A professional digital detective
has dredged up my publicly available information,
but what about the online information that we assume is secure,
like financial details, credit card numbers,
health records, business correspondence?
When a business falls victim to a sensitive data breach,
the consequences can be particularly devastating.
In order to get a better idea of this threat, I'm going to face it head-on.
I'm going to get my Guardian computer hacked.
The first hacker struck at a live telegraph event in 1903.
John Fleming was not pleased
that prankster and magician Nevil Maskelyne
chose to insert insulting Morse code into his fancy demo.
Modern-day hacking started with a phone line.
Freakers, as they were known,
spent the 1970s making free international phone calls.
In 1981, however, the first freaker was convicted in the US for hacking,
but this hack helped to expose the holes in the phone system.
In 1988 the Morris worm hit an early version of the internet,
exposing vulnerabilities in this technology.
In 2000 the Love Letter worm
infected 10% of the world's internet-connected computers,
causing almost $9 billion in damages worldwide.
It was a casually created joke by two friends in the Philippines.
In recent years the new breed of geeks are being hired
by governments, financial systems and corporations
to both attack and defend.
I'm travelling to Las Vegas.
Here, annually, for the past 20 years international hackers gather
to show off their skills and exchange techniques.
We already know what can be learned about me through a legal search,
but what can be uncovered with specialist skills?
With my company computer I'm visiting two hackers,
Khalil from Beirut and Marton from Kentucky.
Can they hack my laptop?
What is the security situation like in the Middle East,
say, compared with Europe or the US?
I think the whole region is somewhere between 5 to 10 years behind,
as far as awareness of the importance of information security.
Mainly because the media doesn't really talk about it.
In the States, you turn on any TV channel
and there's a story about a big hack because these things are publicised.
Yes, I've just got an email from my director.
He says there's a good article on the front-page of the Guardian.
Oh, Lord, there's nothing but bad news down here, is there?
- That's the world for you. - It is, isn't it?
Except there's a cool picture from NASA.
As you're browsing through the Guardian,
I just stole your credentials, so I have your email address... .com
and the password is...
- A nice Guns N' Roses song. - Thank you very much!
I'm actually compromising your whole machine.
I could have downloaded files.
I could do a rickroll, which is redirecting your browser.
- Never Gonna Give You Up. - I just sent you to Rick Astley.
You did.
How did you crack my computer?
The website is not the Guardian.
It looks like the Guardian.
If you look at it carefully, which people don't really do, on the URL,
it actually says "theguardlian", so I added an "L" in there.
- But... - Yes, you did. You did?
- Yes, I... - It was added?
I registered the website, the guardlian.com.
- That's available? - It was. Not any more.
And so I cloned a live version of the actual Guardian website,
so you wouldn't know you're not there.
No, it looks exactly like the Guardian.
It's enough to take control of your whole computer
because you gave me access, just clicking on the link.
I clicked through to the link
from a person who sent me an email whom I trust.
Your Facebook and your LinkedIn is out there.
We can find out who you're associated with.
Then we can get their email out of their LinkedIn or Facebook.
It's a very easy fake.
Is it as easy to do this to company computers?
It's probably easier because out of 100 or 1,000 people,
it's more probable some of them will click the link.
Every year, international hackers converge in Las Vegas
to attend a series of conferences - Def Con, BSides and Black Hat.
Over a few weeks they exchange
the latest hacking and security tricks and techniques.
We're here in Vegas, kind of in the belly of the beast.
Are there any examples of this kind of exploitation
happening in the wild?
Sure, in the old days, and I mean five years ago,
we used to do a lot of USB-based attacks
where we would drop them around parking lots
and that was really common.
So what I want you to do is plug that in.
For one, you don't ever want to stick anything into your computer
that you don't actually know what it is.
At this point I can do anything I want to your computer.
I can do a key logger. I can download and upload files.
You can see here that we're here in the C:/Users/Aleksdirectory.
We noticed you have some business files and some personal files.
- I do, yes. - We'll download to our computer.
I don't want you to have that.
Now we can do a lot of things.
I could take screen shots from your camera.
- Of me? - Of you.
We can record the sound.
And then we're able to download a file to your computer.
It's moving.
And set it to your desktop background.
That's a fantastic picture, guys.
- I've been hacked. - Correct.
What about for corporations? How are they vulnerable with this?
We've done a number of penetration tests
where we've gone to our local computer store.
We've bought 10 or 20 keyboards and slotted one of these devices in
and packed them up and sent them to the company.
What we've done is put a fake letter in there that says,
"Hey, we're from HP. We want you to check out our new keyboard.
"We're hoping if we give you these 20 free models
"you'll buy 10,000 of them because they're so great.
"Try these out."
Nobody resists free stuff.
If you make it expensive enough and nice enough, people will use it.
But humans are humans. Is there anything companies can do?
It's awareness training.
You can have all the firewalls you want
and all the password policies.
If they get online and click on any link, then it renders all that moot.
Sometimes we have to sacrifice some convenience for safety.
If it's too good to be true, either in an email format
or something you found or something somebody sent you,
it probably is.
Wow! It was quite unsettling to see how easy it was to get hacked.
But the consequences of getting hacked aren't always destructive.
Sometimes it ends up exposing corporate vulnerabilities or flaws
that a business can address and improve upon.
From this hack, the Guardian will be more astute with domain registration.
In the next episode, I'll explore how to take control
when you lose control of your online image
and negative information about you or your business
ends up splashed all over the web.