The tickle of curiosity. The gasp of discovery. Fingers running across the keyboard.

Friday, January 17, 2014

Cyber Security - An Interview with a Hacker: Information for Writers


Question mark liberal
 (Photo credit: Wikipedia)
Fiona - In today's interview I am speaking with Steven, who
            was kind enough  to come and share some of his
            unique expertise with us. 

            Hey Steven, can you introduce yourself to my
            readers and tell them how you got
            involved with computers and hacking?

Steven - I work as an IT analyst. My first experience with
              computers was when I was about 10 years old and
              convinced my parents to purchase a used Atari
              computer from a yard sale. This particular
              system did not include very much software, but it
              did come with several books that contained source
              code which you could type and
              run yourself. This was fascinating to me. I had a
              video game console (NES) at this time, but never
              put much thought into how a game was made...
              and a game is essentially an application.

             It was as though a door had been opened, revealing
             a hidden dimension that was all around. My mind
             filled with wonder, and I quickly became obsessed with learning more about this hidden universe.

             Eventually, I learned about what was referred to as an "IBM Compatible" computer. It included
             (what I thought was at the time) a more robust operating system MS-DOS and the first graphical
              interface I used "Windows".

              I started by learning a few commands "dir" and "help". Then I went through the entire system and
              learned every command which was available and read every help document.

              By this point my obsession with the computer was so great, my parents decided to start locking the
              keyboard out so I could only use it at authorized times... This only lasted a while, as I figured out I
              could bypass the lock switch by flipping the jumpers.

Keyboard V
 (Photo credit: Wikipedia)
Fiona - Did your parents know that they
            were helping you grow your hacking
            skills by trying to keep you
            away from the computer?

Steven - My mom originally thought she
             would be the one to teach the rest of
             the family about computers. I don't
             think she could have anticipated that
             I would surpass her knowledge in
             such a short time, nor do I think she
             foresaw where this would lead.

Fiona - Did your friends share in your computer obsession?

Steven - At this point in time, I didn't know anyone else that had a computer. I lived in relatively small town.
             One day in middle school, an exchange student arrived from eastern Europe. I befriended him and
             learned that his father was a computer programmer. He too dabbled in computer programming and
             was as fascinated with computers as I was. We would always say "We didn't want to do something
             if we knew we could" -- Kind of saying, if we were 100% sure something was technically possible it
             didn't interest us. We really wanted to do things to prove ourselves wrong.

Fiona - Let me go back and tell the readers that this interview started on Skype. I was up on the video chat
            and this is the image that came up for Steven:

Black Square

Fiona (cont.) -  Steven startled me by speaking in a digitally disguised voice, which I will not lie, was totally
                        creepy. How did you do that?

Steven - I used a voice scrambling system called VMic. It installs a virtual sound card driver that applies
              modulation effects to the hardware microphone, and sends the output to whichever application you

Video Quick Study (:05) snippet of voice being disguised (not Steven)

Fiona - That could be a great plot point! Okay - so now we are typing on a program called Criptocat - can
            you explain what that is? Why one would use it? And how could something like CryptoCat help a
            literary villain get away with a crime?

Steven -  Cryptocat "encrypts" any messages sent to the chat. This would add another layer for a third party
               attempting to intercept a message via sniffing. They would need to decrypt the conversation
               before it was intelligible.

Child nose
(Photo credit: Wikipedia)
TIME OUT for a vocabulary tutorial: Sniffing:
"A program and/or device that monitors data traveling over a network. Sniffers can be used both for legitimate network management functions and for stealing information off a network. Unauthorized sniffers can be extremely dangerous to a network's security because they are virtually impossible to detect and can be inserted almost anywhere. This makes them a favorite weapon in the hacker's arsenal." Link

Fiona - So Cryptocat  makes my data unreadable from my driveway where someone is sniffing my wifi?

Steven - It would make it difficult enough to prevent most people from sniffing the message. There's always
              the "lead pipe" method though.

Fiona looks perplexed - she can't see Steven, but she assumes he rolled his eyes.

Steven - "Lead pipe" method is where they [the criminal] would use the threat of physical violence to coerce
               you into revealing the key to an encryption. This would, of course, nullify any attempt for the
               listener to remain covert.

Fiona - What about in my slack space is it encrypted there or is it still plain text there?
             (plain text is un-encrypted data)
             Blog Link to Digital Footprints: Computer Forensics and Digtal Evidence

Steven - "Slack space," or the unwritten clusters on your physical storage media, will most likely remain in
               the same format as it was before it became "deleted". If you didn't encrypt it to begin with, it
               wouldn't be encrypted afterwards.

             "Slack space" is sort of an IT new-speak term invented by management with limited technical skills.
              There's an increasing belief that you don't need to be technical to manage those with technical skills.

Fiona - Good to note. The digital forensic investigators refer to the area as slack space but an IT person/
            hacker would not.

            When I first heard about your computer skills, you were on your way to DEFCON in Las Vegas
            to study hacking - now you're in IT, what shifted your perspective. Can you tell me about the change
            between back then and post 911?  (Defcon link)

Steven - I was never involved in anything "illegal". My interests were pure curiosity about how someone
             would go about bypassing security measures. Post 9/11, it "upped the ante". It seemed like more
             resources became available for law enforcement, and they were developing a trigger finger for their
             shiny new big guns. I didn't want to get caught in the scope.

Fiona - Big guns?

Steven - The big guns were things like provisions to the Computer Fraud and Abuse Act of 1986 by the
              patriot act.

Fiona - (Authors - Here's a link if you think this might influence your plot and want to do more research.)

             Steven, if our character was knowledgeable about computers, what advice/systems would you
             suggest they put in place just to be safer?

Steven -   Don't overlap accounts. If you use an account for personal or other business, do not use it where 
                you are doing activities you wish to remain hidden or secret... In other words, don't shit where you

Fiona - That makes sense. I'm suddenly thinking about the General Petraeus affair. 
            "The general’s biographer and mistress thought she was being clever by using anonymous
             e-mail accounts and sending messages using hotel WiFi networks.
             But metadata — in this case the Internet protocol addresses pointing to network locations — 
             gave the Charlotte woman away."  news article link

             What should a writer be careful about when they are writing about digital technology?

Steven - If there was an easy way to do it, everyone would be doing it. I think it would be good to attempt
              to avoid specifics as much as possible. At the time it may seem cutting edge, but probably won't
              age very well. "4 Megabytes" was a lot in 1984, but in 2014 we can transfer it in seconds.

Fiona - What do you see as a big fallibility in cyber security?

Steven - A huge security hole that will never be patched is people. If you can gain confidence with a
             person you can get them to do things they normally wouldn't do 

Fiona's aside: This is completely true. I trust Steven. He told me he would only do an interview with Cryptocat. Since I wanted very much to interview him, I signed right up without doing any research - Shoot! I could have agreed to load sniffing software into my computer, and he could be finding all of my passwords and bank account numbers, etc. Trust. Hmmmn.  

Fiona - Steven - can you believe our hour is up! This has been great. I so enjoyed speaking with you. I'm
            wondering if you could just quickly tell me the story of the hacker you met who turned evil and was
            caught because of his bragging.

Steven - I'd rather not end up on anyone's radar. Snitches get stitches.

English: CAPT John Rolph swears in COL Paul Ho...
 (Photo credit: Wikipedia)
Fiona's aside - Steven suggests that if you need a template for a crime, do a search for a crime that has come to trial and read through the court documents to find out the exact steps involved. 

Fiona - Ha! Well we don't want you acquiring any new scars. Speaking of scars, a standard question here on ThrillWriting is about your favorite scar.

Steven -  If this were an interview where I had
              admitted to doing something illegal, I
              would invent a scar in a
              place where one didn't exist... 
              But since this isn't the case, I'll have to go with my favorite scar would be the one
              on my left arm. I got it from a jungle gym when I was a child. I think it was my favorite because up
              until that point I didn't know anything about limits... I would tumble backwards off the top bars and
              land on my feet. Looking back, I could have snapped my neck, but the only real damage was a
              deep scratch from an uncapped screw.

Fiona - A huge thank you to Steven for his wonderful information.

Thank you so much for stopping by. And thank you for your support. When you buy my books, you make it possible for me to continue to bring you helpful articles and keep ThrillWriting free and accessible to all.


  1. Great timing for this post! Thanks! My protagonist is a hacker and I want to get him right. :)

    1. Thanks S.R.S.

      I thought Steven did a great job giving us a character sketch both from the things he said and from the things he refused to say. I loved his enthusiasm for the subject - but Steven was also very aware of what he was saying, when, and how - self-protective. Once one knows how vulnerable computers can make us - this makes perfect sense.

      Cheers - and best of luck with your writing,

  2. What a fascinating interview. I am constantly challenged to come up with new ideas for my hacker character and Steven's insights helped a lot. Big thanks from a desperate techno-dork!