87: Guild of the Grumpy Old Hackers

Key takeaways

Donald Trump's Twitter account was a powerful communication tool during his presidency, often used for controversial statements and announcements.
The Guild of the Grumpy Old Hackers leveraged publicly available data to demonstrate vulnerabilities in Trump's online security, revealing their password practices.
The ethical dilemmas surrounding hacking are significant, raising questions about responsible behavior when discovering vulnerabilities.
Hacking into influential accounts like Trump's raises the stakes for accountability in cybersecurity and public safety.
Responsible disclosures are crucial for both ethical hackers and organizations to enhance security protocols and protect sensitive information.

Summary

Trump's Twitter Legacy

The episode begins with a nostalgic look at Donald Trump's Twitter presence, emphasizing how his account served as a significant communication tool during his presidency. The discussion notes Trump's staggering follower count and the sometimes chaotic nature of his tweets, illustrative of his unfiltered approach to social media. The narrative highlights the bizarre moment when Rex Tillerson learned about his firing from a Trump tweet, underlining the unpredictable impact of Trump's online activity.

The Grumpy Old Hackers Comes into Play

This section introduces the Guild of the Grumpy Old Hackers, a trio of IT professionals who reminisce about their 2016 adventure of hacking into Trump's Twitter account. The tone is lighthearted despite the serious nature of their discoveries, as they recall how an exploration of leaked LinkedIn data led them to find Trump's lax online security practices—specifically, the discovery of his outrageous password: 'your fired.' The hackers explain their motivations and ethical dilemmas surrounding their actions.

Ethics and Vulnerabilities

Here, the podcast dives deeper into ethical hacking, pondering questions around personal identifiable information (PII) and the responsibilities of individuals who discover vulnerabilities. The hackers raise complex issues about testing passwords and the thin line between ethical and unethical behavior in digital security. This segment also highlights the importance of responsible disclosures, especially in cases of public interest such as securing a presidential candidate's online safety.

The Hacking Process

The Grumpy Old Hackers narrate the step-by-step process they undertook to gain access to Trump's Twitter account. They discuss the technical aspects of their hack, including user-agent manipulation and SMTP enumeration to discover valid email addresses. They playfully recount the thrill of confirming that they could log in, but alongside the tension of potentially facing legal repercussions for their actions. Their methodology, combined with their intentions to improve security, creates a compelling narrative about the intersection of ethics, technology, and accountability.

Responsible Disclosure

The conclusion of their hacking adventure leads to the crafting of a responsible disclosure email to Trump and relevant authorities including the Department of Homeland Security. The Grumpy OId Hackers express their worry about the lack of response, highlighting the anxiety that comes with flagging significant vulnerabilities in such a high-profile context. They reflect on their success in raising security awareness and urge listeners to take personal cybersecurity measures seriously.

Show notes

In 2016 the LinkedIn breach data became available to the public. What the Guild of the Grumpy Old Hackers did with it then is quite the story. Listen to Victor, Edwin, and Mattijs tell their story.