May 17, 2014
Attack Of The Super Hackers: A Group Of Ex-Soldiers Crack Safes, Pick Locks, And Steal Data — All In The Name Of Corporate Security
Kenneth Rosen published an online article yesterday, May 16, 2014, on the website — Narratively, with the title above. He begins by outlining a scenario we witness almost everyday. “On a balmy spring afternoon, Ian Amit stands at the counter of Starbucks in Midtown Manhattan. As customers check FaceBook, Twitter, and Gmail, through the free and open AT&T Network, Amit monitors it all. One keystroke could activate a script that would capture all the information passing through the network. He could, but he refrains.” It is not ethical, and in his words, just “less legal.”
“As Director of Security Services for IOActive, a firm that offers comprehensive computer security services, Amit is a problem solver,” writes Mr. Rosen. “Today’s demonstration at Stsrbucks,” he notes, “is a look at Open Source intelligence, or OSINT, and how the trail of data, left by the most innocuous of tasks carried out on SmartPhones, map out day-to-day activities coalesce into vivid portrait of everyone’s lives. As a corporate security specialist, it makes for an easy day’s work.”
“Don’t check your email,” Mr. Amit says, “plugging an external wireless antenna
into his laptop. “He shields his antenna,” says Mr. Rosen, “in his black backpack on the ground. To anyone watching, it looks as if he’s charging his phone and connecting to an external device, as his penetration and security tools boot onscreen in small command windows.” “It’s not about the tool. The tool is irrelevant,” he says once code begins streaming across the screen like out of the 1995 film “Hackers.” “The data is already out there.”
“But, the coffee shop is child’s play compared to his real work,” writes Mr. Rosen, “the clandestine operations known as “red teaming.” “A red team is a group of security specialists, usually with military experience, that functions without much regulation in the private intelligence sector. They challenge organizations to improve effectiveness in security by, among other things, breaking into systems to expose vulnerabilities. While the technique is rooted in military operations, it is frequently used in real world and civilian operations — some of which happen every day, right before our eyes.”
“Though he has the capability to steal a Starbuck’s customer’s identity while they’re waiting for their latte,” notes Mr. Rosen, “Amit is one of the security professionals whose life’s work is keeping data safe. As Amit explains it, most of what we see as security — the two-step passwords, the ID cards — is the idea of security, not security itself. In that way, security efforts rarely focus on the one or two outliers. Rather, they choose to manifest as long lines and security checkpoints, providing a sense of security through large signs and heavily armed guards.” “Security theater,” as it’s called in the business: the TSA agents and Paul Blart mall cops of the world. Red teams, on the other hand, are practitioners in the art of security, attacking from every direction, beyond the metal detectors and security patrols, until they expose weaknesses, and propose fixes to fortify them.”