The Pop Culture Hacker Image is Deterimental to Real Security

You guys probably know my stance on the usage of the word hacker. You probably also know that the pop culture image of a hacker cultivated by Hollywood annoys the hell out of me. People think that hackers are some super-human geniuses who can break into just about any computer systems by simply rapidly typing on a keyboard. It’s sad – and while most people know that CIA agents to drive flying amphibious cars and have mini-machine guns in embedded in their wristwatches just like James Bond, they seem to eat up all the “hacker” science fiction.

Even the people who should know better, fall into this trap. Go pick up 2600 magazine one day and you will see what I mean. Of course, granted – 2600 is probably not your finest zine out there. Some issues feel like reading about stuff that was cool on the internets 6 month ago, only on dead tree media. But you’d figure that editors of a “Hacker Quarterly” would know better than this. But no – the whole thing is like “hackers this” and “hackers that” – ugh… Even my brother thought it was bit juvenile. I left the magazine in the bathroom once and he started reading it. Afterwords he told me it sounded as if it was written by a 14 year old who just watched Hackers. Btw, I’m not knocking their content – just the attitude. Then again, I guess those who read, or write articles for zines like that have a good idea about security so they are not really doing that much damage here.

Hollywood on the other hand does. Let’s face it – if the average Joe believes that a hacker can just sit at a computer and hax it by pounding on the keyboard for 15 minutes then we have a problem. Do you think they will adhere to all the security policies if they believe that: dude, like a real hacker could like break this encryption in like 5 seconds. Most people believe that hackers are these super intelligent people with awesome skills way beyond the understanding of a mere mortal. They are like some soft of computer gods that must be feared – which of course is bullshit. People have it all backwards. Anyone can hack. You, me, my grandmother – it’s really not that hard. The problem is on your end – your security policies and your setup determines how hard is it to 0wn your system. I think this Bigger Than Cheeses cartoon sums this all up perfectly:

Bigger Than Cheases FTW

You don’t need to be a security expert to implement basic security precautions. You don’t need to be a 3117 h4x0r to protect your systems from 90% of malicious attacks. Most of the security stuff is common sense. You have to keep two things in mind:

  1. All software is shitty and buggy from the get go. It is impossible to create sufficiently complex application that has zero bugs. Why? Because you can never find all the bugs by testing. Every single piece of software ever made is flawed and therefore potentially exploitable. The more applications you are running, the bigger the chance that one of them can become a security concern. There is not much you can do about this, but you can minimize the threat by following basic security guidelines like regularly patching the systems, not running as admin, disabling unnecessary services, keeping all machines behind a firewall, using encryption on sensitive data, using two factor authentication, reading the fucking memos from the sysadmin (even when he is a BOFH) and etc…
  2. Social engineering just works! You can have the best security experts in the world working 24-7 to keep your systems secure, but if the Joe the Janitor let’s Harry the H4x0r into the server room after hours you are fucked. So your security is directly proportional to how well you have trained the dumbest, most technologically illiterate person in your organization. Cause if I can convince that guy that I’m working for the IT department, and that I need the Admin password then I really don’t need any super-human computer skills to fuck you over.

So I think that this super-human hacker stereotype is detrimental to security awareness. I think it is one of the contributing factors to the lax attitude towards security exhibited by most folks out there. If you believe that the biggest security threat out there are these guys:

Oh no! Hackers!

then you are ill prepared to face reality. Anyone can be a security threat – they do not need to have special skills, or a really cool nickname. They can be anyone – especially current and former employees or staff. They don’t even need to be that knowledgeable about computers – you can get “hacked” by that dumb, clueless guy who could barely figure out how to turn on his computer in the morning, or the disgruntled cleaning lady. But they can only do this if you give them the opportunity. And this window of opportunity can be minimized by hiring a good security conscious sysadmin, training your employees, and maintaining popper access controls (ie. Bob from accounting doesn’t get the Admin password, and Joe the Janitor doesn’t get the keys to the server room, no matter how much he says he needs them).

[tags]hackers, hacking, security, social engineering, software[/tags]

This entry was posted in technology and tagged . Bookmark the permalink.



4 Responses to The Pop Culture Hacker Image is Deterimental to Real Security

  1. While we’re at it, it’s CIA officer, not CIA agent. The FBI has agents, the CIA has officers. A CIA agent is a human asset, someone who is feeding information to a CIA officer. But the guys running around in the dark getting paychecks from the U.S. govt. are CIA officers. :-)

    Reply  |  Quote
  2. Luke Maciak UNITED STATES Mozilla Firefox Windows Terminalist says:

    Oh… Hmm… I guess assumed it’s agent because of the whole “secret agent” thing. Oh well. Thanks for the correction. :)

    Reply  |  Quote
  3. Muhammad SINGAPORE Mozilla Firefox Windows Terminalist says:

    Your post here reminds me of an article I’ve read on cracked.com.

    5 Things Hollywood Thinks Computers Can Do

    Tickles the sh*t out of me!

    Reply  |  Quote
  4. Luke Maciak UNITED STATES Mozilla Firefox Windows Terminalist says:

    Hehe… I like the term they used “plot hole spackle”. Good one!

    But they are right – hacking in most movies is just like magic. A mysterious, poorly understood force that binds the universe together, and can be tappend into by the special gifted people. Sigh… Clarke’s third law is working against us here. :(

    Reply  |  Quote

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>