Cyber Security - An Interview with a Hacker: Information for Writers

__________________________________________________

 (Photo credit: Wikipedia)

Fiona - In today's interview I am speaking with Steven, who

            was kind enough  to come and share some of his

            unique expertise with us. 

            Hey Steven, can you introduce yourself to my

            readers and tell them how you got

            involved with computers and hacking?

Steven - I work as an IT analyst. My first experience with

              computers was when I was about 10 years old and

              convinced my parents to purchase a used Atari

              computer from a yard sale. This particular

              system did not include very much software, but it

              did come with several books that contained source

              code which you could type and

              run yourself. This was fascinating to me. I had a

              video game console (NES) at this time, but never

              put much thought into how a game was made...

              and a game is essentially an application.

             It was as though a door had been opened, revealing

             a hidden dimension that was all around. My mind

             filled with wonder, and I quickly became obsessed with learning more about this hidden universe.

             Eventually, I learned about what was referred to as an "IBM Compatible" computer. It included

             (what I thought was at the time) a more robust operating system MS-DOS and the first graphical

              interface I used "Windows".

              I started by learning a few commands "dir" and "help". Then I went through the entire system and

              learned every command which was available and read every help document.

              By this point my obsession with the computer was so great, my parents decided to start locking the

              keyboard out so I could only use it at authorized times... This only lasted a while, as I figured out I

              could bypass the lock switch by flipping the jumpers.

 (Photo credit: Wikipedia)

Fiona - Did your parents know that they

            were helping you grow your hacking

            skills by trying to keep you

            away from the computer?

Steven - My mom originally thought she

             would be the one to teach the rest of

             the family about computers. I don't

             think she could have anticipated that

             I would surpass her knowledge in

             such a short time, nor do I think she

             foresaw where this would lead.

Fiona - Did your friends share in your computer obsession?

Steven - At this point in time, I didn't know anyone else that had a computer. I lived in relatively small town.

             One day in middle school, an exchange student arrived from eastern Europe. I befriended him and

             learned that his father was a computer programmer. He too dabbled in computer programming and

             was as fascinated with computers as I was. We would always say "We didn't want to do something

             if we knew we could" -- Kind of saying, if we were 100% sure something was technically possible it

             didn't interest us. We really wanted to do things to prove ourselves wrong.

Fiona - Let me go back and tell the readers that this interview started on Skype. I was up on the video chat

            and this is the image that came up for Steven:

Fiona (cont.) -  Steven startled me by speaking in a digitally disguised voice, which I will not lie, was totally

                        creepy. How did you do that?

Steven - I used a voice scrambling system called VMic. It installs a virtual sound card driver that applies

              modulation effects to the hardware microphone, and sends the output to whichever application you

              want.

Video Quick Study (:05) snippet of voice being disguised (not Steven)

Fiona - That could be a great plot point! Okay - so now we are typing on a program called Criptocat - can

            you explain what that is? Why one would use it? And how could something like CryptoCat help a

            literary villain get away with a crime?

Steven -  Cryptocat "encrypts" any messages sent to the chat. This would add another layer for a third party

               attempting to intercept a message via sniffing. They would need to decrypt the conversation

               before it was intelligible.

(Photo credit: Wikipedia)

TIME OUT for a vocabulary tutorial: Sniffing:

"A program and/or device that monitors data traveling over a network. Sniffers can be used both for legitimate network management functions and for stealing information off a network. Unauthorized sniffers can be extremely dangerous to a network's security because they are virtually impossible to detect and can be inserted almost anywhere. This makes them a favorite weapon in the hacker's arsenal." Link

Fiona - So Cryptocat  makes my data unreadable from my driveway where someone is sniffing my wifi?

Steven - It would make it difficult enough to prevent most people from sniffing the message. There's always

              the "lead pipe" method though.

Fiona looks perplexed - she can't see Steven, but she assumes he rolled his eyes.

Steven - "Lead pipe" method is where they [the criminal] would use the threat of physical violence to coerce

               you into revealing the key to an encryption. This would, of course, nullify any attempt for the

               listener to remain covert.

Fiona - What about in my slack space is it encrypted there or is it still plain text there?

             (plain text is un-encrypted data)
             Blog Link to Digital Footprints: Computer Forensics and Digtal Evidence

Steven - "Slack space," or the unwritten clusters on your physical storage media, will most likely remain in

               the same format as it was before it became "deleted". If you didn't encrypt it to begin with, it

               wouldn't be encrypted afterwards.

             "Slack space" is sort of an IT new-speak term invented by management with limited technical skills.

              There's an increasing belief that you don't need to be technical to manage those with technical skills.

Fiona - Good to note. The digital forensic investigators refer to the area as slack space but an IT person/

            hacker would not.

            When I first heard about your computer skills, you were on your way to DEFCON in Las Vegas

            to study hacking - now you're in IT, what shifted your perspective. Can you tell me about the change

            between back then and post 911?  (Defcon link)

Steven - I was never involved in anything "illegal". My interests were pure curiosity about how someone

             would go about bypassing security measures. Post 9/11, it "upped the ante". It seemed like more

             resources became available for law enforcement, and they were developing a trigger finger for their

             shiny new big guns. I didn't want to get caught in the scope.

Fiona - Big guns?

Steven - The big guns were things like provisions to the Computer Fraud and Abuse Act of 1986 by the

              patriot act.

Fiona - (Authors - Here's a link if you think this might influence your plot and want to do more research.)

             Steven, if our character was knowledgeable about computers, what advice/systems would you

             suggest they put in place just to be safer?

Steven -   Don't overlap accounts. If you use an account for personal or other business, do not use it where 

                you are doing activities you wish to remain hidden or secret... In other words, don't shit where you

               sleep.

Fiona - That makes sense. I'm suddenly thinking about the General Petraeus affair. 

            "The general’s biographer and mistress thought she was being clever by using anonymous

             e-mail accounts and sending messages using hotel WiFi networks.

             But metadata — in this case the Internet protocol addresses pointing to network locations — 

             gave the Charlotte woman away."  news article link

             What should a writer be careful about when they are writing about digital technology?

Steven - If there was an easy way to do it, everyone would be doing it. I think it would be good to attempt

              to avoid specifics as much as possible. At the time it may seem cutting edge, but probably won't

              age very well. "4 Megabytes" was a lot in 1984, but in 2014 we can transfer it in seconds.

Fiona - What do you see as a big fallibility in cyber security?

Steven - A huge security hole that will never be patched is people. If you can gain confidence with a

             person you can get them to do things they normally wouldn't do 

Fiona's aside: This is completely true. I trust Steven. He told me he would only do an interview with Cryptocat. Since I wanted very much to interview him, I signed right up without doing any research - Shoot! I could have agreed to load sniffing software into my computer, and he could be finding all of my passwords and bank account numbers, etc. Trust. Hmmmn.  

Fiona - Steven - can you believe our hour is up! This has been great. I so enjoyed speaking with you. I'm

            wondering if you could just quickly tell me the story of the hacker you met who turned evil and was

            caught because of his bragging.

Steven - I'd rather not end up on anyone's radar. Snitches get stitches.

 (Photo credit: Wikipedia)

Fiona's aside - Steven suggests that if you need a template for a crime, do a search for a crime that has come to trial and read through the court documents to find out the exact steps involved. 

Fiona - Ha! Well we don't want you acquiring any new scars. Speaking of scars, a standard question here on ThrillWriting is about your favorite scar.

Steven -  If this were an interview where I had

              admitted to doing something illegal, I
              would invent a scar in a

              place where one didn't exist... 

              But since this isn't the case, I'll have to go with my favorite scar would be the one

              on my left arm. I got it from a jungle gym when I was a child. I think it was my favorite because up

              until that point I didn't know anything about limits... I would tumble backwards off the top bars and

              land on my feet. Looking back, I could have snapped my neck, but the only real damage was a

              deep scratch from an uncapped screw.

Fiona - A huge thank you to Steven for his wonderful information.

Fiona Quinn's Newsletter Link, Sign up HERE

Thank you so much for stopping by. And thank you for your support. When you buy my books, you make it possible for me to continue to bring you helpful articles and keep ThrillWriting free and accessible to all.