Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


03:30 PM
Connect Directly

What Mr. Robot Can Teach Businesses About Security

By getting the underlying technology right, Mr. Robot producers understand they boost the show's credibility and give businesses and their customers a more realistic view of security, risk and the challenges of data protection.

Hollywood too often treats hackers like deus ex machina devices who get called in to fix a plot problem and essentially do something magical – and technologically impossible.

But Tanium's Andre McGregor and Ryan Kazanciyan, both technical advisors to the hacker drama Mr. Robot, said their input is sought before, during, and after scenes are shot. By getting the underlying technology right, the show's producers understand they boost the credibility of the characters and the series, which has won general praise from the hacker community and earned six Emmy nominations in its first season. And they may be helping to give businesses and their customers a more realistic view of security, risk, and the challenges of data protection.

If you're just tuning in, Mr. Robot is the story of Elliot Alderon, a socially challenged infosec professional with a double life as a vigilante hacker. He gets recruited to join an underground group of hackers ("Fight Club meets Anonymous/LulzSec," McGregor laughed during Tuesday's Q&A event about the technical aspects of the show), which wants his help bringing down the company he works for – and other evil corporations.

The FBI is usually one or two steps behind; McGregor used to work for the Bureau, which has a more prominent role in Season Two, and he's advised how the FBI agent characters should hold a gun, interview investigation subjects, and deal with surveillance. The set design also looks a lot like the FBI's real cybersquad office, McGregor said Tuesday.

Then there's all that plot material to be mined from today's headlines, since retailers, banks, media companies, and political organizations too often treat security as an afterthought, Kazanciyan said at Tuesday's online Q&A.

"I'd like to see customers change their behavior when they see their data is no longer safe, so that organizations don't treat security as an add-on -- something you don't need to bother with when you're in a hurry," Kazanciyan said. Most organizations, he added, are still struggling to handle security at a basic level, much less build it in from the inception.

Rogue devices (Elliot plants a Raspberry Pi behind a thermostat), rogue wireless networks, ransomware, and USB-borne malware all turn up in various plot lines. But frequently, Kazanciyan or McGregor will field a call from Kor Adana, technology producer for the show, with questions and clarifications about how hackers behave and speak. Sometime dialogue needs to be changed to make a scene more accurate or realistic, or just to be more true to the character, Kazanciyan said. "I can't say anything more without giving it away."

"I'm afraid of spoiler alerts," McGregor added. "My contract says $1 million per infraction! Just kidding."

McGregor and Kazanciyan were quick to note that all of Elliot's coding tricks and social engineering are drawn from real cases. "We're not showing anything that's magical or hasn't been thought of – it's all been done in the private sector or already written," McGregor added. And they're not worried about copycats since all the hacks are essentially in the public domain already.

The technical advisors are also careful to show that hacking requires long, sometimes tedious hours and that code doesn't always work right – or in the way it was intended.

"Hacking, even when it's well planned and executed, is not without repercussions, which is a core theme for this season," Kazanciyan said. "Good offense informs good defense when it's done properly. But even the best-laid plans have some blowback," he said, referring both to real life and the hacks on the show.

Related Content:

Terry Sweeney is a Los Angeles-based writer and editor who has covered technology, networking, and security for more than 20 years. He was part of the team that started Dark Reading and has been a contributor to The Washington Post, Crain's New York Business, Red Herring, ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.