What Is An Ethical Hacker? - Thomas Johnson - #105

**Chris Williamson** (0:00)
Oh, hello, people of Podcast Land. Welcome back to Modern Wisdom. My guest today is Tom Johnson, and he is a social engineer and ethical hacker. Don't worry, I didn't know what that meant before this podcast either. So today, you're gonna learn. Tom is going to tell us how he gets into buildings that he shouldn't, how he gets access to information and computers that are prohibited and protected, how he subverts both online and offline security and hacks into a university CCTV system live on air. This entire discussion with him was pretty terrifying. He is a good guy, but the fact that he is able to do these things with computers and in the real world shows just how vulnerable we are. We think that we have a lot of protections in place and that our information is at least partially secure. And Tom dispels a lot of those myths today. A lot of takeaways to do with both personal and commercial security on and offline. So I really hope that you enjoy it. Thank you so much to Tom for coming on. Please welcome one of the good guys in the world of hacking, Tom Johnson.
I am joined by Tom Johnson, ethical hacker and social engineer extraordinaire. Welcome to the show, Tom, it's great to have you on.

**Thomas Johnson** (1:40)
Hello, thank you very much for inviting me.

**Chris Williamson** (1:42)
It's gonna be an exciting one today. This world of ethical hacking and social engineering is something that I've seen a little bit about online, but I don't really know all that much, but I guess we're gonna delve into it today, right?

**Thomas Johnson** (1:55)
Absolutely, yeah. I mean, would you like to start off at the beginning, how I got involved in it?

**Chris Williamson** (1:59)
Yeah, absolutely.

**Thomas Johnson** (2:00)
Would you like me to tell you what it is, first of all?

**Chris Williamson** (2:02)
So let's find out, how do you define ethical hacking and social engineering and what you do and then let's find out about the Genesis story.

**Thomas Johnson** (2:12)
Absolutely. Okay, so social engineering, according to a guy called Christopher Hadnagy in America, is the art of using human psychology or misusing human psychology to get a target to do something or say something they shouldn't do or say. And that is grassroots. So if you can talk someone into giving you the passwords or plugging a US base stick into the computer, then all of this very expensive sort of cyber security mitigation is useless because they are literally giving you the keys to the kingdom. So that in a nutshell is what it is.

**Chris Williamson** (2:49)
I understand. Yeah, I suppose as these technological firewalls and safety measures become more sophisticated, the ways around it that don't require you to just brute force, try and break through something that's heavily encrypted, I guess this sort of falls to the one remaining weak link in the chain, which is always going to be the several million year old brain that sits inside of the person controlling the system, right?

**Thomas Johnson** (3:17)
Well, in my opinion, humans can be the weakest link, but they can also be the strongest link as well, because they think in a different way to how computers process information. So have you ever had a good feeling before, Chris?

**Chris Williamson** (3:31)
Yeah.

**Thomas Johnson** (3:31)
Well, that good feeling is your subconscious mind telling you that there is something not quite right in a pattern. So your subconscious mind is constantly processing everything around you. And then when you get that good feeling, that is your subconscious mind saying to your conscious mind, there's something not quite right here. So that is a really good way to defend against social engineers, that good feeling.

**Chris Williamson** (3:52)
Got you. Okay. So let's start off the Genesis story.
What happens whereby you are now sat opposite me with a microphone in front of you talking about ethical hacking and social engineering? Where does it begin?

**Thomas Johnson** (4:05)
Right. It begins when I was about 12 years old and I was pulled out of school by an overprotective mother. I was a very small child in a predominantly council area in Wallsend, and it wasn't a very good time at school for me. And she was very overprotective, pulled me out and had nothing to give me work-wise. So she just sat me in front of a computer. So I started playing games, what every child tends to do. And then I started getting bored of games. And I couldn't afford new games. So I started working out how I could break the system and copy those games so I could get them for free. Not because I was a criminal, but because I wanted to play games. The games started getting boring, so I wanted to learn how the games worked. So I programmed the games and things developed on and on and on. And then something amazing happened, this rudimentary thing called the internet come about. And it become my playground. I was spending all of my time online. I had no moral or ethical compass at that point in time. I was young. I wasn't a bad lad, but I'd done things because I was a bit mischievous. So I would hack random computers on the internet and download through all, look through all the files. And then it started getting boring. So I started going a bit further. I started college. I got thrown out of college for hacking an internal mail system. I was, yeah, it was naughty, but I was sending messages from one lecturer to another, saying that they were in love with each other or all sorts of different things. Getting some funny looks. I was great at doing things. They were terrible at getting away with them. So I actually got caught and thrown out of college. So I went back again. I lasted about two weeks and I was thrown out again. I locked the network manager out of his computer and he didn't say the funny side. So you've got to understand at the same time, my skills were developing to a point where college wasn't really teaching me anything. So I was a bit bored, if that makes sense. So it just sort of encouraged me to do more and more risky things, silly things when I look back. I'm a white hat now. May I just add that a white hat is somebody who puts ethics over morals over everything. So I will only act within the boundaries of law. But in those days, anything online was fair game.