Hack Me, Baby: Unreal gets down and dirty with an ethical hacker

It's a hacker's paradise out there, what with the economy in the pooper, layoffs galore and embittered ex-employees prone to seek payback by penetrating the bowels of their former employers' computer networks.

So says St. Peters-based Parameter Security, a firm of certified ethical hackers. Though Unreal, a certifiable hack, couldn't make the company's "lunch and learn" program this month, we got the skinny from 33-year-old co-owner Dave Chronister.

Unreal: "Certified ethical hacker," huh? That sounds very shadowy. Are you quote-unquote certified by guys in dark capes?

Dave Chronister: [Laughs] Yeah, the men in black come in and certify us. Actually it's done by the EC-Council, which is a nonprofit.

Really. So hackers can have morals.

Hackers can have morals. The malicious ones are called "crackers," but for various reasons we don't go there.

Is your trade kind of like Method acting?

It can be. We do offensive security. There'll be times I e-mail a lot of people pretending to be someone else. That whole adage of: If you pretend you know what you're doing, nobody will stop and ask you questions.

We do that all the time. But you've probably hacked more interesting places.

[Laughs] Let me tell you about a story in Vegas. There was a bank out there that wanted us to come in and do a social engineering attack. That is, walk into the building and see how far into their network we could get. I went to Home Depot, spent fifteen bucks on a sprayer, filled it with water and I put [an ID badge] on my shirt, went into the first location, said, "Hey, I'm the bug guy," and they looked at me and said, "OK, do you want to start in the vault or in the offices?"

Was that Merrill Lynch?

No. [Laughs] A credit union. So I walk in and am able to load Trojans, so I can turn on your webcam, turn on your microphone, see everything —

Whoa — this sounds kinda dirty.

Yeah, strangely enough a lot of Trojans are written by college boys. But anyway, I was able to get into all the systems. Thirteen, fourteen minutes I was in and out.

Our kinda timing. Your field sounds sexy.

[Laughs] Oh, yeah. Oh, no. No.

Is that a no means yes?

No, it's not. But it is fun. It allows you to think like a criminal, but do bad things to feel good. Although if you want to say all hackers are sexy, I don't think any hacker would be upset about that.

Done and done.