Latest / Uncomfortable Conversations with Josh Szeps / Who's hacking you right now? with ethical hacker Assadi Youssef

Transcript

Who's hacking you right now? with ethical hacker Assadi Youssef · Uncomfortable Conversations with Josh Szeps

• 0:03
  G'day humans!
• 0:04
  Welcome to the safe space for dangerous ideas, data breaches and hacks when you read about them in the news.
• 0:11
  Are you actually worried?
• 0:13
  Do you actually check whether or not your personal data has been spilled onto the dark web?
• 0:19
  Or like most of us do, you roll your eyes and think, what exactly is new?
• 0:23
  Well, will that continue to be the case?
• 0:25
  Or will artificial intelligence lead to a world where doing anything online is essentially free from the privacy that you have expected when you deal with banks and utilities and so on?
• 0:36
  Is AI going to make things more secure?
• 0:37
  Is it going to turn the Wild West into a place where there is no privacy at all?
• 0:42
  Asadi Youssef, today's guest, was an 11-year-old boy hacker genius who got up to, I suppose, nefarious hacking, shall we say, before he came over to the good side and became an ethical hacker, meaning that he would find and identify vulnerabilities in supposedly impenetrable systems for companies.
• 1:03
  And he's now an online security genius.
• 1:05
  He advises banks and critical infrastructure companies and so on about how to protect their systems from catastrophic attack.
• 1:11
  I wanted to get him in to explain for us who is doing all this hacking exactly.
• 1:16
  Is it China?
• 1:17
  Is it Russia?
• 1:18
  Is it a nerd in his parents' basement?
• 1:21
  Should we all have universal digital IDs so that our data isn't floating around out there?
• 1:26
  Do we even care if anyone has our data?
• 1:28
  What exactly can they do with it?
• 1:30
  How is AI changing the game?
• 1:32
  And do you honestly, really, seriously need the two-factor authentication text message in order to log into everything?
• 1:40
  Or is that just security theatre?
• 1:42
  I hope you enjoy, as much as I did, the one and the only, Asadi Youssef.
• 1:54
  So when we talk about hackers, I think everyone has this kind of cliche of someone sitting in a basement and then sending a Bitcoin ransom to some individual human being or pretending that they have footage of them masturbating in front of their webcam or something like that.
• 2:09
  But there's more than one kind.
• 2:13
  What are the groups?
• 2:14
  Who is hacking?
• 2:16
  Who is hackers?
• 2:17
  Tell me.
• 2:18
  Who is hackers?
• 2:19
  So I think to some extent, what you're saying definitely was the picture that was drawn, you know, maybe a couple of decades back.
• 2:27
  And that would be your archetype.
• 2:29
  You know, the guy in his basement, never left home.
• 2:31
  Yeah.
• 2:32
  Hoodie on.
• 2:33
  Always portrayed with a hoodie.
• 2:34
  Always with a hoodie.
• 2:35
  Yeah.
• 2:35
  In the gloom.
• 2:36
  Exactly.
• 2:36
  By a non-affairs program, so I don't want to show you his face.
• 2:39
  Absolutely.
• 2:39
  And could be working for a foreign state or even like some sort of hacktivism.
• 2:45
  With how times have changed now, that has kind of blown everything out of proportion.
• 2:51
  Because essentially anyone right now can hack.
• 2:53
  I think hacking is like the easiest it ever has been.
• 2:56
  Really?
• 2:57
  Yeah, I think so.
• 2:58
  I still think there's like a level of know-how.
• 3:02
  But the resources online and the education, the tooling that you can come across just from essentially searching it up,
• 3:12
  It's too accessible.
• 3:13
  Right, right.
• 3:14
  You mean on like forums and stuff, not even on the dark web?
• 3:17
  I don't even think dark web really comes into conversation as much as it needs to anymore.
• 3:21
  I mean, you've got, you know, white knights essentially create tooling for companies but can also be used on the site.
• 3:26
  What are white knights?
• 3:28
  Yeah.
• 3:28
  I call them white knights, but essentially, you know, like cyber researchers and security researchers who might use tooling for themselves and for, you know, their own mission, which could be used out of good faith.
• 3:38
  But a lot of it is uploaded towards, you know, repositories like GitHub and whatnot, these websites where, you know, the rest of the open source community can use it.
• 3:48
  So you know, you got like a 12 or 13 year old who can come across that.
• 3:53
  They're just browsing forums.
• 3:54
  Yeah, forums, repositories, you know, and with that, they'll get like a, I guess, a manual on how to use it.
• 4:01
  And it's really kind of like click and paste sometimes.
• 4:03
  Right.
• 4:04
  I'm not going to say that it's the easiest thing in the world, but it's not hard either.
• 4:07
  And hacking.
• 4:08
  So, I mean, what are the tiers of hacking?
• 4:10
  Because presumably it's pretty hard to hack into an international bank and steal people's money.
• 4:15
  When you say that it's not hard to hack, what are we talking about?
• 4:18
  Yeah.
• 4:19
  So I used to think, especially when I was pen testing, or I guess hacking, ethically hacking, that, yeah, it would take some sort of master idea to get into a bank and so forth.
• 4:29
  But I mean, you don't have to look far to see breaches that have occurred in the last couple of years in Australia and around the world.
• 4:36
  And they always come down to the same thing.
• 4:39
  It's like human error.
• 4:41
  Human error normally causes most of these problems.
• 4:43
  It's not the fact that you've got...
• 4:45
  10 geniuses in a room who've created a master plan.
• 4:48
  Sure, that could be the case, but more often than not, it's one person who has decided to try a low hanging fruit from what they've seen.
• 4:56
  And it just so happens to work and that just so happens to create a breach.
• 5:00
  Right.
• 5:01
  Yeah.
• 5:01
  Yeah.
• 5:01
  So it's almost like, I mean, I remember working when I was working at a big organization
• 5:05
  The security team at the organization required everyone to change their passwords ridiculously frequently.
• 5:11
  It was only like six weeks or every two months or something like that.
• 5:15
  And it had to have capitals and special characters and lowercase and numbers.
• 5:20
  So what did everyone do?
• 5:21
  They wrote their password on a post-it note and they would stick it on the screen of their computer.
• 5:25
  because there's no way to remember what password you've got.
• 5:28
  Who's going to remember it every single day.
• 5:29
  Yeah, that's right.
• 5:30
  I remember talking to a security guy going, have you ever thought about human psychology?
• 5:33
  Have you thought about the fact that if you let people keep a password for 12 months, then maybe they wouldn't write it on a Post-it note and stick it on their desk, and that might actually be more secure.
• 5:43
  It's catch-22.
• 5:43
  Yeah, right.
• 5:45
  So is that the kind of human error that you're talking about?
• 5:48
  I mean, what is hard hacking?
• 5:51
  What is easy hacking?
• 5:53
  And who is doing both?
• 5:54
  So if we're going to categorize it into easy and hard, I'd say easy is anything that, yeah, directly kind of correlates to the person on the other side.
• 6:03
  So if you talk to a telco and you've called them up and you're talking to, I guess, like an analyst.
• 6:08
  A phone company.
• 6:09
  Phone company.
• 6:09
  For our American friends.
• 6:10
  For American friends.
• 6:11
  Yeah, your phone company.
• 6:12
  And, you know, you're calling about your plan.
• 6:15
  Yeah.
• 6:17
  I think knowing enough information about the target you're going after and playing with the human emotion of the worker on the other side is enough to get what you want a lot of times.
• 6:27
  I mean, social engineering is real, right?
• 6:29
  Social engineering being?
• 6:31
  So the manipulation of, I guess, getting information out of, I guess, your target.
• 6:37
  So if I'm going after a CEO and I've got enough information about this CEO, could I play the card of being his wife?
• 6:45
  For instance, if I'm a woman.
• 6:47
  Oh, could I play the card of being his?
• 6:49
  I'd like to hear you try.
• 6:50
  You've got a pretty deep voice.
• 6:51
  I do.
• 6:51
  Hello.
• 6:52
  I can get it there.
• 6:54
  So social engineering, did you say?
• 6:56
  Yeah.
• 6:57
  Is in hacking contrasted against technical expertise, social meaning that you know who you're going after.
• 7:04
  Right.
• 7:04
  You build up a database of information on the basis of your social ability, your interpersonal skills, so to speak, and you can do it the old fashioned way, the analog way almost.
• 7:14
  Yeah.
• 7:14
  Absolutely.
• 7:15
  And I think almost like the analog way still kind of goes down that hard route that we're about to get into, right?
• 7:19
  Like, I don't necessarily think because you're going after humans, it's always easy.
• 7:23
  But if you build up a strong enough persona for you going after, there's not a lot of other validation that can be done against you if you are someone that's unknowing.
• 7:32
  You know, if I call someone from a phone company and I've given the email and the account number and every X, Y and Z question they throw at me.
• 7:39
  Well, how can they keep going down the route of validation, right?
• 7:42
  A lot of, I guess, phone companies, especially maybe 10 years back, wouldn't really go as far as an MFA code.
• 7:49
  Like they wouldn't send you a prompt code.
• 7:51
  They just ask you, what's your email, your date of birth, and your account number.
• 7:55
  And it's like, you've got the keys to the kingdom.
• 7:57
  So... Do you have the keys to the kingdom?
• 7:59
  So what if I can control your phone plan?
• 8:01
  Yeah.
• 8:02
  So I think it's like data gathering, right?
• 8:04
  So you go down the route of trying to traverse within someone's account.
• 8:09
  It might not be the fact that you've got control of the phone plan, but it's the fact that you've got someone's identity, right?
• 8:14
  In which case, not a lot of people want that to be the case.
• 8:16
  So if I can keep going down that route, how far can I take it?
• 8:18
  If
• 8:23
  and now traversing onto the next person.
• 8:25
  It's like there's clearly a gap within this phone company that no one's seeing.
• 8:28
  And the gap is the fact that there's not enough validation.
• 8:30
  There's not enough way to prove someone's identity.
• 8:33
  But just to stay on the keys to the kingdom for a moment, because I think a lot of people are confused, as am I, about what hackers are actually getting.
• 8:42
  Like we all know that if they're holding someone to ransom and they're asking a company for $100 million, otherwise they're going to release all of these secrets that they've stolen on the dark web.
• 8:50
  That's one thing.
• 8:52
  Someone gets access to my phone plan.
• 8:53
  Yeah.
• 8:54
  Now they know my telephone billing number and my card number possibly.
• 8:59
  Right.
• 8:59
  So if I call log.
• 9:00
  Maybe my card number.
• 9:01
  And I say, hey, I actually want to change how this routes.
• 9:05
  For instance, this card is not going to be in use really soon.
• 9:08
  Do you mind if I get that card on file?
• 9:10
  I'm going to get rid of it anyway.
• 9:11
  I might put this one down.
• 9:13
  You say it in a way that's kind of flowing with the conversation.
• 9:16
  I don't think a lot of people on the other side are going to really take that into account.
• 9:18
  They're not going to read me back my card number, though.
• 9:21
  They might not, but they might send it to you in an email.
• 9:23
  They might give some sort of indication of what that card number could be.
• 9:27
  And in many cases, they might read it back.
• 9:29
  I mean, who's to tell they won't if they've been able to give me most things back already.
• 9:33
  Okay.
• 9:33
  And I suppose if it's a phone company, they might even let me port my phone number to a new device, in which case I would then control your phone number and I could use two-factor authentication.
• 9:41
  SIM swapping, exactly.
• 9:42
  SIM swapping, which is very big, especially in the States.
• 9:45
  That's been, you know, I think in Australia, we haven't really come across it as much as far as I'm concerned.
• 9:51
  But I know…
• 9:52
  But Verizon, some of these other big phone companies, they've been definite victims of it.
• 9:57
  And it's quite dangerous in that sense.
• 9:59
  You get someone's phone to kind of write back to yours.
• 10:01
  You now have the MFA prompt.
• 10:03
  You can essentially traverse from there.
• 10:04
  MFA being the multi-factor.
• 10:06
  The multi-factor where you try to log into your bank or something like that or your airline rewards or something.
• 10:12
  Right.
• 10:12
  will send you a two factor, they'll send you a text code to put in.
• 10:16
  So if you can commandeer somebody else's phone number, then you can get into everything else with a sufficient amount of information.
• 10:23
  Yeah, it's almost scary how that's kind of like the last line of defense in a lot of ways.
• 10:27
  Hey humans, just jumping in here quickly to make sure you're aware that this is just a preview.
• 10:32
  This is just a brief highlight of one of our premium episodes.
• 10:37
  If you weren't aware, it is our very generous paid subscribers and channel members who help make all of this possible.
• 10:44
  And they get extra juicy premium episodes just like this one.
• 10:47
  You can become a member on YouTube to watch the full episode.
• 10:51
  Or you can subscribe via our sub stack to get the entire backcast.
• 10:55
  catalogue of mind-expanding, bullshit-free, uncomfortable conversations.
• 11:00
  Back to the show.
• 11:01
  Right.
• 11:01
  So to kind of route back to the story of easy and hard, that would be considered an easier hack, even though there are steps to it.
• 11:09
  You're not going through a month-month cycle of doing reconnaissance and finding out a very particular way to get in a very particular defense.
• 11:19
  Right.
• 11:19
  Because I guess when you look at the nation-state-sponsored hackers, right?
• 11:23
  They're completely funded by their government or their agency.
• 11:27
  They're given all the, I guess, resources available, all the intel available, teams that are made up of how many people.
• 11:33
  And typically, they're not doing hacks that are known to men.
• 11:36
  They're going for what's called a zero day, a hack that's never been done before, or an exploit, I should say, right?
• 11:42
  So zero day in the realm of, you know, like wartime right now, we see a lot of things going around the world.
• 11:48
  I've got no doubt there are cyber researchers and security researchers who are creating tooling, looking for exploits that have never been done, and selling those for large amounts of money to agencies to use as a one-time use.
• 12:02
  Of course, that might not be the case every time, but it's a very big benefit, I guess, in the times of war, because it's kind of like unknowing as well.
• 12:11
  Right.
• 12:11
  What is our opponent going to hit us with?
• 12:14
  Zero day is a reference to what?
• 12:18
  Well, I guess it's a zero day.
• 12:20
  It's just never been done before to this particular software.
• 12:23
  I see.
• 12:23
  Right.
• 12:23
  So it could be maybe a submarine, for instance, that has definitely had every type of defense thrown to man inside, but there might be a possible...
• 12:33
  angle that there might be a weak link in, in which case, you know, you get a bunch of exploit developers from this nation state sponsored group, and they've come up with a way to get past it.
• 12:44
  And that costs a lot of money, right?
• 12:47
  You just spent how many millions and millions of dollars making this submarine just for it to kind of get done.
• 12:53
  Yes.
• 12:54
  Okay.
• 12:54
  So, I mean, let's suppose Russia finds a zero-day exploit on a Chinese sub or something like that.
• 13:00
  What do the states tend to do?
• 13:02
  And particularly this is the hard end, right?
• 13:05
  I mean, this is something that the kid with the hoodie is not getting into a nuclear submarine.
• 13:10
  But suppose a state does.
• 13:12
  Is there a market for that information or is the state that finds it likely just to sit on that and use that as their arsenal?
• 13:18
  And at some point, presumably the Chinese are going to find out about it, not from the Russians, but from their own people to keep trying to punch holes.
• 13:26
  And they'll be like, oh shit, there's this back door that someone else might know.
• 13:29
  And they'll presumably patch it before the Russians can.
• 13:31
  exploit it well that's kind of you've placed it out perfectly there's two two ways around it um do we sell it for a stupid amount of money and we're talking millions right or do we millions is probably an understatement if it's a backdoor into the tens of millions if i was donald trump i'd pay billions exactly yeah it's definitely an understatement like tens of millions would would be the case for sure in a lot of ways but uh yeah do we keep it in our back pocket as well
• 13:57
  Could this serve us a better interest later down the line?
• 14:00
  And it really comes down to which group is kind of paying with it.
• 14:03
  If you've got hackers from the Chinese government, I'm sure they're going to serve their interests of the government.
• 14:07
  But if you've got these, I guess, hacktivists of some sort, or you've got just small rogue groups around, they're doing it for money, right?
• 14:14
  It's a monetary gain.
• 14:15
  It's a clout gain.
• 14:15
  It's all, you know, how do I get everyone to look at me?
• 14:17
  Like, typically you see these hacking groups, they will verbally tell the world when they've done something because it is...
• 14:25
  a part of pride as well, right?
• 14:26
  Like we did this, you know, we just put the Chinese government, for instance, on their ass, you know, this submarine that costs billions to make, we did it, us four guys.
• 14:33
  So there is a part of that too.
• 14:35
  Yeah.
• 14:36
  Right.
• 14:36
  Yeah.
• 14:36
  Yeah.
• 14:37
  And, and so while we're on the, we can, I want to go back to the,
• 14:40
  sort of easy things and like data breaches and stuff like that, because this is the everyday kind of thing that we always encounter, the irritation of having to answer security questions when you... By the way, let's just do an aside about security questions.
• 14:52
  While we're on the, like, you know, things jotted on a post-it note on the front of a computer screen.
• 14:58
  The security questions that you get asked on some websites...
• 15:03
  drive me up the wall.
• 15:06
  Like United Airlines got rid of their, you know, their password protection and their MFA, I think in favor of a list of eight of the most stupid questions you've ever heard in your entire life.
• 15:18
  What was your first school teacher's name?
• 15:20
  What's your favorite musical instrument?
• 15:22
  Like the answers that I would never know what I answered six months ago,
• 15:26
  to these things.
• 15:27
  So I do what I assume most people do, which is I select either all of the answers that begin with the letter G, or I just select the first one in the list, or I select the last one in the list.
• 15:39
  And that's just always my answers, because then that's an easy mnemonic for me to remember.
• 15:44
  Which means that presumably, many, many people can have their accounts hacked by a pretty common sense hacker who just goes, I'll bet most people aren't answering this
• 15:54
  legitimately, they've probably got some kind of a rule that they're following.
• 15:57
  So I'll just follow a whole bunch of different rules and I'll get into a whole bunch of different accounts.
• 16:02
  Can we get rid of security questions?
• 16:05
  Yeah, 100%.
• 16:07
  If I do see a company now that is continuously using security questions, I will question the company myself.
• 16:13
  I mean, the whole...
• 16:15
  act of how I got into hacking was through a security question.
• 16:17
  You know, like when I was 11 years old, going into Facebook and trying out what's your pet's first name to my year five colleagues.
• 16:26
  Like that was my route into it.
• 16:27
  So it showed like an 11 year old had this mindset of well, surely this isn't strong enough.
• 16:33
  And two decades later,
• 16:35
  We're here now, and you just said United is doing the same thing.
• 16:38
  We should be moving away from passwords and password-protected questions.
• 16:42
  I think passkeys are the way forward.
• 16:45
  I'm a very big believer of passkeys.
• 16:46
  Just pause on that for a second before we go down the passkey route.
• 16:50
  So you're 11 years old, and Facebook has an ability where you can get into your account without a password by knowing your email address, your pet's first name, and the city that you grew up in or something like that, right?
• 17:03
  Yeah, exactly.
• 17:04
  Yeah, yeah.
• 17:04
  So all you have to do is what?
• 17:05
  Go around to your classmates and go, hey, what's your pet's name?
• 17:08
  And where are you from again?
• 17:09
  That's exactly how it went.
• 17:10
  That's exactly how it went.
• 17:11
  I remember very, very vividly going to class the next day with like a list of people on the list.
• 17:18
  And I was like, all right, let's go to this girl here.
• 17:21
  So your pet's name, what's your pet's name?
• 17:23
  Tell me hers.
• 17:24
  Your mom, what city was she born in?
• 17:26
  And I just kept going to everyone in class.
• 17:28
  I went home that day, I had a field day.
• 17:29
  I had a field day at home.
• 17:31
  And you log into all their...
• 17:32
  Yeah, just because.
• 17:33
  It's like, who's going to stop me?
• 17:35
  Right.
• 17:36
  Did you post rude things on their accounts?
• 17:38
  No, but I think I found out all the gossip I needed to in school at the time.
• 17:41
  That was strong information.
• 17:42
  Yes, you knew everything from all their messenger channels.
• 17:44
  Absolutely.
• 17:45
  Right.
• 17:46
  And that just became a whole thing of, well, this is Facebook, a multi-billion dollar company that is...
• 17:52
  presumably protecting your identity.
• 17:55
  How many other companies doing this?
• 17:57
  I'm just Facebook to the next one to the next one.
• 18:00
  And thus a little hacker was born.
• 18:01
  Exactly.
• 18:02
  Yeah, I mean, it depends what the hacker wants, right?
• 18:04
  I mean, I think a lot of people think, a lot of people have the attitude of, I don't really care if my information is out there because what are they going to take?
• 18:12
  Like if they charge my credit card, my bank is basically going to be, they're going to pay for it, right?
• 18:18
  It's always going to come back to an institution somewhere.
• 18:21
  But up until recently, I mean, I used to see people posting photos on Instagram of their boarding pass before they would go away on a trip from like, you know, the gate at the airport.
• 18:32
  And I would, because I'm a bit of a frequent flyer nerd, I would always be like, you do realize that with the reservation code on that boarding pass.
• 18:41
  It can manage your boarding.
• 18:41
  And your last name.
• 18:42
  Yeah.
• 18:43
  Someone can cancel your return flight without even talking to a human being.
• 18:48
  You can just go to the...
• 18:49
  Most airlines have changed this now, but only in the past six months or so do they require... And it's not very much.
• 18:54
  They just require your date of birth now, most airlines.
• 18:57
  But if you have the record locator and the first name and the last name and the date of birth, you can change and cancel a booking without being logged into anything.
• 19:07
  So I sometimes get on a plane and someone's left their boarding pass in the seat in front.
• 19:13
  I'm like, I can cancel your return flight, bro.
• 19:15
  And a lot of the time, the thing you hear back is, why do I care for?
• 19:19
  It's that mindset of, why do I need to care?
• 19:21
  And it's like, do I have to prove to you why?
• 19:23
  So I'm actually a victim of that.
• 19:24
  Really?
• 19:24
  Yeah, I was a victim.
• 19:25
  All right.
• 19:27
  G'day humans.
• 19:28
  Well, if you've listened to this much of the episode, then you must enjoy it, presumably, unless you're just listening for masochistic reasons.
• 19:34
  So you should listen to the rest of it.
• 19:36
  And the way you do that is by subscribing to the premium feed, where you not only get to hear the rest of this delightful conversation, and trust me, oh, it gets better than what you just heard.
• 19:46
  But you also get to hear no ads, zero ads.
• 19:49
  And previously, up until now, you had to go to the old sub stack.
• 19:52
  to do that and follow me on Substack and add one more platform to your life if you're not already on Substack.
• 19:58
  But here's the thing.
• 19:59
  We are now on Apple Premium Podcast as well.
• 20:02
  So with one click, Apple will just subscribe you up to the premium feed.
• 20:05
  You'll be able to listen to the rest of this conversation right now, right now.
• 20:08
  right now.
• 20:08
  So open up your Apple podcasts, click the old pay old Zepsi button.
• 20:13
  That's probably what it's called pay old Zepsi.
• 20:15
  And you click the button and then you no longer have to be a free rider.
• 20:19
  You can feel like you're contributing to the mission of this show, which is really what we're all here for better conversations, a freer, more freewheeling attitude towards the things that we can talk about.
• 20:30
  a way to steel man our opponents and to take the most gracious approach towards disagreement.
• 20:35
  That is what you're voting for when you vote for Uncomfortable Conversations by going into your Apple Podcasts and clicking subscribe.
• 20:42
  I love you.
• 20:43
  If you don't do that, that's fine.
• 20:45
  I'll see you the next free episode, I guess.
• 20:47
  Take care.
• 1:22:05
  .