Transcriber: Annet Johnson Reviewer: Anna Sobota
Allow me to pose a question:
“Is there a different way?”
That is a question that hackers ask every single day.
Now, you’re likely already familiar with the concept of malicious hackers:
the entities who attack companies, governments, schools, and hospitals.
But, you might not be familiar with their opposing force:
ethical hackers.
Ethical hackers use all the same tools, techniques,
approaches, and methods as the bad kind of hackers,
but they do so in order to improve the security of a system
rather than to exploit it.
That’s the world that I come from.
My name is Ted Harrington and I lead a group of ethical hackers.
We’ve hacked everything from cars to phones, medical devices,
password managers, dating apps, movie productions, IoT devices,
and a whole lot more.
Companies hire us every day to hack them
in order to help them build better, more secure systems.
And one thing that I have learned from all that hacking experience
is that your life will be better, if you think like a hacker.
So what does that mean?
What does it mean to think like a hacker?
Well, pretty much all hackers of both the good kind and the bad kind
share at least three mindset traits:
hackers are contrarian,
hackers are committed,
and hackers are creative.
So if you think about your own life and whatever it is that you’re pursuing
or trying to achieve, maybe you're stuck.
Maybe you’re facing resistance or an obstacle.
Maybe someone’s telling you no.
And you’re looking for ways to overcome those barriers.
Or maybe you’re simply looking for a better way to achieve your goals.
Well, if you can think like a hacker,
what that does for you is it helps you think about your situation differently.
And when you think about your situation differently,
that reveals new pathways to achieve your goals.
So the first way to think like a hacker is to be contrarian.
Contrarians reject conventional thinking.
They reject norms.
Contrarians identify the assumptions that most people have
about how you might approach a situation.
And then they challenge those assumptions
and they question whether they’re flawed or maybe even wrong.
Contrarians approach scenarios
wondering if they can do it the exact opposite way that everyone else does.
For example,
have you ever stood in a line?
Well, obviously, I know every single one of you has stood in a line.
The question, though, is
have you ever stood in line and wished you didn’t have to?
Well, I certainly have.
I once went to a bar to celebrate a friend’s birthday.
Unfortunately, when I got to the bar, there was a really long line to get in.
I just didn’t want to wait in that line.
I wanted to be inside spending time with my friends.
So I approached the situation with some contrarian thinking and I said,
“Is there a different way?”
And as I assess the situation, I realize that, of course,
there’s the conventional line that most people wait in
in order to get into the bar.
But there was another way.
There was a VIP entry.
The VIP entry didn’t have a line and didn’t have a wait.
So my goal now became to figure out how I could get in through the VIP entry.
So here’s what happened.
I walk right up to the VIP hostess and I said,
“Hi, I’d like to come in this entry.”
Admittedly, pretty bold for someone who does not have the permission to do that.
And she says, “Cool, well, are you on the list?”
I said, “No, I’m not on a list, but I’m here to celebrate my friend’s birthday.”
And she said, “Oh, great. Well, is your friend on the list?”
And I said, “Actually, I’m not sure.
But wouldn’t it be better if I was inside celebrating and spending money right now?”
Now, I don't think anyone had asked this hostess this question this way before,
so she was a little bit taken aback by it.
So she paused for a moment to think about it.
And then, somewhat to my surprise, she said, “You know what?
That does sound better.”
(Laughter)
And wouldn’t you know it,
she opens the velvet rope and ushers me into the bar.
(Laughter)
The only way I could have arrived at that outcome
was because I approached it like a contrarian.
I rejected the conventional method and I saw it a different way.
Now, I get it.
That story’s pretty silly.
It doesn’t matter.
We are not talking about life and death.
But the story clearly illustrates the power of contrarian thinking.
So whatever you’re working on:
maybe you’re trying to get a raise or a promotion at work,
maybe you’re trying to raise money for a cause that you care about,
or maybe you’re trying to launch an initiative.
Be a contrarian.
Start by identifying how you think about it.
Start by identifying the assumptions that you hold
about how you’re supposed to approach that endeavor
and challenge those assumptions.
Is there a flaw in the assumption?
Is it wrong?
Explore if you can do it the exact opposite way
of the way you’re doing it right now.
Hackers are contrarian and you should be too.
So hackers are contrarian and hackers are also committed.
By that what I mean to say is that hackers are motivated.
They’re on a mission
and they’re willing to invest the time, effort, money,and resources
to pursue that mission.
Now, the motivations might be different.
The good kinds of hackers,
those of us from the ethical hacking community,
we’re motivated to improve the security of a system.
While, by contrast,
the bad types of hackers are motivated by a variety of motivations:
they could include the desire to make money, make a statement,
or make a name for themselves.
But whatever the motivation, the point is hackers are committed to it.
Simply put: hackers don’t quit easily.
Let me illustrate with a story about hackers being committed.
We were once exploring the thought exercise,
“What is the worst thing that could happen as the result of a security breach?”
Now, I’m in the fortunate position
that I get to work with some of the most brilliant and creative people.
So the list we came up with was pretty long.
A lot of bad stuff on this list,
but one really stood out in particular.
And that was that it would be pretty bad if as the result of a security breach,
a human being was injured.
That led us to start thinking about health care,
because the delivery of care relies so heavily on technology.
That begets the question, “If the technology gets popped,
does that mean that a human being is going to get hurt?”
What followed was a piece of security research
that took a little over two years to complete.
But here’s the interesting wrinkle about that timeline:
of those two years,
almost a full year of it was spent just trying to get access.
We spent a year just trying to convince these health care organizations,
the hospitals, the medical device makers,
and all the other members of the health care ecosystem,
to let us do it.
It’s not like we were charging for it; we were going to do this for free.
This was research.
We wanted to study a problem and publish it.
But we were told no in every conceivable way you can imagine.
But we persisted, because it mattered.
Eventually, we were able to get more than a dozen health care organizations
from all across the United States to participate in this study.
And I’m so glad that we persevered because the results were shocking.
We found countless ways
that attackers could cause harm or even fatality to patients.
For example, one such scenario involved what's called the patient bedside monitor.
This is a device that every single one of us are familiar with.
It sits right next to the bed in a patient’s room
and it reports on the patient’s vital signs, like oxygen level or heartbeat.
We discovered that an attacker from anywhere in the world
could access the device.
They could then bypass authentication.
That means effectively they could log in without needing to log in.
Then they could perform what’s called remote code execution.
That means that an attacker could issue a command to the device
and the device would react to it.
Essentially, that means the attacker could get the device to do
whatever the attacker wanted it to do.
One scenario would be the attacker could disable alarms.
Imagine a patient who is suffering an irregular heartbeat.
That should signal an alarm to the central nursing station,
so the nurse can come and administer care.
But with the alarms disabled, the nurse wouldn’t know.
A patient who’s suffering an irregular heartbeat
or potentially a heart attack and does not get the care that they need
is at a minimum going to suffer, probably get hurt, and possibly die.
It took us two years to arrive at that outcome.
And we found many, many, many outcomes like that.
That's what I mean when I say that hackers are committed.
They’re willing to invest the time, the money, the effort, the resources
to pursue their mission.
The outcome of that story was a good one.
This was security research.
We were able to report the issues back to the manufacturers so they could fix it,
but the point remains the same.
We were committed to a mission.
So whatever it is that you’re working on:
if it matters to you, keep going.
You are going to run into resistance.
You’re going to see setbacks.
People are going to tell you no.
Keep going anyway.
Hackers don’t quit easily and neither should you.
So, hackers are contrarian and hackers are committed.
But perhaps above all, hackers are creative.
In fact, hackers are amongst the most creative people that I know.
They’re original, they’re inventive, they’re innovators.
Hackers are constantly exploring new ways to approach different situations.
And a lot of times those new ways have never been thought of before.
That's what makes them so successful.
Let me illustrate with a story about a hacker's creativity.
One of our hackers once came to me
very excited about a project that he was working on.
And he said, “Ted, I have successfully predicted the key.”
Now I’m in the field, so I understood why that was a problem.
But I’m always seeking simplicity and clarity.
So I asked him to explain and I said, “Why does this matter?
Why should my grandmother care?”
He said, “Well, because like most systems, the unpredictability of keys
is one of the crucial elements of what keeps a system secure.
I shouldn’t be able to guess them.”
And then I asked again.
I said, “Explain unpredictability to me.”
He thought about it for a second and he said, “Imagine it like this.
Let’s say you go to the beach, you pick up a grain of sand,
and then you throw the grain of sand back.
Then I go to that same beach and I pick up a grain.
How likely is it I picked up yours?”
I thought about it for a second and I said what I imagine most of us are thinking
which is, “That sounds pretty impossible.”
And he said, “Exactly, except now multiply that by every beach on Earth
and multiply that by a billion gazillion Earths.”
I mean, he literally said “a billion gazillion”
as if that was like a number I could comprehend.
He says, “That’s how unlikely it is that I would be able to predict a key.”
And then he paused for dramatic effect.
And he said,
“But I just did it 732 times.”
That is wild!
That’s like he walked into the middle of the Sahara Desert
and he found my grain of sand hundreds of times.
Should be impossible.
So how did he do it?
It turns out, here’s what he did.
Pretty much any system at some point is going to fail
and when it does it will have a process whereby it handles those errors.
He looked at the error handling process
and from that was able to deduce a method where he could predict the key.
That is creative.
I mean, think about that.
Who would have thought to look at the way a system failed
as the way to be able to predict the unpredictable?
That’s what hackers do.
Hackers are creative.
As you think about whatever it is in your own life that you’re trying to achieve,
roll out your own creativity, be original, be inventive.
Look at the problem inside out and upside down.
Hackers are creative, and you should be too.
So,
I pass the baton to you.
Ideas are only as good as the action we take on them.
So I urge you,
I beg you,
think like a hacker.
Be contrarian,
be committed,
and be creative.
When you do these things,
it helps you think differently about whatever it is you’re trying to achieve.
And when you can think differently,
that reveals new pathways to achieve your goals.
These principles work for hackers,
they’ll work for you too.
Thank you.
(Applause)