Johnny Long has been hacking stuff for as long as he can remember. But Long, a professional hacker and security researcher at Computer Sciences Corporation, doesn't fit the stigma. As a self-described Christian hacker who created an organisation for the hacking community to do charity work, he says his goal is to improve the security of computer networks by exposing their vulnerabilities.
He became the authority on search-engine hacking in 2005 when he wrote Google Hacking for Penetration Testers, the first book exploring how malicious hackers use Google features to unlock security flaws. In his new book, 'No Tech Hacking', he explains how hackers are using their curiosity and sense of perception to compromise security without the use of technology, and what security professionals need to know to get ahead of the game.
Explain the concept of "no-tech hacking."
Long: Security is a race between the good guys and the bad guys. Everybody tries to get more technically advanced and smarter about what it is that they are doing. After being a professional hacker for a number of years, breaking into computer networks and breaking into physical buildings to get access to computer networks and data, I learned that the things I was able to do most successfully often had very little to do with technology. I could spend a week, a month or three months pounding on an Internet-connected network for some agency trying to sneak past their firewall, or in a matter of two days I could actually be inside the building through social engineering, maybe by creating a fake badge that looked like an employee badge, pretending to be a telephone repairman, or even by entering through the smokers' entrance. There's a whole pile of stuff that doesn't involve technology.
Why does a good "no-tech hacker" also have to be a good social engineer?
Long: It's all about being comfortable where you are. A lot of people assume it's like acting, where you have to play a part, but really it's just about coming across as someone who's not up to something. Really good social engineers can pick up the phone and change their voice or their age. These days, you don't even have to do that, you just have to be comfortable and convince yourself that you're in a place you belong, that you're having a conversation that's completely normal.
What was the writing process like? Did you find that you learned new things as you went along?
Long: This was slow in coming. Many projects I work on are three to six months from beginning to end. The writing process for "No Tech" was very similar to that in duration, but the research, stories and photos behind it are years in the making. I got to the point where I saw so many things in public that I started carrying a camera with me all the time. I started pulling together years worth of pictures and war stories, and then came to the realisation that it was practical stuff that a wide audience could understand. "No Tech" gets to the heart and soul of what we're up against, not just for corporations trying to protect their data, but for individuals trying to protect their privacy.