Becoming an Ethical Hacker

PROLOGUE

Angela Gunn is fried. This is one of those frantic periods when it feels as if she works in an ER or at a fire station rather than holding a staff position with a computer security firm. It’s just after Labor Day 2018, and she’s chosen as our meeting place a café with a dive-bar vibe in a trendy stretch of Seattle’s downtown. Called Bedlam, Gunn declared the place thematically appropriate for any discussion that involves her life and job. A frazzled Gunn plops down in a seat across from mine. I’m a hot mess today, she declares.

This is her life every August, Gunn explains. Invariably, it’s the same around Christmas and New Year’s as well. She’s busiest when the rest of the world is on vacation and online fraud peaks. People attack when they think your guard is down, Gunn says. At the time of my visit, she was juggling three cases. That made for a hectic August that spilled into September. All three were coming to a close, but she had been roped into a fourth. I was up till four a.m. last night and it wasn’t even one of my cases, she says. The late hours were because she needed to speak with the firm’s malware—malicious software—specialist, who lives in Australia. A brilliant guy. I respect the hell out of him, Gunn says. I just wish he didn’t live nineteen time zones away. Her job over the next twenty-four to forty-eight hours will be to find the people her firm needs for this latest case. My guy can’t get here so I need to find boots on the ground, she says. So now it’s about making alliances with people known for wearing hats that are some shade of white.

Gunn orders a tall Rose Mocha latte that the menu describes with flowery prose: Imagine walking in a garden, cool and in the bright sun, a fountain splashing softly, the faint sweet scent of roses & chocolate full of Eastern promise. After reading it out loud to me, Gunn starts rattling off jokes about the new Seattle (she first moved to the city in the late 1990s) and for good measure takes a couple of biting digs at Amazon, which she and others I meet with while in town cast as an Evil Empire, practically swallowing whole the city they love. She brightens when her Rose Mocha arrives. It’s been a rough few weeks, Gunn tells me, I could use a cool walk through a garden right about now.

It’s people like Gunn that organizations large and small call if they’ve had a data breach or suspect they have. People in the industry—cybersecurity, if you’d like, though Gunn’s preference is information security, or info-sec for short—call this incident response. To my mind, though, they’re the online world’s firefighters: those who rush to put out the flames and then assess the damage. Ten years ago, Gunn was working as a tech journalist. Now she works full-time for a long-standing British security firm called BAE Systems, which hired her a couple of years earlier to help them establish a presence in Seattle. Her title is incident response consultant, and it’s her job to assemble the small crew she needs for each case. Typically, that includes an analyst who can pore over computer logs, a malware specialist, and those she dubs forensic workers, except without the formaldehyde smell and ripped-open chest cavities. That’s if she can find any live bodies to do the work.

Right now, I’d sell a right toe for a forensics guy, Gunn says. Like a lot of people in info-sec right now, we’re agonizingly understaffed.

That morning she had been on the University of Washington campus for the quarterly gathering of the Seattle-area computer security group to which she belongs. As usual, that day’s talk, about the special precautions a security team must take to protect power grids, water treatment centers, and other critical infrastructure, was off-the-record. The idea, she explains, is to create a safe space for people so they can speak freely without fear of the consequences. It’s a network of trust. Except when it comes to stealing everyone’s best people, she says. People don’t say hello so much as let one another know what postings they have that remain open. A typical conversation goes, ‘Oh my God, where did you land?’ They’ll say Amazon and you ask, ‘Oooo, are you okay?’ Gunn has been in the business for eight years—if not quite an old hand, then someone who has learned a lot since taking a job at Microsoft, in 2010, where she helped manage the company’s message to the wider world when a bug hit Windows or another Microsoft product.

People in security are changing jobs it seems every year, if not every six months, Gunn says. At the meeting just now, I was like, ‘Maybe one of you guys is my next analyst.’ Except they’re hoping I’ll join their team. A 2015 report by the job analytics firm Burning Glass Technologies found that postings for cybersecurity had grown more than three times faster than other information technology (IT) positions, and roughly twelve times faster than all other jobs. The firm also reported that those working cybersecurity on average earn nearly 10 percent more than others in IT.I

•  •  •

IT WASN’T THAT LONG ago that computer security was more of a niche job category—a wise career choice, perhaps, but a specialty that relegated an employee to a backwater of the computing world. The release of the 1983 movie WarGames woke up many to the importance of cybersecurity in a digital age, including then president Ronald Reagan, who saw the movie the day after its release. Reagan was among those frightened by its depiction of Matthew Broderick as a teen tech whiz who unwittingly breaks into a military computer and nearly triggers World War III. Fifteen months later, in September 1984, the National Security Agency, or NSA, released a policy directive dryly titled, National Policy on Telecommunications and Automated Information Systems Security. The generals and spy chiefs around Reagan concluded that the film wasn’t as far-fetched as they might have hoped. The government’s systems, the policy directive said, were highly susceptible to attack by foreign powers, terrorist groups, and criminals. Yet networking was still an esoteric issue then, even among computer scientists, and personal computers were only starting to appear inside corporate America and in people’s homes. Most people working info-sec then toiled in the bowels of the Pentagon or worked for a big defense contractor.

Slowly, the rest of the world woke up to cybersecurity and the importance of protecting computers, networks, applications, and data from unauthorized access. The invention in the late 1980s of the World Wide Web helped to popularize the internet throughout the 1990s (the web is a user-friendly interface built on top of the internet). But the move online brought with it worms, viruses, and malware. Commerce came to the internet, along with thieves and scammers. We bought security software packages from companies such as McAfee and Symantec, but then used passwords often no more sophisticated than 12345 or a spouse’s name. People talked about computer security but it still wasn’t something most colleges taught. The spread of wireless network—Wi-Fi—made it easy for us to connect our laptops, including work laptops, to the open networks in cafés, airports, and libraries, potentially exposing our personal information to those tech savvy enough to hack into a network. Wi-Fi also inspired wardriving—people creeping along in a car, searching for un-secure networks to infiltrate, maybe for the fun of it, maybe for more nefarious reasons—which, eventually, schooled us on the importance of a secure network.

The advent of thumb drives—USB memory sticks—proved an easy way to transfer documents from one computer to another but also an efficient way to infect a machine with malware. The nanny cams and other gizmos we linked to our networks posed another threat, punching holes in our firewalls and offering potential back doors into our private lives. All these consumer-grade devices are made as cheaply as possible, said Mark Seiden, who has been working in computer security since the 1990s. They use old, unpatched software and a lot of it isn’t even upgradeable. Our smartphones and the tablets we’ve connected to our networks tend to have better security than these cheap, more disposable items, but there’s the so-called Internet of Things, which is this idea that cheap computer chips will be added to everyday items, including the internet-connected devices that transform the places we live into a smart home: smart locks on our front doors and smart thermostats and smart lights, all connected to the same Wi-Fi networks we use to do our banking and carry on private conversations. And now, of course, there are the listening devices people have welcomed into their homes in the form of the voice-activated assistants sitting on the kitchen counters of tens of millions of Americans. Is it any wonder that old hands like Seiden speak of an attacker’s advantage? You’re a business that does everything right but an employee installs a device on the network which has a vulnerability and it opens you up, Seiden said. He should know: for years he has jobbed himself out to big companies looking for help testing their defenses. With everything we’re connecting to our networks, there’s definitely an attacker advantage today, Seiden noted. Cybercrime caused an estimated $3 trillion in damages in 2015, according to the research firm Cybersecurity Ventures. It expects that figure to double to $6 trillion by 2021.II

We survived phishing scams and browser popups and the danger when opening attachments from unknown senders and hijacked Facebook accounts. Yet we now have ransomware. Risk being exposed in front of your friends, spouse, or employer unless the victim sends bitcoin to the hackers who intercepted something incriminating or embarrassing. Or the hostage could be the user’s system. The victim must spend a small fortune cleaning up the malware some no-goodniks have slipped onto their server—or pay the ransom and get back to business. Victims of this second type of attack have included Fortune 500 companies, hospitals, and even police departments. Our financial lives exist online, along with our photos, texts, and medical records. Corporations store their most precious secrets in the cloud, along with ours, including our credit card numbers, social security numbers, and passwords. Yet for more than a decade, we’ve been reading about the huge data breaches hitting one big company after another, including Uber, Google, eBay, and Equifax. Reported data breaches in the United States hit a high of more than 1,500 in 2017—a jump of nearly 45 percent over the previous year.III

Among those hit in 2018: Facebook, where flaws in its code gave hackers access to fifty million accounts, including those of Mark Zuckerberg and his nearly-as-famous number two, Sheryl Sandberg.

Our power grid, our cars, our everyday devices—basically everything is online and able to be attacked, Georgia Weidman, the author of Penetration Testing: A Hands-On Introduction to Hacking, told the New York Times in 2018. Our water supply is increasingly digitized, and therefore more vulnerable to attack.