100's of hours teaching cybersecurity and even more mentoring those new to the field and can you guess the #1 question I get?
"How do I be a Hacker?"
When most people picture a hacker, they think of a shadowy figure in a dark room, wearing a hoodie, typing rapidly into a green-text terminal while murmuring, "I'm in." . It's the sexy part of offensive security. They think hacking is a purely technical skill set—a collection of programming languages, network protocols, and cryptographic exploits.
On my blog I like to reTHINK and buck the status quo, so I'm going to let you in on a little secret: The technical stuff is the easy part. Hacking isn't a skillset. It's a mindset.
At its absolute core, hacking is about looking at a system, understanding the rules that govern it, and finding a creative way (yes these can be technical too) to bend or bypass those rules to achieve a completely different outcome. It's about questioning the default settings of life. And believe it or not, you don't even need a computer to do it.
To prove it to you, I am going tell you two completely non-technical stories about how I hacked my local neighborhood.
Exhibit A: The Jason’s Deli Soft-Serve Exploit
If you’ve ever been to Jason’s Deli, you know one of their best features is the complimentary, all-you-can-eat soft-serve ice cream machine. It's a beautiful system; after all who doesn't like free ice cream? However, the architects of this system put a security control in place: they provide these incredibly tiny, Dixie-cup-like "bowls." They want to limit your payload. Your joy. They want you to take a tiny bit, eat it, and feel too self-conscious to keep walking back for more.
But as a hacker, I don't look at the small bowl. I look at the whole environment.
When you order a meal, they hand you a massive, 32-ounce plastic drink cup. The system says that cup is for iced tea or soda. But the their logic doesn't actually check what liquid goes into the container.
So, I bypass the tiny bowl entirely. I take my massive drink cup straight to the soft-serve machine and fill it to the absolute brim. I used the existing parameters of the system to maximize my ice cream ROI. Input: One meal. Output: A glorious, structurally questionable mountain of vanilla soft-serve.
System: Hacked.
Exhibit B: The Movie Theater Popcorn Buffer Overflow
Theaters make their real money at the concession stand, but to entice you to buy the most expensive option, they offer a policy: Free refills on large popcorns. The baseline user behavior is simple: Buy the popcorn, eat it during the trailers and the first half of the movie, miss ten minutes of the plot running out to get a refill, and walk back in.
I looked at that workflow and realized it was highly inefficient. I didn't want to leave the theater mid-movie. And I sure don't want to miss any previews.
So, I brought my own secondary storage device (a clean, empty grocery bag) to the theater. I stepped up to the counter, ordered the large popcorn, took the full bucket, and right in front of the concession worker, I flipped it upside down and dumped the entire contents into my bag.
Then, I immediately handed the empty bucket back to the slightly stunned worker and said, "Can I get my free refill now, please?" They checked the policy logic. Did I have a large bucket? Yes. Was it empty? Yes. Does the policy specify a time delay between purchase and refill? Nope.
They filled it right back up. I walked into the theater holding a double payload of popcorn without missing a single frame of the film.
System: Hacked.
The Common Thread: Be Curious, Not Judgmental
Geez looking back at my examples no wonder I am fat :) . In both of these scenarios, the "exploit" didn't require a single line of code. It just required looking at a scenario and asking: "Why does it have to be done that way? What happens if I try this instead?"
This brings us to the absolute foundational trait of any great hacker: Relentless Curiosity.
If you want to understand the ultimate hacker philosophy, you actually have to look to a football coach from Kansas. In a brilliant scene from Ted Lasso, one of my favorite TV shows, Ted defends himself in a high-stakes game of darts by quoting a phrase he saw on a wall: "Be curious, not judgmental." Take a look at the clip to see exactly how this mindset plays out when someone underestimates what you're capable of:
When most people look at a secure system or a rigid set of rules, they become judgmental. They think, "Well, that's just the way it is. It's unchangeable. It's locked down." A hacker chooses to be curious. They don't judge the system; they investigate it. They ask questions:
How does this talk to that?
Why did the developer choose this specific boundary?
What happens if I send too much data, or use a container that's "too big" for the soft-serve?
If you have that burning desire to pull things apart, figure out how they tick, and see if you can make them tick a little differently, congratulations—you already have the hacker mentality. The technical stuff—the Linux commands, the Wireshark captures, the scripting—is just a set of tools you pick up along the way.
So, as you step out into the world (or into the terminal) today, don't just accept the defaults. Ask the extra question. Test the boundary.
Be curious. ***
No comments:
Post a Comment