(soothing techno music)
(car door slams)
(car alarm beeps)
(metal clanking)
- Yeah, barcodes,
invoices, and this is medical.
I mean, I'm not even going in, and I can grab this data.
I'm Jayson E. Street, I'm a hacker,
and I rob banks for a living.
I do pen testing.
It's like finding vulnerabilities
to better protect the client.
I'm wearing a DEFCON leather jacket
and red Thundercat tennis shoes,
and within two minutes and 22 seconds,
I'm behind your teller line,
and I go, "I walked in.
You've got a problem.
You may want to address that."
(dramatic music)
(cash register dings)
- If you ever look at a bank robbery,
when a guy comes up with a ski mask and a shotgun,
he doesn't usually end up having a great day.
But when I walk in with a jacket and jeans,
"I'm here with Microsoft.
I'm here to make the network faster."
I am telling you, their answer's going to be,
"Yeah, it is running a little slow.
What door do you need open?"
Computers are really good tools
to commit crimes with nowadays.
When you're doing a pen test,
you are trying to recreate the scenario
of an actual attacker.
I sit down with the client and tell them,
"This is what I would like to do.
I could like steal all your corporate secrets this way."
Then I do like a three-day engagement.
I spend like the first day or two
being the worst thing to happen to you
at the worst possible time in the worst possible way.
Usually, I can walk into a place
and just go, "Hi," and I'm in.
And I plug in my USB drive,
(USB drive chimes)
like a HAK5 rubber ducky.
It operates a code that can compromise the machine.
That's on easy mode.
But on that third day,
I come back with a representative of the company,
so the employees know that I'm legit
and then educate 'em on what I did and how I did it.
I'm trying to make sure everybody
is comfortable with what happened,
make sure they turn that into a positive lesson
instead of a negative one.
That's why penetration testing is so important.
Now if someone else goes in,
and they don't have authorization,
they're not going to be able to get in.
- And we're recording.
- Okay, see you in a little bit.
- 'Kay.
- Penetration testing is basically
a social engineering engagement.
Most employees have that voice
in the back of their head going,
"This ain't quite right."
"Could you let me in really quick?"
And they're looking at me,
and I can tell by their face
they know I don't effing belong there!
And then they go, "Okay."
They don't wanna be rude.
They don't wanna cause waves.
I was in Amman, Jordan robbing a bank there,
and I don't know too much Arabic.
Whatever.
I start walking in like I own the place,
go straight down to the farthest cubicle
I can have access to,
and I plug in my USB drive.
(USB drive chimes)
And then I go to the next one,
(USB drive chimes)
and the bank manager comes up to me,
and she's like, "You can't be doing that."
And I'm like, "You're right.
If you don't think I should be doing this,
(keyboard keys clacking) (USB drive chimes)
it's like we should definitely contact somebody."
I compromised five machines.
She realized something was wrong,
but she wasn't trained to counteract that
because I didn't have a ski mask on.
I did not fit the pattern.
And so I was like, "You know what?
I've got some paperwork in my car."
She's like, "Yes, you need to go get the paperwork."
And they let me leave,
but I'm trying to get caught.
I'm trying to create a teachable moment.
So one of my best engagements
that I've ever been on was this year.
I had pen tested the company the year before,
and this year they caught me several times.
That shows me that my job that I did last year worked.
(soothing techno music)
I always tell people,
every person on this planet was born a hacker,
every one of us.
It's like that innate curiosity of a child that said,
"This is what we're told it's supposed to be.
Let's do something different."
The key thing is questions.
Why did you get that email?
Why does it have that link?
Were you expecting that email from that person?
And there's also this wonderful device.
It's a great hacking device.
This thing.
You can make phone calls with it.
Call the person and be like,
"Did you send me this sketchy-looking email?"
No one wants to talk to Bob in Accounting.
Look, just question.
"Could you let me in?
I just went to the bathroom, and I didn't have my badge."
When you're living in a dumpster fire,
you've got two choices:
go get marshmallows and watch it burn,
or try to put it out.
That's what motivates me,
not just showing where it's broken,
but showing people how to make it better.
(upbeat techno music)