PBS Nova: Rise of the Hackers

The digital world.

We rely on it more deeply every day

for our shopping, our banking, travel

and every kind of communication.

But with so much of our lives now online,

how vulnerable are we?

The Internet is a bad neighborhood.

In the digital world, there are ne'er-do-wells

coming by to rattle the door all the time.

If you become a target, how much could you lose?

My entire digital life was wiped out:

every device, everything I had,

almost all of it completely deleted.

Now, computer hacking is rising to a whole other level.

A new generation of cyber weapons

aren't just for stealing your credit cards...

My mouth was wide open

going, "Oh, my God, oh, my God, oh, my God!"

...but are designed for mass destruction,

targeting factories, water supplies, power grids,

and now, they're on the loose.

It was never intended to get in the wild,

but unfortunately it did.

It's a digital arms race,

and the stakes couldn't be higher.

This was a digital Pandora's box.

Once it was opened, you could not put the lid back on.

How can we protect ourselves on this new battlefield?

"Rise of the Hackers," right now on NOVA.

Major funding for NOVA is provided by the following:

Supporting NOVA and promoting public understanding of science.

And by the Corporation for Public Broadcasting.

And by contributions to your PBS station from:

And Millicent Bell, through:

Additional funding from:

It's an intriguing group of scientists

from many different backgrounds.

Some are experts in codes and code breaking.

Others are leading researchers in quantum physics.

A few are trying to build the world's most advanced computer.

But together, they're all taking on one common enemy:

hackers.

The greatest threat today to the world is the keyboard.

In the past, it may have been nuclear weapons

or weapons of mass destruction.

Today, we see that same level of capability being exercised

by lone individuals using keyboards as opposed to bombs.

Hackers are trying to devise ways

to steal our money, our identities, our secrets.

But it's not just criminals.

Now we know that governments are in on the action,

eavesdropping on an epic scale

and even launching powerful cyber weapons.

In this murky world,

can scientists harness the laws of physics and mathematics

to protect us from the hackers?

Mat Honan considers himself to be pretty savvy

when it comes to security and the Internet,

but recently, he discovered just how devious hackers can be.

The first clue that something bad was happening

came when he tried to charge his phone.

When I went to plug it in,

the phone had this icon on it, an iTunes icon and a plug.

And so I went to connect it to my computer,

and when I opened up my computer,

the screen turned grey and it asked for a four-digit pin,

and I knew I didn't have a four-digit pin.

I hadn't set up a four-digit pin.

I grabbed my iPad out of my bag,

and my iPad was also in this reset state

that wanted a password to proceed,

and the password that I knew should have worked didn't work.

At that point, I knew that I was being hacked.

That was pretty terrifying, you know?

I didn't know what they were doing at this point.

I had no idea what their motivation was.

The whole hack took less than 45 minutes.

By 5:00,

basically my entire digital life was wiped out.

My every device I owned,

everything I had had been taken over

and almost all of it completely deleted.

Just about every picture I'd ever taken of my daughter,

old emails, emails from people who were no longer alive,

all kinds of stuff that was very precious to me.

Mat thought he was the victim of a classic hack:

someone had repeatedly tried to crack his password

and eventually succeeded.

He went online to write about what happened.

And then, unexpectedly, the hackers got in touch with him.

They saw it.

They saw that I'd speculated

that they had brute-forced my password,

and this hacker got in touch with me to say,

"No, that's not how we did it."

And at that point,

I basically tried to strike up a dialogue with them

because I wanted to understand

both how things had happened and why they had happened,

and I basically made a deal that I wouldn't press charges

if they told me how it was done.

I was angry, I was scared.

I mean, I was concerned.

I was a lot of things like that,

but I also realized pretty quickly

that this was an interesting story

from a journalist's perspective.

For Mat, it was personal, but also professional

because he happens to be a writer for Wired magazine.

His hackers had discovered

a series of loopholes in the Internet

which, taken together, left him completely unprotected.

It wasn't like they used some crazy cracking program

to hack into all my stuff.

They didn't, you know, they didn't break my password.

They didn't break any encryption.

They didn't do any of that kind of stuff.

What they did was they socially engineered all of my accounts,

and social engineering is basically

just a fancy term for a con job.

Basically, you con your way

into a company's or a person's security system

by making them think that an attacker is actually a customer.

The first step was to find a way of stealing his identity

from one of his many online accounts.

Their way in was a simple phone call

to the online shopping service Amazon.

They gave Amazon a fake credit card number

and added it to my account, and they hung up.

They called Amazon back

and they told them they were locked out of my account

and gave them the credit card number

they had just added to my account.

Once they did that,

they were able to get a temporary password from Amazon.

It was a simple deception, but effective.

The hackers now owned his Amazon account.

But they didn't go on a shopping spree.

What they were after

were the last four numbers of his credit card

to pull off the next stage of their con.

On those recent orders,

they could see the last four digits of the credit card

that I had used to pay.

At the time, Apple was using those last four digits

as an identity verification method.

Once they had those, Apple gave them a password reset.

They now owned Mat's Apple accounts,

so they could access pretty much all of his digital life.

The ultimate prize was his Twitter account, @Mat.

For the hackers, a trophy.

And to keep this prize,

with just a few clicks, they destroyed his digital life.

My computer,

my iPhone and my iPad,

and they deleted my Google account

so that I couldn't get back in there and, you know,

kick them out of the Twitter account again.

It was an interesting chain.

They went from Amazon to Apple to Google to Twitter.

These hackers knew the security flaws of the Net

and how to use them, one after another,

to pull off this con.

And they were just teenagers.

It's just online vandalism.

They thought that this was going to be funny,

and they were teenagers,

and so they didn't think about the implications

of deleting everything someone owns

and how much kind of precious data you may have in your life.

You know, I mean, data's quite precious to people now.

It's valuable, and they didn't really see that.

Once revealed, the loopholes involved in this hack

were quickly closed.

But in the anonymous realm of the Internet,

there will always be ways to steal someone's identity.

Using the Internet to take control of valuable data

is now pretty routine.

And the victims aren't just individuals like Mat.

Hackers have stolen millions of credit card numbers

from big companies like Target and Bank of America

and broken into social media accounts.

But even this pales in comparison

to what the big boys can do.

It was probably the most sophisticated hack in history,

and it could have gone completely unexplained

but for a small group of cyber-security sleuths,

including Eric Chien and Liam O'Murchu.

Right from the word "go,"

there was just red flags going up everywhere.

You can really feel it.

Like, the hairs on the back of your neck stand up

if it's, like, really something really, really big.

As analysts for the giant cyber security firm Symantec,

Eric and Liam investigate the viruses

that pop up on computers around the world.

Most malicious software, or malware, they see

is pretty run-of-the-mill.

But in July 2010, they started analyzing

a baffling and crafty piece of code