Hacker Breaks Down Hacking Scenes From Movies & TV | WIRED

Key Takeaways

it keeps rewriting itself to counter my commands this has something to do with computers hack them all hi i'm sammy camkar sammy is the co-founder of open pass security and a computer hacker i'm back to talk about more hacking scenes in tv shows and movies breaking into a government system the x-files this has something to do with computers the internet actually the arpanet you can access it through the internet i want to believe but this clip isn't too realistic arpanet is essentially what the internet came from darpa the us government agency created arpanet and that bubbled into the internet and became publicly available when the x-files came out arpanet was no longer in existence isn't this something you could i mean how do you say it hack into i'm sorry i think this is the end of the line how you say that's what she says she says how you say hack how do you say it hack into but how you say is what you say in other languages when you don't know right what did you do oh it's a government system i know a couple of logging out tricks with vms version 5. if you're using a password that you know then i don't really consider that hacking what is that it's an encrypted file why would your three-year-old have an encrypted file than a secret defense department database can you decode it there's another issue here in that they find a file that's encrypted that by itself is not too unrealistic they're showing the file in ascii format can you print it out for me but when you print it out that's going to be useless information and that's because many of the characters that would be in an encrypted file are not visible in an ascii format so you end up with things like periods which may or may not be a period or it could be a totally different uh character or bike so your ex-boyfriend is into computers i would totally say that wait your boyfriend's into computers i should meet him locking down a system jurassic park [Music] in this clip it looks like newman you know who i mean is kind of running around activating or deactivating certain types of locks but at some point someone else tries to run a command like access grid and that causes an access denied but then he gets a series of messages so this doesn't look too realistic just in the fact that he's getting access to nine messages without a password and he's also then getting a message in a loop which is just less likely to happen in a realistic scenario this reminds me of some of the clips that we saw in the first technique critique when we were seeing really just a lot of pop-ups that would occur stop the pop-ups and a lot of videos typically that will hackers will put onto devices that's not something we generally see in the real it's a world system it's all the files of the whole park the girl gets to the computer and says it's a unix system it doesn't look like a unix system which is typically a terminal or console window but it actually is unix it tells you everything i got to find the right file the 3d interface that she's using is a legitimate software that a company called sgi made many years ago it's not something anyone actually uses it was really just about proof of concept of using a 3d file system the reason no one would ever use it is because it takes forever to navigate a 3d system when you're just trying to find a file take this hack of graph decrypting a file the code might be an error in the video compression i can fix that maybe but i would need to get online [Music] here we see jesse taking a corrupted video file and for a moment we see him start running a program called ffmpeg and he essentially tries to remove corruption from this video file and that's totally reasonable ffmpeg is meant for all sorts of modifications or alterations to video images and audio so for example if you have something that's corrupt you could take all the frames that are not corrupt extract them and then reconstruct all of those frames into a single video there was a part that was inaccurate in where we saw the red green and blue channels all visually come up while that would be possible to do ffmpeg the tool itself is a terminal based tool so it's all text based despite operating on video image and audio can you fix that maybe but i would need to get online he has to go online but if he already has that ffmpeg tool downloaded to his machine there's actually no reason for him to go online so who knows what he was actually doing sometimes you do hear of hackers getting sentenced not to use computers or be on the internet unfortunately that occurred to me earlier in my life for several years i don't know if we want to go into it now i'm allowed to be on the internet hardware hacking firewall i need my daughter's mp3 player he uses a hard drive here we see jack stanfield using his daughter's ipod to store data while under duress in a kidnapping situation this is the scanner head from the fax machine and you'll capture the images of the account numbers off the server screen and transfer them to this that's totally realistic if you think about an mp3 it's just a digital format of audio and audio is really just an analog signal so you can convert that into a digital format and just like you can convert any other data into some digital format but they're still just images what are you going to do with them we use an ocr program to convert it to data that the computer can use he also mentions using ocr which is object character recognition so if i were to take a screenshot of a bank account it's an image there's not actually text in it even though i can read the text ocr software would then convert that and extract all of the text from it without me having to type it in manually 10 000 songs 10 000 account goods it doesn't know the difference the only thing he doesn't go over here is how he converts the images from the scanner into the mp3s you do need some conversion to occur so that needs to be a computer or a microcontroller or something it should work packing a smart fridge silicon valley hello my cool friend hello huh yang hmm ah huh you attack and destroy my refrigerator and you misspell my name essentially smart fridges themselves are really just computers they're running some operating system maybe a stripped down version of linux i was able to brute force the backdoor password to that chrome piece of in under 12 hours what guilfoyle is saying is that he was able to brute force the password all that means is he went through millions and millions of passwords trying to authenticate through some mechanism that the fridge exposed maybe it's connected to the wi-fi network and it has a port open that you can then connect to that is a possible scenario a backdoor is a way to log in or authenticate into a system without going through the traditional mechanism so maybe a website has a username and password field a backdoor would be a special url that you wouldn't need to enter any username or password but i added a little visual flair huh hacking an atm pin terminator 2 judgement day please insert your stolen card now they insert a device that looks like a credit card tied to a computer with a ribbon cable and it looks to do some type of brute force of the pin code go baby go baby go baby right easy money some of this could be possible the problem is the pin code has nothing to do with the data on the credit card nor is it ever inserted within the credit card slot those are two independent systems what they're doing here with the pan just isn't talking to the right system so they'd have to be plugged into something else in order to even attempt an attack like this could you learn this stuff from anywhere from my mom destroying a hard drive the core this is the fbi we have awards in this scene the main character is trying to wipe delete purge any day they can from a number of different data storage types [Music] he takes some pretty big magnets and he goes over what i assume are hard drives which would work for traditional spinning platter hard drives that would erase a lot of the data as the data is kept in magnetic fields if i had to destroy something like a traditional spinning hard drive then i probably would do something similar by using magnets but ideally i would also want to open it after the fact and then crush it into bits the more small pieces you have the less data someone will be able to extract and be able to put them together he also throws some cds or dvds into a microwave the data there is actually stored within the polycarbonate so if he had a sufficient time to melt it he could make it disappear but it just depends on that amount of time he also deleted some data just using software now a quick software delete in the period of time he had which was only a few seconds while that appears to delete the files it actually doesn't delete the data all it does is tell your hard drive or your computer that the data in this sector is now free in order to actually delete data from a drive you actually need to overwrite that data and typically you'll want to override it several times then for a safe measure hit it with a hammer a bunch of times i know these look like computers totally not faraday cage enemy of the state this is where i work completely secure copper wire mesh keeps the radial signals out he says this copper wire cage or a faraday cage keeps radio signals out normally that is true when you have a conductive mesh or a metallic mesh the only thing that can penetrate that mesh are wavelengths that are essentially smaller than the mesh itself so the holes themselves but in this case there's a lot of radio frequency that can fit in that wavelength so really even something like five gigahertz wi-fi would be able to penetrate that mesh if the mesh were smaller then it would be able to block a lot more radio frequency hate to see the chicken that lives in this coupe acoustic analysis eagle eye sir all the threats we've been tracking chatter also in this scene a couple of things are happening there is a voiceover ip phone that they ultimately disconnect to prevent someone from snooping or enabling the microphone it shows that the camera is essentially able to read lips really creative and absolutely doable with software today what they didn't expect and which is really creative is they're actually using acoustic analysis to look at vibrations off the coffee cup that was there so when you're speaking or when someone's speaking they are moving air molecules and that's going at a certain frequency based off the frequency of their sound when that hits something like the drink you're actually able to convert that physical change of that liquid back into audio because essentially it's moving at the frequency of sound and if you can visually see that you can then convert that visual frequency back into the frequency of sound and hear it so it's actually very creative but it is doable denial of service attack ralph breaks the internet insecurity detected [Music] in this clip we see some sort of malicious system that is finding this insecurity in ralph and they're essentially duplicating ralph and duplicating the sense security which then takes over all sorts of websites stops it starts interfering with people's web browsers the internet is under assault as a massive denial of service attack crashes servers across the web denial of service typically isn't going to do something manipulative like alter your web browser or alter a video feed instead its goal is one simple thing and that's to bring a system down while this is uh pretty unrealistic i think we can give ralph a pass here just for his insecurity hijacking a tv channel v for vendetta dad what's wrong with the telly good evening in this scene we see someone essentially taking over a tv station in this case i don't consider this hacking because they essentially already have the capability they're in the station and they have the ability to already override the video that's been playing right now what makes it a little less unlikely is that they're also taking over billboards and often those are coming off a separate feed off some pre-recorded video granted those could be based off of live video as well in tim burton's batman we do see something similar where a live newscast is taken over by the joker now that is actually a lot more realistic and is an actual hack because often live broadcasts are being aired over radio so if someone can intercept and by intercept i just mean send a stronger signal then they can actually override that signal if they can hit the receiver and take over that so that is something that can happen and has happened in the past he don't look happy he's been using brand x stock market hack who am i [Music] in this clip they're on the roof of what appears to be a stock exchange and they're somehow connecting to the network this by itself is going to be a little challenging because there are many different networks and just being on the roof is typically not enough to jump on the network we do see them run something called bash buffer overflow.sh and some number and buffer overflow is a common technique to exploit various types of software by overflowing their memory so much that you get to a point in memory that you can tell the processor where to run code and you can then point that back to the original memory you overflowed and that's now your code so it's a way to take over a computer just by inputting some data what they're demonstrating is that they're able to connect to and then run their own code and run their own instructions [Music] we're also seeing essentially video of a graph and that chart is probably going to be extracted from some other location maybe from a website or from some other feed so it might be possible but it's going to be challenging to do this autonomous vehicle exploitation fate of the furious there's over a thousand of them hack them all in this clip we see a bunch of cars getting hacked and taken over some of this could be possible and there's a pretty incredible demonstration of this type of attack where they were able to take a jeep that was driving on the road with someone from wired inside and they were able to take that car over they first started just controlling the windshield wipers adjusting the radio and then actually started messing with the controls of the vehicle like the throttle and that's because some vehicles do have these components computerized however what they're showing here where they're just arbitrarily choosing cars to take over is really unlikely because it's a lot of effort and it's typically a targeted attack you have to really know the vehicle that you are trying to get to first you see a bunch of cars that are actually parked and they start driving well that's not going to happen if you have something like an e-brake as far as i know today there aren't many vehicles with a computerized e-brake so we're just seeing way too many vehicles doing way too many things they simply don't have the capability to do add buckle up if i were you credential hack mission impossible ghost protocol in this scene we see ethan hunt going into uh government building he reveals his credentials and the person working behind the desk starts scanning the credentials he looks at kind of what percentage of this hacking is being done this seems pretty unlikely for a couple of reasons for one when you're talking about a credential or authorization system it's likely not going to be on some wireless network even if you do have a wireless network in a government building it's again likely not tied to a security checkpoint another problem here is that we see a percentage of completion you almost never have percentages when you're talking about hacking either you have found a mechanism to get in or or you haven't so the loading bar in hacking scenes is usually not very accurate i love your disguise by the way max boof mr robot [Music] in this scene we see darlene take a little magnetic read head and take a hotel card and scan it and then store it into a device called mac spoof then she goes up to the hotel room and she essentially hits play which either replays that or it brute forces the code and that unlocks the door and that is something that can absolutely occur max boof is a device i personally created and it's designed to essentially allow to perform penetration testing around different types of mag stripes primarily around credit cards the device itself is an electromagnet and what all that means is it's able to create a magnetic field both north and south the writers of mr robot were really creative here and asked if this were possible on hotel mag stripes and it's entirely possible and they actually came up with the idea of taking that same device and using it here in a hotel to brute force through various numeric codes for a room just by having somebody else's room card and that's a totally feasible scenario hacking at an apple store captain america the winter soldier now he's trying to hide something can i help you guys with anything oh no my fiance was just helping me with some honeymoon destinations it seems that really what they're trying to do is just hide who they are and what they're doing so they're going to an apple store so they can take the ip address of the apple store rather than doing it say from their home or office or captain america network how much time we have uh about nine minutes from now generally you wouldn't want to do it in an apple store for one they're gonna have a lot of cameras so all they have to do is correlate the time the computer and then look at the video feed and they might be able to capture who is there oh maybe we can find out where it came from there was an art prank done many years ago at an apple store in new york the creator kyle ended up getting the secret service sent to his house so you probably don't want to try this congratulations were you guys thinking about going new jersey if you did want to actually perform attacks and hide your ip address it would make more sense to have some sort of device say a raspberry pi computer connect it to a solar panel throw it on top of a store and then connect to that so that is now connecting to the free wi-fi of somewhere nearby and now you're sort of proxied there's no video of you you're not at the store but you're taking advantage of their ip address and now it's going to be much harder to link back to you the person who developed this is slightly smarter than me fishing attack ocean's eight rihanna or nine ball is trying to fish somebody she's constructing a an email or message it has some link that the person clicks and then that person had their camera engaged and the video feed went back to nine ball that is pretty unlikely in order to actually enable somebody's web camera you need to get code to execute on their computer that's usually very difficult when you employ those attacks and they get executed they're going to be discovered pretty quickly if you start using it and it's going to be patched pretty quickly so it's not to say it's not possible it's just that once you start using these types of attacks you're essentially burning them otherwise a phishing attack by itself getting someone to click something or visit a malicious link that is pretty easy to do and that happens honestly every day discovering a worm hackers it isn't a virus it's a worm here we see zero cool doing some sort of investigation we do see a lot of algebraic formulas unfortunately which have really nothing to do with what he's doing granted if you're programming you will be writing a lot of algorithms but you're never doing it in let's say the algebraic format that they're showing it isn't a virus it's a worm the worm eats a few cents from each transaction and when the worm's ready it zips out with the money and erases its try he says this is a worm and not a virus and that seems true essentially we think of a virus as some piece of software or malware that requires some action by a user in order for it to execute where a worm is more likely something that requires little to no action in order to proliferate by this point it's already running at twice the speed is when it started when i was younger i did accidentally release a worm on a site popular many years ago called myspace all it did was someone would visit my profile without knowing it they would add me as a friend and the code would copy to their profile that means when someone visits their profile and the code would copy to their profile within about 24 hours over a million people were infected it said sami is my hero on all these profiles and my myspace had to shut down in order to remove this worm unfortunately for me i couldn't touch a computer for several years i wasn't allowed on the internet until i went back to a judge now we're here crash 1507 systems in one day aptitude test snowden we're gonna start with an aptitude test the average test time is five hours if you take more than eight you will fail i don't know whether after two tests like this happen in government i can only assume they do i know with a lot of companies you will go through some types of tests you will be on the spot you will be given a computer or you'll be given a whiteboard and they'll say okay do x you know write some software to perform this so there are realistic tests like this it's actually interesting because they're running legitimate commands we see nmap run a few times we see tar an archiving utility used to compress some data and then extract that data a lot of this was extremely realistic i'm really just nitpicking but a couple of those commands had a verbose flag enabled which should have output a lot more data but they didn't output any data but otherwise it seemed like a reasonable clip eyes on screens don't have enough space to do all the other clips does anyone have an ipod conclusion hacking itself is not always the most glamorous to look at however we are seeing more and more hardware type hacking where people are taking physical devices and moving hacking into the real world and that by itself i think looks more interesting all right guys from the top