TLDW logo

Cybersecurity Expert Answers Hacking History Questions | Tech Support | WIRED

By WIRED

Summary

## Key takeaways - **Kevin Mitnick's Social Engineering Mastery**: Kevin Mitnick was the most influential and infamous hacker, known for social engineering by conning people through their desire to trust, serving 5 years in prison for abusing the phone system to make free long-distance calls. [00:28], [00:57] - **Hack Term from MIT Model Trains**: The term hack originated in the 1960s at MIT's model train club, referring to creative, unconventional technology use; by the 70s-80s, it shifted to unauthorized access. [01:02], [01:22] - **1996 CIA Website Defaced**: In 1996, hackers took down the CIA's main website, changing it to 'Welcome to the Central Stupidity Agency,' causing reputational damage like electronic graffiti. [03:39], [04:02] - **Stuxnet Sabotaged Iran Nukes**: Stuxnet malware targeted Iranian nuclear centrifuges, making them speed up and slow down to disrupt uranium enrichment; widely attributed to US and Israel. [08:23], [09:28] - **Firewall as Network Gatekeeper**: A firewall acts as a gatekeeper between trusted internal networks and untrusted internet, enforcing security policies to allow or block traffic types based on rules. [15:49], [16:29] - **VPNs Shift Trust to Provider**: VPNs encrypt traffic and hide your IP from ISPs but route everything through the VPN provider, who sees all your destinations; some preserve privacy, others don't. [16:43], [18:55]

Topics Covered

  • Mitnick Mastered Social Engineering
  • Hackers Defined by Hat Colors
  • Kerckhoff's Principle Secures Crypto
  • Bans Drive Threats Underground
  • Passkeys Beat Passwords

Full Transcript

Hopefully, we'll stay out of jail on this. Ladies and gentlemen, start your

this. Ladies and gentlemen, start your lawyers. I'm Jeff Kr. I'm a cyber

lawyers. I'm Jeff Kr. I'm a cyber security architect and adjunct professor at NC State University. Let's answer

some questions from the internet. This

is history of hacking [Music] support. Atmatscary 34 asks, "Who do you

support. Atmatscary 34 asks, "Who do you think is the most influential hacker in cyber history?" Some of the really great

cyber history?" Some of the really great hackers are ones you've never heard of because they in fact were so good they didn't get caught. Certainly one of the big names. He was certainly the most

big names. He was certainly the most influential and infamous back in the day is Kevin Mitnik. Kevin Mitnik was particularly known for his social engineering where he would basically try

to con people, rely on their desire to trust each other and get information out of people by pretending to be someone else. He served 5 years in prison. He

else. He served 5 years in prison. He

was arrested for abusing the phone system. Back in those days, you had to

system. Back in those days, you had to pay for long-distance calls. He was able to break into the phone system and make calls for free. at Raymond Goch one asks where does the term hack come from? The

term really traces its evolution from the 60s where at MIT there was a model train club and they use the term hack or hacker to refer to someone who was able

to use the technology in an unconventional way in a creative way.

Then about the 70s 80s it kind of took a change and most people began to associate hacking with unauthorized access. In the security community, we

access. In the security community, we actually refer to at least three different types. And we refer to them by

different types. And we refer to them by their hat color, believe it or not. No,

they're not actually wearing hats necessarily, but we refer to black hats as the ones who are breaking into systems in order to do damage, in order to steal things, operating without permission. The white hat hackers, those

permission. The white hat hackers, those are more like that original terminology that we referred to with the the group from NI MIT who were basically hobbyists trying to find out where the limits of

the technology. this sort of thing. They

the technology. this sort of thing. They

report those vulnerabilities and they're trying to do something for the overall good. Now, you've got something in

good. Now, you've got something in between, a grey hat hacker where they claim to be doing some good, but maybe they don't. They cross a few lines here

they don't. They cross a few lines here and there. James K. Poke, how did

and there. James K. Poke, how did computer hackers do their hacking back in the 60s and 70s? It was all about physical access because computers, there was no internet. All the computers that

existed were pretty much in very known places. A company had a data center. It

places. A company had a data center. It

was on raised floor. It had to be cooled with air conditioning. The entry and access to those systems was controlled via badge reader. There were cameras.

So, it was basically security was guards, guns, and gates back in those days. If you didn't have access

days. If you didn't have access physically to the system, you couldn't do much damage. Then it started moving to where attackers were starting to use the phone system. Hackers that were hacking on the phone system were known

as freakers, phone hackers. They would

do different things to try to figure out how they could get into the phone system and control it remotely, maybe from a pay phone. There were not a lot of

pay phone. There were not a lot of computer systems for them to break into yet. And then we start moving into the

yet. And then we start moving into the 70s now. We didn't really have an

70s now. We didn't really have an internet that everyone had access to, but more and more systems were being made available over the public phone network. So they had modems and you

network. So they had modems and you could call into a system and then get access. If you knew the password, you

access. If you knew the password, you could log in and then maybe take control of the system that way. So that's what happened really more in the '7s. In

the8s, especially as we move into the '90s. Then we had the internet and

'90s. Then we had the internet and that's when really hacking changed very dramatically because everyone had access to everyone everywhere in the world. It

was a great thing for pretty much everyone including the attackers at Charlie's Curious asks, "Have hackers ever taken down a government website?"

One of the first that I remember was back in about 1996 when the Central Intelligence Agency had their main website hacked and at least for a short period of time it said welcome to the

Central Stupidity Agency. Not a lot of damage done there, more just a reputational damage. It was basically

reputational damage. It was basically electronic graffiti. So what could

electronic graffiti. So what could people do to prevent their websites for instance from being hacked? One of the first things is make sure that you change all of the default user IDs and

passwords. We call that hardening.

passwords. We call that hardening.

That's one form of hardening. Another is

turn off all the unnecessary services.

Every single thing that's turned on on a system is potentially another way a bad guy can use to get into your system.

Also, keep your software up to date because all the time vendors are fixing bugs in their software and many of those bugs are security bugs and the bad guys will know about what those bugs are and

they'll take advantage of them. Needs to

be at minimum multiffactor authentication. Don't rely on voice

authentication. Don't rely on voice recognition. By the way, we have deep

recognition. By the way, we have deep fake technology from AI that potentially could fake that stuff out. Weeds asks,

"Question for cyber security mavens.

Since signal is open- source, doesn't that mean that some intelligent adversary could determine its encryption algorithm and come up with a way to decrypt signal communications?" Well,

yes, in general. But first of all, don't add people to your group chat if you don't know who they are. There's a a notion in cryptography that's known as Kirkoff's principle and it says that

nothing should be secret about a crypto system except the keys. In other words, knowing how an algorithm works should not give you any insight into how to

break it. A good crypto algorithm will

break it. A good crypto algorithm will stand the test of time. Everyone can

know how it works and yet they still can't break it. The only way to break an encrypted message is to guess what the key is. That's been the case. So if the

key is. That's been the case. So if the keys are the secret to the system, then one thing you want to be able to do is generate those keys and keep them secret. You want a random key and then

secret. You want a random key and then you want to store it somewhere safe. The

more randomness you can get, the better your key will be and then you you don't have to remember that. You'll use some other form of multiffactor authentication or things like that in order to get access to the key. But the

key itself will be saved on your system.

And if it's really sensitive, you'll store it in a special place in hardware where if someone tries to access that without permission, it'll actually blank the key and just wipe it out completely.

Then that crypto device uh becomes effectively just a paper weight at that point. Deadbird Rugby says, "I've seen

point. Deadbird Rugby says, "I've seen some older generation folks on LinkedIn as cyber security analysts in the '90s."

Yeah, he's probably talking about me. Uh

from what I remember, the internet was like the Wild West in the '90s. A lot of focus was just on putting up a firewall, putting up some sort of technology that gave us an initial block, an initial

front door to separate our internal network from the external wild west. But

firewalls weren't nearly enough. They

weren't enough then and they're not enough now. But that was what a lot of

enough now. But that was what a lot of the view was. And we talk about the wild west. Well, there was a wild west then

west. Well, there was a wild west then on the internet because everything was kind of unknown and unmonitored. We

still have that today to a great extent.

But then there's another layer deep below the surface that most people never see. Where you exist for the most part,

see. Where you exist for the most part, if you're typical uh of most people is you're on the surface web. That's maybe

5% of the content that's on the worldwide web. And it's stuff that you

worldwide web. And it's stuff that you can get to from your favorite search engine. It's been indexed, in other

engine. It's been indexed, in other words. So you can go to the search

words. So you can go to the search engine and find it. The other 95% is kind of think of an iceberg. This is the stuff below the surface. You know, the iceberg is deeper below the water level.

So think about the iceberg. The other

95% that's below, that's the deep web.

It's not necessarily nefarious stuff.

It's just not stuff that everyone needs to get to. It's business records. It's

things like that. Only authorized users would be able to go in and authenticate and be able to see that stuff. But

there's a subset that's in an area we call the dark web. And it's dark because it's not indexed. You have to know where it is. So, you're not likely to just

it is. So, you're not likely to just stumble into it. In fact, you've got to use special tools to get there. And for

what it's worth, I don't recommend that you go there because it's a rough neighborhood. Your system could be taken

neighborhood. Your system could be taken over, could be hacked, could have malware on it after you visited some of these illicit sites. Now, is everything on the dark web terrible? No. Some group

of the people that are on the dark web are people who are whistleblowers, people who are political dissident, people who live in areas of the world where they can't speak freely, and maybe it's even journalists who need to be

able to get a message out and be able to do it with anonymity. But with anonymity comes also the possibility of illegal and illicit activities. It's dark

because the lights are off. It's not

dark because of what the content is there, but certainly some of the content is of a dark nature. A user on Reddit asked, "What was the Stuckset virus and why was it so successful?" Well,

Stuckset was some malware. I'll just use that general term to refer to it.

Designed specifically to target nuclear centrifuges in Iran. It was unleashed on those systems. Those systems didn't have general internet access. So the idea was

that it would be brought into the system physically implanted on those systems and then it would cause these centrifuges to speed up and slow down and speed up and slow down which caused them to not be functional. The idea of

course was to disrupt Iran's ability to enrich uranium. So who was looking out

enrich uranium. So who was looking out for doing that? Well, there's a lot of attribution and it's one of those situations. One of my favorite quotes is

situations. One of my favorite quotes is those who know aren't talking and those who don't, well, you can't shut them up.

I'm going to keep talking. So now you know which one of those categories I'm in. I don't have any firsthand

in. I don't have any firsthand information, but it's been widely attributed in the public space that the US and Israel were involved in this particular attack as a way to try to

subvert Iran's nuclear ambitions. It was

pretty successful for a good period of time until it turns out that the virus spread to some other systems. Those other systems then were discovered with

an antivirus tool. Then from there, the whole game started to unravel. at Mach 5 turtle says, "Yay, my data has been compromised due to the OPM data breach.

Not sure that's a reason for celebration. Uh, my fingerprints and

celebration. Uh, my fingerprints and everything. Uh, where will it all turn

everything. Uh, where will it all turn up next? How exciting." That's a case

up next? How exciting." That's a case where data is turned over to someone else and you have to trust that they're going to do the right thing. And maybe

they do the right thing 99% of the time, but it's that other 1% where they didn't and then that's where an attack occurs.

So, what can you do about this? Well,

first of all, don't give your data to places where you don't have to. And most

people give their data up very freely for very little in exchange. So, make

sure that you're understanding the bargain. Understand that your data is

bargain. Understand that your data is worth something to those companies.

That's why they want to keep it. And

make sure that what you're getting back in exchange for it is really a fair bargain. Also, you can do some things

bargain. Also, you can do some things like credit monitoring, like credit freeze, credit lock, things like that.

So that way if someone tries to open a line of credit in your name, tries to get a credit card, tries to get a home loan, whatever like that, they try to do that in your name using information that they got from one of these data

breaches. Well, they won't be able to.

breaches. Well, they won't be able to.

That's something that you can do at least in the US, and there are probably similar things you can do in other countries as well. ATC magazine asks, "A question for cyber security pros. Would

you ban Tik Tok from your organization over security and privacy concerns raised about its ownership being based in China?" First of all, my general

in China?" First of all, my general approach to bans is I don't think they work. Not in the way that people hope

work. Not in the way that people hope that they will. When you ban something, you drive its behavior below ground. And

once you drive it underground, then it's hard to monitor. Now, am I concerned about ownership? I'm concerned about

about ownership? I'm concerned about ownership of all of these because just because a company is in China or even if they're in the US doesn't necessarily make me think that there's going to be

no violations of privacy or no manipulation of information. We've

already seen that every country on earth is really good and has people who will find ways to be good at manipulating people through misinformation and fake

news. And we know that privacy

news. And we know that privacy violations occur everywhere. And we also know that privacy violations can occur even unintentionally. So there are

even unintentionally. So there are concerns certainly if a government is able to say we are going to make you turn over those records to us and now there's not independence from that

service and the government and that's a big concern but that happens in a lot of cases. I heard Daikaiu asks what are

cases. I heard Daikaiu asks what are some ways elections are vulnerable from a security standpoint and what can be done to shore up these platforms. almost every case I will choose the more

high-tech alternative to the lower tech alternative except when it comes to voting. In that case, the reason I like

voting. In that case, the reason I like paper ballots is because with a paper ballot, if the counting machine messes up, well, we just go back and take the paper ballots and run them through another one. If we have only electronic

another one. If we have only electronic votes to begin with, we can't go run them all back through. We can't line up all the people that voted on that day and say, "Please go back, get in line again, and vote exactly the way you did

before." Doesn't work like that. We

before." Doesn't work like that. We

could have a power outage at a voting station. Well, again, that doesn't

station. Well, again, that doesn't affect paper ballots. It might affect the counting, and if we want to use machines to do counting of those, I think that's not so unreasonable, but

there there are a lot of things that technology helps us with. This is one where a lower tech solution is probably better. Chronoport asks, "Why did the I

better. Chronoport asks, "Why did the I love you virus overwrite other files?"

If you're a virus, you're trying to spread yourself as much as you can. The

more types of files that you can overwrite, the more things you can infect and the more other systems you can infect and the harder it is to get the system disinfected. If you're the designer of a virus, you want it to

spread as virally as possible. So,

infect as much stuff as you possibly can. At Allah asks, "Who stopped W to

can. At Allah asks, "Who stopped W to Cry?" Wann to Cry was one of the most

Cry?" Wann to Cry was one of the most famous examples of malware. Did a lot of damage. The guy that's given credit for

damage. The guy that's given credit for stopping it is named Marcus Hutchkins.

He did it in May of 2017. He was doing some analysis of the malware and found that it actually made a call out to a particular website to a particular domain name. It was really long and

domain name. It was really long and complex and gorpy looking. Nothing that

you would ever guess unless you were just decompiling the code. And he

realized that as long as it didn't find the presence of that, it would continue to spread. So what he did then was go

to spread. So what he did then was go register that domain name so that then whenever the malware went out to go ping that site to see if it exists, it would in fact exist and therefore the malware

would stop replicating. So he basically found what was a kill switch that was built into the code, but that didn't necessarily stop and eradicate. The

malware was still on a lot of people's systems and may still be out there in some cases, but at least it was a way to turn a kill switch and make it stop so that it didn't hurt other people for at

least a good period of time. At the boss almighty asks, "How exactly can hackers shut down a pipeline?" I'm assuming this is a reference to the Colonial Pipeline ransomware case that was very infamous

because in fact there was a pipeline that transported oil across the southeastern portions of the US. Well,

it turns out that the attacker, the actual malware, the ransomware did not actually shut down the pipeline. The

operators of Colonial Pipeline decided they needed to shut it down in order to prevent further damage cuz they weren't quite really sure what was going on.

They knew that they had experienced a ransomware case. They were being

ransomware case. They were being demanded a $5 million ransom in order to restore the systems. And they, in an abundance of caution, just felt like it was better to shut things down until they could figure out what happened.

They eventually did turn things back on and of course we got back in operational. Interesting sideline with

operational. Interesting sideline with that story is they actually paid the $5 million ransom, but here was the unhappy part of that ending. The attackers gave

them a tool that would decrypt the data that had been encrypted. So they paid the ransom, they got the tool, but the tool was so inefficient and so slow that it would never have recovered the data

in time to do anyone any good. So they

ended up having to rely on their own backups, incomplete as they might have been. And so they paid the $5 million

been. And so they paid the $5 million ransom, didn't get their data, and it was kind of a worst of both worlds situation. However, in the end, there

situation. However, in the end, there was one more twist, and that was that the FBI actually recovered half of that ransom. Don't expect that to happen in

ransom. Don't expect that to happen in your case. At Noble Infantry asks, "What

your case. At Noble Infantry asks, "What is a firewall, and how does it work?"

Well, a firewall was a building mechanism that was fire retardant materials that would at least slow the spread of fire from one unit to the next. Now, when you apply that concept

next. Now, when you apply that concept into network security, it's a place a zone a se of of separation where we're going to keep one level of trusted network away from another. Maybe an

untrusted internet will keep that separate from a trusted internal network. And the firewall will basically

network. And the firewall will basically be the gatekeeper. So, we'll have a security policy in it and it will look for certain types of traffic and say that kind of stuff can come in. This

other kind of stuff we're going to block because we don't use that kind of traffic. we don't need traffic coming

traffic. we don't need traffic coming from that area of the internet or we don't need users of that sort they're not part of our organization so we put a

gating factor basically a guard between areas of networks where we have different zones of trust AI pitch side asks I'm curious to know how people balance online security with the need

for convenience do VPNs really offer the anonymity we think they do the original purpose of VPNs was really just as a way to transport sensitive information over a public network. So if I wanted to send

a secret message to you that only you could see and that someone else who saw the traffic going across the internet would not be able to read, I would encrypt the message and then send it to you. So that way we have an encrypted

you. So that way we have an encrypted connection between the two of us. Now

the VPNs that most people use today not only can do that, but they also will hide the IP address that you're coming from. And that's where you start to get

from. And that's where you start to get some of these anonymity features. The

idea is that your ISP, whoever it is that's providing your internet connection and getting you as the on-ramp onto the highway, that is the internet, they know what your IP address is. And they can see everything that

is. And they can see everything that comes and goes into your home network or into your computer itself, unless you use a VPN, which then all they can do is see where the packets are coming from and where they're going, but they can't

see the contents of it. So, that gives you a certain level of anonymity.

However, if you use a VPN, then what it will do is also hide where your originating IP address is because what will happen is no matter where you want to send a packet, if you've got the VPN

turned on, it's going to go to the VPN access point first. Then from there, it will get routed to where it's supposed to go. So the ISP then at that point

to go. So the ISP then at that point only sees here you are sending all your traffic to this one VPN entry point, this VPN access point, and then stuff comes back from there. They won't be

able to see the contents. they won't be able to see where it goes after that point. Now, that gives you some

point. Now, that gives you some anonymity and some privacy. However,

don't be fooled. What you've done is shifted your trust from your ISP, which maybe wasn't so trustworthy in terms of guarding your privacy, to the VPN provider because the VPN provider now

gets to see where all your traffic is going. And you don't really have a way

going. And you don't really have a way to verify the way they're operating. So,

some VPNs will be very rock solid and will preserve your privacy. Others will

not. So just by using a VPN, you may just be making it easier by concentrating all your data to one place. And if that place gets attacked

place. And if that place gets attacked or if that place is a bad actor, then you've given them all your information.

So be careful. A VPN is not a panacea.

It can help. At hot geologist 6330 asks, why are fishing emails and telephone scams still profitable despite increased awareness? Simple answer is people. Have

awareness? Simple answer is people. Have

you ever met them? Well, they can be exploited. We have this tendency as

exploited. We have this tendency as humans to trust other people. Even if

you're very jaded, you see someone walking toward a building, their arms are full of stuff and it's raining and you're at the door. So maybe you hold the door open for them. But if that person was planning to do that as a way to get into the building, well then they

basically just socially engineered you into letting them come into the building and tailgate without using their badge.

Social engineering is what lies at the heart of these types of attacks of fishing emails, telephone scams, and things like that. Our tendency to trust.

And in one context, that's a beautiful thing because we wouldn't want everyone to be so jaded that we never trusted another person ever again. But we can't be trusting of everything either because

then everything falls. The attackers are always going to try to find that crack that they can exploit. And they keep changing their tactics. They keep ch changing different ways of doing this.

Fishers originally used mostly just email. Now they've moved into other

email. Now they've moved into other areas as well in addition to email. They

could do an SMS message to you. We call

that instead of fishing, we call that smishing. They could do fishing via

smishing. They could do fishing via voicemail. We call that fishing. There's

voicemail. We call that fishing. There's

even a new one called quishing where they use QR code. This is a pseudo asks, "Are password managers safe?" If you're asking a security person, is it safe?

The answer is no. I don't even have to know what the question was. The answer

is it's not safe. Nothing is ever fully safe. Nothing is ever fully secure. Now,

safe. Nothing is ever fully secure. Now,

is it safe enough? It depends on which password manager you use and how you use it and where you put the password manager and how you get access to the password manager itself. Most of these

password managers will require you to set a strong password that you type in once and then that unlocks all the other passwords that it keeps in its storage.

If you have a trivial password on your password manager, you have an unsafe system. So you need to have at least one

system. So you need to have at least one really good password. And again, maybe use multiffactor authentication so that it doesn't rely just on a password to get in. Let me tell you what's better

get in. Let me tell you what's better than a password. If you're trying to make sure that no one steals your password, don't have one in the first place. And you say, "What does that

place. And you say, "What does that mean? How I don't get to choose that?"

mean? How I don't get to choose that?"

Well, actually, you are more and more getting to choose a newer technology called pass keys. There's an

organization called PHO, fast identity online, that came out with this standard. And pass keys sounds like the

standard. And pass keys sounds like the same kind of thing, password, pass key.

It's actually very different. Pass keys

use cryptographic techniques. You don't

have to reme remember what the password is. You don't have to choose what the

is. You don't have to choose what the password is. You unlock your device. The

password is. You unlock your device. The

pass key is a cryptographic key that's kept on your device and may or may not be synced with other devices that you have. It's relatively fishing resistant,

have. It's relatively fishing resistant, if not almost impossible to fish because it uses a challenge response system. And

all of this stuff happens under the covers. And the good news is password

covers. And the good news is password managers support both passwords, the good ones, and pass keys, so you don't have to choose. Curious Brain 2781 asks,

"How likely is it to catch a virus nowadays, assuming a standard up-to-date antivirus?" It's actually still very

antivirus?" It's actually still very possible. We continue to see that

possible. We continue to see that certain types of malware proliferate.

Thankfully, we've gotten a little better at this, but the problem is the game constantly keeps changing. So then we had to as an industry come out with things that were not just looking for

literal signature that is a a string of bits that were in there in the particular malware itself and that was the identifier. Now we're looking for

the identifier. Now we're looking for things like behaviors and if we're looking for those behaviors maybe we're able to block these things more often. A

lot of these viruses and malware will exploit different vulnerabilities in software. So that's why as patching and

software. So that's why as patching and updating of software levels has become more and more automated, we've been able to deal with a better defense than we had back in the day when these things

were first coming out. Reboot your

system every so often because some viruses and malware are not able to survive across a reboot. So you'd like to get rid of those and clean things that way. But in general, use tools that

that way. But in general, use tools that can disinfect your system. That will

help a lot. Tyrone Bigums asks, "What hack has caused the most damage?"

depends on how you measure damage. Would

it be financial damage? Would it be in terms of the number of systems that were affected? Would it be in terms of the

affected? Would it be in terms of the number of lives that were impacted?

Would it be in terms of the number of lives that were lost? There's a lot of different ways to to look at this. There

was one case where a ransomware instance happened at a hospital and it caused the hospital systems to not be available and they started redirecting emergency

traffic to other hospitals. One person

died during transport to a more distant hospital. So there's a case where

hospital. So there's a case where indirectly ransomware cost a person their life at sector quadruple07 says but what is the CIA triad? Well CIA if you talk to a cyber

triad? Well CIA if you talk to a cyber security person probably doesn't mean central intelligence agency although it could. We think of this as one of the

could. We think of this as one of the classical security teachings and that is really lies at the fundamentals of everything we do in cyber security.

Everything in cyber security is about these three confidentiality integrity and availability. So CIA,

and availability. So CIA, confidentiality integrity and availability, that's really everything we do in cy cyber security is about doing those three things. At gunlaze

1969 asks, what was the name of the first computer virus? Well, if you use the term virus in the larger sense of malware, I'm actually going to shift this question to refer to the first real

example that the world came to know, and that was the Morris worm back in 1988.

And that was where an MIT student came up with a way of planning a a piece of software on a lot of different systems across the internet and it spread automatically. That's what a worm does.

automatically. That's what a worm does.

It self-replicates. And it did this and got to 10% of the internet before it finally got shut down. So that was really the first one that made the world wake up to the fact that this stuff could actually have software that could

do harm. At Peter Burkehead asks, "How

do harm. At Peter Burkehead asks, "How is it I never heard about phone freaking? It's an old attack. In the

freaking? It's an old attack. In the

early days when there really were not a lot of computers to break into, there was a phone system and it was worldwide and phone freakers were the ones who tried to manipulate the phone system.

And it was discovered that you could actually control the phone system, maybe even reconfigure the switch that's involved. You could get free

involved. You could get free long-distance phone calls. There's a lot of different things you could do. And

you could do this because the phone systems used a specific tone in order to put them into a management control mode.

That mode was triggered by a tone at 2600 hertz. So if you could whistle 2600

2600 hertz. So if you could whistle 2600 hertz or get a tone generator and hold it up to a phone, you could then take over the phone and maybe even penetrate

into the system from that. It turned out that Captain Crunch, the cereal, came out with a toy prize, a whistle inside.

And guess what? That whistle blew 2600 hertz. Now, Captain Crunch, I'm sure,

hertz. Now, Captain Crunch, I'm sure, had no idea that that's what was going to happen when they did that. They were

just making a toy for kids. But the

phone freaker community learned about that pretty quickly and they got all over that and bought up a lot of Captain Crunch boxes and now they were able to go into payoneses and get free phone calls. But you don't hear about it much

calls. But you don't hear about it much now because nobody really pays for long-distance phone calls. Barrow Wolf

asks, "What movie has the most realistic concept of hacking?" Sorry, movie industry. I'm not sure any of them have

industry. I'm not sure any of them have gotten it really all that right. How it

works in the real world is not necessarily all that exciting to watch.

It's often hours and hours of just mind-numbing activity of running different programs in the background until finally you trip onto something.

It's not something that makes for a great spectator sport. So that's why you see the movies take liberties with this in order to make it a lot more interesting. I don't know if hackers

interesting. I don't know if hackers ever actually say I'm in, but in every movie they certainly do. Okay, those are all the questions. Thanks for watching History of Hacking Support.

[Music]

Loading...

Loading video analysis...