaker 1: would cause a catastrophic failure and perhaps perhaps even destroy
Speaker 1: the facility. As it turned out, it caused a failure,
Speaker 1: but not at that level. But that those are examples
Speaker 1: of something that's technically legal within the country because it's
Speaker 1: it's endorsed or at least permitted by a government, but
Speaker 1: you don't want it out there because it seems pretty
Speaker 1: darn shady to anybody else. Yeah. Yeah, So state sponsored
Speaker 1: hacks are more worrisome to me because they oftentimes have
Speaker 1: much larger targets. For example, they might target a large
Speaker 1: government facility like I don't know, the Pentagon, So I
Speaker 1: worry about those because those kind of servers have a
Speaker 1: lot of information on the citizens of any sort of country.
Speaker 1: So anytime you see these in the news, it's it's
Speaker 1: always like, oh, well, this this hack was done by
Speaker 1: Chinese state sponsored hackers, or Russian state sponsored hackers, or
Speaker 1: American state sponsored hackers in these North Korea. North Korea
Speaker 1: would be another big one. Yeah, yeah, So so they
Speaker 1: are either it might be a tinam of hackers that
Speaker 1: are kind of comprised together in a illegitimate company, who
Speaker 1: are hired by a government or like you say, where
Speaker 1: they may not necessarily have any affiliation quote unquote with
Speaker 1: the government, but the government ends them paying them in
Speaker 1: some way, shape or form for their infiltration because it
Speaker 1: ends up helping the government in some way or another.
Speaker 1: And so it's it's a very sticky scenario when you
Speaker 1: start dealing with these state sponsored hackers, because it's it's
Speaker 1: hard to understand, Um, how are we going to, you know,
Speaker 1: penalize them? Who do we penalize? Do we penalize government
Speaker 1: or the hackers themselves? Are both like who was actually involved?
Speaker 1: It might end up being how do we address the
Speaker 1: underlying situation that led to the employment of hackers in
Speaker 1: the first play? Um, which can get pretty pretty delicate.
Speaker 1: Another great example, or not too long ago, or at
Speaker 1: least one that may or may not have been involved
Speaker 1: in my may or may not have involved a state
Speaker 1: sponsored hacker I'm still somewhat skeptical of that, would be
Speaker 1: the Sony hack. Because the Sony hack, the US government
Speaker 1: essentially was pointing fingers to North Korea, saying the hackers
Speaker 1: must have come from North Korea. Look at this IP address,
Speaker 1: which we don't even need to go into detail right now,
Speaker 1: except to say that an IP address does not proof
Speaker 1: make but at any rate, they're they're pointing over at
Speaker 1: North Korea saying, we think the attacks came from there.
Speaker 1: The attack appears to be politically motivated North Korea, for
Speaker 1: its part, the government, which, by the way, North Korea
Speaker 1: not shy about taking credit for stuff, but they said, no, no,
Speaker 1: we didn't. We we didn't ask for this, but we're
Speaker 1: totally cool with it happening. Um, So you know, it's
Speaker 1: one of those It's also very muddy because obviously, when
Speaker 1: you're talking about things like espionage or Sava Taj or
Speaker 1: any of those things, uh, you don't you don't come
Speaker 1: out and talk more about it, you don't. That ends
Speaker 1: up being closed away. In fact, I should, I should
Speaker 1: really throw that over to the stuff they don't want
Speaker 1: you to know guys, and have them do an episode
Speaker 1: on it, because that would be a lot of fun.
Speaker 1: And then we've got got the the traditional at least,
Speaker 1: I would argue the traditional concept of a hacker from
Speaker 1: the Hollywood perspective. The black hats, the ones they are
Speaker 1: wearing the hoodies and they're sitting at a keyboard and
Speaker 1: they're typing really fast on a green and black screen.
Speaker 1: Over They've got like got some junk food food around them. Yeah, mail,
Speaker 1: and they have a ton of different windows popping up
Speaker 1: on their computer really really fast. You can't make out
Speaker 1: anything that's happening. It's entirely not true. That's not how
Speaker 1: it works. It's actually a somewhat slow process to get
Speaker 1: um basically, to get reconnaissance and to get into any
Speaker 1: kind of network. Uh. The only things I've done, of course,
Speaker 1: are completely legal. I've sure authorization by everybody who I
Speaker 1: have tested my my abilities on. Right. Yeah, so black hats.
Speaker 1: That's that's another awkward definition because it's not one that
Speaker 1: I like to use all the time, because black hat
Speaker 1: hacker means that there's it makes hackers have more of
Speaker 1: a negative appeal to a lot of people, So I
Speaker 1: always just call them black hat thiefs. Yeah. Now that's
Speaker 1: a great way of putting it, because, Uh, typically you'll
Speaker 1: see things like, um, uh, the idea of infiltrating a
Speaker 1: system in order to steal information, perhaps to sell it
Speaker 1: to someone else, or to hold it against the party
Speaker 1: that you've stolen it from. Um, you know, so it
Speaker 1: might be extortion as opposed to h to stealing and selling. Uh. Also,
Speaker 1: we should go ahead and point out something else that
Speaker 1: I'll talk about in a future episode, but I've mentioned
Speaker 1: it in previous ones too. Um. Hackers don't necessarily just
Speaker 1: sit at a keyboard and type in strings of letters
Speaker 1: and numbers. They also do a lot of social engineering
Speaker 1: where or they can do a lot of social engineering
Speaker 1: where they attempt to gain access to systems, either by
Speaker 1: physically gaining access to a system, which makes it way
Speaker 1: easier than remotely doing it, or even easier than that
Speaker 1: manipulating someone who does have access to a system, and
Speaker 1: then you get it that way. Um, And it's surprisingly
Speaker 1: easy to do if employees have not been educated on
Speaker 1: how to spot that and avoid it. Yeah, properly training
Speaker 1: your your your employees at your place of work is
Speaker 1: really important when it comes to social engineering. And it
Speaker 1: is incredibly easy to do social engineering, especially when you're
Speaker 1: a female, I would imagine. So it turns out also
Speaker 1: if you are dressed as the stereotypical I T. Guy
Speaker 1: and you are there to quote unquote upgrade someone's machine,
Speaker 1: really easy to get access to that machine. People are
Speaker 1: so eager. Yeah. Yeah. And obviously, like social engineering completely
Speaker 1: depends upon identifying and then exploiting a person's vulnerability and
Speaker 1: typically speaking like greed lust, those are two big ones
Speaker 1: that are exploitable and that the people who are really
Speaker 1: good at social engineering know that, and they're very good
Speaker 1: at that leveraging that. Just as knowing what sort of
Speaker 1: vulnerabilities typically show up within code, within within programs, you
Speaker 1: need to know what vulnerabilities show up in people. Um.
Speaker 1: And I also I had a little thing on here
Speaker 1: about botan net masters. Really what in this I was
Speaker 1: thinking about the people who are using malware to get
Speaker 1: that back door access to machines, to get uh, to
Speaker 1: get that administrative control over a wide array. Sometimes we
Speaker 1: call it a botan net. Sometimes we call it a
Speaker 1: zombie army of of user computers and then utilizing that
Speaker 1: to do stuff like uh uh distributed denial of service
Speaker 1: attacks or de DOS attacks, where you are uh directing
Speaker 1: an army essentially to coordinate an attack against an identified target.
Speaker 1: Sometimes this is done just to cause problems. I mean,
Speaker 1: obviously if you've ever had issues logging into like a
Speaker 1: gaming network. Xbox Live has had this happen, PlayStation has
Speaker 1: had this happen where people who are disenchanted with the
Speaker 1: service for one reason or another, or they just want
Speaker 1: to do it for the lulls. Uh. Specifically around holiday times,
Speaker 1: that's a big that's a big target time to attack
Speaker 1: something like Xbox Live. They'll direct a ton of traffic
Speaker 1: to break down servers, so servers can't respond to legitimate
Speaker 1: traffic because they're too busy responding to a bunch of
Speaker 1: fake traffic. Essentially, I'm oversimplifying, but this is a basic
Speaker 1: DETOS attack. It is. It's such a mean thing to
Speaker 1: do to those little kids during Christmas time. Just turn
Speaker 1: off their xboxes so that they can log in and
Speaker 1: they can't play their games, so they just go on.
Speaker 1: Yeah yeah, I think, break my heart. Gosh, it's it's
Speaker 1: a jerk move. It's a jerk move, don't do it.
Speaker 1: I love the definition, or I love the term zombie
Speaker 1: for botton nets, because that's exactly what it is. Where
Speaker 1: you have a you have a zero, a patient zero,
Speaker 1: and that would be the first computer. They end up
Speaker 1: biting a few more computers, and those ones end up
Speaker 1: getting infected with the same exact infection that patient zero had,
Speaker 1: and then those ones end up biting ten each, So
Speaker 1: you end up with thousands upon thousands of these computers
Speaker 1: that each have the same exact infection, and they all
Speaker 1: end up perpetrating the same exact vulnerability on whatever their
Speaker 1: target might be. Yeah, and then ultimately you end up
Speaker 1: with a situation where Nagan is standing there with a
Speaker 1: baseball bat and you don't know whose head he's gonna
Speaker 1: cave in. I might have taken that metaphor a little
Speaker 1: too far. But one of the things that boughton net
Speaker 1: controllers might do, and in fact, this has happened on
Speaker 1: multiple occasions, it's similar to ransomware, is they'll send a
Speaker 1: message to an identified target and say, hey, we we
Speaker 1: got your number. We're gonna come after you unless you
Speaker 1: pay us a certain amount of money. Um, we will
Speaker 1: unleash the dogs of war on your servers, and you
Speaker 1: will be unable to do business. And there have been
Speaker 1: cases where businesses have folded to this kind of pressure,
Speaker 1: where they have in fact paid to do this because hospital. Yes,
Speaker 1: yes it was. Yeah. I've seen a few cases of
Speaker 1: particularly malicious and odious acts against things like hospitals. There
Speaker 1: was one year when I was participating in a charity
Speaker 1: for children's hospitals and the charity was targeted in the
Speaker 1: middle of the event and for about three hours they
Speaker 1: were offline trying to deal with that. Um, yeah, it's
Speaker 1: and in that case, it wasn't a it wasn't an
Speaker 1: attack in an effort to get money. I don't think.
Speaker 1: I think it was just someone being truly an awful
Speaker 1: human being. Uh. But we have seen cases of people
Speaker 1: trying to do this in order to extort money. So
Speaker 1: you're probably noticing some trends here extortion, stealing, uh, you know,
Speaker 1: holding things for ransom, this idea of making sure that
Speaker 1: that people are spending money for out of fear or
Speaker 1: out of a need to get back uh, and and
Speaker 1: have access to something that belongs to them. These are
Speaker 1: all terrible, terrible motivations to make money and as such
Speaker 1: as such terrible motivations. You might think, well, wait a minute,
Speaker 1: how are they actually like, how are they getting paid?
Speaker 1: How is this money transfer happening? Because you would think
Speaker 1: anything that would be traceable would end up being somewhat problematic.
Speaker 1: You've got a trail that leads back to you as
Speaker 1: a person, then pretty soon law enforcement's going to get involved,
Speaker 1: or at least the I R S. So, so, how
Speaker 1: Shannon do hackers? How do they get the money? So
Speaker 1: there's probably some ways that I don't even know about yet,
Speaker 1: but the ones that I can think of would be
Speaker 1: trading of high value data. So that's a pretty big
Speaker 1: one where uh say a hacker collects a whole bunch
Speaker 1: of really really high value data like your SOLL security number,
Speaker 1: your credit card accounts, your banking account, tons of information,
Speaker 1: and they decided to go on to a deep web
Speaker 1: forum sell it, and then or trade it for something
Speaker 1: else of high value, for example, a gift card. They
Speaker 1: could ask for people to give them a ton of
Speaker 1: gift cards that are, like you, twenty five or fifty
Speaker 1: dollars each, and then use those gift cards at a
Speaker 1: retailer who is easily vulnerable to some kind of gift
Speaker 1: card scam, and in that sense they would be able
Speaker 1: to make some kind of money back through those gift
Speaker 1: cards and that trade of that high value uh data
Speaker 1: that they stole from whoever it might be, whatever company.
Speaker 1: Another way would be bitcoins. Now that's probably the most
Speaker 1: obvious one, of course, because bitcoins are very very hard
Speaker 1: to track. Yes, they are traceable in some circumstances, depending
Speaker 1: on what kind of wallet you use, but in a
Speaker 1: lot of circumstances, the bitcoins will trade wallets so many
Speaker 1: times that it will be somewhat impossible to find out
Speaker 1: where it actually came from, where it actually started. Yeah,
Speaker 1: it's kind of interesting because every single bitcoin contains with
Speaker 1: it a record of every transaction. But that does not
Speaker 1: mean that the parties involved are actually identifiable. Yeah, it
Speaker 1: really is. Um it's it's actually data that's used in
Speaker 1: order to allow for the mining of further bitcoins. It's
Speaker 1: a really fascinating process. But but one of the things
Speaker 1: that attracts people to bitcoins is this idea of being
Speaker 1: able to spend them anonymously and be able to purchase things, uh,
Speaker 1: whether legal or illegal, without it being traced back to
Speaker 1: that person you often will hear about things like, you know,
Speaker 1: the old Silk Road, where you could purchase all sources
Speaker 1: of stuff, including illegal drugs or other materials, sometimes weapons,
Speaker 1: that kind of stuff, um, and you could do it
Speaker 1: through bitcoins, and people felt a high level of confidence
Speaker 1: because it was not a state backed currency. It was
Speaker 1: this independent cryptocurrency that allowed them that that freedom and
Speaker 1: had real value because people want the bitcoins. If no
Speaker 1: one wanted the bitcoins, they wouldn't be worth anything, right,
Speaker 1: And bitcoins have actually been pretty steady last time I checked,
Speaker 1: so their value has been pretty decent in late days,
Speaker 1: in recent days, So I completely understand why hacker would
Speaker 1: want to be paid in bitcoins. It makes sense. Yeah. Yeah.
Speaker 1: There's also the old, the old deal of putting the
Speaker 1: money into the the washing machine. Right, that's how money
Speaker 1: laundering works, right, Yes, money laundering. So that was something
Speaker 1: that I learned about way back in the day when
Speaker 1: I worked at a bank of all places, which also
Speaker 1: got me really interested in security before I started podcasting.
Speaker 1: But money laundering, it's very easy for somebody to go
Speaker 1: online be able to sell this high value d to
Speaker 1: get some bitcoins, or it might be some other form
Speaker 1: of currency and then be able to resell that money
Speaker 1: or be able to trade a product to get real money,
Speaker 1: real cash at one point or another. But basically it's
Speaker 1: it's um exchanging the hands that hold that money so
Speaker 1: many times that again it's very hard to trace. Yeah,
Speaker 1: and it's it's hard to determine that the the original
Speaker 1: source of that money was anything remotely illegal. And then
Speaker 1: depending on again, if you're if you're a state sponsored hacker,
Speaker 1: you're probably just drawing a salary or doing contract work.
Speaker 1: So you're actually getting paid a check. Yeah, Yeah, you
Speaker 1: got money withdrawn from your paycheck to handle to support
Speaker 1: the government while you are subverting other governments. And then
Speaker 1: it looks completely legitimate. So that's a really easy way
Speaker 1: for somebody to do something that might be very very bad. Yeah,
Speaker 1: because they are they do have to pay the I
Speaker 1: R S, they do get a tax refund every year,
Speaker 1: they do have an employer, so it looks completely normal
Speaker 1: for them to be receiving a paycheck for whatever work
Speaker 1: this might be. Yeah. So the nice thing is there
Speaker 1: aren't just quote unquote bad guys out there doing all
Speaker 1: this kind of of work with computers, with a hacking,
Speaker 1: with discovering vulnerabilities. There are plenty of people, as as
Speaker 1: you mentioned earlier, Shannon, who are doing this in order
Speaker 1: to help others, either to make systems more secure or
Speaker 1: to inform people of how these kind of attacks happen
Speaker 1: so that they can be better prepared to defend themselves.
Speaker 1: So let's talk about some of them. Uh. Of course,
Speaker 1: if you have black hat hackers, right, you got the
Speaker 1: bad guys, you gotta have, you gotta hat white hack hackers.
Speaker 1: These are the These are the the noble bounty hunter
Speaker 1: characters of those westerns, the ones who you know they've
Speaker 1: seen things, but deep down they have a heart of gold. Well,
Speaker 1: not all of them, but a lot of a lot
Speaker 1: of my friends are considered white hat hackers. They're the
Speaker 1: people who either they work for a company that specializes insecurity.
Speaker 1: So a lot of my friends work for these companies
Speaker 1: who will be contracted with big brands, go into their
Speaker 1: networks and then find out what the vulnerabilities are and
Speaker 1: fix them, or they will give them a report and
Speaker 1: tell them how to fix that fix it in the future.
Speaker 1: They make a lot of money. A lot of them
Speaker 1: don't like it because they have specific amounts of vulnerabilities
Speaker 1: or specific time frame set that they have to get
Speaker 1: this work done, and a lot of times, hacking takes
Speaker 1: a lot of time. It takes a lot of information reconnaissance.
Speaker 1: So a lot of my friends don't necessarily appreciate having
Speaker 1: to be under these time constraints with these big brands,
Speaker 1: well particular Relea, since you figure the bad guys aren't
Speaker 1: under any particular time constraints exactly. So the bad guys
Speaker 1: have tons of time to find these vulnerabilities, while the
Speaker 1: white hacks are under the stress of these time constraints
Speaker 1: to get the work done so that they make their
Speaker 1: bosses happy. In this sense, a lot of my a
Speaker 1: lot of people that I know, have created their own
Speaker 1: security companies because of this fault in the generic nature
Speaker 1: of having these security companies. So they said, you know,
Speaker 1: I'm tired of having to deal with these constraints that
Speaker 1: my boss has given me. Just gonna open my own
Speaker 1: security company, and we're going to do it even better
Speaker 1: because we won't give ourselves those time constraints. Will give
Speaker 1: us ourselves several months to find all the vulnerabilities that
Speaker 1: we absolutely can and then we'll write a report and
Speaker 1: we'll fix it. And uh, those are the ones that
Speaker 1: I would definitely work with if I had to hire
Speaker 1: a security company. Yeah, because they're the ones who are
Speaker 1: going to use the exact same kind of methodologies that
Speaker 1: bad guys are going to use. And if if you
Speaker 1: want to really be secure, you want the people to
Speaker 1: throw everything they can at your system so that you
Speaker 1: can find out are you actually secure? If you're not,
Speaker 1: what do you need to do to address it? Um.
Speaker 1: If you want to see a movie that that does
Speaker 1: a very fantasy version of this very idea, there's a
Speaker 1: film that I always think back to, Sneakers had Robert
Speaker 1: Redford and dan Ackroyd, who plays a character named mother
Speaker 1: Ben Kingsley is in it Um. A ton of folks.
Speaker 1: River Phoenix was in it Um, and it's a It's
Speaker 1: a movie about a group of kind of almost like
Speaker 1: outcasts who have grouped together to form a company that
Speaker 1: they specifically do this. They try to infiltrate a company
Speaker 1: in order to test its security, not to exploit it,
Speaker 1: but rather to tell the company, hey, here's how we
Speaker 1: got in, here's how someone else could get in, So
Speaker 1: you need to plug this vulnerability. That kind of thing um.
Speaker 1: And then of course they get involved in all sorts
Speaker 1: of shenanigans. And in case you are interested in the methodology,
Speaker 1: I actually find it very very interesting how they get
Speaker 1: their work done, because of course they have to go
Speaker 1: through the tennis match of back and forth with a
Speaker 1: brand name company, whatever it might be. So they'll have
Speaker 1: to get a purchase order. They'll do a little bit
Speaker 1: of negotiation for an amount that they'll do the work for,
Speaker 1: and then they'll go in and they'll gather information on
Speaker 1: the network and they'll capture traffic, and they'll try to
Speaker 1: find any kind of vulnerabilities that are on that network,
Speaker 1: even with the people too. For example, they could use
Speaker 1: social engineering to get into the server rack uh physically,
Speaker 1: or they could get into a network that doesn't necessarily
Speaker 1: have a very good password on it. UH. They could
Speaker 1: email clients that work there that are employed at the
Speaker 1: brand name company with I don't know malware written PDFs
Speaker 1: for example, and they could use wireless attacks. They could
Speaker 1: do war driving from the parking lot if they wanted to.
Speaker 1: And then what they'll do, it's right, a very very
Speaker 1: long report so that the brand name company can see
Speaker 1: exactly what happens on their network and exactly what they
Speaker 1: were able to do. From from whatever back door they
Speaker 1: were able to get into. It's really interesting how how
Speaker 1: well they're able to put everything together in in turn
Speaker 1: hopefully save this company in the long run thousands and
Speaker 1: thousands of dollars. Yeah, yeah, I mean this is the
Speaker 1: whole Security has always been a tick talk approach. Right.
Speaker 1: You've got the tick, which is where someone has identified
Speaker 1: a way of exploiting a system, and then the talk
Speaker 1: is where you find a way to correct that that vulnerability.
Speaker 1: The tick is the next time someone's found of vulnerability. Uh,
Speaker 1: you're always going to have that, right unless someone somehow
Speaker 1: designs the absolute perfect system, which as far as we
Speaker 1: know is an impossibility. Yeah. That's yeah, because for one thing,
Speaker 1: if people are involved, there's no such thing as a
Speaker 1: perfect system. It's always a battle. And I love my
Speaker 1: video games, so I love a battle. But it also
Speaker 1: drives other other industries though, because we'll see things like
Speaker 1: the artificial intelligence industry improve as a result of this
Speaker 1: security battle between hackers and uh, the infosec experts who
Speaker 1: are trying to make sure that their protecting systems. And
Speaker 1: as a result, we're we're getting information that can be
Speaker 1: used in other areas, which is phenomenal, Like I remember,
Speaker 1: here's a simple one. It's it's as far as security goes.
Speaker 1: This is as low level as it gets. But the
Speaker 1: capture system. So when cap when capture was implemented, even
Speaker 1: the people who were writing capture at the time, we're
Speaker 1: not really thinking of it as being some sort of
Speaker 1: full proof security system to make sure that bots don't
Speaker 1: get into a system, right. They weren't thinking, oh, now
Speaker 1: only human beings can get access. And if you don't
Speaker 1: know what a capture is, anytime you get your filling
Speaker 1: out a thing and you get a little picture of
Speaker 1: something and it says, uh, tell, you know, write down
Speaker 1: the word or numbers that are in the picture, or
Speaker 1: even to a point of identify the pictures in this
Speaker 1: sequence that have this particular feature, like identify all the
Speaker 1: pictures that have a lake in it or something like that.
Speaker 1: That's a simply that's simply a version of capture. Um.
Speaker 1: The people who made it, they actually said, our goal
Speaker 1: was really to help push artificial intelligence, because we created
Speaker 1: a system where programmers or hackers had to start coming
Speaker 1: up with uh, computer programs that could identify the same
Speaker 1: things that we humans can identify, and in turn that
Speaker 1: means now we've got software that pushes forward artificial intelligence. Now, granted,
Speaker 1: that also means you have to improve the system you
Speaker 1: had designed to keep bots out in the first place.
Speaker 1: So again it goes to that TikTok. But there's an
Speaker 1: added benefit beyond someone being able to to automatically access
Speaker 1: systems and build you know, dozens and dozens of fake
Speaker 1: profiles on Facebook or whatever it might be, whatever that
Speaker 1: might be. Yeah, yeah, And and keep in mind, like
Speaker 1: like we've been saying here, I mean, any any system,
Speaker 1: security is only as strong as its weakest link. That
Speaker 1: weak is pretty much always people. That's the big one, right.
Speaker 1: But I mean I've I've read stories about hacker gaining
Speaker 1: access to a system because there was an overall security
Speaker 1: system that was really robust for the main company, but
Speaker 1: then they had a little branch office and the branch
Speaker 1: office didn't have that crazy amount of security but was
Speaker 1: still on the same network. I think I read about
Speaker 1: that story too, So I mean, these are these are
Speaker 1: things like if you identify a potential point of weakness
Speaker 1: that's now suddenly the you know, it's it's like a
Speaker 1: bank vault. If the bank vault has an enormous door
Speaker 1: with huge locks on it that you have to get through. Oh,
Speaker 1: but it also has a backdoor. Just for convenience sake,
Speaker 1: you're gonna aim for the back door. So, but there
Speaker 1: are other ways that that hackers can can make a
Speaker 1: legitimate living that don't even involve testing security systems. It
Speaker 1: might involve education. Yeah, absolutely so education is I guess
Speaker 1: what you would say, I fall into that kind of category.
Speaker 1: And while I I don't necessarily like to call myself
Speaker 1: a hacker because I know so many experts in the
Speaker 1: field who are much more knowledgeable than I am. I'm
Speaker 1: quite a intermediate, I would say, but I love to
Speaker 1: teach and I love to give tutorials online, so I
Speaker 1: give tutorials on YouTube. But I also know a lot
Speaker 1: of people who have either written books about hacking UH,
Speaker 1: and they could do either specifics about penetration testing or
Speaker 1: they get to make it a very very wide based
Speaker 1: book where they explain everything that you would have to
Speaker 1: do as a penetration tester. And a penetration tester is
Speaker 1: basically one of those guys that would go into a
Speaker 1: company and UH find all the vulnerabilities and report on it.
Speaker 1: You would also have companies that administer certifications. So a
Speaker 1: lot of I'm sure a lot of your your UM
Speaker 1: listeners probably know that you have to get certifications to
Speaker 1: get a lot of uh A, to get into a
Speaker 1: lot of the fields with computer security and even just
Speaker 1: you know, computer networking too. There's a lot of searts
Speaker 1: for those and they're very, very expensive. So a lot
Speaker 1: of companies just administer their certifications or they'll will have
Speaker 1: you take classes for a period of time until you
Speaker 1: actually take the test and get certified. But that ends
Speaker 1: up being a really good thing to put on your
Speaker 1: resume for a lot of companies whenever you do intend
Speaker 1: to get a job in network security. And then lastly,
Speaker 1: we have the publishers. So that's the YouTubers, the that's
Speaker 1: the people that make podcast That's the people that UM
Speaker 1: might be creating other forms of entertainment that not only
Speaker 1: educate but also entertain their users and their listeners so
Speaker 1: that they get excited about being a part of information security.
Speaker 1: Uh And that's what I like to do. I like
Speaker 1: to teach people in a way that makes it exciting.
Speaker 1: So I do a lot of hands on stuff. I
Speaker 1: I make, I make jokes, and I explain things in
Speaker 1: a very natural light, and it helps, it helps again
Speaker 1: foster that desire to learn how things work. Right. That
Speaker 1: does so again that that same fascination, Like if you
Speaker 1: were ever a kid that took apart a watch or
Speaker 1: a radio or some other piece of equipment, because you
Speaker 1: really want to know what's the magic that makes this
Speaker 1: thing do what it does? Uh, hackers have that. I mean,
Speaker 1: that's the that's that's the defining quality in my mind
Speaker 1: of a hacker is ultimately it's someone who is fascinated
Speaker 1: with the way something works. Uh. We've largely been focusing
Speaker 1: on software, but that is just as legitimate as any
Speaker 1: hardware hack. It's the idea of how does this It
Speaker 1: might not even just be the software, might be a
Speaker 1: full system, like how does this system work? What are
Speaker 1: all the interlocking parts? How do they communicate with each other?
Speaker 1: I just had a random memory from when I was
Speaker 1: younger and in school. I took apart my first iPod
Speaker 1: because I had no clue how it worked, and I
Speaker 1: was very curious about what what the interior of it was.
Speaker 1: So I just I took it apart. I could have
Speaker 1: put it back together, So I was not hacker in
Speaker 1: any sense. We um we for for an article I
Speaker 1: was writing. We got a first edition launch day Nintendo
Speaker 1: three D s and it was my job to disassemble
Speaker 1: it and take photos of all the pieces. So first
Speaker 1: I took a picture of it whole and shared it
Speaker 1: online on Twitter and said look what I have, and
Speaker 1: everyone got excited. And then by the end of it,
Speaker 1: I had a little had a little black cauldron at
Speaker 1: my desk that was left over from a Halloween thing,
Speaker 1: and then I put all the different pieces because there
Speaker 1: was no way this thing was going back together after
Speaker 1: I took it apart. For one thing, Nintendo is pretty
Speaker 1: careful about sealing stuff in such a way that it's
Speaker 1: not meant to come amart so um, so you have
Speaker 1: to hear. It was a little force in some cases
Speaker 1: in order to get to stuff. And then I showed
Speaker 1: a picture. I'm like, I'm like, look what I did
Speaker 1: to the thing. I made the entire internet cry. Yeah,
Speaker 1: although ultimately I think the three DS most people are like,
Speaker 1: oh whatever, But at the time when it was brand new,
Speaker 1: people were freaking out. And of course there's there's also
Speaker 1: another role for for hackers out there. It may not
Speaker 1: be a steady gig, but we are seeing more and
Speaker 1: more of the Hollywood productions out there actually talk with
Speaker 1: people in the industry so that the depictions that we're
Speaker 1: getting are more accurately reflecting what really happens. Mr. Robot
Speaker 1: is probably the example that immediately leaps to my mind,
Speaker 1: and that it's it's a show that tries very hard
Speaker 1: to take a more realistic approach to the world of hacking,
Speaker 1: as opposed to um you type in three passwords, the
Speaker 1: third one gets you in, and then you're navigating through
Speaker 1: a vector graphics three D dungeon and you encounter a
Speaker 1: skull and cross bones. That's not how hacking works. It
Speaker 1: sounds like you were talking about hackers hacked the planet
Speaker 1: might have been. I should mention too, with education, just
Speaker 1: to bring it back a bit. Professors. I didn't leave
Speaker 1: you guys out. I'm sorry. I love you guys. You
Speaker 1: are the reason why I'm here now. If I didn't
Speaker 1: take my computer courses in college with my professors, I
Speaker 1: would not be doing what I'm doing now. So professors
Speaker 1: are like at the top of that education list because
Speaker 1: and you can take a lot of computer security courses
Speaker 1: in college and sometimes in high schools if you're lucky.
Speaker 1: But yeah, technical assistance. So technical assistance are people that
Speaker 1: will come on board with a Hollywood movie or a
Speaker 1: TV show or what have you, and they will explain
Speaker 1: to the network how the hacking actually happens. So I
Speaker 1: know a few uh they will They'll come to some
Speaker 1: of their hacker friends or they will be a hacker
Speaker 1: themselves and they will say, okay, uh in this season,
Speaker 1: I know that they want to do X, Y and
Speaker 1: Z on camera, and I need to make it look legitimate,
Speaker 1: so they will come up with the script. They will
Speaker 1: come up with the hack and the actual keyboard commands
Speaker 1: that the actor has to type in on camera so
Speaker 1: that they are actually doing legitimate hacks. So that way
Speaker 1: they're not only making it look cool for a wider
Speaker 1: audience because an audience is actually going to see how
Speaker 1: a hack works, but they're also getting that credibility with
Speaker 1: the info set community too. So Mr Robot is huge
Speaker 1: with the infoset community because it is legitimate. Like I've
Speaker 1: watched several of those episodes and I've seen a lot
Speaker 1: of the hacks that they do. They've even used some
Speaker 1: of our Hack five products on the show, and they're
Speaker 1: actually using legit hacks and it is so much fun
Speaker 1: to see it on TV and see them get so
Speaker 1: many good reviews from a wider consumer audience, because it
Speaker 1: makes me feel like many more people are getting interested
Speaker 1: in info sex because they see what's happening on camera
Speaker 1: and they see that this is actually how you do it. Yeah,
Speaker 1: it's nice to see it go beyond. Uh. The the
Speaker 1: niche that I would argue in po sak and hacking
Speaker 1: has largely inhabited for the past three decades, right, the
Speaker 1: people who have been interested. When it first started, it
Speaker 1: was essentially your hobbyists, and often those hobbyists were isolated individuals. Uh.
Speaker 1: You got to the phone freaking days where there was
Speaker 1: a little bit of a small subculture of people who
Speaker 1: were interested in hacking the telephone system using all sorts
Speaker 1: of stuff, including a whistle from Captain Crunch. Uh. You
Speaker 1: had you had the the early hack days where people
Speaker 1: were just trying to create interesting programs for their computers
Speaker 1: or to see how some of the programs that were
Speaker 1: coming out, how did those work? Um, But it was
Speaker 1: largely a tiny slice of the folks who were even
Speaker 1: aware of personal computers, and and even that group was
Speaker 1: still a tiny slice of the overall population. We're seeing
Speaker 1: that tiny slice grow over time, and largely because so
Speaker 1: many of us are so dependent upon computers these days
Speaker 1: that it benefits us to have an aware is to
Speaker 1: make sure that we remain safe, but also because of
Speaker 1: things like Mr Robot showing how this works and sparking
Speaker 1: the imagination of people who perhaps before they saw that,
Speaker 1: never thought, yeah, it's kind of cool. I would love
Speaker 1: to be able to manipulate code in such a way
Speaker 1: that I could do something new or unexpected or help people. Uh.
Speaker 1: And it's really encouraging to see that kind of thing
Speaker 1: happen right now. I kind of wish it had happened
Speaker 1: ten years ago, but I love seeing it happen now. Same.
Speaker 1: I actually feel like there was a little bit of
Speaker 1: negativity in in the aspect that we we used to
Speaker 1: have all these really fancy graphics happening on in these
Speaker 1: Hollywood movies and these TV shows, and now they're actually
Speaker 1: seeing the reality that is hacking, and it is not
Speaker 1: super colorful. It's not super quick, fast paced and exciting
Speaker 1: like it looks like it is on those old school shows.
Speaker 1: So I'm hoping that now that they're actually seeing it,
Speaker 1: people will try it too. Like if they see, um,
Speaker 1: the main actor on Mr Robot do a specific command
Speaker 1: line option, they'll go to their computer and try it
Speaker 1: themselves and see that it actually does work, and then
Speaker 1: they'll be like, oh, I really want to try some
Speaker 1: new stuff too, so they'll start googling in and see
Speaker 1: what else they can find out. That's the kind of
Speaker 1: inspiration that I wish happened thirty years ago, and it didn't,
Speaker 1: So I want to see more of that now, and
Speaker 1: I'm really happy that, for example, Mr Robot has done
Speaker 1: a great job with it. Yeah, it's it's and you
Speaker 1: not to not to poop all over Hollywood because I
Speaker 1: do loves mo Hollywood's but but it is. And to
Speaker 1: understand where they were coming from, they were trying to
Speaker 1: find a way to create an exciting visual depiction of
Speaker 1: something that doesn't necessarily necessarily lend itself to that in
Speaker 1: order for to create a dramatic effect. So I get it.
Speaker 1: It's very similar to the way Hollywood per trade virtual
Speaker 1: reality back in the nineties, way before virtual reality was
Speaker 1: ready for public consumption, and it's what largely killed VR
Speaker 1: for a decade before the various video game systems started
Speaker 1: to make the very the components cheap enough for people
Speaker 1: to play in that space again, and now we're on
Speaker 1: the verge of another VR revolution. The same sort of
Speaker 1: thing is true of hacking, Like, how do you show
Speaker 1: hacking in a way that gets across what is happening
Speaker 1: to an audience and makes it interesting? I think largely
Speaker 1: you have to do that through really good writing of
Speaker 1: your characters, and once you do that, then everything else follows.
Speaker 1: I think if if you can show that the characters
Speaker 1: in a movie or in a TV show are actually
Speaker 1: real people that have real relationships, they have real jobs
Speaker 1: and real lives, and they have hobbies outside of just hacking,
Speaker 1: you can really you can start to relate to that
Speaker 1: character in a very real sense in the fact that, hey,
Speaker 1: they are humans too, because hackers are people too. That
Speaker 1: was actually a documentary nice. Yeah, because again, when when
Speaker 1: you're when you're thinking about it in the abstract, you're
Speaker 1: really it becomes that us versus them mentality, where by
Speaker 1: by its very nature, it's dehumanizing. But that's probably a
Speaker 1: topic for a show that's not about technology, So I
Speaker 1: will just leave it be. Shannon Morse, thank you so
Speaker 1: much for joining me today. Please let everyone know where
Speaker 1: they can find all of your stuff. Jonathan Strickland, thank you.
Speaker 1: So it was a little, it was a little, it
Speaker 1: was a little laden. Yeah. Yeah, I've been watching Star
Speaker 1: Trek lately, way way too much Start Trek, so you
Speaker 1: can find me. Um, the most direct path is on Twitter.
Speaker 1: I'm at snubs and that's s n U b S
Speaker 1: and then my shows, specifically Our Tech Thing over at
Speaker 1: t e K thing dot com and Hack five over
Speaker 1: at h K five dot org. Yeah, so go check
Speaker 1: those shows out. They are awesome. Shannon and her co
Speaker 1: hosts are all awesome. I gotta get I gotta get
Speaker 1: Darren on the show. Yeah, no, you are cooler, but
Speaker 1: someday I gotta get Darren on the show. Um. I
Speaker 1: don't think Darren and I have ever I think we
Speaker 1: may have been on one of tom Merritt's shows at
Speaker 1: the same time, but otherwise I don't think we've ever
Speaker 1: done a show together at any rate. Yeah. I know,
Speaker 1: it's crazy, right, I've known forever happen. Let's let's do that.
Speaker 1: Let's do that. So, guys, if you have any thoughts
Speaker 1: on this subject, or you have any requests for future episodes,
Speaker 1: or you have questions comments that kind of thing let
Speaker 1: me know, send me an email that address is tech
Speaker 1: stuff at how stuff works dot com, or dropped me
Speaker 1: a line on social media. You can find me on
Speaker 1: Twitter and Facebook with the handle text stuff h s W.
Speaker 1: Thank you so much for joining us, and I'll talk
Speaker 1: to you again really soon. For more on this and
Speaker 1: bathands of other topics of how stuff works dot com