wants to teach the world how to hack. An expert on legal philosophy and the founding director of Yale University鈥檚 Cybersecurity Lab, his day job is to provide cutting-edge teaching for Yale law students on how the online world works and how to keep it secure.
He believes that we can only effectively tackle cybercrime if we understand not only how people hack, but why. In his new book he explores true stories from the front line of cybercrime, from the hacker known as Dark Avenger who wrote the first mutating computer virus, to the teenage boy who hacked Paris Hilton鈥檚 phone because he wanted to be famous. The book鈥檚 title derives from the exploits of Fancy Bear, a group working for Russian military intelligence that hacked the governing body of the US Democratic Party during the 2016 presidential campaign.
Advertisement
Shapiro talks to New Scientist about what we can learn from hackers, why he wants to and just how close he came to committing cybercrime himself.
David Adam: You teach people to hack. Why?
Scott Shapiro: I think it鈥檚 very hard for people to understand how hacking works when it is described abstractly. It鈥檚 a bit like explaining how to do carpentry through a description 鈥� you can read the words, but you don鈥檛 really understand what鈥檚 happening. If you teach people how to hack, they can understand in a much more intuitive way not only how it works, but also how to protect themselves against hackers.
Is it difficult to learn how to hack?
It鈥檚 upsettingly easy to learn to hack. My teaching partner and I put together an online course with 12 videos, each an hour long, plus assignments and explanations on how to hack. So, that鈥檚 12 hours of videos with some homework. That鈥檚 open to anybody and if you do it, you鈥檒l learn not just how to hack, but more importantly you鈥檒l learn why it works. I want to teach people how to understand how information is stored, manipulated, transferred and, ultimately, exploited.
Your book says there is no technical way to stop hacking. Why is that?
There are many technical solutions to improve cybersecurity, such as protecting accounts with passwords, providing easy-to-use encryption on the internet and sophisticated firewalls. But there鈥檚 no technical way to achieve perfect cybersecurity.
Even if we just want to improve cybersecurity, as opposed to perfecting it, it is a mistake to think that the way to do that is through technical means. It鈥檚 primarily a human problem. We need to try to fix the political, social and psychological vulnerabilities that generate vulnerable code. If people just try to fix vulnerable code, in some sense they have already lost the game.
What changes are required to tackle these vulnerabilities?
We need to focus on what I call 鈥渦pcode鈥� 鈥� the social, legal, economic and psychological factors that drive, encourage and permit the anti-social, disruptive and illegal behaviours of hackers.
The UK has been very forward-leaning in this respect. The National Crime Agency to understand how young people start engaging in low-level deviant behaviour online. There have been attempts to try to have law enforcement meet with these people to try to divert them away from criminality. We know that mentorship can do that. In the US, new types of competitions have been created to divert people who might ordinarily commit crimes on the internet into projects where people engage in activities that are safe.
While we work out how to tackle hacking, is it really a good idea to teach large numbers of people how to do it?
Somebody needs to teach people what鈥檚 happening. The idea is to provide this information for interested people, presented in a responsible way, so that they can learn it and understand the news and what鈥檚 happening around them. And to make them more secure.
When we teach the course, we repeat 鈥� over and over again 鈥� the absolute importance of not hacking other people without their consent. Some people who do our Yale Law School course go on to learn more about cybersecurity and become experts. Others go to work for the US Department of Justice, or they go into private cyberlaw practice, and they are newly empowered to understand things that almost nobody understands.
In your book, you describe various high-profile hacks. Do you have a favourite?
I鈥檓 partial to the Robert Morris hack. Morris was a graduate student at Cornell University [in New York] in 1988 and he wanted to do an experiment to see if he could infect lots of computers on the internet. He figured out multiple ways of getting a worm to spread over the internet. He didn鈥檛 intend to cause any harm, though it ended up crashing the internet and he was ultimately convicted for doing so.
I like it a lot because it was technically very interesting, how he was able to allow his worm to spread. But it also raised novel legal questions about the desire to hold people responsible for intentionally releasing viruses and worms onto the internet if they didn鈥檛 intend to create any damage, but nevertheless did so.
At the time, Morris鈥檚 dad was chief scientist for cybersecurity at the . A lot of the things he did, he learned from his father. I feel a kindred spirit with Morris. We鈥檙e the same age, we used to both go with our dads to their work at , (where Morris senior worked prior to his move to the NSA). We never met, but I know we were both really interested in the UNIX operating system and we both read all the manuals.
It seems that you have more sympathy for some of the hackers than for the big tech companies like Microsoft. Why is that?
Well, partly because it鈥檚 adults versus children. And because I want to hold Bill Gates to account for, in my opinion, wanting to crush the free and open internet and not prioritising security. Also, the hackers I鈥檓 talking about are often young boys who are trying to win the respect and esteem of their peers, which is something I think we all can relate to. They often get sucked into a cycle of escalating transgressions, which is a very well known behaviour pattern in human psychology. And they tend not to be, you know, billionaires.
What have we learned from the hacks you write about that could help tackle cybercrime?
One of the things that has been said many times is that it鈥檚 a cat-and-mouse game. Somebody does something, you fix it. Somebody does something else and, again, you fix that. They respond and so on. Cybersecurity is so much better than it used to be, but the attacks are so much better than they used to be too. I feel this cat-and-mouse game will keep going forever.
The question is, can we win the game more than we are right now? I think the answer is yes if we start to view cybersecurity as primarily a human problem that requires human solutions. We need to develop rules and norms and principles to regulate how computer code is written, deployed, tested and, ultimately, used. It鈥檚 always going to be a whack-a-mole situation, but we can make it so that it鈥檚 not so frustrating.
In the movies, a hacker who is caught is always offered a job with the government. Does that happen in real life?
Yes, that鈥檚 what happened in the last hack in the book. The three hackers released malware called Mirai that targeted and took control of devices connected to the internet of things, like security cameras and smart toasters. Instead of being incarcerated, they were given five years of community service, during which time they worked for the FBI and helped stop a nation-state hacking group. They were mentored by the FBI agent who caught them. The special agent diverted them into a socially productive activity instead of a socially wasteful activity like putting them in jail.
What would you say to New Scientist readers who want to make sure their own computing is as secure as it can be?
Don鈥檛 freak out. Ordinary people aren鈥檛 high value targets. Cybercriminals don鈥檛 want to hack you, they want to make money. That means they don鈥檛 want to spend time on people who take even minimal precautions. I think the most minimal precaution you could take is never clicking on a link or opening an attachment in an email from somebody you don鈥檛 know.
Has artificial intelligence changed hacking?
Yes. Cybercriminals tend to be non-native English speakers who target the English-speaking world, and this provides a natural barrier to the effectiveness of their phishing emails. They need to write English not only with correctly spelled words, but also to write idiomatically. This has been very difficult. But ChatGPT allows everyone to write a good hacking email, a good phish, so it鈥檚 going to become even more important not to click links in emails from people you don鈥檛 know.
Have you ever hacked a computer that you shouldn鈥檛 have?
Well, I got up to the edge. It was the Yale law library website. I did what was called a cross-site scripting attack, which injects malicious script, and it generated a link that I could have used to send an email, let鈥檚 say to the dean, to say 鈥渉ey, look at this new book that the library is ordering鈥� and have her click on it and then gain access to her machine.
Of course, I would never do that, but I was proud of myself for being able to get to the line. I didn鈥檛 gain unauthorised access, but I was tempted. I feel like I鈥檓 a responsible person, but you just get caught up in it. This is the problem, which I repeat over and over and over in my classes. You will want to use this. Do not use this.
David Adam is a science journalist聽based in Hertford, UK,聽and聽author of The Man Who聽Couldn鈥檛聽Stop鈥�
