Hacking computers, scifi or reality

Question

I was watching The Girl with the Dragon Tattoo, and this female hacker was really good at hacking. My question is, how is it possible for her to crack passwords besides the brute force approach? I can't think of anyway besides it. And if that's the case, then why do movies make hackers out to be geniuses, if there isn't any way of doing it?

Answer 1

First, movies are unrealistic in these regards. It's no different than the "realism" of zooming in on security cameras and cleaning up the images. It's just not realistic, but it makes for good entertainment and helps with plot advancement.

However, that said, there are plenty of people with easy-to-guess passwords. I know plenty of otherwise intelligent people who don't bother with good passwords, don't change them frequently, etc. Intelligence is no deterrent to bad password management, and therefore, super-villains and bad guys are just as likely to have easy-to-guess passwords.

If I were to try to crack into an account without brute force, I'd start with the basic easy-to-guess passwords, and count on the stupidity of the people I'm trying to hack. Or I'd resort to social engineering. "I'm from the helpdesk and I need to get rid of a virus on your PC. Can you give me your username and password so I can log in and do it?" (You'd be surprised how many people fall for this.)

An easy way to induce "willing suspension of disbelief" for the sake of password cracking in the movies, I tend to favor the "weak password" scenario as it's the most realistic.

Answer 2

Pretty much all the hacking techniques in the Girl With The Dragon Tattoo are real and used regularly by not only the bad guys, but also law enforcement, penetration testing teams, and security auditors. (caveat - I read the book and watched the original film...they may have changed everything)

Sure, Hollywood dramatises them, but in this case, not by much. I have managed teams of individuals who can do the things shown in this film, and in my dim and distant past, I did some of them myself.

Regarding video feeds from CCTV cameras, there are now a few companies with systems that pull information from multiple frames to interpolate/extrapolate high quality stills. But no, you can't turn the view round to face the opposite direction the camera was facing (Enemy of the State). And you can't zoom in and pan indefinitely (Blade Runner)

Answer 3

In almost every computer security paradigm the weakest link is the human portion. Some security algorithms are just plain bad which helps hackers. Social engineering and stupidity go a long way toward making hackers look really good before suspension-of-disbelief is required too.

Here is an interesting calculator that gives you a rough idea of different computing power scenarios and how long a brute-force attack would take.

https://www.grc.com/haystack.htm

Using a password like "power" you get a result of less than a millionth of a second with an array of computers designed for brute-force and a worst-case online attack time frame of less than 4 hours. On the other hand a password like "1We^gold" gives a simulated attack time of 1.12 minutes with the same super-computer, but over two thousand centuries using an online dictionary based attack.

All that to say, on one hand ANY password that doesn't lock out guesses can be brute-forced on a long enough timeline or with enough computing power. The Hollywood question then becomes, is it easier to convince the audience that the password was weak or that the hacker has access to a super-computing array? The second option would be nice for a change, but usually the issue is either just ignored or explained by the target's weakness.