What Is An Ethical Hacker? | Thomas Johnson | Modern Wisdom Podcast 105

Thomas (Tom) Johnson 0:00 To me, you've got to understand that data now is worth more than oil. Um, so they're going to put a lot of money into securing that, and they're gonna put a lot of money into defending that. Now, I'm genuinely proud of, of living in England and in Britain, because we have some of the best security professionals in the world. But you have a lot of threat actors as well. So you've got China, you've got Russia, you've got North Korea. You've got all the states that wouldn't necessarily get on with us politically. And you have to understand that for the price of one fighter plane, you can hire 200 hackers. So information warfare is going to be the future of war.

Chris Williamson 0:45 I am joined by Tom Johnson, ethical hacker and social engineer extraordinaire. Welcome to the show, Tom. It's great to have you on.

Thomas (Tom) Johnson 0:54 Hello. Thank you very much for inviting me.

Chris Williamson 0:56 Uh, it's gonna be an exciting one today. This world of ethical hacking and social engineering is something that I've seen a little bit about online, but I don't really know all that much. But I guess we're gonna, we're gonna delve into it today, right?

Thomas (Tom) Johnson 1:09 Absolutely, yeah. I mean, would you like to start off at the beginning, how I got involved in it?

Chris Williamson 1:14 Yeah, absolutely.

Thomas (Tom) Johnson 1:14 Or would you like me to tell you what it is, first of all? (laughs)

Chris Williamson 1:16 (laughs) No. So yeah-

Thomas (Tom) Johnson 1:17 (laughs)

Chris Williamson 1:17 Let's, let's, let's find out. How do you define ethical hacking and, and social engineering and what you do? And then, and then let's find about, out about the, uh, the genesis story.

Thomas (Tom) Johnson 1:27 Absolutely. Okay, so social engineering, according to a guy called Christopher Hadnagy in America, is the art of using human psychology or misusing human psychology to get a target to do something or say something they shouldn't do or say, and that is grassroots. So if you can talk someone into giving you the passwords or plugging a USB stick into the computer, then all of this very expensive sort of cybersecurity mitigation is useless, because they are literally giving you the keys to the kingdom. So that, in a nutshell, is what it is.

Chris Williamson 2:03 I understand. Yeah. I suppose as these, uh, technological firewalls, uh, and safety measures become more sophisticated, the, uh, ways around it that don't require you to just brute force try and break through something that's heavily encrypted, I guess this sort of falls to the, the one remaining weak link in the chain, which is always going to be the, the several-million-year-old brain that sits inside of the person controlling the system, right?

Thomas (Tom) Johnson 2:31 (laughs) Well, uh, in my opinion, humans can be the weakest link, but they can also be the strongest link as well, because they think in a different way to how computers process information. So have you ever had a gut feeling before, Chris?

Chris Williamson 2:45 Mm-hmm. Yeah.

Thomas (Tom) Johnson 2:46 Well, that gut feeling is your subconscious mind telling you that there is something not quite right in a pattern. So your subconscious mind is constantly processing everything around you, and then when you get that gut feeling, that is your subconscious mind saying to your conscious mind, "There's something not quite right here." So that is a really good way to defend against social engineers.

Chris Williamson 3:06 Yeah.

Thomas (Tom) Johnson 3:06 That gut feeling.

Chris Williamson 3:07 Got you. Okay, so let's start off, the genesis story. How do you ... So h- what happens whereby you are now sat opposite me with a microphone in front of you talking about ethical hacking-

Thomas (Tom) Johnson 3:17 (laughs)

Chris Williamson 3:17 ... and social engineering? Where does it begin?

Thomas (Tom) Johnson 3:20 Right. It begins when I was about 12 years old, and I was pulled out of school by an overprotective mother. Um, I was a very small child in a predominantly council area in Wallsend, um, and it wasn't a very good time at school for me. And she was very overprotective, pulled me out, and had nothing to give me work-wise, so she just sat me in front of a computer. So I started playing games, what every child tends to do, and then I started getting bored of games. Um, and I couldn't afford new games, so I started working out how I could break the system and copy those games so I could get them for free. Not because I was a criminal, but because I wanted to play games. Uh, the games started getting boring, so I wanted to learn how the games worked. So I programmed the games, um, and things developed on and on and on. And then something amazing happened. This rudimentary thing called the internet come about, and it'd become my playground. Um, I was spending all of me time online. Um, I had no moral or ethical compass at that point in time. I was young. I, I wasn't a bad lad, but I'd done things because I was a bit mischievous. So I would hack random computers on the internet and download through all the ... Look through all the files, and then it started getting boring, so I started going a bit further. I started college. Um, I got thrown out of college for hacking an internal mail system.

Chris Williamson 4:46 (laughs)

Thomas (Tom) Johnson 4:46 I was ... (laughs) Yeah, I was naughty, but I was sending messages from one lecturer to another saying that they were in love with each other or, or all sorts of different things.

Chris Williamson 4:56 (laughs) Okay.

Thomas (Tom) Johnson 4:57 Getting some funny looks.

Chris Williamson 4:58 Yeah.

Thomas (Tom) Johnson 4:58 I was great at doing things, but terrible at getting away with them.

Chris Williamson 5:01 Ah, yeah.

Thomas (Tom) Johnson 5:02 So I actually got caught and, and thrown out of, uh, college. So I went back again. I lasted about two weeks, and I was thrown out again. Um, I locked the network manager out of his computer, and he didn't see the funny side.

Chris Williamson 5:14 (laughs)

Thomas (Tom) Johnson 5:14 So you've got to understand, at the same time, uh, uh, me skills were developing, um, to a point where college wasn't really teaching me anything. So I was a bit bored, if that makes sense. So it just sort of encouraged me to do more and more risky things, silly things when I look back. I'm a white hat now, may I just add that? A white hat is somebody who puts ethics over morals, over everything. So I will only act within the boundaries of law. But in those days, anything online was fair game. Um, I was running me mother's phone bill because of course it was on dial-up at the time.

Chris Williamson 5:53 (laughs)

Thomas (Tom) Johnson 5:53 Um, she used to put a little, um, key code on, so I wrote a little program that would go through every single key code and, and brute force it.

Chris Williamson 6:01 Ah. (laughs)

Thomas (Tom) Johnson 6:01 So within an hour, I was back online again. And then one day, I heard a knock at the door. I answered the door, and there was two big, burly police officers standing in front of us. Um, they subsequently arrested me.... took me to the police station, locked me up for about 15 hours, threatened to extradite me to America where I'd get death by lethal injection and everything. And I was absolutely terrified. And in 20-

Chris Williamson 6:26 How old were you, how old were you here?

Thomas (Tom) Johnson 6:28 I was about 16, 17-ish.

Chris Williamson 6:31 Shit the bed. It's a young age-

Thomas (Tom) Johnson 6:33 And, uh-

Chris Williamson 6:33 ... to be having such, uh, such, such heavy words thrown at you.

Thomas (Tom) Johnson 6:36 I'd had a, I'd had a slap about the head and everything.

Chris Williamson 6:37 Yeah, yeah, yeah.

Thomas (Tom) Johnson 6:38 And 20 years later, I found out it was a social engineering attack on us. It was actually two of my mother's friends who were coppers, who she put them up to the task of scaring me straight.

Chris Williamson 6:51 Oh, no way.

Thomas (Tom) Johnson 6:51 So it wasn't a real arrest. It was to fuck up with our phone bill. (laughs) So, that was my first taste of, of, um, social engineering, and believe you me, it was very effective.

Chris Williamson 7:02 Wow. So did that-

Thomas (Tom) Johnson 7:03 And then-

Chris Williamson 7:03 ... did that scare you straight?

Thomas (Tom) Johnson 7:05 It scared me straight for a very long time. In fact, I lost me love of computers for a while. Um, I, I, I took it hook, line and sinker, and I was genuinely in fear of me life (laughs) . Um, and, and I just stayed away from computers. I set up a company. Um, I'd done all right out of the company. And then that went under and I just thought to meself, "What do I want to do? Do I want to earn minimum wage for the rest of me life?" So I looked at the skillset that I had and I thought, "I want to go back into cybersecurity." Now it is a, a job. It wasn't back then. It was a crime, but now it's a job. So, uh, I had no qualifications to me name, so I blagged me way onto a Tayside University course. Um, they give me a shot and I've received a, a first with honors in every module so far. So, I've done all right.

Chris Williamson 7:55 Amazing. That's fantastic.

Thomas (Tom) Johnson 7:58 Yeah. Thank you.

Chris Williamson 7:58 So, that's, that's the journey that you've taken yourself on there. So, how do you go from the online to the offline? Is it off- offline hacking?

Thomas (Tom) Johnson 8:09 Right, yeah. Well, it's, it's more in person. It, it, it's like, it's like the, the good old-fashioned con. That's exactly what it is, but it's got a cyber element to it.

Chris Williamson 8:19 Okay.

Thomas (Tom) Johnson 8:19 So, if you remember the old conmen or conwomen who would trick you into doing something, that is exactly what social engineering can be.

Chris Williamson 8:27 Mm-hmm.

Thomas (Tom) Johnson 8:27 It's tricking somebody into doing something or saying something they shouldn't. So, I set up a little company. Um, I started doing a little bit of work with the police, um, little bits and bobs here and there. Um, and then I done a talk at Cyberfest. Have you heard of Cyberfest, the convention?

Chris Williamson 8:45 No.

Thomas (Tom) Johnson 8:45 It's, it's a north- northeast convention, Northeast of England. Um, and then I was invited from that talk, um, to do a talk at the, um, local government level. Now, the talk that I done was based upon a hack that I carried out, an ethical hack, on the university that I studied at. So, I was a first-year student, bearing in mind, when this took place and I approached the school of computing, "Can I test your security, please?"

Chris Williamson 9:12 Hmm.

Thomas (Tom) Johnson 9:13 And they said yes. They didn't realize I'd been a hacker from being about 12 years old.

Chris Williamson 9:18 Oh, did they just think that it was some, some student who didn't really know what he was doing? Didn't realize they were coming up against boss level 55 hacking skills?

Thomas (Tom) Johnson 9:27 (laughs) I wouldn't say I'm that good. Uh, but yeah, they, they, they got a bit of a shock. Um, within 24 hours, I worked out how their, um, smart card system worked and I built a cloner that could clone the cards. So I then dressed up as a security guard, and this is the social engineering side of things, put the high-vis on, done me Superman change, shaved me head, looked completely different, and then went round and skimmed all of the staff's cards. Um, and with those cards I had access to all areas, free parking for six months me I had.

Chris Williamson 10:00 (laughs)

Thomas (Tom) Johnson 10:00 Um, free food (laughs) , free food, um, library books. Everything you could ever want was all there, free. Um, I didn't tell Tayside University until Cyberfest, which was a little bit naughty.

Chris Williamson 10:15 Oh.

Thomas (Tom) Johnson 10:16 Um, and then I sort of gave away all the secrets and it got a little bit of attention. (laughs)

Chris Williamson 10:23 I bet it did, yeah.

Thomas (Tom) Johnson 10:24 It did. Um, but then I got invited to the ICDDF, the Information, Communication, Data and Digital Forensics Convention, which is, uh, Europe's largest closed cybersecurity convention for, uh, police, law enforcement and military. So I was invited by the National Police Chief's Council to do a talk there. Um-

Chris Williamson 10:48 Real epicenter of, of this sort of stuff then.

Thomas (Tom) Johnson 10:51 Absolutely, absolutely. It's about as big as you can get. Um, it was invite only, you know, you couldn't get through the doors unless you were invited. So I arrived, um, I expected to be shut in a little side room, just doing a little filler talk, and I was in the big county suite, uh, and I was a keynote speaker, so it was absolutely terrifying.

Chris Williamson 11:10 (laughs)

Thomas (Tom) Johnson 11:12 So I had to talk in front of 600 of some of the world's best professionals on cybersecurity and, and especially social engineering.

Chris Williamson 11:22 Shit the bed.

Thomas (Tom) Johnson 11:23 Absolu- Do you wanna see what I got as well? I got that.

Chris Williamson 11:26 What's that? That's a plaque. Certificate of-

Thomas (Tom) Johnson 11:29 It's a cert-

Chris Williamson 11:29 ... Appreciation. That's so cool. That's from-

Thomas (Tom) Johnson 11:32 It i-

Chris Williamson 11:32 Is that from the Home Office?

Thomas (Tom) Johnson 11:33 That's from the Home Office, yeah. Um, let me just see. I've got something else kicking about somewhere. (rustling) Oh, there it is. Bear with me one moment. I've dropped it. This is even cooler. This is an honor coin that I was given, believe it or not, off the Home Office-

Chris Williamson 11:51 Okay.

Thomas (Tom) Johnson 11:52 ... and the FBI.

Chris Williamson 11:53 Oh. So it's an AT&T NTAC-

Thomas (Tom) Johnson 11:57 This-

Chris Williamson 11:57 What, what does, what does that mean and what is it? It's like a big plastic-

Thomas (Tom) Johnson 12:00 So, it-

Chris Williamson 12:00 ... plastic coin.

Thomas (Tom) Johnson 12:01 No you know, it's not. It's a metal coin. (laughs)

Chris Williamson 12:03 Metal c- Oh, inside of a pla- inside of a plastic sleeve?

Thomas (Tom) Johnson 12:05 It's in a plastic container. See if I can get it out for you.

Chris Williamson 12:07 Oh, right. Yeah, yeah. So what, what does it mean?

Thomas (Tom) Johnson 12:09 And-

Chris Williamson 12:09 What does it do?

Thomas (Tom) Johnson 12:09 Oh, it's stuck. So this is what you call an honor coin. Um, and it's what I was awarded for doing the talk.Um, and it- I'll show you. So, that's the side there, that's the important one.

Chris Williamson 12:20 Okay.

Thomas (Tom) Johnson 12:20 That's, uh, the National Police Chief's Council, our central government-

Chris Williamson 12:25 Yeah, yeah.

Thomas (Tom) Johnson 12:25 ... and, um, the National Crime Agency.

Chris Williamson 12:28 Got you.

Thomas (Tom) Johnson 12:29 And on that side we've got, um, AT&T who sponsored the event.

Chris Williamson 12:33 Got you.

Thomas (Tom) Johnson 12:34 We've got, uh, the Metropolitan Police, the British government. That little round one there-

Chris Williamson 12:39 Yep.

Thomas (Tom) Johnson 12:39 ... is the FBI Operational Technological Division.

Chris Williamson 12:42 (laughs) Fuck me.

Thomas (Tom) Johnson 12:44 (laughs)

Chris Williamson 12:44 There's some big names on this thing. Jeez.

Thomas (Tom) Johnson 12:46 Yeah. And the bottom one is the National Technological Assistance Center. So to me, that is like my valued possession. I've went from port scanning the FBI when I was a kid-

Chris Williamson 12:57 Yeah.

Thomas (Tom) Johnson 12:57 ... to now sort of working alongside them. It wa- it was really exciting.

Chris Williamson 13:01 Unbelievable. So off the back of this talk that you've given, presumably it's- it's been interesting to quite a few people in the audience. What happens from there? Do you... Are there any job offers? Do you get any emails? Is anyone...

Thomas (Tom) Johnson 13:13 I'm getting a fair few job offers all the time, to be, to be fair. Um, but I'm currently putting them on hold. I've went on another journey now, which is the technical side. I'm currently studying, uh, OSCP, which is Offensive Security Certified Professional hacker. Um, I should receive that in two months. And then (claps hands) the world is my oyster.

Chris Williamson 13:34 What's that most recent qualification? What does that mean?

Thomas (Tom) Johnson 13:38 Um, that is... We have an operating system, and you'll see it just behind me here.

Chris Williamson 13:42 Yeah.

Thomas (Tom) Johnson 13:42 That's a Kali Linux, which is not a Windows-based system, it's a, it's a Debian-based system. And, uh, Offensive Security, who make Kali Linux have an accreditation called OSCP. Um, and it's called PWK, Penetration With Kali Linux. So once I get that, it's a- a globally recognized certification.

Chris Williamson 14:04 Okay. And that is, like you said, on the technical side. So is it rare to find, uh, hackers who have the in-person skills alongside the technical know-how? Or do you find-

Thomas (Tom) Johnson 14:18 I think-

Chris Williamson 14:19 Do you find- do you find people who have that mindset with regards to just trying to open doors? Whether it's online or offline, they're just interested either way?

Thomas (Tom) Johnson 14:29 I think you have more technological hackers than you have social engineers. Um, s- sorry, let's rephrase that. You have more good technical hackers than you have good social engineers.

Chris Williamson 14:43 Gotcha.

Thomas (Tom) Johnson 14:43 So every- every hacker has the potential to attempt social engineering-

Chris Williamson 14:48 Mm-hmm. Mm-hmm.

Thomas (Tom) Johnson 14:48 ... techniques and- and tactics, but some are better than others. Um, and- and it's relatively rare to find a nerd like meself with the ability to be able to talk to people as well.

Chris Williamson 15:00 Mm.

Thomas (Tom) Johnson 15:00 So I take pleasure in teaching and- and communicating and- and helping organizations. And that in itself helps me sort of sharpen me social engineering toolset. Um, I've recently done a hack on a- on a large unnamed company.

Chris Williamson 15:18 Mm-hmm.

Thomas (Tom) Johnson 15:18 Um, uh, uh, an ethical hack. I was employed to test their security. Um, and part of my training them allowed me to advance my social engineering, and I'll explain that. W- I was- I was approached by this company and asked if I could test their human firewall. So I spent three, about three weeks exfiltrating information, um, doing reconnaissance on them, passive and active, finding out who the staff were who they were talking to. Um, I trolled all of the Facebooks, the LinkedIn, all of the social media. I built up profiles on them. I prioritized five staff, um, who I thought would be the weakest, and I approached them over LinkedIn for my pretext, which was my lie. So I tried, um, multiple... I'll not go into the trade secrets, but I tried multiple lies and a couple of them were successful. I- I managed to- to hook a couple of them, but one I prioritized. I went and I held a meeting with them pertaining to something that didn't exist, um, and then left. And in that short amount of time I had already cloned all of the cards to get into the building.

Chris Williamson 16:27 (laughs)

Thomas (Tom) Johnson 16:28 Um, so within 15 minutes of my actual, um, exploitation phase, I was in their inner sanctum through multiple coded doors, drinking cups of coffee in their tea station for three and a half hours unquestioned. Um, it was- it was good. It was interesting. It was exciting.

Chris Williamson 16:51 Is that- is that what you call a successful hack?

Thomas (Tom) Johnson 16:54 Yes. Um, to- to be totally honest with you, they were very good on a lot of areas, um, but th- th- they just didn't expect an attack of that magnitude to take place. So the final straw was I was asking staff to step away from the computers when I was plugging in, um, covert, um, hacking tools, like the USB Rubber Ducky and the Bash Bunny, which look like USB devices but they aren't. Um, the- the tools-

Chris Williamson 17:22 Tell us- tell us about those. I want to know what those do.

Thomas (Tom) Johnson 17:24 Right. Well, uh, USB Rubber Ducky was created by a company called Hak5. Shout-out to Shannon Morse and Darren Kitchen. Um, they created, um, a- a device called an HID, a human, uh, interface device. Now, it looks to the computer like it's a keyboard with somebody typing on the other end-

Chris Williamson 17:44 Okay.

Thomas (Tom) Johnson 17:45 ... but it can type at thousands of characters a minute. So I could spend a full day coding exploits to- to compromise their systems, and then I plug this device in and it types it out locally-

Chris Williamson 17:59 Ah, yes. Okay.

Thomas (Tom) Johnson 18:01 ... on the system. Yeah. So it- it thinks it's a person typing. And the Bash Bunny is an attack, a multi-attack platform, um, which can emulate, uh, ethernet over USB, which is trusted by Windows, iOS and Linux-... um, and you can run payloads, steal password hashes, do all sorts with it, even through a lock screen on a computer.

Chris Williamson 18:25 Shit the bed.

Thomas (Tom) Johnson 18:26 Yeah. Yeah. (laughs)

Chris Williamson 18:26 This is serious stuff.

Thomas (Tom) Johnson 18:28 Oh, it gets worse. It gets worse. (laughs)

Chris Williamson 18:29 Oh, come on. I want to find out, what are the other, what's the other, like, atomic weapons? Or what ... If we were to open up the ethical hacker's toolkit or the bag, what have you got inside of it? You've got the rubber ducky, you've got-

Thomas (Tom) Johnson 18:44 I've, I've got all sort of things.

Chris Williamson 18:44 ... the bash, you've got the bash bunny.

Thomas (Tom) Johnson 18:46 In fact, I've got, I've got some bits here if you want me to show you them.

Chris Williamson 18:49 You can just run-

Thomas (Tom) Johnson 18:49 Would you like me to show them?

Chris Williamson 18:50 You can just run through them if you want to. You can just run us through everything that'd be in there.

Thomas (Tom) Johnson 18:54 Right. Okay. Well, I've got them, and I'll show you at the same time.

Chris Williamson 18:58 Cool.

Thomas (Tom) Johnson 18:58 So we've got, um, little single board computers, Raspberry Pis. Really useful, they run off a battery. Uh, they've got wifi, Bluetooth, and that's a full PC there.

Chris Williamson 19:08 Okay.

Thomas (Tom) Johnson 19:08 Um, but they do get smaller. You can get the little Raspberry Pi Zeroes, which are absolutely tiny.

Chris Williamson 19:13 That's ju- n- not much bigger than the size of a matchbox, but it's essentially a computer in your, in your pocket.

Thomas (Tom) Johnson 19:19 Pretty much. But they get even smaller.

Chris Williamson 19:21 And that's one-

Thomas (Tom) Johnson 19:22 That is the full PC there.

Chris Williamson 19:23 ... that is one which is probably the size of, just bigger than a lighter, but totally two-dimensional.

Thomas (Tom) Johnson 19:29 Well, there's a USB stick.

Chris Williamson 19:30 Yeah.

Thomas (Tom) Johnson 19:31 And there's a-

Chris Williamson 19:31 About ... Just a bit bigger than a USB stick. Yeah. Wow.

Thomas (Tom) Johnson 19:33 Yeah. So that's how you-

Chris Williamson 19:35 Unbelievable.

Thomas (Tom) Johnson 19:35 ... how you ... So just standard USB sticks with, uh, malicious software on them.

Chris Williamson 19:39 Okay. Yeah.

Thomas (Tom) Johnson 19:39 Uh, you can, you can generate malware, and then you can, um, use a crypter, like Veil Evasion, to mask its file signature-

Chris Williamson 19:49 Okay.

Thomas (Tom) Johnson 19:49 ... so the antivirus, uh, systems don't pick up on it.

Chris Williamson 19:53 Okay.

Thomas (Tom) Johnson 19:53 So the very system that you use to protect you works against you because it doesn't flag you of any problems.

Chris Williamson 19:59 Perfect. And you, and you think that you're safe as well, so you're probably-

Thomas (Tom) Johnson 20:03 Absolutely.

Chris Williamson 20:03 ... probably a little bit more complacent about the security that you should have in place. "Oh, well, even if someone does get through, the antivirus will catch it."

Thomas (Tom) Johnson 20:11 Yeah. Absolutely. So we've got a, a normal, like that cheapy six quid off eBay, really useful. It's got a little covert camera in the bottom of it.

Chris Williamson 20:20 No way.

Thomas (Tom) Johnson 20:20 And this bit comes off and it's a, it's a USB stick. Really handy, leave them in cigarette areas and stuff to, to record stuff and then exfiltrate information from that.

Chris Williamson 20:29 That's awful.

Thomas (Tom) Johnson 20:29 We've got this device, it's held together with tape 'cause I, I abuse it quite a bit. But this is a scary, scary device.

Chris Williamson 20:37 Okay.

Thomas (Tom) Johnson 20:38 Um, I'll give you-

Chris Williamson 20:39 It looks, it looks to me just like a motherboard encased in a plastic shell.

Thomas (Tom) Johnson 20:44 It, it does, um, but it isn't. I'll explain what it is. It's actually ... I'll give you two, two definitions. One, the tech definition.

Chris Williamson 20:53 Yeah.

Thomas (Tom) Johnson 20:53 And two, the, the everyday English definition.

Chris Williamson 20:56 Got you.

Thomas (Tom) Johnson 20:56 So this is a, uh, software-defined radio transceiver operating from one megahertz to six gigahertz. Uh, and in English-

Chris Williamson 21:06 Yep. (laughs)

Thomas (Tom) Johnson 21:07 ... it's a, it's a radio transmitter and receiver that talks to technology.

Chris Williamson 21:12 Okay.

Thomas (Tom) Johnson 21:12 Um, but you can talk to Bluetooth with it, you can talk to wifi, um, you can talk to NFC, you can talk to the little, uh, readers on the doors that allows you into buildings.

Chris Williamson 21:23 Okay.

Thomas (Tom) Johnson 21:23 Um, you can talk to GPS with it. You can literally, with this device, snatch telephone calls out of the air, decrypt the conversation and listen to both sides of the call.

Chris Williamson 21:36 (laughs)

Thomas (Tom) Johnson 21:36 Not that I would. It would be illegal, but it's possible.

Chris Williamson 21:39 Yeah. Yeah. So-

Thomas (Tom) Johnson 21:41 Um-

Chris Williamson 21:41 What ... So how does that ... It ... Does that need to be powered? Is it battery-powered? How does that work?

Thomas (Tom) Johnson 21:45 You, you just plug it into your USB port in your computer, um, that powers it. It does eat the battery quite a bit. It's quite sorta-

Chris Williamson 21:52 Hungry.

Thomas (Tom) Johnson 21:52 ... power hungry, yeah. Um, depending on which frequencies you're operating on. If you're operating on low frequency, there's less frames, so it's less power. If you operate on a high frequency, it obviously squashes more data in, so it has to use more power to do that.

Chris Williamson 22:05 So you need to be, um, th- d- that particular device that you've just brought up there, does that need to be in the facility?

Thomas (Tom) Johnson 22:13 Um, about 100 yards away.

Chris Williamson 22:15 Okay. So you can, say-

Thomas (Tom) Johnson 22:16 Depending on, depend on what you're talking to. If it's low frequency, uh, as opposed to high frequency. Depends on what you're talking to.

Chris Williamson 22:22 Okay.

Thomas (Tom) Johnson 22:22 If it's, if it's a door lock, you need to be relatively close to the, the system. But you can-

Chris Williamson 22:26 Gonna say, you can't just park the car outside and start doing stuff with that.

Thomas (Tom) Johnson 22:30 Well, criminals use those very tools to steal cars. So they sit in Asda car park and they run a, a, a sniffer and they literally capture, um, the, the codes off the, the car keys. The older cars works with what you call a replay attack. So you literally just capture the, the door lock code and then replay it through the device, and the doors on the cars would open. Um, but d- have you seen all the modern cars that keep getting stolen with the people who stand outside of the houses with the antennas to look for the keys?

Chris Williamson 22:59 So I've seen a blog post about it, but if you understand, Tom, it'd be great for you to tell the listeners, 'cause it's a really cool story.

Thomas (Tom) Johnson 23:06 Well, it's called a rep- uh, a relay attack. Sorry, not a replay attack, a relay attack. So what they do is they pretty much sit the device in between the car and the key in the house. And what they do is they scan with a, an antenna to ... How it, how it works is the car sends what you call a Wiegand signal, which powers up the key.

Chris Williamson 23:29 Mm-hmm.

Thomas (Tom) Johnson 23:29 So when you come in re- be- like, get in range of the car, it powers up the key, the key responds, the car knows you, knows that that's the, the correct key. So you sit there and you relay it from the car to the key, the key to the car-

Chris Williamson 23:42 Mm-hmm.

Thomas (Tom) Johnson 23:42 ... and then the car opens-

Chris Williamson 23:44 Mm-hmm.

Thomas (Tom) Johnson 23:44 ... and then they drive off with it. So that's how it works. I'm not gonna tell you how it's done-

Chris Williamson 23:48 Yep.

Thomas (Tom) Johnson 23:49 ... 'cause, uh ... (laughs)

Chris Williamson 23:49 There was a, I saw a, um, uh, I saw this blog post. Uh, I think it might have even been on Top Gear or something like that. And they were talking about some of these really new, fairly high ... Like a Ford Cougar or something else, like a s- pretty new and f- 19-plate cars that were being stolen in under 30 seconds by using this sort of, uh, th- this sort of approach. Terrifying.

Thomas (Tom) Johnson 24:12 Absolutely. 'Cause that car is, is firing this signal to power up that key.

Chris Williamson 24:17 Mm-hmm.

Thomas (Tom) Johnson 24:17 If that key's out of range, the car's locked. As soon as that key goes into range-

Chris Williamson 24:22 ... it's unlocked.

Thomas (Tom) Johnson 24:23 It op- it opens, but the S- the SDR, the software-defined radio, is extending that range like a, like a relay runner.

Chris Williamson 24:31 Yep, yep.

Thomas (Tom) Johnson 24:31 It's passing that baton, that signal backwards and forwards.

Chris Williamson 24:33 Mm-hmm.

Thomas (Tom) Johnson 24:34 So the car knows no difference.

Chris Williamson 24:35 So, e- for anyone that's listening, if you've got a, a vehicle which has got keyless entry, uh, and engine start, how can they protect themselves?

Thomas (Tom) Johnson 24:44 (inhales sharply) That's the question. (laughs) Um, store it in a biscuit tin on a night-time. Um, it acts like a Faraday's cage, it stops the signal getting out. You can buy little wallets for the keys. Manufacturers are now looking at creating keys that, um, disable themselves unless they actually move, so when you-

Chris Williamson 25:04 Mm-hmm.

Thomas (Tom) Johnson 25:04 ... move them and wobble them, they'll reactivate themselves. But it's just a matter of time before the black hats and the cyber criminals come up with ways around that, you know?

Chris Williamson 25:13 Yeah.

Thomas (Tom) Johnson 25:13 Clever stuff. Really, really clever stuff.

Chris Williamson 25:15 Yeah, that's really interesting. So we've got the, the rubber ducky, we've got the, uh, Bash Bunny, we've got the, uh, that wireless, the camera that's inside of a, a lighter is unbelievable. Literally just looks like a lighter and it's got a camera on the bottom of it. Uh, we've got you, your relay for getting stuff from the facility and sending that back in.

Thomas (Tom) Johnson 25:36 Yeah.

Chris Williamson 25:37 Um, what else, what else have you got, or what else would you want to use if you were, if you were needing to get a hack? Maybe stuff like-

Thomas (Tom) Johnson 25:42 Uh-

Chris Williamson 25:42 ... blank cards and stuff like that, I guess, for replacing, blank cards for using on access panels?

Thomas (Tom) Johnson 25:47 Oh, blank cards, yeah, absolutely. Blank cards, you can pick them up from good old China for about 25 pence each.

Chris Williamson 25:54 Yep.

Thomas (Tom) Johnson 25:54 Um, and then, and you can rewrite them and reprogram them anytime you want.

Chris Williamson 25:57 Mm-hmm.

Thomas (Tom) Johnson 25:57 Um, I use simple things like little button cameras. Really cheap, buy them off of eBay. Just shove them in underneath your shirt and then you can capture people. It's all good for, um, listening to conversation at a later date, so things you may have missed. It might just be that one tiny little bit of information that you can use to leverage that person or that company. Um, I mean, I've tried everything. Uh, I've tried bribery. Go up to somebody and just say, "Look, let me into the building, I'll give you 200 quid."

Chris Williamson 26:29 Mm-hmm.

Thomas (Tom) Johnson 26:29 Um, you try everything within scope. So you have a s- a document of scope set up by the company, and they literally say what you can and what you can't do, and then you just try and leverage the information that you, you pull down. But we, we do all sorts of things, like we check, um, to see if emails have been involved in, uh, data breaches, so if you register with a, a website and then that website gets hacked and your details get leaked, then we can check to see if those emails have been involved in data breaches and, and which data breaches they've been involved in.

Chris Williamson 27:05 Yep.

Thomas (Tom) Johnson 27:06 Um, I mean, for a, for a cyber criminal, it would take a minute and a half to download the entire Twitter database in plain text. If you know where to look, it's there. And that's, that's pretty, pretty scary, to be totally honest with you.

Chris Williamson 27:24 Fucking hell. So, um, LinkedIn had a data breach not so long ago, uh, and a bunch of, um, a bunch of logins, uh, account information was taken from that. Mine was one of them. One thing that I didn't do, although I have done now with a, a updated password protector, shout out to 1Password, Tiago Forte's suggestion to me, which has been an absolute lifesaver. Um, I had the same password for LinkedIn as my Deliveroo, um, and-

Thomas (Tom) Johnson 27:51 No, no!

Chris Williamson 27:52 ... I know, I-

Thomas (Tom) Johnson 27:52 Don't share passwords!

Chris Williamson 27:54 I know, I know.

Thomas (Tom) Johnson 27:55 Do not share passwords.

Chris Williamson 27:55 That was a bad, that was a bad idea. And, um-

Thomas (Tom) Johnson 27:57 Yeah.

Chris Williamson 27:57 ... so, I, I got a mess- woke up one morning with a message off my business partner, and he said, uh, uh, "Is this you ordering Nandos in London on my card?" 'Cause his card was on my account. I must have ordered something for him.

Thomas (Tom) Johnson 28:10 (laughs)

Chris Williamson 28:10 So, uh, I was like, "No. No, no, not at all. Not at all." Went on-

Thomas (Tom) Johnson 28:14 (laughs) I shouldn't laugh, I'm sorry.

Chris Williamson 28:16 Oh, it's okay. It wasn't my money, it was his. Although he did, he, he then did, uh, make sure that I was billed for it on the company account. But, uh, yeah, and then sure enough-

Thomas (Tom) Johnson 28:24 (laughs)

Chris Williamson 28:24 ... they, they'd used my details and they must have just brute force checked a whole bunch of other platforms to see, does this email and password combination appear on this, this, this, this, this, this, this, this, this? And sure enough, on Deliveroo it did. And 45 quid worth-

Thomas (Tom) Johnson 28:38 Absolutely.

Chris Williamson 28:38 ... of Nandos later, they'd, they'd had it away.

Thomas (Tom) Johnson 28:41 That is social engineering 101. The human psychology make... The way that you're wired makes it difficult to remember complex random passwords, so what we do is we create something that we know. Most passwords have a capital first letter and have numbers at the end. Why? Because through school, we're taught to capitalize the first letter of a sentence. So when we're generating our password, we capitalize the first letter 'cause we know it needs a capital.

Chris Williamson 29:09 Mm-hmm.

Thomas (Tom) Johnson 29:09 We're putting the number at the end because it's at the end and we'll remember it. It's normally two digits or four digits, a date of birth, or a memorable date, um, or something simple like one, two, three, four at the end of the password. Passwords are normally constructed out of, if you're English, English words, um, which can be found in a dictionary. Um, and it doesn't take very long to crack a password. The entire character set of eight characters, including uppercase, lowercase, numbers, and special characters, in its entirety, can be cracked in two hours now. So, I mean-

Chris Williamson 29:46 Jesus Christ.

Thomas (Tom) Johnson 29:47 (laughs) Yeah. If, if, if you're looking at longer passwords, if it's constructed of English words and numbers and letters, we use dictionary attacks, so we'll say, okay, we'll try dictionary one and dictionary two, and we'll use a rule set to capitalize the first letters, or not, and put numbers at the end from one to 3,000, and then that reduces that character set down massively. So you can, you can crack a lot of passwords relatively quickly.

Chris Williamson 30:16 Is that brute force stuff there, where you just start, you'll set some sort of program away and it will just start cycling through version one, version two, version three, version four?

Thomas (Tom) Johnson 30:26 No, brute force isn't very efficient. Uh, the eight-character set, which I said can be cracked in its entirety, that is a brute force attack.

Chris Williamson 30:34 Yes.

Thomas (Tom) Johnson 30:35 As you start getting to nine, 10, it's inconceivably long.

Chris Williamson 30:39 Yeah.

Thomas (Tom) Johnson 30:39 So what you do is you use rule sets-

Chris Williamson 30:41 Yes.

Thomas (Tom) Johnson 30:41 ... and dictionaries.

Chris Williamson 30:43 Understand.

Thomas (Tom) Johnson 30:43 So it's not, uh, a brute force. You're not going through like, 0000A, 0000-

Chris Williamson 30:49 Yep, yep, yep.

Thomas (Tom) Johnson 30:49 ... 0000AB. You're, you're literally combining different words together and using sort of different numbers and rule sets alongside it. But a lot of people use, um, it's, it's called hackerish, it's where you substitute, uh, a letter for a number. So I becomes one, O becomes zero-

Chris Williamson 31:07 Mm-hmm.

Thomas (Tom) Johnson 31:08 ... A becomes three. A lot of people use that in their passwords 'cause it's easier to remember. But that's the first thing somebody's gonna try. They're gonna use a rule set to try that. So now we've got what you call GPU hacking, uh, sorry, cracking. We use something called Hashcat, and you can put together graphics cards, uh, a number of graphics cards, which are very, very good at, um, mathematics, so they're, they're much, much quicker than CPU cracking. So it's just, you know, it's, it's getting much, much tougher. Now, I can give you a really good hint. One-pass, things like, uh, password safes, they're all good and well unless somebody gets your master password, and then they've got the wh- all the keys to the kingdom. So you can create something called mnemonic password generation. Have you heard of that?

Chris Williamson 31:55 No.

Thomas (Tom) Johnson 31:56 So you think of, uh, a sentence, uh, specific to you.

Chris Williamson 32:01 Mm-hmm.

Thomas (Tom) Johnson 32:01 For example, "Tom ate 27 pies and now he is fat."

Chris Williamson 32:06 Yes.

Thomas (Tom) Johnson 32:06 Which is not very good.

Chris Williamson 32:07 Yeah.

Thomas (Tom) Johnson 32:07 And then you take the first letter and all the special characters from the se- first letter of each word and all the special characters and numbers-

Chris Williamson 32:14 Mm-hmm.

Thomas (Tom) Johnson 32:14 ... and it generates your password. So in our minds, we can remember the sentence because we've evolved over millions of years' language. Um, but on paper, it looks like a very long string of random numbers, letters, and special characters, and it's super secure.

Chris Williamson 32:31 Okay, that's interesting. Yeah, I, uh, I'm, it's terrifying to know that every different permutation of eight characters up, uh, uh, eight characters, special characters, letters, et cetera, can be run through in the space of two hours. That's, I mean, that, that, that is really, really concerning. So I guess, you know, first off, it-

Thomas (Tom) Johnson 32:51 That's like every possible password (laughs) .

Chris Williamson 32:53 Yes. That's under eight-

Thomas (Tom) Johnson 32:54 Yeah.

Chris Williamson 32:54 ... that's under eight characters. And I think most websites now just dictate that it needs to be a min- a minimum of eight characters, one uppercase, and sometimes one special character. So I'm gonna guess most people will take the path of least resistance and choose exactly eight characters, exactly one special character, exactly one number as well.

Thomas (Tom) Johnson 33:12 Most people do, yeah.

Chris Williamson 33:14 I, um, I saw a, uh, what's it called? A word storm, where the, uh, most common words are the biggest, and the most common password apparently across the entire internet is Password1, capital P.

Thomas (Tom) Johnson 33:29 I can quite believe it (laughs) .

Chris Williamson 33:31 So if you are listening-

Thomas (Tom) Johnson 33:32 I can quite believe it (laughs) .

Chris Williamson 33:32 ... and you're, and you have the password Password1 with a capital P and I've just guessed it, and I haven't got a c- I'm, you know, Tom is a different species to me when it comes to trying to hack in-

Thomas (Tom) Johnson 33:42 (laughs) .

Chris Williamson 33:42 ... but I've just guessed your password, for, for the love of God, please go and change it from Password1 with a capital P.

Thomas (Tom) Johnson 33:48 Y- you need to set at least 12 digits in your password. Um, and I would not use English words. I would put a little bit of slang in there or I would change it about. If you're not gonna mnemonically generate a password, try and make it as, as random and not likely to be in a dictionary as possible.

Chris Williamson 34:07 Got you. Okay. Well, that's, that's some good takeaways already for today. So keep your, your, uh, keyless entry car keys inside of a Werther's Originals, like, tin, and make sure that you've got a 12, a 12-digits password which isn't, isn't pure English. So getting back to the, uh, the ethical hacking and the social engineering and stuff like that, have you got some, some cool stories, some experiences that you've been through recently that you think some of the listeners might be interested to hear?

Thomas (Tom) Johnson 34:35 Yeah, I mean, we can continue with the, the attack on that large company and we can explain sort of certain, uh, things pertaining to that. So initially, we set up this meeting, um, uh, uh, I created a product, um, or a project that didn't exist, and I talked about it for an hour. I don't know how I did. It just all flowed out.

Chris Williamson 34:57 (laughs) Okay.

Thomas (Tom) Johnson 34:58 Um, but when I first arrived there, I asked to use the loo, um, and that was because I was given a visitor's pass, and the first thing I wanted to do was use me mobile phone to take photographs of that pass. Mobile phones now have got a resolution high enough to pretty much print out a pass and make it look relatively realistic. Um, I noticed that the, uh, lanyard was a generic lanyard that you could buy off eBay. You could buy 20 different colors for like, a tenner, um, and I had a load of them in the back of me car.

Chris Williamson 35:29 (laughs)

Thomas (Tom) Johnson 35:29 So after the meeting, I went home, um, I produced a new pass, I clipped the lanyard on, and the next day, I went in. I waited till they swapped for lunch, the people on the desk, and I just walked straight past, used the cloned card that I had, um, accessed the room. Uh, I was drinking cups of coffee for a while. One of the, the stories within that is there was somebody photocopying on a photocopier, and I started getting so bored of just sitting there, um, I walked up to her and pretended I was from the photocopying company. So I walked up and I said, "Hi, it's Tom from the photocopying company. How is your machine behaving today? I've been told it's been a little bit naughty lately." And she said, "Yeah, yeah, last week it was a bit bad, but now it's working fine." And I said, "Cool, excellent. It's just this, like a courtesy call. Would you mind showing me the other photocopier in your, in your building?" And she was like, "Yeah, sure. No problem." Now, why do you think I wanted her to show me?

Chris Williamson 36:29 ... and-

Thomas (Tom) Johnson 36:29 I knew where it was.

Chris Williamson 36:31 Oh, right, okay. Uh, to get access through the different doors, maybe, to where it was in the building?

Thomas (Tom) Johnson 36:35 No, it was on the same floor.

Chris Williamson 36:36 I have no clue.

Thomas (Tom) Johnson 36:36 Why do you think? Try and think. Have a think.

Chris Williamson 36:42 (sighs)

Thomas (Tom) Johnson 36:42 Do you want me to tell you?

Chris Williamson 36:43 Tell me, come on.

Thomas (Tom) Johnson 36:44 It was because I wanted to be seen being associated with that member of staff.

Chris Williamson 36:49 Oh.

Thomas (Tom) Johnson 36:50 So when she was walking across the floor with me, I was really loud, I was joking, I was talking, uh, I was having a laugh-

Chris Williamson 36:57 Mm-hmm.

Thomas (Tom) Johnson 36:57 ... and people were looking. "Look at that loud man over there. He's with Shirley," or whatever her name was. Um, and that means, within their mind, I'm meant to be there. Does that make sense?

Chris Williamson 37:10 Absolutely, yeah. This is a (sniffs) reputation by association type thing.

Thomas (Tom) Johnson 37:15 Abso- absolutely, absolutely. So, a little bit later on, I actually got questioned off a, off a guy who was quite, um, sorta security aware.

Chris Williamson 37:25 Mm-hmm.

Thomas (Tom) Johnson 37:25 And he come up to me and he's like, "Oh, hiya, what's your name?" I'm like, "Oh, yeah, me name's Tom." "Oh, where do you work?" I says, "Oh, I work in IT." "How long have you worked here for? It's a lovely building." He sa- and, and I suddenly switched the conversation over to him.

Chris Williamson 37:39 Mm-hmm.

Thomas (Tom) Johnson 37:40 Well, people love talking about themselves.

Chris Williamson 37:42 (laughs)

Thomas (Tom) Johnson 37:42 So, he spent about 15 minutes telling us about he worked there for 15 years, he was telling us all about his wife and his children and everything. And he completely forgot about questioning who I was. Um, in all that time, I was recording on me phone meetings between people, exfiltrating information that way. I was planting devices like this, a little remote transmitter bug. Um, I can dial into, where it's just on a mobile phone, and you can listen to things going on in meeting rooms and things like that.

Chris Williamson 38:12 (laughs)

Thomas (Tom) Johnson 38:13 Um, there's ... I even installed one of these in one of the meeting rooms. It's just a ... I don't know if you can see it. Can you see that?

Chris Williamson 38:19 Yeah, yeah. Yeah. What is it?

Thomas (Tom) Johnson 38:19 It's a, it's a cheapy little covert camera, but it transmits. So, it can transmit a video feed.

Chris Williamson 38:26 Okay.

Thomas (Tom) Johnson 38:26 And what I'd, what I'd done is I wrote a little facial recognition system in Python, um, and wha- what I'd do is I scrape the website for pictures of the employees, and then I pop them into me little facial recognition system and link it with a little bit of information about them that I've already searched. And I wear a cap with a camera in it, yeah?

Chris Williamson 38:48 Mm-hmm.

Thomas (Tom) Johnson 38:48 And I wear one of, one of these, which is a little covert headset. And that bit there goes underneath your shirt.

Chris Williamson 38:58 Mm-hmm.

Thomas (Tom) Johnson 38:59 And those are two tiny, tiny, tiny little magnets. Don't know if you can see them.

Chris Williamson 39:04 Yeah, yeah, yeah.

Thomas (Tom) Johnson 39:05 There's a big one in the middle and those tiny little ones drop inside your ear canals, and they roll down to your eardrum inside your head. And it uses, um-

Chris Williamson 39:14 Oh, my God. (laughs)

Thomas (Tom) Johnson 39:15 Yeah, it's a bit minging. It uses induction to vibrate them against your eardrum.

Chris Williamson 39:20 Right.

Thomas (Tom) Johnson 39:21 And you can, you can hook it up to take an audio feed. So, what was happening is I was walking along, the camera was picking up their faces, sending the feed to the computer, the computer was recognizing their face, and then it was speaking in my ears who they were and which department they were in. So, without even knowing them, I knew who they were. Does that make sense?

Chris Williamson 39:45 Fucking hell, Tom. (laughs) Oh, my God, that's so scary.

Thomas (Tom) Johnson 39:51 It's, it's a little bit.

Chris Williamson 39:52 Oh, wow.

Thomas (Tom) Johnson 39:54 It only took me two nights to write that facial recognition system.

Chris Williamson 39:57 That's absolutely blown my mind. You've scraped the website for all of the different employees, then you've linked that to a camera in your hat, and you've put tiny little magnets to re- so I'm gonna guess the reason for the magnets is that a typical earpiece would be too conspicuous and-

Thomas (Tom) Johnson 40:13 Absolutely. This is completely covert. Totally invisible.

Chris Williamson 40:16 This is inside of your ear canal?

Thomas (Tom) Johnson 40:19 Yeah. No, I can tell you a funny story about it. It actually got stuck in me left ear.

Chris Williamson 40:24 Oh, God. Okay.

Thomas (Tom) Johnson 40:25 And, and that little magnet in the middle, you're meant to extract them out of your ears.

Chris Williamson 40:28 Okay, yeah, so it jumps and catches the magnet.

Thomas (Tom) Johnson 40:30 Yeah, and it, and it wasn't working, so I spent like a day and a half with this magnet stuck in me ear canal (laughs) -

Chris Williamson 40:36 (laughs)

Thomas (Tom) Johnson 40:36 ... and I couldn't hear.

Chris Williamson 40:38 (laughs)

Thomas (Tom) Johnson 40:38 And I was thinking, "I'm gonna have to go to hospital." But, uh, I had a, a, a huge fishing magnet. I don't know if you've seen them before?

Chris Williamson 40:45 Yeah, I know what you mean.

Thomas (Tom) Johnson 40:45 People use them.

Chris Williamson 40:46 Yeah, yeah.

Thomas (Tom) Johnson 40:46 And I stuck it against the side of me head and it went (mimics magnet pulling magnet out of ear) and it sucked it out.

Chris Williamson 40:50 (laughs)

Thomas (Tom) Johnson 40:50 And it was covered in all sorts of wax and horrible stuff, but yeah, I got it out of my ear.

Chris Williamson 40:55 Oh, fantastic. Oh, well, yeah, I'm glad, I'm glad that you've got it out of your ear. But I mean, that, that, that sort of ... that, the sophistication of that's really terrifying. And the other thing as well, obviously-

Thomas (Tom) Johnson 41:07 Oh.

Chris Williamson 41:07 ... the, the implication is that if you're doing it as a white hack, a white hat, then the black hat hackers, uh, or people that are doing this for, um, corporate espionage and stuff like that, like if you're, I don't know, the, the top boffins in Apple, let's say, and you're designing the new iPhone, and Samsung or Huawei, let's say Huawei, the Chinese are always up to something in technology at the moment, aren't they? Everyone's worried about that. Um, and they can put all of these different bits of technology in the meeting room-

Thomas (Tom) Johnson 41:39 (laughs)

Chris Williamson 41:39 ... and they know all the different bits and pieces, or they put some sort of keyboard key, uh, keystroke tracker on someone's so they can hack into the backend of all of the communication channels. And, you know, you're, you're, you're just a, you're just a guy that's doing this. If you had the weight of an entire comp- uh, w- like, government behind you, what, what can they do then?

Thomas (Tom) Johnson 41:58 Nation state are on a whole new level. A whole new level. Have you heard of Stuxnet?

Chris Williamson 42:06 Uh, I've heard the name. I don't know why. What is it?

Thomas (Tom) Johnson 42:09 Stuxnet, um, without going into too much technical detail, it was a, uh, a virus that had infected a large volume of computers across the globe. Um, and it took Symantec several weeks to work out what this virus was. Normally, it takes them about 10, 15 minutes to say, "Oh, this is a worm, this is this, this is how it works, this is how it propagates."... but Stuxnet, they didn't know what it was for a long time. It had bits of code that they didn't know what it was and, and how it worked. And it was infecting computers on a level that they had never seen before. Um, it was infecting USB sticks, removable media, transferring it everywhere, and it wasn't doing anything. Yeah.

Chris Williamson 42:55 Oh, right.

Thomas (Tom) Johnson 42:55 And they were like-

Chris Williamson 42:56 Okay, just sitting there being, been very intimidating. (laughs)

Thomas (Tom) Johnson 43:00 Uh, no, it was being very quiet. That's the scary thing about it.

Chris Williamson 43:03 Yeah. Okay, yeah.

Thomas (Tom) Johnson 43:04 And it turned out, it was looking for one system, um, and that system was the Iranian Nuclear Enrichment Program. And this bug was so sophisticated, it had four zero-days in it, and a zero-day is worth about a million dollars. It's like a hole, an unknown hole in an operating system or a service.

Chris Williamson 43:25 Okay.

Thomas (Tom) Johnson 43:25 And this had four in it, which pointed to Nation State. And what it done when it found, um, this power plant, all this unknown code was to control the industrial controllers of the factory. So, what it done is it recorded, uh, stats covertly of the factory for about 30 days. It then disabled the safety mechanisms, 'cause they were all through a computer, and then it replayed the good stats. So, do you know, like in films, where the, the, they capture a bit of footage and then they'll loop that footage while they're committing a crime-

Chris Williamson 43:56 Mm-hmm.

Thomas (Tom) Johnson 43:56 ... on a C- CCTV camera? Well, this was doing it on, doing it on a nuclear enrichment system. So, once it was playing back the good stats, it started speeding up and slowing down all the centrifuges until it exploded, and it blew up thousands of centrifuges, physically exploded.

Chris Williamson 44:13 This actually happened? When was this?

Thomas (Tom) Johnson 44:14 This actually happened, oh, 2009-ish, I think. I might be wrong.

Chris Williamson 44:20 Wow. I'm not, uh, s- I'm not massively au fait with news and stuff like that, so I very well might have missed it, but that is terrifying. And obviously, the, the implications are that could be for pretty much, you know, if they can get into the Iranian Nuclear Enrichment plant, like, what, what really is left after that? What's got more security than that?

Thomas (Tom) Johnson 44:40 (laughs) Well, the scary thing was, is it wasn't even connected to the internet.

Chris Williamson 44:44 Okay, right. So it was totally off-

Thomas (Tom) Johnson 44:46 So it wasn't connected-

Chris Williamson 44:46 ... totally offline, totally isolated.

Thomas (Tom) Johnson 44:47 That's... Yeah, it was called air- air-gapped, so that's why they were infecting removable media. So one person plugged that stick into that computer and that system was doomed, absolutely doomed. I mean, there's, there's amazing things which happen all of the time. This device that I showed you before, the little, uh, radio transceiver, um, there was a guy called Barnaby Jack who was a New Zealand-based, uh, ethical hacker. Uh, he was the guy who used to hack bank machines, and he could dial something into his phone and then the bank machine would put JACKPOT on the screen and start emptying the cassettes of its money.

Chris Williamson 45:23 (laughs)

Thomas (Tom) Johnson 45:23 Yeah, he, he was a showman, an absolute showman, super genius. Um, he discovered that, um, pacemakers and morphine pumps, um, were, and insulin pumps, a lot of them, not all of them, uh, were susceptible to an SDR attack. So, he potentially could defibrillate the person by pressing enter on his keyboard-

Chris Williamson 45:46 Oh, my God.

Thomas (Tom) Johnson 45:47 ... from about 100 yards away. Um, and he approached the big, uh, company and s- companies and said, "Look, you know, this is a major security flaw." And they said, "We're not interested." Um, so he was gonna sort of tell everyone how it was done at a big convention, and unfortunately he died before the convention.

Chris Williamson 46:10 Was that a suspicious death?

Thomas (Tom) Johnson 46:13 Who knows?

Chris Williamson 46:14 Well, he, he died.

Thomas (Tom) Johnson 46:15 Who knows?

Chris Williamson 46:15 He died.

Thomas (Tom) Johnson 46:16 He died of a, a drug overdose of a speedball of drugs two days before his big convention, so I'm led to believe off what I've read.

Chris Williamson 46:24 Wow. And he was a- just a young guy? He wasn't, like...

Thomas (Tom) Johnson 46:27 He was a young guy, he was famous, he had an amazing career, a beautiful family, you know, he had it all.

Chris Williamson 46:32 Wow. I mean, this-

Thomas (Tom) Johnson 46:34 Money, cars.

Chris Williamson 46:37 It's weird, isn't it? Like, when we talk about all of this stuff-

Thomas (Tom) Johnson 46:40 (clears throat)

Chris Williamson 46:40 ... it, it's, it's fascinating, really, I, I, I love learning about it, and it's really interesting, but there's just... When you finish laughing about whatever the point is and you remember, if this gets into the r- the hands of the wrong people, if this is used on the wrong sort of facility, it's, the implications are really scary, aren't they?

Thomas (Tom) Johnson 47:03 Make no d- like, make no doubt about it, yeah, this is, is in the hands of the wrong people. Yeah? They have it now, they use it now. And what gets me is, the media tend to demonize hackers, yeah? We're, we're, we're told, like, uh, they, they tell everyone that we are the bad guys, we are... The hackers are the good guys. The cyber criminals are the bad guys. They're the ones who... If you're... How can I put it ............................ Right, okay, think of Gordon Ramsay-

Chris Williamson 47:38 Yeah.

Thomas (Tom) Johnson 47:38 ... and Jeffrey Dahmer.

Chris Williamson 47:39 (laughs)

Thomas (Tom) Johnson 47:40 Yeah? Yeah? So, Gordon Ramsay will use a knife to cook you a meal.

Chris Williamson 47:45 Yep.

Thomas (Tom) Johnson 47:46 And it'll be beautiful.

Chris Williamson 47:47 Mm-hmm.

Thomas (Tom) Johnson 47:47 Jeffrey Dahmer would use a knife to kill you and eat you.

Chris Williamson 47:51 Yep.

Thomas (Tom) Johnson 47:51 Yeah? That knife is hacking. Does that make sense?

Chris Williamson 47:55 Yes.

Thomas (Tom) Johnson 47:56 And then Gordon Ramsay's the hacker, and Jeffrey Dahmer's the cyber criminal. And that's the best way to sort of, to explain it to the layman, so they'll understand-

Chris Williamson 48:04 I understand.

Thomas (Tom) Johnson 48:05 ... that, that there is a battle between good and evil constantly.

Chris Williamson 48:07 Same, same tool, but different direction.

Thomas (Tom) Johnson 48:09 Absolutely, absolutely.

Chris Williamson 48:12 Okay. So, going onto, we touched on it earlier on, the, the stuff to do with nation states, uh, uh, and things like that. Just how much power and resources do you think countries are throwing into this, both on the defense and on the offense side? Obviously I've, I've listened to... I don't know how much you listen to Joe Rogan, but he, he often has a c-

Thomas (Tom) Johnson 48:33 Yeah, I listen to him.

Chris Williamson 48:34 ... has, has a couple of guys on from the CIA and the FBI who are now retired, and they talk about Huawei and Samsung TVs being installed with these particular chips, and, uh, the-... backdoors and the Chinese having government officials working inside of every big company and all this sort of stuff all the time.

Thomas (Tom) Johnson 48:49 A- absolutely, absolutely. To me, you've got to understand that data now is worth more than oil, yeah? So data about people, big data to train machine learning algorithms, et cetera, et cetera, it's worth more than oil. So it's, it's a very, very valuable resource that people want. Um, so they're gonna put a lot of money into securing that, and they're gonna put a lot of money into defending that. Now I'm genuinely proud of, of, of living in England and in Britain because we have some of the best security professionals in the world. Genuinely.

Chris Williamson 49:25 Is that true?

Thomas (Tom) Johnson 49:26 Um, absolutely true. Absolutely true. Um, they don't make a big thing about it and that's what's great about it, because they don't make a big thing o-

Chris Williamson 49:35 Probably a good sign. (laughs)

Thomas (Tom) Johnson 49:37 Yeah. You've got some amazing, amazing people, absolutely unbelievable people protecting us now, and it, and it genuinely does blow my mind. Um, but you have a lot of threat actors as well. So you've got China, you've got Russia, you've got North Korea, you've got all the states that wouldn't necessarily get on with us politically. And you have to understand that for the price of one fighter plane, you can hire 200 hackers. Do you get my point? So information warfare is going to be the future of war, and it's as simple as that. If you don't spend the money, you're not gonna be able to defend against it.

Chris Williamson 50:19 And do you need to spend a lot to be able to defend effectively?

Thomas (Tom) Johnson 50:22 (inhales sharply) I can't quantify that because I, I don't know enough about it.

Chris Williamson 50:29 Mm-hmm.

Thomas (Tom) Johnson 50:29 But I know that you have to spend some money.

Chris Williamson 50:32 Yeah.

Thomas (Tom) Johnson 50:32 And especially invest in education and, and teaching people and making people aware. Um, you've got to remember that all the meddling in the elections in the US and everything was all, all the email leaks and everything, was all based upon a phishing campaign, which was a social engineering attack. So, you know, it was once said that, uh, hackers use technology but the professionals hack the person.

Chris Williamson 50:59 (laughs) Mm-hmm, mm-hmm.

Thomas (Tom) Johnson 51:00 Does that make sense?

Chris Williamson 51:01 Yeah, absolutely. Yeah.

Thomas (Tom) Johnson 51:02 Yeah. So, you know, we've just got to... Everybody needs to do their bit, in my opinion.

Chris Williamson 51:09 Mm-hmm.

Thomas (Tom) Johnson 51:10 We're entering into an information age. We all have mini super computers attached to us at the hip, you know. For a, w- we Google things like, you know, you don't know the answer, you just Google it straight away and you know the answer.

Chris Williamson 51:26 Mm-hmm.

Thomas (Tom) Johnson 51:27 It, it's there. We are now integrating more and more and more with technology. And if we don't protect that and if we don't look after ourselves, you know, we're gonna be eaten for breakfast, in my opinion.

Chris Williamson 51:37 Does this need to happen at a state level or are there things that at, at an individual level which we all should be doing as well, apart from 12 string passwords and not using the password "password1"?

Thomas (Tom) Johnson 51:48 Uh, I think... I think governments do have a responsibility to protect us. Um, that's what we were elected for. And, uh, so far I think the UK have done a fantastic job, you know. There is gonna be attacks all the time but how many they stop and how many they defend against it, you know, we will never know.

Chris Williamson 52:11 Mm-hmm.

Thomas (Tom) Johnson 52:11 But they are doing their bit. Um, but I think common sense is a big thing. You know, don't just have super complex passwords but just don't share them between all sorts of different platforms, 'cause if I get your LinkedIn, there's a very good chance your email's gonna have the same password as your LinkedIn or something similar.

Chris Williamson 52:31 Mm-hmm.

Thomas (Tom) Johnson 52:31 So I'm gonna target your email 'cause then I can recover all your passwords to your email from all your other accounts.

Chris Williamson 52:37 Mm-hmm.

Thomas (Tom) Johnson 52:37 Does that make sense?

Chris Williamson 52:38 Mm-hmm.

Thomas (Tom) Johnson 52:38 Remember a few things. Whatever you put on the internet will always remain on the internet. There's no getting rid of it. It's gonna be there, it's gonna be spidered, it's gonna be captured. Um, if you're using IOT devices, so internet of things like, um, CCTV cameras and things like that, buy them from reputable places, you know. Do your homework. Um, if you're buying a camera from China that's 20 quid and the same one in, from a, a British manufacturer or whatever's 150 quid, there's a reason why.

Chris Williamson 53:14 (laughs)

Thomas (Tom) Johnson 53:14 Do you know what I mean?

Chris Williamson 53:15 (laughs)

Thomas (Tom) Johnson 53:16 Um, that reason tends to be the fact that they're, they're rubbish, they're crap, they don't protect you. In fact the very devices that we use to protect us sometimes works in the favor of the cyber criminals. One of my demonstrations is something called Google Dorking. Have you heard of Google Dorking?

Chris Williamson 53:33 No. Take us through it.

Thomas (Tom) Johnson 53:35 Really, really simple technique. It's, um, using advanced search operators in Google to look for misconfigured systems.

Chris Williamson 53:46 Right.

Thomas (Tom) Johnson 53:46 Um, now anybody can do it without any technical capabilities whatsoever. Um, they just need to know where to look. Now I'm not gonna tell you where to look-

Chris Williamson 53:54 Okay.

Thomas (Tom) Johnson 53:54 ... but it's called, it's called Google Hacking-

Chris Williamson 53:57 Yeah.

Thomas (Tom) Johnson 53:57 ... if you're interested in looking.

Chris Williamson 53:58 Yeah.

Thomas (Tom) Johnson 53:59 Um, and you can put in a string and you can exfiltrate, um, broken cameras or cameras... When I say broken, I mean cameras that aren't set up correctly. Now with one line of code I can find 500 web cameras that I can log into. Some of them are CCTV cameras. So, you know, it's- it's really, really scary stuff.

Chris Williamson 54:21 It is scary stuff. I, n- and some of the listeners will know I had, uh, Roger McNamee who was one of the early investors in Facebook, personal advisor to Mark Zuckerberg, he was the, the guy that got Sheryl Sandberg on board. Um, then, uh, just before that I spoke to Professor David Carroll who was the man-

Thomas (Tom) Johnson 54:38 Yeah.

Chris Williamson 54:38 ... the professor from The Great Hack, uh, on Netflix. Spoke to both of those guys within a couple of days of each other and, um, it definitely does feel at the moment like everything is gathering pace and the...... the online attacks, or the online threats are just, they're increasing in their magnitude across all, all platforms, as far as I'm concerned.

Thomas (Tom) Johnson 55:01 Absolutely.

Chris Williamson 55:01 So it's, it's not just that you have this sort of below the line, underground, black hat hacker things that are going on, but also even the data which we're willingly giving away is being manipulated in more, more and more sophisticated ways. And, you know, it- it really is, it's getting ... it's getting more serious, isn't it?

Thomas (Tom) Johnson 55:20 It absolutely is. All these, uh, apps like, uh, the T- uh, FaceApp and the 10 Year Puberty Challenge.

Chris Williamson 55:28 Mm-hmm.

Thomas (Tom) Johnson 55:28 Ten Year Puberty Challenge was used to capture data of people 10 years ago and now so they can build a machine learning model. That machine learning model potentially could be used for FaceApp to predict better aging of people, and that's why you take a photograph of yourself and it ages you 'cause it's all based on a data set.

Chris Williamson 55:45 Yeah.

Thomas (Tom) Johnson 55:46 So it's, it's scary stuff. I've just sent you, um, a little link that I've just pulled up on a Google Doc.

Chris Williamson 55:52 Okay.

Thomas (Tom) Johnson 55:52 Um, and this is actually a misconfigured CCTV camera-

Chris Williamson 55:56 Right.

Thomas (Tom) Johnson 55:56 ... on, um, a university in America.

Chris Williamson 55:59 Okay.

Thomas (Tom) Johnson 55:59 So, just-

Chris Williamson 55:59 So you've just done a, you've just done a live hack there, and now I've clicked on this link. I won't say where it is.

Thomas (Tom) Johnson 56:07 Fantastic.

Chris Williamson 56:07 And now, and now I can ag- wow, I can actually pan left and right and tilt-

Thomas (Tom) Johnson 56:14 And you can zoom in as well.

Chris Williamson 56:15 ... and tilt this camera up and down. I can see people walking around. Tom, this is fucking terrifying, mate.

Thomas (Tom) Johnson 56:21 (laughs)

Chris Williamson 56:21 You've just-

Thomas (Tom) Johnson 56:22 That's nothing. (laughs)

Chris Williamson 56:23 I can s- so I can see this, I can see this student walking towards class. He's got a hoodie on, he's got his hands in the hoodie. And there's si- some people, some guys sat down having a, a, a Starbucks just on this thing here. And I can zoom myself back so I can have a little bit wider of a look. (laughs) Oh my god.

Thomas (Tom) Johnson 56:42 Can I put me smug face on now please? (laughs)

Chris Williamson 56:45 You've, you've already, you've already-

Thomas (Tom) Johnson 56:47 No like that, that is-

Chris Williamson 56:47 ... you've already got it.

Thomas (Tom) Johnson 56:48 That is so simple that anybody can do without any coding skills, without anything. It's just creative Google searching. Um, a while back the, uh, somebody using Google Docking found all of the, uh, firmware and the software for all of the Boeing planes, I believe.

Chris Williamson 57:08 Oh my god.

Thomas (Tom) Johnson 57:09 Um, including the new 777 one. Um, the, you know, they found all of the source code for the plane. So it, although it doesn't take much to master, it's a very, very powerful little tool.

Chris Williamson 57:23 It is. And I suppose the thing as well is that as the effectiveness and the power of the systems that we're using increase, the concern with someone doing- using that for a nefarious purpose is, i- it goes up in line with that, right? So, Naval Ravikant, there's an unbelievable podcast that I'll send to you once we're done actually. It's Rob Reed from the After On podcast with Naval Ravikant.

Thomas (Tom) Johnson 57:51 Yeah.

Chris Williamson 57:51 Uh, I'll put it in the show notes below for anyone who wants to listen as well. They'll have heard me mention it before. Um, and basically he talks about all of the different ways that they're concerned about the future, all the different ways that the world could end as far as they were concerned. They go through, uh, syn bio, this synthetic biology stuff which they're fucking terrified about, that includes nanotechnology, and they-

Thomas (Tom) Johnson 58:11 Oh, absolutely.

Chris Williamson 58:11 That- that's stuff's really worrying.

Thomas (Tom) Johnson 58:13 (laughs)

Chris Williamson 58:13 There was some, some stuff to do with, um, being able to deploy drones with tiny amounts of C4 in them out the back of a plane, and then those drones are attached to facial recognition software. And as opposed to dropping a big nuclear bomb on a, on a city-

Thomas (Tom) Johnson 58:30 (laughs)

Chris Williamson 58:30 ... whereby it would make the city uninhabitable for a few years-

Thomas (Tom) Johnson 58:33 (laughs)

Chris Williamson 58:33 ... they could just drop 20,000 of these little drones out. These drones would detect all of the people, all of the men, or all of the Black men, or all of the white women, or all of the, the people that voted one particular way. Facial recognition, tiny little penny-sized amount of, uh, plastic explosive, fly up to them straight in the middle of their forehead, just blow their head off.

Thomas (Tom) Johnson 58:56 Great defense against that, either wear a mask or have a bloody good tennis racket with you. (laughs)

Chris Williamson 59:01 Big tennis ra- I'd back myself. I'd back, I've got a strong forehand, so I'd back myself with a tennis racket.

Thomas (Tom) Johnson 59:06 (laughs) All the tennis players would be safe. (laughs)

Chris Williamson 59:07 I know their words. Andy Murray's sweet, isn't he? Andy Murray and all of his family are, are the safest people in all of the UK. But yeah, they're talking about all of this stuff, and one of the things that's really interesting, and it, it kind of rounds this discussion off nicely, I guess, with regards to some, uh, um, some of the importance of what we're talking about with regards to data security at the moment. What they say is that in the past the most damage that anybody could have done, 200, 300 years ago, the most damage anybody could have done would have been shot one person once out of a musket, and then m- that would have been it. That was really the peak of what we could do. Maybe hit someone with a cannonball, but that was fairly, fairly inaccurate. And as technology grows and as these weapons and as the, um, the delegation, uh, and the d- uh, how would you put it? The ability for people to understand how to do destructive things becomes more and more well-understood, and then more and more well-distributed, it means that it won't be long before someone will be able to ... they're already doing it, 3D printing guns. There we go, perfect example. You've got technology with some coding that's come together, you can 3D print a gun. How long before you can 3D print a bomb of some kind or, you know, all of these things? So I suppose what that means is we need to be even more security conscious because the stakes of getting it wrong increasingly get worse and worse.

Thomas (Tom) Johnson 1:00:24 Absolutely. Uh, I mean, that rounds it up lovely. You know, uh, as things are progressing we're gonna be faced with lots of new challenges, and if we don't adapt as a race, we're gonna end up destroying ourselves. I mean now, you know, it's possible, very unlikely, but it's possible for a rogue hacker to shut down a power plant or to...... um, do a ransomware attack on a, on a water treatment factory and- and flood the water with loads of chlorine or, you know. Th- there's so many different things you can do that are damaging with technology now. And if we don't stay one step ahead of it, if we don't have a good educational system and- and people to inspire young minds and to get them involved in being a white hat and an ethical hacker, you know, we're gonna be in a world of hurt. We genuinely are.

Chris Williamson 1:01:16 Are you guys ... I'm going to guess the answer is yes, but you guys will be paid fairly well for your services. It will be a specialized, uh, and small group of people who have skills up to the standard that are required.

Thomas (Tom) Johnson 1:01:28 Well, the average wage for a- a qualified penetration tester with a bit of experience, uh, is between 65 and 120,000 pound a year.

Chris Williamson 1:01:39 Mm-hmm.

Thomas (Tom) Johnson 1:01:40 Um, and there is going to be a 1.8 million job deficit within the next three years. So nobody will have the skillset to do that. Um, my suggestion would be if you want a career change, do what I done, you know, quit your minimum wage job, blag yourself into university and smash it the best you possibly can. Jump in headfirst, take on every opportunity, do the best you possibly can and change your life, 'cause you can do it.

Chris Williamson 1:02:09 Tom, what an unbelievable way to end the podcast. Thank you so much for coming on, man. If, uh, if anyone who is listening wants to learn a little bit more, are there any blogs that you like or have you got anything online? Uh, um, are you on Twitter? Is- is-

Thomas (Tom) Johnson 1:02:22 Uh, no, I'm very careful on what I go on online believe it or not. (laughs)

Chris Williamson 1:02:25 I imagine- I thought- for some reason I was- I thought that you might say that.

Thomas (Tom) Johnson 1:02:29 I'm a tad paranoid, I only got a phone about a month ago. (laughs)

Chris Williamson 1:02:33 Okay. Okay. Fair enough.

Thomas (Tom) Johnson 1:02:34 Yeah, what I would suggest is if you want to learn more, uh, get yourself on Hack The Box. It is a website designed to teach hacking and you can legally hack their networks, um, they allow you to do it and have di- different capture the flag challenges.

Chris Williamson 1:02:52 Ah.

Thomas (Tom) Johnson 1:02:52 Things like that.

Chris Williamson 1:02:52 That's awesome.

Thomas (Tom) Johnson 1:02:53 You've got Over The Wire War Games, have a go at that. Um, learn Kali Linux the best you can. And if you're a student or you've got access to an academic email, get yourself on Immersive Labs, um, which was set up in conjunction with our sorta GCHQ technical sorta departments of the government. Um, and they have sorta labs that you can learn on there as well. So it's brilliant.

Chris Williamson 1:03:19 And you can have a little play around- play around in these safe environments where you can do a little bit of hacking, see if you're any good and then maybe flog your skills for 120 grand a year?

Thomas (Tom) Johnson 1:03:27 Absolutely. Absolutely.

Chris Williamson 1:03:29 Unbelievable.

Thomas (Tom) Johnson 1:03:29 Yeah. Go for it.

Chris Williamson 1:03:29 Well, and do you know what it is, I don't- I don't think that we could have done a better recruitment video if we'd tried.

Thomas (Tom) Johnson 1:03:33 (laughs)

Chris Williamson 1:03:33 Tom, uh, links to everything that we've spoken about today, uh, Naval Ravikant on Rob Reed's After On, links to Hack The Box, Over The Wire and some of the other bits and pieces we've gone through will be in the show notes below, as always. If you enjoyed this, please don't forget to give us a like and hit subscribe, it really does make me happy. Tom, man, thank you so much. I'm- I'm really excited to see what happens next. I guess we'll have to wait a couple of years until the- your non-disclosure agreement probably frees up and you can actually talk about it. But, yeah, what an awesome day. Thank you so much, man.

Thomas (Tom) Johnson 1:04:02 Fantastic. Thank you, mate.

Chris Williamson 1:04:06 Outfits. Ah, yeah. Oh, yeah. Outfits.