Hollywood has always portrayed hacking in films as an action packed and glamorous pastime. However, there have been a few recent attempts to portray a more realistic view of hacking: none more so than Mr Robot.
Hollywood has always portrayed hacking in films as an action packed and glamorous pastime. Their representation of hacking has developed layers of absurdity, from the stupid in ‘Hackers’ (USA, 1995), to the unbelievable ‘Swordfish’ (USA, 2001), to the downright comical in ‘GoldenEye’ (UK, 1995). ‘Hacking’, as seen on screen, depicts the protagonist nonsensically bashing away on the keyboard to get into a secret database, or to bypass the FBI security system, and it happening within seconds. Time and time again, script writers and production companies are getting away with ignoring the actual difficulty and the painstaking time it takes to prepare hacks and find exploits in a system which could take days or even months to figure out.
However, there have been a few recent attempts to portray a more realistic view of hacking. Take, for example, scenes in ‘The Social Network’ (USA, 2010) where Mark (Zuckerberg) hacks into college groups to steal photos for his ‘Facemash’ app, or the nuclear power plant hack featured in ‘Blackhat’ (USA, 2015), which does resemble what happened in real life with Stuxnet and the Iranian nuclear facility.
It’s clear Hollywood is trying to take a turn towards a more realistic portrayal of hacking, probably because it’s featured so prevalently in the news at every turn. Think of the recent Ashley Madison hacks, or the UK based hack that saw 157,000 TalkTalk accounts accessed remotely, or the downright extravagant and massive cyber attack which hit Sony Entertainment - resulting in the leak of a huge amount of data, allegedly perpetrated by North Korea. All are the prime fodder for the silver screen... but somehow Hollywood always seems to miss the mark. That is, until now.
One of the most common hacks that Elliot (Mr Robot) employs is spear phishing, which is a crucial weapon in the arsenal of social engineering. Spear phishing is an email that is received by a potential victim styled in such a way to make the viewer believe it is from a legitimate sender but has actually been imitated so they can gain access to confidential data, or infect the victim's computer with loaded viruses.
In season one Elliot employs a number of spear phishing tactics on characters within the show: Shayla Nico, Fernando Vera and even his psychiatrist Krista Gordon. Elliot spends a huge amount of time researching his victim's social media, personalities and their hobbies to carefully craft emails designed just for them.
There are a few ways companies can protect themselves from this very common and extremely harmful attack:
Spam Filters: this sounds so simple but a lot of companies forget to enable their spam filters. Always make sure that you have the latest spam filters enabled and make sure to flag any suspicious emails as spam to keep your mailbox clean and make it easier to identify potential spear phishing attacks.
Training employees on how to recognise phishing emails have proved to be a successful method. Making sure employees are able to recognise the aspects of an email that makes it “phishy” will help protect your company.
Using an SSL Certificates between your website and the traffic that visits it keeps it safe. This will protect the information being sent between your web server and your customer's browser from any potential attacks.
In episode 6 of Mr Robot ("A Brave Traveler"), Elliot is trying to access the prison network to bust Fernando out. He employs Darlene who throws infected USBs into the police car park hoping that an unsuspecting officer plugs one into their computer.
This has become a very common attack in the real world and is how the infamous Stuxnet was able to access Iran's Natanz nuclear facility, spreading a deadly virus that knocked the facility offline and slowed down Iran's nuclear program.
Luckily for the police station in the show, the virus which was loaded onto the USB was a known threat which the computer antivirus detected it and the USB was quickly pulled out before any damage could be done. Unfortunately for Iran, this isn’t always the case.
This is still the most common way that virus attacks happen, the reason is because people are often curious about what is on a USB and keen to either find details of the person who owns it to give back, or to see if there is anything interesting on it.
There are a few things that companies can do to keep themselves safe from this form of attack:
Remove/lock USB Ports: This means either physically disabling USB ports from the machine or using software to shut them down. This will avoid people unnecessarily, or accidentally, plugging in infected USBs.
Updated Anti-Virus Checkers: Having up to date antivirus software ensures that USBs with known threats are more likely to be discovered by the virus checker and stop any damage before it takes control.
Education: It is absolutely crucial for companies to invest in training to teach their employees to never insert an unknown USB device into their machine, even ones from trusted companies.
In the season 2 premiere of Mr Robot, Darlene and her gang unleashed a ransomware attack on the E-Corp servers, which leads to an embarrassing moment when their CFO has to physically burn $5.9million dollars in cash to un-encrypt the data. Although an unusual way to punish their victim, ransomware and having to pay to release your files and data is becoming an epidemic.
Every day there is a new causality to the phenomenon that is ransomware. A number of universities and NHS hospitals have been struck by the hacking technique, with Bournemouth University reported having been hit 21 times in the space of 12 months.
Ransomware is a method of encrypting targets files and demanding a ransom reward, usually in bitcoins, before they will un-encrypt the data. Usually, the malware is hidden within emails, downloadable programs or corrupt sites and applications that are downloaded onto the computer.
What can your company do to protect itself from these types of attacks?
Backups: Constantly backing up files is a great way to protect your business from ransomware attacks. Make sure that whether it's through the cloud or local storage there is an external source to store your files away from your main systems so that they don't get infected.
Education: This is a common theme of cyber security, but a great method of prevention is providing training to employees and making them aware of how ransomware gets onto computer systems. Employees should understand that opening unknown attachments on emails can be very dangerous. If emails or attachments are coming from addresses they don’t recognise then it's best to avoid opening them without clarification from the sender.
Configure the whitelist for the plugins and add-ins for your browser that you use: Make sure to block plugins like Flash on every site and whitelist only the sites you trust. Also, instal ad-blocking software as ransomware had been known to be spread using infected popup ads.
Mr Robot continues to be a smash hit show depicting very realistic hacking techniques that are used in the real world. Now that season 2 has finished, we're going to have to wait (not long hopefully) until we can see what new hacking techniques will be portrayed in the next instalment. However, even someone who isn't an avid Mr Robot fan can see the destructive potential of these kinds of hacking attacks in the real world. There are many businesses can do to ensure they don’t become hacking victims.
To find out more about cybersecurity or how we can help your business, contact us.