Teenage Hackers Have Cyber Weapons as Powerful as Nation States | VICE: Cyberwar | Blueprint

A tsunami of insecure devices floods

[music] the internet.

>> Venture capital is just injecting

massive amounts of money into the IoT

craze.

>> Teenage hackers take down the web's

biggest sites. They have access to the

same tools as nation states.

>> With millions of new smart devices

[music] coming online daily,

>> we're very nervous about the impact this

has on the internet as a whole.

>> The threat to all of us is now real.

>> It can't be unfixable and immortal.

From wireless printers to smart baby

monitors to Bluetooth enabled coffee

makers, 5 million [music] new devices

are hooked up to the net every single

day. controlled by your smartphone or

computer. These products make up the

internet of things or IoT and with them

comes the promise of unbridled

convenience. What people don't realize

is 80% of them have weak to no security.

In essence, super hackable. So, I don't

really trust the internet [music] of

things because of the risks it poses to

me personally, but also something like a

stove could be hacked by hacker and burn

down your house or it could be used to

get into your [music] network cuz has

bad security or it could be part of some

sort of zombie botnet that takes out one

of [music] your favorite websites. So,

the question is, are we setting

ourselves up for the internet

apocalypse? I can describe how messed up

the internet of things is, but the IoT

threat was really made tangible during

the second season premiere of the USA

[music] network drama Mr. robot. A woman

comes home to find all her smart devices

taken over by hackers. Lots of people

think this is sensational, [music] but

it's not. With the explosion of IoT, the

threat of your own tech being turned

[music] against you is no longer science

fiction. Is the added convenience really

worth the risks? To find out, I'm in the

Bay Area to meet Ben Actis, a legit

engineer who gets paid to hack IoT

devices for companies.

>> So, we could do we could do a couple

ways. We have a screwdriver here. We

could pop this or if you want to just go

completely Hannibal Lectar, we could.

>> This is getting a weird

>> Yeah, this is getting pretty weird

pretty quick.

>> Poor bastard is getting the cut job.

>> Yeah.

>> Tada.

>> Well done.

>> So, the idea of this little IoT cloud

pet is children will talk to it, sing to

it. The problem with cloud pets was all

these recordings that was sent up to

their web API completely public anyone

could grab which is bad.

>> That's a creepy thing.

>> It's super creepy. Creepy thing,

>> right? Yeah. It It's sketchy.

>> Doesn't it kind of remind you of some

weird like Soviet Cold War era.

>> Oh, the spy on the little

>> It's like a very much a spy thing.

You're like, you know what's inside your

teddy bear?

>> Yeah, that. But that's what we're moving

to, right? Well, all these devices that

I mean, look at this teddy bear is a

regular teddy bear before cloud pets,

right? So someone was like, "Oh, I have

a brilliant idea. We'll make put a mic

in it. We'll make a mobile app." And

they just shoved it in the bear's

bottom.

>> And would you say there's a big

difference between, you know, what they

put inside a teddy bear and what they

put inside a stove top or

>> No, there's not a big difference. And

that's the terrifying thing. If someone

can reverse engineer how your stove

works, right? Yeah.

>> And wants to disable fail safes, right?

Or provide false data, that's a big

issue. Actis and I went to a furniture

store to see some of the IoT devices

currently on the market.

>> So, obviously we're in a furniture

store. Mhm.

>> I mean, how many different types of

devices you're seeing have smart

capabilities?

>> Tons. Uh, okay. There's dishwashers in

here. There's IoT, stove tops, ovens.

>> I mean, what's to stop a bunch of kids?

It's almost like the 2017 version of

egging a house.

>> Yeah.

>> From like just screwing with somebody's

stove from across the street. That's

completely valid. And also the I think

the scariest thing is there's no way of

checking integrity or someone has messed

with it. So even if you can clean a a

phone or a PC, right? How am I going to

scan if my oven's firmware's integrity

is okay? So far, the most visible damage

caused by the internet of things has

come from botn nets. Put simply, an IoT

botnet is a cabal of hacked devices, all

infected with the same malware and

controlled in unison by a single hacker.

With a botnet, an asalent can program

those hacked devices [music] to launch a

distributed denial of service or DDoS

attack that floods their victim with so

much junk internet traffic, it forces

them offline. A massive international

cyber attack that took down some of the

biggest websites on the internet. The

sites were out for several hours this

morning in the eastern part of the

United States. By the afternoon, it had

spread to Europe. [music]

And among the websites were Twitter,

Amazon, Netflix, and Reddit.

This attack from September of 2016 was

unleashed by hundreds of thousands of

Internet of Things devices hijacked to

form the biggest botnet ever assembled.

The botnet named Mariah demonstrated the

risks of IoT. But it wasn't the first

time Mariah had surfaced. A month

earlier, the same IoT botnet had been

used in a DOS attack on tech reporter

Brian Krebs as retribution for his

exposing the identity of a pair of

Israeli cyber criminals.

So, the botnet [music] that attacked

you, what was in the zombie computer

army that was directed your way?

>> Uh, I think it was about 250,000 devices

uh in the bot that that hit my site. The

vast majority of those were digital

video recorders, DVRs, and security

cameras.

>> So, just stuff taken over on the

internet.

>> Exactly. The threat from poorly designed

Internet of Things is probably the

biggest cyber security threat we have

facing us. Most of these devices are

running Linux versions that were 10, 15

[music] years old.

>> In an article from January of 2017,

Krebs lays out how Marai, the largest

botnet of all time, was not the weapon

of some powerful nation state, but was

likely being controlled by a couple of

teenage hackers in New Jersey.

People ask me, you know, what what what

do you think of the chances that

somebody's going to take out the lights,

you know, take out the power grid or

something in a cyber war? And I always

say, first time we see that happen, it's

not going to be a nation state. It's

going to be some bored idiot savant kid

in his parents' basement who gets access

to some place he's not supposed to have

access to and says, "Wonder what happens

if I push this button?"

>> Boom.

>> They have access to the same tools as

nation states today. and they have fewer

reasons not to use them. The individuals

involved in this type of activity were

raised by the internet,

which explains a lot. These guys are

starting to do criminal activity when

they're 12, 13, and 14 years old. These

kids get drawn into these online

communities. They get involved in

identity theft. They get involved in

credit card theft. And left to their own

devices, I believe [music] these forums

generally turn people into sociopaths.

The Maride botnet literally took out

Twitter for a time, but these teenagers

didn't build it just to take out

Netflix. So why did they create such a

powerful cyber weapon? For that answer,

I have to [music] enter the dank

subculture of the online video game

Minecraft.

I'm in the Bay Area looking into the

threat [music] posed by the millions of

vulnerable IoT devices coming online

daily. The dangers of the internet of

things first made international

headlines when the Marai botnet took

down a bunch of the web's biggest sites.

Launched by a couple of underage

hackers, the attack proved teenagers in

New Jersey can wield cyber [music]

weapons as powerful as nation states.

Funny enough though, that weapon wasn't

made to take out websites. It was

initially made to force gamers offline.

>> So, let me get this straight. The thing

that took out parts of the internet,

>> Yeah. This massive DOS attack

>> was essentially incubated to attack

Minecraft servers.

>> Yeah, that's basically its main purpose.

>> This is Robert Quell. [music] At the

mature age of 12, he and his friends

built a Minecraft server, allowing them

to play the popular video game together

online.

What started as a hobby became a

business, and soon strangers [music]

were paying to play Minecraft on

Robert's network. Then they started

getting dodosed by an early version of

the Marai botnet. So you had these bad

Minecraft servers which would attack

other ones and gain a competitive edge

in the market. Right.

>> So the ones basically that would be

making lots of money. They'd shut down

other ones that they were competing

against so that all those players would

then go over to the other server.

>> That's basically how it works. Exactly.

>> The hackers directed the Marai botnet to

knock Robert's server offline.

Frustrated clients [music] who couldn't

access the game would leave Robert's

server and sign on with the Marai

makers. But Robert wasn't cool with

that. So we started a new company that

provided Minecraft servers protection

against these attacks.

>> So you came [music] up with a DOS

mitigation platform yourself,

>> right? So basically,

>> how old were you into this?

>> I was like 14 years old.

>> Yeah.

>> You were 14 years old when you started

doing this.

>> Yeah, definitely. We we had we needed to

do it. Like

>> I was editing houses when I was 14

making DOS mitigation.

>> Yeah.

>> And are you still doing this business?

>> Yeah, we still we still uh sell it as a

service today. like um

>> and you're raking in thousands.

>> Yeah, it it's very lucrative. [laughter]

>> And how old are you now?

>> I'm 19.

>> So the people going after you the same

age as you. So it's kind of this

adversarial

>> dark versus light kind of weird.

>> Yeah, Minecraft's making a lot of really

skilled programmers.

>> So the internet of things is making us

vulnerable to teenage hackers using botn

nets. But are IoT botnets something

governments would ever use? Like a lot

of things in life, I turn to Google for

the answer.

And to learn how big a threat DOS really

is, I'm meeting Damen Menure, Google's

expert [music] on DOS defense.

Now, coming from you and the perspective

of Google, what are the major concerns

surrounding DOSS attacks and botn nets

and IoT?

>> From Google's perspective, we're large

enough that we think we can probably

absorb everything, but we're very

nervous about the impact this has on the

internet as a whole. Um, you know, we

want people to be able to trust that the

internet is always there, that it's

accessible. We want small sites to be

able to exist. Um, thus attacks are

largely used as a method of extortion.

It's it's a financial difficulty for a

small site to survive. And so, we're a

little bit concerned about the risk of

DOSS attacks disrupting the free flow of

information on the internet.

>> I mean, I've heard that DOSS attacks, a

really great one, could quote unquote

take out the internet. It's somewhat

unlikely that a DOSS attack will

intentionally take out the internet.

That said, there can be accidents that

take out portions of the internet.

>> Have you ever seen any evidence of

nation states using DOSS attacks?

>> There was a case in uh this is probably

2012 where there was an attack called

robot that used compromised servers and

it was largely used to attack US banks.

So, financial institutions in the US. uh

this was later attributed by the US

government to the country of Iran and

probably other countries will realize

that this is an an opportunity for them

and do the same.

>> What's the big fear for you going

forward?

>> IoT is sort of changing the game because

now you have even more devices but

they're not managed at all and this is

affecting security on the internet. You

know recently there was a case of an

internet connected dishwasher. I was

trying to figure out why would you need

your dishwasher to be connected to the

internet? like what what benefit do you

get from that and this had some

vulnerability? Well, the user isn't

going to realize that that even has an

internet connection or you know this

need to be patched and so it's never

going to be updated.

I agree with Damian. Do we really need

Wi-Fi enabled dishwashers? Even so, the

internet of things is exploding and it's

not going [music] away. And if the only

thing we really need to worry about is

botnetss and DOS attacks, it's

manageable. But it's not. In fact, I

found other IoT threats that are far

more insidious and way more personal.

This is San Francisco, where I'm looking

for answers on the threats posed by the

Internet of Things. So far, the

high-profile victims of IoT are major

websites like Netflix and Twitter, taken

offline by an IoT botnet in a DOS

attack. But the truth is, you don't need

to be a multi-billion dollar Silicon

Valley Goliath to fear the rise of IoT.

The issue with the whole IoT world and

what's freaky and scary is that there's

the great unknown out there.

>> Morgan Marque is a cyber security

legend, plain and simple. He's also an

expert in how acronym agencies around

the world use cyber weapons.

>> Do you think IoT has made all of us more

susceptible to nation state offensive

actions?

>> More vulnerable to anybody, right? I

mean, you're maybe more vulnerable to

angry kids running Minecraft servers. Is

the internet of things making us less

secure? I mean, the answer is almost

definitely. But I guess a further

question is, do we care? You're probably

not thinking about security when you're

like, I want that bomb smart TV. You

just want to watch the game with your

friends while you eat hot wings. We all

need to start thinking about security

because if you're going to have a smart

lock on your front door, the reality is

it's more than possible to hack and then

physically enter your house [music] or

to use those same IoT locks as a virtual

gateway into your network, then move to

your mobile phone or computer or tablet

[music] and gain access to your entire

life. One of the things that personally

worries me, right, is that it has become

cheap enough to produce tiny computers

to control all manner of devices from

Barbie dolls to televisions to watches

to fitness monitors to light bulbs. Um,

teddy bears.

>> Teddy bears, right? I want as few

remotely controllable listening devices

around me in my house as possible. So if

everything from like a teddy bear to my

fridge is being produced in a way that

is insecure, I mean whose responsibility

is it?

>> Who is at fault here? Or who should

carry the liability? And that's a loaded

word, right? Because liability suggests

law and money um

>> payouts

>> and payouts, right? And and you know the

technology industry isn't that into the

idea of software liability because you

know we'll stifle innovation. It it it

looks as though we might possibly be

moving towards an era where we need

someone to be culpable, you know, if if

the insecurity of devices causes

widespread problems. But it's really

important that we fix the obvious

problems in these technologies before

they're widely deployed because by the

time I need that heart monitor, I'm

like, I I would like it to be incredibly

difficult to mess with.

>> Morgan's not the only one who would like

to see better security for the internet

of things. It's already a huge issue for

US corporations, losing hundreds of

millions every year to IoT breaches.

Justin Fear used to work with US

intelligence [music]

extensively. Nowadays, he's a director

for Dark Trace, a security firm on the

front lines of IoT security. So, first

thing I ask a customer how many devices

they expect to see on their network. Um,

and on 100% of the time, they

underestimated by almost 15 to 20%. And

of those underestimated devices, it's

typically IoT devices. all of the TVs in

the conference rooms, the uh

thermostats, the vending machines, etc.

So, for instance, we have a client here

uh had a fingerprint scanner, and what

happened was that scanner all of a

sudden became internet exposed. We then

started to see unusual activity between

the scanner and the database server that

keeps all the fingerprints.

>> What kind of target was this?

>> I I can't say what industry they were

in. Uh but it was a highly secure

facility. And when it comes to IoT, you

have anything that can be exploited and

owned.

>> I mean, if there's a a camera in

something, can you own the camera and

then

>> Absolutely. Yeah. We actually in one of

our clients found um one of their video

conferencing systems. They turned the

microphone on and recorded uh the calls

for about 2 weeks. Um and this was

actually in the board of directors

conference room. So, probably the most

sensitive discussions within the

company. I mean, how many more devices

are just popped up on networks, period?

>> Hundreds of thousands of millions. I

mean, if you look at the current climate

right now, venture capital is just

injecting massive amounts of money into

the IoT craze. I'd say every connected

device on your network is a potential

doorway into your company and your

network. I think if you wanted to

foreshadow and look into the future,

we'll look at ransomware. It's been

wildly successful. I kind of think that

the two are going to converge. I think

we're going to move from the virtual

world to the physical world and that's

kind of scary and eventually somebody's

going to find a way to lock you out of

your house until you pay a ransom.

>> I think part of the problem in terms of

making people understand just how

insecure all these devices are is that

they think that these wild examples

aren't possible,

>> right?

>> Um,

>> but they totally are.

>> I would say anything you've seen on TV

is actually possible. Having your

company's secrets stolen or board

meetings spied on is the antithesis of

convenience promised by the internet of

things. Are there any fixes to these

problems? You might think I'm headed to

more tech wizzes in California for the

[music] solutions, but instead I found

some of the answers in the pastures of

Rhode Island.

Like it or not, the internet of things

is making us all more connected. [music]

And that also means that with the added

convenience of IoT comes serious risks.

What do you think should be done with

all these devices lying around that

[music] the fix is device manufacturers

need to ensure that their devices have

at least basic security and also a way

to automatically patch themselves

[music] so that if a security flaw is

detected in the future that they can fix

that flaw.

>> We have a tremendous amount of of

hardware makers that are just pushing

out hardware and letting somebody else

design the software. They tend to have

very very poorly written software

[music] powering the devices.

>> Brian Krebs and Damen Venture see the

solution lying with the manufacturers.

But Justin Fear of Dark Trace believes

the answer is with machine learning and

artificial intelligence [music] using

algorithms to monitor the flow of data

on your network.

>> So unfortunately what we've been doing

for the last 5 years is just not going

to work anymore. Uh which is really why

I think companies need to start adopting

new technology. So the only answer to

all this is really machine learning, AI.

>> Yeah. I I mean I I hate saying it

because you know it's it's a buzz word

that's being thrown around quite a bit

but there is a lot of power there and

that's why technology like machine

learning is just absolutely required in

order to detect these [music] sort of

things.

>> Justin fear isn't the only one who

thinks our future is in the hands of the

machines. Dan Gear is possibly the

world's most respected voice in cyber

security. Period. The Central

Intelligence Agency tapped [music] him

to be the head of information security

for their tech firm, and he IDed the

threat posed by the Internet of Things

over a decade ago. I met with him at his

horse farm in Rhode Island, a setting as

disconnected from the world of smart

devices as you can pretty much imagine.

>> Having algorithms to protect you from

algorithms is the future, I suspect. I'd

rather have an analog circuit breaker

than a

digital one. In the year 2000, there was

a big to-do about whether when the clock

struck

>> Y2K,

>> Y2K. When the clock struck midnight,

would the elevator stop running or the

planes fall out of the sky or whatever.

I remember quite vividly the head of the

water department in New York said, "We

don't have a problem. We still have

valves and we know where they are." Can

imagine if it was a bad thing, somebody

would be out climbing into a hole with a

big ass wrench and cranking a a valve

opener shut. Um, the ability to do that

is, I think, a

a prudent requirement for

going over to a dependence on the

internet of things. We certainly will

see it, I think, that uh on a day-to-day

basis, it will make life much better.

Um, if it ever comes completely apart,

it'll make life much worse. Do you think

it's the internet of too many damn

things at this point?

>> Not yet. It's going to be. If you want

me to pick something that I view as

somewhat scariest, the vehicle-tovehicle

communication for the autodriving cars

that would allow them to stack up

thicker on the highway. And as such, you

get a free, if you want to call it that,

free expansion of roadway capacity.

Think about it. It's just irresistible.

Yet at the same time, that all works

until the day it doesn't.

>> Nothing comes for free. So, what is all

this convenience costing us? I asked Dan

what we're giving up as our world

becomes more interconnected and complex.

>> You remember the thing about complexity

is that because risk is is proportional

to dependence,

you're only at risk of things you depend

on. Thing about complexity is it hides

dependencies. If you put a device on a

network, I think you have to make a

choice. And I only think there are two

alternatives. One is it has to have a

remote management interface so that can

be modified, [music] turned off,

upgraded, something that's one option.

Can be reached, you know where it is.

You can fix it. Or if it can't be

reached or it can't be fixed, it can't

live forever. It has to have a finite

lifetime.

>> So what you're saying is the IoT devices

that are being built today, you think

that they should be built in order to

die at some point?

It can't be unfixable [music]

and immortal.

The two of those together are [music]

anathema.

In our quest for convenience, we've

created an insecure future with teenage

hackers just as dangerous as powerful

nation states. Dan gear is right. We

need to rethink how these IoT devices

are being built. But without pressure,

manufacturers will never be motivated to

care about security. The pressure can

come from consumers or it can come from

government. Either way, one thing's for

sure. Until something changes, [music]

the risks to all of us are only going to

get worse.

[music]