WEBVTT 1 00:00:00.160 --> 00:00:04.360 Welcome to the deep dive. Today we're getting into something that, well, 2 00:00:04.400 --> 00:00:07.759 it touches almost everything in our hyper connected lives. There's 3 00:00:07.759 --> 00:00:10.880 that ts Eliot quote, where's the knowledge we have lost? 4 00:00:10.919 --> 00:00:15.560 In information? It feels especially fitting now, doesn't it? When 5 00:00:15.640 --> 00:00:18.079 access to info shapes so much? 6 00:00:18.239 --> 00:00:21.480 It really does. And you think about how fast information 7 00:00:21.559 --> 00:00:24.199 is growing, Yeah, doubling what was it every seventy three 8 00:00:24.280 --> 00:00:27.160 days by twenty twenty. That prediction the sheer amount of 9 00:00:27.280 --> 00:00:29.800 data we create, well, it just creates more targets, more 10 00:00:29.800 --> 00:00:31.000 security risks. 11 00:00:30.920 --> 00:00:36.640 Exactly, which brings us straight to today's deep dive. Hacking. Now, 12 00:00:36.640 --> 00:00:39.079 when you hear hacking, most people probably jump straight to 13 00:00:39.119 --> 00:00:40.799 the illegal stuff, right, the negative side. 14 00:00:40.880 --> 00:00:41.880 That's sort of movie version. 15 00:00:41.960 --> 00:00:44.679 Yeah, but it's interesting. The word originally meant something more 16 00:00:44.719 --> 00:00:48.439 like ingenuity, making tech do more than you thought. 17 00:00:48.200 --> 00:00:49.880 It could, pushing the boundaries, right. 18 00:00:50.039 --> 00:00:53.600 But today yeah, mostly we mean gaining unauthorized access digital 19 00:00:53.640 --> 00:00:55.719 networks devices, usually over the Internet. 20 00:00:55.880 --> 00:00:57.640 So our mission here is to kind of peel back 21 00:00:57.679 --> 00:00:59.799 the layers on this whole world. We want to look 22 00:00:59.799 --> 00:01:03.840 at it. How hacking evolved, I mean, its origins are 23 00:01:03.840 --> 00:01:08.079 pretty surprising, and who the hackers actually are, what tools 24 00:01:08.120 --> 00:01:11.640 they're using, and the threats, the really serious threats to 25 00:01:12.319 --> 00:01:16.040 individuals like you listening to businesses, even national security. 26 00:01:16.280 --> 00:01:19.959 And we'll also get into that tricky debate. Is hacking 27 00:01:20.040 --> 00:01:23.400 ever justified. There's a whole gray area there, definitely. 28 00:01:23.799 --> 00:01:26.879 And finally, what's being done to fight back. The goal 29 00:01:26.959 --> 00:01:29.640 is to give you a solid understanding, you know, without 30 00:01:29.719 --> 00:01:31.079 drowning you in technical jargon. 31 00:01:31.200 --> 00:01:33.920 Okay, let's dive in because the history, like you said, 32 00:01:34.000 --> 00:01:36.760 it's not what most people probably think, not at all. 33 00:01:36.840 --> 00:01:41.519 So fundamentally, hacking is about getting access you shouldn't have 34 00:01:42.040 --> 00:01:44.719 or doing more than you're allowed to within a system, 35 00:01:45.000 --> 00:01:47.920 often by finding weaknesses vulnerabilities nobody else knows about it. 36 00:01:47.920 --> 00:01:50.120 But it's not always just about code and computers. Is 37 00:01:50.120 --> 00:01:51.799 that there's a big human element. 38 00:01:51.480 --> 00:01:56.040 Oh, absolutely huge. That's social engineering. It's basically using social 39 00:01:56.040 --> 00:01:59.680 skills psychology to trick people, get them to give up 40 00:02:00.200 --> 00:02:00.879 without realizing it. 41 00:02:01.040 --> 00:02:04.319 Like looking over someone's shoulder for a password that's simple. 42 00:02:04.200 --> 00:02:07.680 Yeah, shoulder surfing, that's one way, Or crafting clever emails, 43 00:02:08.199 --> 00:02:12.240 fake websites, you click something and boom, your computers infected. 44 00:02:12.479 --> 00:02:16.159 They play on trust or fear or curiosity. 45 00:02:15.599 --> 00:02:18.479 And this idea, this exploiting systems, It goes way way 46 00:02:18.520 --> 00:02:19.039 back right. 47 00:02:19.080 --> 00:02:22.599 The very first sort of proto hack. Yeah, nineteen thirties 48 00:02:22.759 --> 00:02:26.840 Polish mathematicians Marian Radjuski and his team they cracked the 49 00:02:26.919 --> 00:02:28.039 Nazi Enigma. 50 00:02:27.719 --> 00:02:29.319 Machine, the messaging machine. 51 00:02:29.000 --> 00:02:32.879 Exactly, which operated with programming codes, kind of like early computers. 52 00:02:33.479 --> 00:02:36.800 And that breakthrough it let the British decode German messages 53 00:02:36.840 --> 00:02:39.479 in World War Two. Huge historical impact. 54 00:02:39.560 --> 00:02:42.400 Wow. So the core concept is almost a century old. 55 00:02:42.639 --> 00:02:43.680 But the word. 56 00:02:43.400 --> 00:02:47.039 Hacker that came later late nineteen fifties mit the tech 57 00:02:47.120 --> 00:02:48.599 model Railroad Club believe it or. 58 00:02:48.599 --> 00:02:49.319 Not, where Rose. 59 00:02:49.639 --> 00:02:52.639 They had this mainframe computer and these students found ways 60 00:02:52.680 --> 00:02:56.000 to get unauthorized access, usually with paper punch cards, just 61 00:02:56.000 --> 00:02:58.199 to get more time on it to develop software. It 62 00:02:58.240 --> 00:03:01.039 wasn't malicious, It was about you know, figuring things out, 63 00:03:01.080 --> 00:03:03.360 pushing limits for fund So it started pretty innocently. 64 00:03:03.479 --> 00:03:05.560 When did it turn more sinister? 65 00:03:06.080 --> 00:03:10.400 The big shift was really the Internet going mainstream the nineties. 66 00:03:11.159 --> 00:03:15.960 That's when hacking, just mushroomed, became this massive global issue. 67 00:03:16.000 --> 00:03:17.039 How big are we talking? 68 00:03:17.280 --> 00:03:20.680 Well, think about this. By two eleven, the FBI's Internet 69 00:03:20.719 --> 00:03:24.199 Crime Complaints Center, they were getting twenty five thousand complaints 70 00:03:24.199 --> 00:03:24.599 a month. 71 00:03:25.240 --> 00:03:25.759 Wow. 72 00:03:25.879 --> 00:03:31.360 Yeah, and the damages billions every year, theft fixing systems 73 00:03:31.400 --> 00:03:34.719 lost time. Yeah, it became a serious economic drain. 74 00:03:34.919 --> 00:03:37.199 So who are these people doing the hacking? It's not 75 00:03:37.280 --> 00:03:37.719 just one. 76 00:03:37.599 --> 00:03:40.080 Type, right, definitely not. You've still got the hobbyists like 77 00:03:40.080 --> 00:03:42.919 Brian Harvey Berkeley described, and the people who just love computers, 78 00:03:42.960 --> 00:03:44.639 live and breathe them, want to make them do anything 79 00:03:44.919 --> 00:03:47.400 for them. It's still about the challenge, the knowledge. 80 00:03:47.039 --> 00:03:49.360 Okay, the original spirit kind of sort of. 81 00:03:49.520 --> 00:03:52.800 But then you have the ones making headlines. Yeah, the 82 00:03:52.800 --> 00:03:55.680 black hat hackers. It's bad guys pretty much like villains 83 00:03:55.680 --> 00:03:59.000 and old Westerns, hence the name. They're hacking for illegal money, 84 00:03:59.240 --> 00:04:02.800 stealing it, or just to cause chaos, break things. 85 00:04:02.840 --> 00:04:05.039 And because of the black hats, you need the white hats. 86 00:04:05.280 --> 00:04:08.400 These are the good guys. The security professionals. Companies hire 87 00:04:08.439 --> 00:04:10.960 them to hack their systems, find the weak spots and 88 00:04:11.000 --> 00:04:14.599 fix them before the black hats do. Ethical hacking makes sense. 89 00:04:14.680 --> 00:04:15.759 Is there anything in between? 90 00:04:15.919 --> 00:04:18.560 Yeah, the gray hats they're not out to steal, but 91 00:04:18.600 --> 00:04:23.040 they're not strictly defensive either. I think researchers, maybe hobbyists 92 00:04:23.040 --> 00:04:25.800 trying to improve things, sometimes bending the rules a bit. 93 00:04:25.879 --> 00:04:28.120 And then there's another category entirely. 94 00:04:28.040 --> 00:04:33.040 Activists, right, These are political or social activists. They target governments, 95 00:04:33.199 --> 00:04:36.160 good corporations, not usually for money, but as a form 96 00:04:36.160 --> 00:04:39.879 of protest, to make a statement, push for change. Groups 97 00:04:39.920 --> 00:04:43.000 like anonymous lulled sec. Those are classic examples. 98 00:04:43.079 --> 00:04:45.800 Okay, so a whole range of players. What about their tools? 99 00:04:45.839 --> 00:04:47.560 How do they actually break in? 100 00:04:47.800 --> 00:04:51.639 It's a mix sophisticated software, yes, but also exploiting simple 101 00:04:51.720 --> 00:04:55.000 human mistakes, like we talked about with social engineering malware. 102 00:04:55.040 --> 00:04:56.759 Malicious software is a huge part of it. 103 00:04:56.920 --> 00:04:57.639 Like viruses. 104 00:04:57.759 --> 00:05:01.720 Viruses are one type. Yeah. A really common tool, especially 105 00:05:01.800 --> 00:05:03.680 for getting initial access, is. 106 00:05:03.600 --> 00:05:06.199 The trojan, like the trojan horse. 107 00:05:06.240 --> 00:05:09.199 Exactly the same idea. It looks like something harmless, maybe 108 00:05:09.240 --> 00:05:12.680 a useful program or file. You download it, run it, 109 00:05:13.079 --> 00:05:15.160 and it secretly opens the back door for the hacker, 110 00:05:15.639 --> 00:05:18.879 lets them hide their tracks, download more nasty. 111 00:05:18.480 --> 00:05:20.360 Stuff, and they can just buy these things. 112 00:05:20.439 --> 00:05:22.600 Some develop their own, but yeah, you can actually buy 113 00:05:22.720 --> 00:05:26.600 trojans and other malware toolkits on underground forums. Its whole 114 00:05:26.600 --> 00:05:27.519 economy scary. 115 00:05:28.240 --> 00:05:29.199 What about worms? 116 00:05:29.240 --> 00:05:32.399 I hear about those worms are really dangerous because they 117 00:05:32.399 --> 00:05:36.360 spread by themselves. A worm infects one computer, then it 118 00:05:36.399 --> 00:05:40.279 automatically scans the network and copies itself to other vulnerable machines. 119 00:05:40.519 --> 00:05:42.800 So it replicates automatically. 120 00:05:42.279 --> 00:05:44.480 Right, and it can take control of those infected computers, 121 00:05:44.639 --> 00:05:48.920 turning them into zombies. Zombies basically computers controlled remotely by 122 00:05:48.959 --> 00:05:52.600 the hacker without the owner knowing. When you get thousands 123 00:05:52.680 --> 00:05:56.399 or even millions of these zombies linked together, that's a botnet. 124 00:05:56.680 --> 00:05:58.680 And what can they do with a botnet. 125 00:05:58.319 --> 00:06:01.920 All sorts of things. Common use is a distributed denial 126 00:06:01.959 --> 00:06:05.439 of service attack a DDAs attack. The hacker tells all 127 00:06:05.480 --> 00:06:08.319 the zombies and the botnet to flood a target website 128 00:06:08.399 --> 00:06:12.279 or network with traffic all at once, overwhelming it. Exactly, 129 00:06:12.319 --> 00:06:14.680 it just can't handle the load and it shuts down. 130 00:06:15.079 --> 00:06:17.839 Russia used this against Estonia back in two thousand and seven, 131 00:06:18.000 --> 00:06:19.639 a big political cyber attack. 132 00:06:19.720 --> 00:06:21.120 I remember hearing about that. 133 00:06:21.120 --> 00:06:24.439 And remember the Configer worm. By twenty eleven, it had 134 00:06:24.519 --> 00:06:29.800 infected something like seven million computers worldwide, huge potential for damage. 135 00:06:29.839 --> 00:06:30.399 What did it do? 136 00:06:30.839 --> 00:06:34.759 Ironically, mostly sent spam, but it could have done much worse. 137 00:06:35.399 --> 00:06:37.199 Shows how versatile these botnets are. 138 00:06:37.319 --> 00:06:40.879 Okay, so trojans worms, what. 139 00:06:40.920 --> 00:06:43.959 Else you mentioned viruses. They can erase files, mess up 140 00:06:43.959 --> 00:06:46.800 your system, often spread through email attachments you shouldn't open. 141 00:06:47.319 --> 00:06:50.720 Then there's spyware. Spying software pretty much hides on your 142 00:06:50.759 --> 00:06:54.079 computer and watches what you do online, tracks websites you visit, 143 00:06:54.279 --> 00:06:57.920 logs keystrokes, maybe sometimes changes your settings, slows things down. 144 00:06:58.000 --> 00:07:00.279 And besides malware, hackers use. 145 00:07:00.199 --> 00:07:03.360 Tools like password crackers, programs that try millions of combinations 146 00:07:03.360 --> 00:07:07.319 to guest passwords, and sniffers, which intercept data traveling over 147 00:07:07.360 --> 00:07:10.639 a network. They can grab business secrets, credit card numbers, 148 00:07:10.839 --> 00:07:12.399 anything not properly encrypted. 149 00:07:12.519 --> 00:07:14.560 It sounds incredibly technical. 150 00:07:14.279 --> 00:07:17.000 A lot of it is, but again, never underestimate the 151 00:07:17.040 --> 00:07:20.600 human angle social engineering. Remember the Sarah Palin email hack 152 00:07:20.639 --> 00:07:23.199 in two thousand and eight. Vaguely a college student got 153 00:07:23.199 --> 00:07:26.800 in simply by resetting her password using public info, her birthday, 154 00:07:27.000 --> 00:07:29.360 zip code, where she met her husband, stuff you could 155 00:07:29.399 --> 00:07:30.079 find on Google. 156 00:07:30.240 --> 00:07:31.839 Seriously, that's all it took. 157 00:07:32.040 --> 00:07:35.800 Yep shows how basic information could be of vulnerability, and 158 00:07:35.839 --> 00:07:38.319 it gets worse. In twenty eleven, there was a report 159 00:07:39.360 --> 00:07:45.399 hackers put malware into online games. Games for preschoolers. No way, 160 00:07:45.800 --> 00:07:50.000 because toddlers can't read warning messages. They click yes to anything, 161 00:07:50.439 --> 00:07:53.639 so their parents' computers got infected, became part of botnets, 162 00:07:53.759 --> 00:07:56.720 and potentially gain hackers access to the parent's financial info. 163 00:07:56.879 --> 00:07:58.639 That's incredibly low. 164 00:07:58.560 --> 00:08:00.480 It really is. Shows how far some will go. 165 00:08:00.639 --> 00:08:03.279 So let's talk about the fallout the costs. This must 166 00:08:03.360 --> 00:08:06.480 have a huge impact financially, impersonally, oh immense. 167 00:08:06.600 --> 00:08:09.759 The global cost of cybercrime back in twenty ten, estimates 168 00:08:09.759 --> 00:08:12.480 were around three hundred and eighty eight billion dollars billion 169 00:08:12.720 --> 00:08:16.560 with a b YEP which get this was apparently more 170 00:08:16.600 --> 00:08:18.839 than the entire global trade in legal drugs at the 171 00:08:18.839 --> 00:08:20.759 time by about thirty five percent. 172 00:08:21.000 --> 00:08:22.879 That's staggering, it is. 173 00:08:23.040 --> 00:08:25.319 And you see big cases all the time. The US 174 00:08:25.399 --> 00:08:28.759 Secret Service just in twenty ten made arrests linked to 175 00:08:28.800 --> 00:08:30.800 over half a billion dollars in fraud. 176 00:08:30.639 --> 00:08:33.200 And businesses are right in the firing line absolutely. 177 00:08:33.399 --> 00:08:36.080 City Group twenty eleven hackers got in stole about two 178 00:08:36.080 --> 00:08:39.440 point seven million dollars from customer accounts through freak purchases, 179 00:08:39.480 --> 00:08:42.919 cash advances. Customers lost trust, left the bank. 180 00:08:42.679 --> 00:08:44.879 And Sony had huge problems around then too, right. 181 00:08:44.759 --> 00:08:49.240 Massive problems also twenty eleven their PlayStation network Sony Pictures 182 00:08:49.440 --> 00:08:51.600 hit hard cost them over one hundred and seventy seven 183 00:08:51.600 --> 00:08:55.759 million dollars. That's downtime fixing things, stock price drop, but 184 00:08:55.879 --> 00:09:00.200 also huge reputation damage. Personal data, credit card info for May, 185 00:09:00.320 --> 00:09:02.720 seventy million users got exposed. 186 00:09:02.320 --> 00:09:03.840 Seventy million ouch. 187 00:09:04.159 --> 00:09:06.639 Yeah, and that wasn't even the first really big one. 188 00:09:06.799 --> 00:09:09.720 KEJX companies TJ Max Marshals back in two thousand and 189 00:09:09.759 --> 00:09:12.360 six they lost forty million credit in debit card numbers 190 00:09:12.639 --> 00:09:14.039 cost them two hundred million dollars. 191 00:09:14.120 --> 00:09:16.039 So these massive breaches aren't new. 192 00:09:15.720 --> 00:09:18.120 Not at all. Even Google got targeted in twenty ten 193 00:09:18.279 --> 00:09:20.639 an attempt likely by the Chinese government, they said, to 194 00:09:20.679 --> 00:09:23.360 get into their source code systems, aiming for the Gmail 195 00:09:23.360 --> 00:09:24.919 accounts of human rights activists. 196 00:09:24.960 --> 00:09:25.759 Did they succeed? 197 00:09:26.000 --> 00:09:28.840 Google said no, they caught it, but it shows the risk. 198 00:09:29.360 --> 00:09:32.440 As Dave Dewol from McAfee said, just one breach can 199 00:09:32.480 --> 00:09:37.399 cause irreparable financial damage to reputation, stock price, customer confidence. 200 00:09:37.759 --> 00:09:41.120 It sounds relentless. How common is this for businesses? 201 00:09:41.240 --> 00:09:45.159 Depressingly common. A survey ending early twenty eleven found ninety 202 00:09:45.159 --> 00:09:47.480 percent of US businesses got hacked at least once in 203 00:09:47.519 --> 00:09:51.000 the previous year, and fifty nine percent got hacked twice. 204 00:09:50.799 --> 00:09:51.960 Or more ninety percent. 205 00:09:52.080 --> 00:09:55.519 Yeah. Stuart mccluar, also from McAfee, famously said something like, 206 00:09:55.759 --> 00:09:58.120 if you plug into the Internet without a good firewall, 207 00:09:58.799 --> 00:10:02.679 you could get hacked before the arrives, like under thirty minutes. 208 00:10:02.720 --> 00:10:04.399 So it's basically constant. 209 00:10:04.000 --> 00:10:05.039 Pretty much a constant threat. 210 00:10:05.120 --> 00:10:08.639 Yeah, and what about individuals beyond the big data breaches? 211 00:10:08.799 --> 00:10:12.600 Individuals are definitely targets too. Remember Christopher Cheney arrested in 212 00:10:12.600 --> 00:10:16.480 twenty eleven for hacking about fifty celebrities email cell phones. 213 00:10:16.600 --> 00:10:19.679 Scarlett Johansson's private photos got leaked because of him. 214 00:10:19.759 --> 00:10:20.519 How did he do it? 215 00:10:20.759 --> 00:10:24.360 Just piecing together clues from their social media public appearances, 216 00:10:24.600 --> 00:10:28.559 again using available information. And it's not just celebrities. A 217 00:10:28.600 --> 00:10:31.120 twenty ten poll found thirty percent of teens and young 218 00:10:31.120 --> 00:10:35.200 adults said their social media had been hacked. Anyone online 219 00:10:35.399 --> 00:10:36.600 is potentially vulnerable. 220 00:10:36.639 --> 00:10:41.320 Okay, so it's hitting individuals, businesses, but it goes even higher, right, 221 00:10:41.519 --> 00:10:42.320 national security. 222 00:10:42.360 --> 00:10:46.240 Absolutely, this is where it gets into cyber warfare, espionage. 223 00:10:46.559 --> 00:10:49.919 US Defense Secretary Leon Panetta warned about the next Pearl 224 00:10:49.919 --> 00:10:54.240 Harbor being a cyber attack crippling power grids, financial systems, 225 00:10:54.440 --> 00:10:55.960 government operations. 226 00:10:55.440 --> 00:10:56.720 That's a terrifying thought. 227 00:10:56.840 --> 00:11:00.279 It is, and FBI Director Robert Mueller called three it's 228 00:11:00.279 --> 00:11:02.399 the number one threat to the US in the future. 229 00:11:02.759 --> 00:11:06.519 US military's networks, they get probed something like six million times. 230 00:11:06.240 --> 00:11:09.919 A day, six million daily. Who's doing it? 231 00:11:10.000 --> 00:11:13.519 Often it's state sponsored actors. China has been frequently accused 232 00:11:13.519 --> 00:11:17.000 of systematic cyber spying against the US, targeting defense contractors, 233 00:11:17.000 --> 00:11:19.799 stealing huge amounts of data. There were even reports of 234 00:11:19.799 --> 00:11:22.240 interference with US satellites back in two thousand and seven 235 00:11:22.279 --> 00:11:24.720 two thousand and eight, possibly linked to the Chinese military 236 00:11:24.919 --> 00:11:29.080 in Operation Aurora in two thousand and nine that hit Google, Adobe, others, 237 00:11:29.840 --> 00:11:32.840 trace back to emails with bad links, exploiting flaws, and 238 00:11:32.879 --> 00:11:37.159 Internet Explorer again widely suspected state involvement is just China. 239 00:11:37.440 --> 00:11:40.200 Oh No. North Korea in two thousand and nine took 240 00:11:40.240 --> 00:11:43.799 down websites for the US Treasury Secret Service FTC for 241 00:11:43.960 --> 00:11:47.559 days using a botnet. Russia hit Georgia with cyber attacks 242 00:11:47.559 --> 00:11:49.879 in two thousand and nine, right before a military conflict, 243 00:11:50.039 --> 00:11:51.279 disrupting their defenses. 244 00:11:51.399 --> 00:11:54.720 So cyber attacks are becoming part of actual warfare exactly. 245 00:11:54.799 --> 00:11:58.600 They're integrated into military and political strategy now it's changing 246 00:11:58.600 --> 00:11:59.960 the nature of conflict. 247 00:12:00.000 --> 00:12:02.080 Countries attacked each other directly like that. 248 00:12:02.120 --> 00:12:04.879 We've seen things like a hacking skirmish between Israel and 249 00:12:04.879 --> 00:12:07.840 Saudi Arabia and twenty twelve hitting each other's stock exchanges, 250 00:12:08.159 --> 00:12:11.720 and reports claimed Israel's Masad hacked the Syrian officials computer 251 00:12:11.799 --> 00:12:13.720 back in two thousand and six to get nuclear intel. 252 00:12:14.200 --> 00:12:17.159 It shows the threat to critical infrastructure, power finance is 253 00:12:17.320 --> 00:12:20.039 very real. Crippling those could cripple a country. 254 00:12:20.080 --> 00:12:22.440 And it's not just governments we need to worry about, right. 255 00:12:23.120 --> 00:12:26.840 Director Mueler also warned about terrorist groups like Al Qaeda 256 00:12:26.879 --> 00:12:30.360 actively trying to get hacking skills, using the Internet for 257 00:12:30.399 --> 00:12:36.759 recruitment too. So the threat landscape is broad. Nations, criminals, terrorists, activists. 258 00:12:37.080 --> 00:12:39.840 Okay, So what's being done? How do we fight back 259 00:12:39.879 --> 00:12:40.639 against all this? 260 00:12:41.279 --> 00:12:45.240 Well, governments are definitely trying. The Obama administration brought in 261 00:12:45.279 --> 00:12:49.440 cybersecurity measures for businesses, things like forcing companies to report 262 00:12:49.519 --> 00:12:53.360 breaches to the SEC, having the NSA share intel with banks, 263 00:12:53.519 --> 00:12:57.759 and Congress proposed things like the Cybersecurity Act of twenty twelve, 264 00:12:57.840 --> 00:13:02.200 aiming to protect critical infrastructure, set security standards, and SISPA. 265 00:13:02.399 --> 00:13:05.440 The Cyber Intelligence Sharing and Protection Act, which was controversial. 266 00:13:05.480 --> 00:13:08.440 Why controversial because it would let Internet companies and others 267 00:13:08.559 --> 00:13:12.360 monitor user info and share with the government. Privacy advocates 268 00:13:12.519 --> 00:13:16.519 like the Electronic Privacy Information Center were really worried. They 269 00:13:16.600 --> 00:13:19.639 argue that data collected for cybersecurity could end up being 270 00:13:19.720 --> 00:13:22.759 used for other investigations, infringing on privacy rights. 271 00:13:22.840 --> 00:13:25.600 So there's a tension there, security versus privacy, a. 272 00:13:25.639 --> 00:13:29.879 Huge tension, and some former top officials like Mike McConnell 273 00:13:30.000 --> 00:13:33.159 Richard Clark were saying the US was actually losing the 274 00:13:33.200 --> 00:13:36.960 cyber war, that defenses were woefully lacking. So it's a 275 00:13:37.039 --> 00:13:39.600 really complex ongoing debate, which. 276 00:13:39.480 --> 00:13:42.519 Leads us into another really complex area. This idea of 277 00:13:42.679 --> 00:13:47.159 justification is hacking. Ever, Okay, that's where activism comes in, 278 00:13:47.240 --> 00:13:47.919 right exactly. 279 00:13:48.120 --> 00:13:51.519 Hackavists often see themselves as performing a public service. They 280 00:13:51.600 --> 00:13:55.279 might say they're exposing security flaws that companies or governments ignore, 281 00:13:55.679 --> 00:13:58.279 or uncovering secret documents they think the public has a 282 00:13:58.360 --> 00:14:01.600 right to see. It's protest, basically digital protest. 283 00:14:01.840 --> 00:14:04.759 Like George Harts, the guy who hacked the PlayStation three. 284 00:14:04.799 --> 00:14:07.120 Right back in two thousand and nine, he wanted to 285 00:14:07.120 --> 00:14:09.919 bypass its limitations let people run other software on it. 286 00:14:10.120 --> 00:14:12.120 He shared how he did it online, called it a 287 00:14:12.240 --> 00:14:15.440 victory for consumers, said things like we build this world. 288 00:14:15.519 --> 00:14:17.000 We are not mindless consumers. 289 00:14:17.039 --> 00:14:17.840 Did he get in trouble? 290 00:14:17.919 --> 00:14:20.960 Sony sued him. Yeah, but Apple when he unlocked the 291 00:14:21.000 --> 00:14:22.840 iPhone back in two thousand and seven to work on 292 00:14:22.879 --> 00:14:26.159 other carriers, they actually didn't sue, though they patched the 293 00:14:26.240 --> 00:14:27.200 vulnerability later. 294 00:14:27.440 --> 00:14:30.320 Interesting difference. What about groups like Anonymous? 295 00:14:30.559 --> 00:14:34.279 They took it further. Loulsek and Anonymous had Operation Anti 296 00:14:34.279 --> 00:14:37.759 Security in twenty eleven. They hacked places like the CIA 297 00:14:37.960 --> 00:14:41.600 the US Senate, claiming they were exposing classified info to 298 00:14:41.639 --> 00:14:43.080 help the government fix their issues. 299 00:14:43.159 --> 00:14:44.000 Helping by hacking. 300 00:14:44.039 --> 00:14:47.679 That's bold, very Lulsek even put out a letter warning 301 00:14:47.720 --> 00:14:51.799 regular Internet users about weak security on Facebook, Gmail, Skype. 302 00:14:52.159 --> 00:14:55.600 Another group, goat see Security, hacked at and T's iPad 303 00:14:55.639 --> 00:14:58.679 network in twenty ten, affecting over one hundred thousand users 304 00:14:58.720 --> 00:15:01.320 just to show vulnerabilities. The framed it as a service to. 305 00:15:01.279 --> 00:15:03.159 Customers, and it gets political too. 306 00:15:03.039 --> 00:15:06.159 Right deeply. Anonymous went after the Syrian government in twenty 307 00:15:06.159 --> 00:15:10.919 eleven twenty twelve, hacked websites, emails, even leaked emails showing 308 00:15:10.960 --> 00:15:13.559 advice given to president aside for a big TV interview 309 00:15:13.679 --> 00:15:16.519 EW And in twenty twelve they hit Alabama state website 310 00:15:16.519 --> 00:15:21.279 to protest immigration laws. Releasing residents personal records direct political action. 311 00:15:21.399 --> 00:15:23.320 But there have to be strong arguments against this. 312 00:15:23.720 --> 00:15:28.000 Absolutely, Releasing government secrets could endanger soldiers or agents, shutting 313 00:15:28.000 --> 00:15:32.159 down websites, disrupts essential services. Add More, Mullen, when he 314 00:15:32.240 --> 00:15:36.120 was chairman of the Joint Chiefs, said WikiLeaks, which often 315 00:15:36.120 --> 00:15:39.519 published leaks from hackers, might end up with blood on 316 00:15:39.559 --> 00:15:42.279 their hands. And just the legality of it right, As 317 00:15:42.320 --> 00:15:45.120 one British editor, Paul Connolly put it bluntly, it is 318 00:15:45.159 --> 00:15:47.039 simply illegal to hack into phones. 319 00:15:47.440 --> 00:15:49.720 That whole news of the world scandal in the UK 320 00:15:49.960 --> 00:15:51.600 really brought that home, didn't it. 321 00:15:51.639 --> 00:15:55.320 Definitely A huge newspaper shut down in twenty eleven over 322 00:15:55.399 --> 00:16:01.000 allegations its reporters hacked hundreds of cell phones, crime victim, celebrities, 323 00:16:01.039 --> 00:16:04.919 politicians just to get scoops. One former editor even tried 324 00:16:04.919 --> 00:16:07.120 to justify it as part of the journalistic mission. 325 00:16:07.360 --> 00:16:10.519 So how does the public see these hectivists? It seems divided, 326 00:16:10.679 --> 00:16:11.240 very divided. 327 00:16:11.360 --> 00:16:14.320 Hacktivists were apparently responsible for almost sixty percent of all 328 00:16:14.360 --> 00:16:17.440 stolen data in twenty eleven. Businesses often see them as 329 00:16:17.440 --> 00:16:20.480 a bigger, more unpredictable threat than regular cyber criminals. But 330 00:16:20.559 --> 00:16:25.120 then you see anonymous topping Time magazines Most Influential People 331 00:16:25.200 --> 00:16:28.480 poll in twenty twelve, got way more votes than President Obama. 332 00:16:28.639 --> 00:16:31.720 It shows a real split in public opinion about their 333 00:16:31.720 --> 00:16:32.720 methods and motives. 334 00:16:32.879 --> 00:16:37.240 Okay, so it's messy complicated. Given all this, this constant 335 00:16:37.240 --> 00:16:40.519 back and forth, can hackers actually be stopped? Is this 336 00:16:40.639 --> 00:16:41.399 fight winnable? 337 00:16:41.840 --> 00:16:45.120 That's the million dollar question, isn't it. Secre Computing Corporation 338 00:16:45.240 --> 00:16:47.080 called it a cat and mouse game that's unlikely to 339 00:16:47.200 --> 00:16:50.840 end soon. Hackers are specialists, always innovating, finding new ways 340 00:16:50.879 --> 00:16:52.639 around security improvements. 341 00:16:52.279 --> 00:16:56.879 Especially with these advanced persistent threats exactly apts. 342 00:16:57.000 --> 00:17:00.759 These are long term, sophisticated attacks, often date sponsored or 343 00:17:00.799 --> 00:17:04.160 by very organized groups. They're patient, they adapt, They're incredibly 344 00:17:04.200 --> 00:17:05.599 hard to defend against completely. 345 00:17:05.680 --> 00:17:08.759 The governments are trying to clamp down. You mentioned laws, right. 346 00:17:09.039 --> 00:17:11.319 The US has the Computer Fraud and Abuse Act from 347 00:17:11.400 --> 00:17:14.480 way back in eighty six. China brought in laws in 348 00:17:14.519 --> 00:17:18.799 twenty eleven making even possessing hacking tools illegal with long 349 00:17:18.839 --> 00:17:23.480 prison sentences, and the US keeps proposing new laws funding research. 350 00:17:23.200 --> 00:17:24.039 And law enforcement. 351 00:17:24.240 --> 00:17:28.279 The FBI has dedicated cybercrime units. They've made some big busts, 352 00:17:28.519 --> 00:17:31.640 like the Rov group that stole millions from computers worldwide. 353 00:17:31.759 --> 00:17:35.000 They've also arrested members of anonymous in Luldzek for things 354 00:17:35.039 --> 00:17:37.599 like the stratfor hack using stolen credit cards. 355 00:17:37.920 --> 00:17:39.279 And they sometimes turn hackers. 356 00:17:39.559 --> 00:17:43.119 Yeah, that's a controversial tactic using hackers as informants. Hector 357 00:17:43.160 --> 00:17:47.839 Monseigor Sabu a leader in Luldzek. He became an FBI informant, 358 00:17:48.000 --> 00:17:52.200 helped them arrest others in exchange for leniency. It works sometimes, 359 00:17:52.559 --> 00:17:54.119 but raises ethical questions. 360 00:17:54.279 --> 00:17:56.640 Is everyone on board with these government tactics? 361 00:17:57.000 --> 00:18:01.200 Not entirely. Germany's highest court push back against police using 362 00:18:01.200 --> 00:18:05.440 spyware citing privacy. US email providers have fought against giving 363 00:18:05.519 --> 00:18:09.400 access to accounts without warrants. There's pushback on privacy grounds. 364 00:18:09.440 --> 00:18:11.720 What about the tech industry itself? What are they doing? 365 00:18:11.880 --> 00:18:15.319 They're definitely involved. Microsoft created its Digital Crimes Unit in 366 00:18:15.359 --> 00:18:20.279 twenty ten, lawyers investigators fighting cybercrime globally. They helped take 367 00:18:20.319 --> 00:18:23.799 down the Rustock botnet. Remember the one sending thirty billion 368 00:18:23.839 --> 00:18:28.079 spam emails a day, and the whole cybersecurity field is professionalizing. 369 00:18:28.799 --> 00:18:34.079 Huge demand for Certified Information Systems Security professionals CISSPs. They 370 00:18:34.119 --> 00:18:36.839 needed like two million more by twenty fourteen. The demand 371 00:18:36.880 --> 00:18:42.160 is massive, plus developing defensive tools like honeypots. Honeypots yeah, 372 00:18:42.160 --> 00:18:46.440 basically decoy systems set up to lure attackers, trap their malware, 373 00:18:46.680 --> 00:18:47.920 and study their techniques. 374 00:18:48.079 --> 00:18:51.160 Clever is their cooperation between companies. 375 00:18:51.359 --> 00:18:56.079 Increasingly, Yes, financial giants like Morgan Stanley, Goldensachs partnering with 376 00:18:56.160 --> 00:18:59.559 universities like NYU to share threat data spot attacks. Earlier, 377 00:19:00.079 --> 00:19:02.680 the FCC push for an anti bought code of Conduct 378 00:19:02.720 --> 00:19:03.720 for Internet providers. 379 00:19:04.039 --> 00:19:07.519 Collaboration is key, but there are still big gaps in defense. 380 00:19:07.759 --> 00:19:10.839 Huge gaps. Estimate suggests only maybe twenty five percent of 381 00:19:10.880 --> 00:19:14.000 electronic data is properly secured, and forty percent of business 382 00:19:14.039 --> 00:19:16.480 leaders admit they just don't have the capability to detect 383 00:19:16.559 --> 00:19:18.039 or prevent cybercrime effectively. 384 00:19:18.079 --> 00:19:19.559 Even chief technology officers. 385 00:19:19.640 --> 00:19:22.480 Even among CTOs, only about fifty nine percent felt really 386 00:19:22.519 --> 00:19:25.640 confident they could fend off attacks. A big barrier's budget, 387 00:19:25.759 --> 00:19:29.000 especially for smaller businesses, and finding skilled security people is 388 00:19:29.160 --> 00:19:30.519 tough and expensive. 389 00:19:30.079 --> 00:19:31.720 And we still make mistakes ourselves. 390 00:19:32.000 --> 00:19:35.519 Oh yeah, user error is still a big factor. Microsoft 391 00:19:35.559 --> 00:19:38.119 figured about five percent of people don't handle their antivirus right, 392 00:19:38.440 --> 00:19:42.240 might even download malware despite warnings, and free antivirus often 393 00:19:42.279 --> 00:19:45.000 isn't as good as paid versions, leaving gaps. 394 00:19:44.920 --> 00:19:46.720 So it feels like we're always playing. 395 00:19:46.559 --> 00:19:49.920 Catch up pretty much. A Dloitte study found hackers developed 396 00:19:49.920 --> 00:19:53.880 new attacks much faster than defenders can create defenses. Perry 397 00:19:53.880 --> 00:19:58.640 Olsen at Intel basically said, compromises inevitable, Data loss is inevitable. 398 00:19:58.720 --> 00:20:01.400 What of do us? Is a shift in thinking, maybe 399 00:20:01.400 --> 00:20:03.559 perfect prevention isn't possible. 400 00:20:03.160 --> 00:20:05.599 So focus on resilience bouncing back. 401 00:20:05.680 --> 00:20:08.359