- [Kevin] Hackers are everywhere. From Ashley Madison to JPMorgan, from Jennifer
Lawrence to the federal government, our biggest celebrities, corporations,
and institutions have all been the targets of devastating cyber-attacks. I wanted to see
how bad a hack can get, so I invited a few of the world's best hackers to try to hack
me and show me where my vulnerabilities are. And now, I'm going to meet them in
Las Vegas at DEFCON, the biggest hacker convention of the year, and see what they
found. This might have not been the best idea.
- DEFCON is the biggest hacker convention of the year. It’s a place
where thousands of hackers come to hear talks, to demonstrate their newest hacks.
It's actually a place that's so dangerous to be on the internet, that they tell you
to turn off the WiFi and the Bluetooth on your phone and they tell you not to use
the ATMs too, because those could be hacked as well.
- This is the DEFCON ballroom. It's the main room where things are
happening and it's pretty wild. I think this is car-hacking village. This car is
locked, can you get me in?
- I'll unlock it for you. Should be good.
- Hacking is no longer this fringe activity, and if you are at
DEFCON, there's a good chance that you're here because you want to learn what could
happen to you or your company.
- [Chris] Anyone here for the first time in the SECTF?
Holy crap.
- I invited Chris to hack me with his team, but they're going to hack me
using social engineering, which is essentially hacking without any code.
They've just used a phone and an internet connection.
- We help people with human security issues by testing
vulnerabilities, like a network test but it's for the people network. We test those
vulnerabilities, see where the holes are and then help people learn
so they could patch them.
- Can we try some of this? Can we try some--
- Yeah-- - See if it works?
- We could have our star visher here make phone calls as your girlfriend.
- You want to do a sample vishing call? - What's vishing?
- Vishing is voice solicitation and basically what you do is you use the
phone to extract information or data points that can be used in a later attack.
- Let's do it. Who are you going to call?
- Maybe I'll call your cell phone provider?
And see if I can get them to give me your email address.
- I bet they're good. I bet they have my back.
But yeah, go for it.
- I'm going to spoof from your number so it's going to look like it's
calling from you. - Okay.
- Hi, I'm actually so sorry, can you hear me okay? My baby-- I'm sorry. My
husband's like-- we're about to apply for a loan and we just had a baby and get this
done by today so I'm so sorry I can't call you back. [laughing] I'm trying to log
into our account for user information and I can't remember what email address we
used to log on to the account. The baby's crying and-- can you help me?
- Awesome.
- In just 30 seconds, Jessica gets my personal email address.
- Now, if I needed to add our older daughter on our account so she could
call in and make changes, how would I need to go about doing that? You would have to
send me a secure PIN through a text message? The thing is I don't think I'll
be able to receive a text message if I'm on the phone. Oh, I'm not on there either?
So I thought when we got married, he added me to the account. Okay my name is...
- Jessica uses my girlfriends name and a fake social security number to set
up her own personal access to my account.
- Wait I'm sorry, so there's no password on my account right now?
Can I set that up?
- She even gets the support person to change my password.
- Thank you so much for your help today...
- So she just basically blocked me out of my own account.
- I'll get her fed after this. All right, thank you.
- Holy shit. So they just gave you access to my entire cellphone account.
- You're going to have to go on and change your password now because
it's ‘Jess', my name.
- And all it took was a crying baby and phone call.
- Yes.
- I really thought that my cell phone company would protect me. I
mean, this is the most basic stuff and they're not doing it. And if they're not
doing it, you know all these other businesses aren't doing it either.
- Anyone with a phone and an internet connection can do social
engineering. But I was curious, what can a hacker with serious coding skills do?
- [Dan] Well DEFCON is the world's biggest hacking convention. It's hacking
everything. Hacking social, hacking software, hacking various systems.
- I asked Dan Tentler, a well-known security researcher, to turn
all of his firepower on me.
- I did get into quite a number of things that I found.
- So what were the first things that you did? How did you start hacking me?
- I quickly found your Squarespace blog and had an idea. Basically what I did
was created a bogus Squarespace site and sent an email to you, a phish, asking you
to go to this website and run the certificate installer.
- And I did it, because I'm an idiot.
- So once you ran that, it gave me access to your computer and I created
several fake pop-ups that looked like system pop-ups that would
ask you for your credentials.
- You didn't even have to have my passwords.
- No, you gave them to me. - I gave them to you...
- Yeah, so I stole your 1Password keychain--
- That password is where I store all my other passwords, so effectively by--
- And your social security number and your Amex stuff and all your stock
trading and bank information. I can send email to everyone in this room as you. I
am you right now if I wanted to be. If my evilness is working correctly, it should
actually be taking pictures of your desktop pictures through your webcam every
two minutes, and I have been watching you for about two days now. In coffee shops,
at your mom's house, on a plane. Here's your editing stuff, there's you--
- Oh my god, so this is literally...
- Every two minutes. - Through my webcam.
- Yeah. Through this guy.
- How badly could you have messed up my life?
- I could have made you homeless. I could have made
you homeless and penniless.
- How? How would you make me homeless?
- Like I have control of your digital life in its entirety. I have all
your credentials. I have all your access to all your financial information, all
your work information, all your personal information. I can pay people with your
bank account or your Amex account. I am you. I can fully impersonate-- the only
thing I couldn't doctor would be your fingerprints.
- This is like as bad as it gets. - It's ridiculous, yeah it's bad.
- So it turns out that Dan Tentler is very good at his job. I mean, he hacked
the hell out of me. He got everything. I mean, frankly, I want to take my computer
and throw it into the deepest part of the ocean and I want to become a hermit and I
want to never touch a piece of technology again because holy shit, that was
everything. That was the keys to my entire life
and he just pulled them out of his pocket.
- But even if I did keep my passwords and my bank accounts safe, I can
still be in danger from hacks because with factories, power plants, and other major
infrastructures being controlled by network computers,
the world itself is hackable.
- I'm going to meet Marina Krotofil. She's studying hacking chemical
plants. She's thinking about, what happens if hackers decide to go after
infrastructure. But this is the kind of hacking that could
really ruin an entire country.
- Who should be worried about chemical plant hacking?
- [Marina] Well pretty much every plant. Because big business means big money. So
the hackers are always where the money are, so it is a good target. So for
example the most common cause is extortion. A large number of extortion
attacks has happened already. And our critical infrastructure is vulnerable.
- So let's just say like a nuclear power plant could have a big accident and
they think: our machine just malfunctioned, our safeguards didn't work,
but it's actually someone hacking.
- Yes, but the worst case scenario is if it will be an incompetent
or unskillful attacker who doesn't understand what he is breaking in and they
will do something with a large or extensive collateral damage. But probably
most scary is hacking the satellites, because now everything navigates with a
GPS. So basically even the huge oil tankers in the sea, they are completely
navigated automatically by the signals from the satellites. So by simply
disrupting the satellite signals, you can lose an entire tanker
or the aircrafts can collide.
- And to me, it seems obvious like this is how war will be conducted in the
future. But it's much easier than sending a million ground troops in or buying drones
to fly over an enemy state. We're certainly looking at the future of not just
infrastructure, but global conflict.
- There's almost too much for me to worry about here. I almost just feel
numbed. People keep telling me, oh this could get hacked, oh that could get
hacked, and this other thing can get hacked. Chemical plants can get really
hacked! And at some point, I got to get out of bed in the morning, so I have to find a
way to make myself a little bit better about all of this.
So I'm meeting Morgan Marquis-Boire, a cyber-security consultant
and the director of security at First Look Media. For some advice on
locking down my digital life.
- Should I be feeling helpless or can I help myself here?
- Do you worry about trained martial artists
beating you up on the street? - Not particularly.
- But you're aware that they exist. You're also aware that you probably
couldn't do anything about it if one of them wanted to beat you up in the street.
- Probably not.
- Right, and I mean you could actually possibly think about the danger
that hacking poses to you right now in much the same terms. The first step is
actually thinking sanely about digital security. Which most people don't do. So
for instance, How do we protect our physical integrity? Maybe we don't walk
down the dodgy alley at night, right? People who haven't spent any time thinking
about digital security, don’t actually know what the dodgy alleys of the internet are.
Like should I click that link? You know, maybe I shouldn't install this software.
- And I thought I was pretty good, like I thought I was--
- It's tough but chances that a skilled black-hat is deciding for no reason
whatsoever to attack you, is actually reasonably small. It begs the question
why? Right? You could hire security people to look after your online life but
you probably don't need to do that.
- We used to think of hackers as being fringe characters but now when
so much of our lives are lived on these connected devices, they're power brokers.
They can make or break us.
- I'm trying to log into our account...
- I stole your 1Password keychain...
- They know more about this stuff than anyone and that's a power
that's going to become increasingly valuable. We need to know where our flaws
are so that we can be safer. And I think the best thing to do is to enable them to
help us rather than shoo them away.
- Do you guys have any of those little things that you put over the camera
on your laptop?
- Paradoxically, I feel more secure now than I did last week because
now, at least, I know what I have to fix.