I Got Caught Hacking in 1981. The Professor Made Me Head of Security.

In 1981 a college professor caught me trying to break into the school’s computer system. He didn’t suspend me. He said, since you hacked our computer, you’re now in charge of system security, and handed me the job.

That was the most useful thing anyone has ever done for my career, and not because it taught me about computers. It taught me that the only reliable way to protect a system is to look at it the way somebody trying to get in would look at it. Not the way the person who built it sees it, and definitely not the way the brochure describes it.

Thirty-three years in enterprise technology later, twenty of them running computer operations at Trader Joe’s, that habit has never stopped paying. It’s also the reason I find most home security advice close to useless. It describes products. It doesn’t describe how anybody gets in.

How does a company with cameras and card readers still get breached?

The company had spent thousands on card readers, security cameras and alarm systems. Every door logged every entry. Every corridor was covered. On paper it was excellent. An employee got tired of digging his badge out every time he stepped outside for a smoke break, so he propped the door open with a brick. That was the whole breach. Everything upstream of that door became decoration.

I’ve thought about that brick for years, because it’s the shape of nearly every failure I’ve seen since. The technical controls were fine. The seam was a person doing something reasonable to make his day slightly easier. Criminals know this better than most security professionals do. They don’t build attacks around beating your antivirus. They build attacks around what you already know and keep postponing. You know you should install that update. You keep clicking remind me later, because you’re busy and it’ll restart your machine and you have things to do.

The remind-me-later button is a dumb feature. Software makers put it there because people hate restarts, and criminals profit from it every week. Each postponed update is a door you already know is unlocked, and you’re betting nobody tries the handle before you get around to it.

What does an ordinary neighborhood look like from the attacker’s side?

Some years ago I drove through a suburban neighborhood with a laptop running network scanning software. Not doing anything, just looking, the way somebody who wanted in would look. In twenty minutes I found 127 home networks still using their default passwords and 43 with no password at all. Dozens of routers hadn’t been updated in years. Any teenager with ordinary computer skills could have been inside most of those houses’ internet connections that afternoon. None of those families thought of themselves as targets. That’s exactly why they were easy ones.

I ran a version of the same test at a cybersecurity conference, a room full of people who do this for a living. I set up a wireless network called Free Conference WiFi and left it running.

Within an hour I’d captured login credentials from seventeen different smart devices, because their owners’ phones had connected automatically and the devices had followed. Most of those people had no idea their gear hands over credentials to anything that looks familiar enough.

How many connected devices are in your house right now?

I counted the devices using my own internet connection once, expecting maybe fifteen. There were 47. Phones, tablets, computers, smart speakers, security cameras, thermostats, the refrigerator. I’d bought every one of them separately, over several years, each for its own reason. At no point did I sit down and design a network. It assembled itself out of individual purchases that each made sense on their own.

The average American household has more than twenty connected devices, and most families have never counted. Each one contains a computer more capable than the systems that ran entire corporations in the 1980s. Each one talks to servers belonging to companies you’ve never heard of.

That part is worse than any single gadget. Manufacturers ship these things with default passwords and quiet connections home, and nobody in the house agreed to any of it in a way they’d recognize. When one of those devices gets taken over, the family finds out last, if it finds out at all.

The strangest one I’ve found belonged to a family who called me about mysterious activity on their router.

We checked every computer, every phone, every obvious smart device, and found nothing. It turned out to be their two-year-old microwave. It had never been set up for internet access, so it had attached itself to a neighbor’s unsecured network and was phoning the manufacturer every night.

You can’t protect an inventory you’ve never taken. That’s the first real step, and almost nobody does it.

Does paid security software protect you better than the free one?

I ran a comparison of Windows Defender against four commercial antivirus products. Defender detected 99.2 percent of the malware samples, had the lowest false positive rate of anything tested, and used less memory and processor than most of the paid alternatives. The free thing already on the machine outperformed the subscriptions.

I think most of the money people spend on paid security suites goes to the wrong place. The subscription feels like protection, and the vendors are glad to sell that feeling. The protection that works is the dull maintenance nobody advertises: updates, backups, and passwords that aren’t the factory default.

A small business owner I know of postponed his updates for three months because restarting interrupted his work. Criminals eventually exploited a vulnerability Microsoft had patched two months earlier. The attack encrypted everything and the ransom demand was fifty thousand dollars.

He paid it and never received working decryption keys. Three years of customer records, gone, and the business rebuilt from nothing.

Ten minutes of restart, spread across three months, against the whole company. That’s the real exchange rate, and it never feels like that in the moment.

Why do so many breaches start with somebody being helpful?

A family I helped donated an old computer to a charity. They’d deleted their files first and believed it was clean. Deleting isn’t erasing, and whoever bought that machine from the charity recovered five years of tax returns, bank statements and personal photographs. The identity theft that followed cost them fifteen thousand dollars and two years of credit repair. Nothing technical failed there. They did a generous thing and didn’t know that the delete key is a suggestion instead of an instruction.

Don’t count on anyone else to wipe a machine before it leaves your house. That job is yours. Erase the drive properly or pull it and destroy it, because a stranger with free recovery software can read everything you thought you’d deleted, and the people who pay for that mistake are the family whose names are on those tax returns.

Even my own network taught me this one. I noticed a gaming console connecting at three in the morning, every night. It was my neighbor’s teenager, who had guessed my WiFi password and had been downloading games for months. He’d consumed nearly half my monthly data before I looked.

What should you do first, and in what order?

If you take one thing from this, take the order. Most people start with the most visible step instead of the most effective one.

Count your devices. Open your router’s admin page and look at the list. You’ll find things you forgot about and probably something you don’t recognize. That list is what you’re protecting.

Change the router’s default password. Then check when it was last updated. This is the front door and it’s the one people skip.

Turn on automatic updates and stop postponing them. The restart is the price. It’s a low price.

Back up the things you can’t replace, and keep one copy somewhere that’s not attached to your network. Ransomware encrypts what it can reach. (See the padlock math ransomware borrows)

Talk to the people you live with. Every technical control in your house runs through somebody’s judgment at some point. The brick is always a person, and the fix is a conversation instead of a purchase.

None of that is exciting and none of it costs much. That’s rather the point. The professor who caught me in 1981 was right about the method: look at your house the way somebody trying to get in would look at it. What you find will be duller and more fixable than you expect.

Families lose years of records and photographs to attacks that a changed password or a routine restart would have stopped. An industry that keeps selling them another gadget without ever mentioning either fix owes them better.

From the author

Family Cybersecurity
Home security fails at the human seam, and Family Cybersecurity is about protecting the people who live in your house. It opens with a ransomware call in the middle of the night.

Frequently Asked Questions