Hacking with no technology

By Elinor Mills, CNET News.com
Tuesday, July 22, 2008 10:42 AM

NEW YORK--The typical image of a hacker is a kid hunched over his keyboard in the wee hours of the night staring at commands on his computer screen that unlock the secrets of the national government.

But, according to someone who knows better, the woman sitting next to you in the airport or Starbucks fiddling with her digital camera while you work on your company's confidential sales data could be just as dangerous.

One of the more fascinating talks at the Last HOPE hacker conference this weekend was by Johnny Long, a security researcher who hacks, writes books on hacking, and founded Hackers for Charity, which helps children and others in underdeveloped countries.

On Sunday evening, he told about an epiphany he had when he and a friend were thwarted in their attempts to get into a highly secured building. Long was ready to give up. But his friend had another plan. He got a coat hanger and a rag and proceeded to break the window in the door. He then reached in with the straightened coat hanger and the door opened up.

"What he had done was defeat this multimillion-dollar security system with trash," Long said. "The touch bar doesn't know the difference between a wet wash cloth and a hand."

The message? "There's a lot of room for...solving problems in simple ways," he said.

Some of those simple ways to get access to supposedly secured systems, such as buildings or computer networks, without using technology include: shoulder surfing, which is viewing exposed information on computer screens; dumpster diving; and if you cannot get in the front door, trying the smoker entrance where you'll be less likely to be interrogated.

Long showed photos of laptop screens he had managed to photograph in airports and other public places where executives and military officials were casually but unwittingly revealing confidential and sensitive information to anyone within a few feet. It is clear--nobody tries to hide what buttons they are pushing on pass code secured doors, even at the airport's TSA room, based on his ample photographic evidence.

You have to wonder, if Long could snoop so easily, what data can someone who is really targeting a source get at.

He showed photos of ATM, grocery store check-out and other public kiosks with error messages or in some other state that they could be easily compromised.

Long also talked about how easy it is to "sniff" a hotel's billing and room entertainment network over the cable system and view other peoples' room charges and activities, such as porn surfing, logging into banking accounts, and e-mail communications.

Then there are what he called the "Jedi wave" and "fed blend" techniques of getting past security guards and mingling with federal officials by wearing a fake badge and just acting like you belong.

Blending in is the key to getting access, he said. Wearing a uniform will get you in anywhere, and telephone repair, FedEx delivery, and other uniforms are readily available on eBay and other sites.

This article was first published as a blog on CNET News.com.


See also:  Hacking, Security
WORTHWHILE?

0

0 votes
Blog

Talkback 0 comments

There are currently no comments for this post.

Guest user

Guest user

Level: 
Joined: —
Already a member? Log in »



 

Loading...

Tech Jobs Now!

Secure ASP.NET sites with Membership API

Web Development

Beginning with ASP.NET 2.0, the Membership API was added to simplify adding security to a Web application. Find out how to use the Membership API with a SQL Server backend.


Read more »



  • HPC Applications

    Ever wondered if High Performing Computing systems really matter in our day-to-day world? Let Dr David Scott from Intel take you a for quick tour on developing HPC applications.
    Play video


  • Maximize IT Spend: Business Acceleration

    How do you ensure your IT solutions are well integrated and streamlined across your enterprise? Rajen from Oracle highlights the important considerations ...
    Play video


  • HPC Architecture: Explained

    Why is High Performance Computing increasingly in demand in today's businesses? Find out which is the most widely deployed HPC architecture today.
    Play video

Tags

  1. apple
  2. attacks
  3. botnet
  4. credit
  5. data
  6. details
  7. dns
  8. facebook
  9. fix
  10. flaw
  11. flaws
  12. fraud
  13. google
  14. iphone
  15. issues
  16. microsoft
  17. olympics
  18. oyster
  19. patch
  20. researcher
  21. researchers
  22. security
  23. spam
  24. storm
  25. team
  26. uk
  27. us
  28. users
  29. warns
  30. worm

ZDNet Asia Top Tech 50 to recognize Asia's potential

Blog thumbnail

The ZDNet Asia Top Tech 50 awards are back, and we're once again seeking nominations to identify the industry's best-performing tech companies.

The marketplace is crowded with players clamoring for..... by Eileen Yu

Read more »