World Wide Weird

Hacks are serious business. But sometimes, they can be silly.

Cybersecurity is a serious matter. Businesses take great pains to cover their bases and protect their assets. Hackers, always looking for an edge, sometimes find network access in unexpected places, a consequence of a world where seemingly everything is connected to the internet. The struggle between hackers and defenders is constant, and victory lasts only until the next defeat. But for all the high stakes, the game can still produce humorous moments.

Casino Fish Tank Thermometer

In 2017, Nicole Eagan, then the CEO of UK cybersecurity firm Darktrace, related the story of an unnamed casino that lost 10 gigabytes of data, including a database with information on high rollers. How did the hackers gain entry to the network? Through the IoT-connected thermometer in the aquarium, of course. Such devices can also measure the salinity of the water and manage automated feeding, but it seems nobody at the casino thought of it as a potential weak point in the cybersecurity infrastructure. The hackers worked their way in, got the high-value information “then pulled it back across the network, out the thermostat, and up to the cloud,” Eagan said.

Operation Cupcake

It might not be the way James Bond would have done it, but MI6 agents got a sweet-tasting win in an ideological battle with al-Qaeda. The terrorist group’s Arabian Peninsula wing published an English-language online magazine called “Inspire” aimed at recruiting young, disaffected Americans and Brits. The British intelligence agency and officers at the Government Communications Headquarters hacked into one issue, replacing an article entitled “How to Make a Bomb in the Kitchen of Your Mom” with a recipe for mojito cupcakes. They also removed an article written by Osama bin Laden himself. The issue was re-released two weeks later with the articles restored. Bet those cupcakes were the bomb, though.

You’ve Been Thunderstruck

Thought to be created by U.S. and Israeli intelligence agencies, Stuxnet was the world’s first known cyberweapon. The computer worm disrupted centrifuges in Iranian nuclear facilities, preventing them from enriching uranium that could be used to build a nuclear bomb. Computers in the facility were air-gapped, meaning they weren’t connected to the internet but they were connected to each other, so the worm could spread quickly to them all. It’s not uncommon for centrifuges to break in the process of enriching uranium, but they were breaking at a rate of about 2.5 times what would be considered normal. It wasn’t until the computer system started blasting AC/DC’s hit “Thunderstruck” that the subterfuge became clear.

Hack Right Back

Anyone who’s suffered a malware attack feels some level of embarrassment. They might even fantasize about exacting some measure of revenge. German programmer Tobias Fromel did just that when hit by the Muhstik ransomware gang. Fromel paid the ransom in bitcoin. But then he managed to penetrate Muhstik’s defenses and take over their server. Once inside, he released 3,000 decryption keys and free decryption software that allowed other victims to regain control of their computers without paying a ransom. “Hey guys, good news for you all, bad news for me cause I paid already … maybe someone can give me a tip for my hard work,” he posted on Twitter. While Fromel’s actions were technically illegal, he was hailed as a modern-day Robin Hood.

Right Man for the Job

In 2010, a Hungarian citizen named Attila Nemeth emailed higher-ups at the Marriott Corporation claiming to have hacked their system and gained access to proprietary information. Two days later, after receiving no response, he sent proof of his hacking in the form of documents taken from Marriott’s computer system. Nemeth’s demand wasn’t a ransom, but a job. He threatened to expose the vulnerabilities unless Marriott offered him a job in IT. The next week, a fictitious human resources employee contacted Nemeth to set up an interview. When he showed up, Nemeth confessed his crimes to the interviewer, who was actually a Secret Service agent, and Nemeth was arrested.

Fingerprints at the Scene

Darktrace global field CISO Max Heinemeyer revealed an incident where a hacker tried to attack a luxury goods company by tricking biometrics scanners. The company had installed fingerprint scanners at a warehouse to restrict access. The hacker began removing authorized fingerprints from the scanners database and uploading their own, planning to later go to the warehouse and gain entry. When one scanner began acting strangely while the others worked fine, authorized personnel called Darktrace. “The Darktrace AI detected what is potentially the first hack where the perpetrators purposely left their fingerprints at the crime scene,” Heinemeyer told Forbes, describing the incident as “the weirdest hacker move yet.”