Take the 2-minute tour ×
Movies & TV Stack Exchange is a question and answer site for movie and tv enthusiasts. It's 100% free, no registration required.

I was watching The Girl with the Dragon Tattoo, and Lisbeth Salander was really good at hacking computers as well as other security breaking skills, to the point where it was way too easy to do from a real life standpoint. This isn’t the first movie that’s treated hackers this way, showing them breaking stuff too easily, or going about it in a fantastic way.

Why do movies make hackers out to be geniuses, or show spectacular ways to hack computers?

share|improve this question

migrated from scifi.stackexchange.com Jan 25 '12 at 17:39

This question came from our site for science fiction and fantasy enthusiasts.

7  
Breaking passwords is not "hacking". It's "cracking" –  DVK Jan 25 '12 at 16:51
    
are there any movies where the ha(c)rackers use realistic techniques and/or effort in their task? –  matt_black Jan 25 '12 at 18:58
1  
I'll answer that with asking you if there are any movies of police officers using realistic forensic techniques or of any movies about relationships that are realistic. –  TylerShads Jan 25 '12 at 20:10
2  
This doesn't really seem to be asking about the movie itself...seems like a thinly veiled attempt to get a tutorial on cracking passwords than asking for a "plot explanation" (one of the tags). ]I feel like it belongs on Security or Skeptics... –  Laura Jan 25 '12 at 21:12
1  
@matt_black - I donno, "Swordfish" looked pretty realistic. –  DVK Jan 25 '12 at 22:41

8 Answers 8

First, movies are unrealistic in these regards. It's no different than the "realism" of zooming in on security cameras and cleaning up the images. It's just not realistic, but it makes for good entertainment and helps with plot advancement.

However, that said, there are plenty of people with easy-to-guess passwords. I know plenty of otherwise intelligent people who don't bother with good passwords, don't change them frequently, etc. Intelligence is no deterrent to bad password management, and therefore, super-villains and bad guys are just as likely to have easy-to-guess passwords.

If I were to try to crack into an account without brute force, I'd start with the basic easy-to-guess passwords, and count on the stupidity of the people I'm trying to hack. Or I'd resort to social engineering. "I'm from the helpdesk and I need to get rid of a virus on your PC. Can you give me your username and password so I can log in and do it?" (You'd be surprised how many people fall for this.)

An easy way to induce "willing suspension of disbelief" for the sake of password cracking in the movies, I tend to favor the "weak password" scenario as it's the most realistic.

share|improve this answer
1  
That said, zooming in on security camera footage or random images is possible if the resolution of the recorded image exceeds that of the display. But once you exceed the available pixels extrapolation will only get you so far. –  Xantec Jan 25 '12 at 16:23
3  
True, but in my experience, most systems have a much lower resolution on the camera than your average PC display. Perhaps high-end ones, or military-grade cameras are a different story, but most commercial camera security systems just don't have that high a resolution. (We often have to try to read license plates from our systems where the cameras are less than 15 yards away and it's hard.) But our systems are around 5 years old. They could be better now. –  David Stratton Jan 25 '12 at 16:26
    
And we're not even considering people using the same word for both their login and password... –  Bertrand Moreau Jan 25 '12 at 17:26
2  
Yeah, don't forget Enemy of the State where they rotate the security camera of a shop to gain a 3d modeling of a shopping bag and see if a bulge has changed. That was just great. –  Sonny Burnett Jan 25 '12 at 18:18
    
There was a scene in "Clear And Present Danger" where this guy was given mounds of papers to go through in an attempt to figure out the password for some drug cartel's disk files. Harrison Ford and this other guy were walking away, thinking it would take weeks or months, but were called back by the guy who got the code - using the digits of the guy's birth year, his wife's birth month and his daughter's birth day... in reverse. –  Barry Hammer Jan 26 '12 at 16:03

In almost every computer security paradigm the weakest link is the human portion. Some security algorithms are just plain bad which helps hackers. Social engineering and stupidity go a long way toward making hackers look really good before suspension-of-disbelief is required too.

Here is an interesting calculator that gives you a rough idea of different computing power scenarios and how long a brute-force attack would take.

https://www.grc.com/haystack.htm

Using a password like "power" you get a result of less than a millionth of a second with an array of computers designed for brute-force and a worst-case online attack time frame of less than 4 hours. On the other hand a password like "1We^gold" gives a simulated attack time of 1.12 minutes with the same super-computer, but over two thousand centuries using an online dictionary based attack.

All that to say, on one hand ANY password that doesn't lock out guesses can be brute-forced on a long enough timeline or with enough computing power. The Hollywood question then becomes, is it easier to convince the audience that the password was weak or that the hacker has access to a super-computing array? The second option would be nice for a change, but usually the issue is either just ignored or explained by the target's weakness.

share|improve this answer

Your question raises a lot of Network Security arguments, but i'll try to explain you the essential starting from the begining

1) All hacking movies and books are very unrealistic so a hacker stereotype is someone who usually does everything someone asks, even breaking NSA (Nations Security Agency) systems, that is quite impossible.

2) There are a lot of ways to hack someone's computer, not just guessing the password (if there's a password based authentication protocol) by using brute-force attacks (that take very much if the passwords are long and pretty random) or social engineering. There are a lot of other possible attacks if there's a weak protocol:

  • Passive attacks where the hacker can just listen the communication channel when somebody logs in and if the password is transmitted in clear (no cryptography) then everything's done: no bruteforce.
  • Active attacks where the hacker just need to change some transmitted bits or to interact with the victim without knowing anything to have the credentials/keys/passwords/passphrase.

Remember, the movie hacker is a stereotype that's able to do EVERYTHING, even that in real life is not so easy, sometimes not possible at all.

share|improve this answer

Well, about cracking, some notes:

  1. Is illegal in USA, so most are rogue or simply are not working in a different thing. The exceptions are government agents.
  2. In some movies, it show that the FBI and CIA has a team of expert in cracking. Of course it is stupid, first the FBI and CIA agent earn a average salary while a computer expert can earn the double with less than the effort. Second, it is not easy to work for the FBI and CIA, exist several requirements and every agent in controlled and audited regularly, so i don't think that nobody would want to work in the CIA instead of a big corporation. And finally, most of the work is outsourced...
  3. Since 2. some programs and services features a backdoor. In fact, most services are required to have a backdoor in case of an investigation. So it makes easiest to crack into some system.
  4. Exist systems with vulnerabilities that everybody (that know about it) can exploit. For example, it is pretty easy to hack into a Windows system (with physical access) using some hacking program (such CIA COMMANDER <-- lol ).
  5. Also, is the fact that most people uses the same password more of one time. So it is possible to collect the password from one site (for example a site of warez) and use the same password for break the email account.
share|improve this answer
    
Another point: Many sites allow to set a new password by having the site send you a confirmation email, under the assumption that only you can read your email. Thus as soon as someone can access your email account, he can break into all accounts with such a password protection scheme. –  celtschk Aug 24 '12 at 14:01

Pretty much all the hacking techniques in the Girl With The Dragon Tattoo are real and used regularly by not only the bad guys, but also law enforcement, penetration testing teams, and security auditors.

Sure, Hollywood dramatises them, but in this case, not by much. I have managed teams of individuals who can do the things shown in this film, and in my dim and distant past, I did some of them myself.

Have a look at this question on Password Strength for some useful information on password strength, and why humans are so bad at making strong ones.

Regarding video feeds from CCTV cameras, there are now a few companies with systems that pull information from multiple frames to interpolate/extrapolate high quality stills. But no, you can't turn the view round to face the opposite direction the camera was facing (Enemy of the State). And you can't zoom in and pan indefinitely (Blade Runner)

share|improve this answer
    
After that comic, I'm sure one of the passwords every cracker checks first will be "correct horse battery staple" :-) –  celtschk Aug 24 '12 at 14:04

Because, it is boring to show hackers as engineers. They didn't show Zuckerberg as a person that like build things - same logic here. I would consider her as Script kiddie, though.

share|improve this answer

The don't always, What about Clear and Present Danger

"In the movie, CIA computer whiz Petey (Greg Germann) cracks the password of the boat victim by manually guessing combinations of birthday numbers of the victim's family. " - IMDB

He later says something about having to write a program to crack a different account of someone with a better/higher CIA account (Ritter's I think)

share|improve this answer
    
Heh - I made a comment about this exact scene on the top answer. –  Barry Hammer Jan 26 '12 at 16:05
1  
I think I got there before you ;) Great scene, I think one of the guys says something like "We really need to change your password" as they're walking away! –  AidanO Jan 26 '12 at 16:16

My answer has to do with the personality of most people who take up such skills. Introverts.

Introverts, tend to score higher on IQ test, because their personality is a better fit for thinking and abstract problems. They actually enjoy these types of activities. It makes them feel good. It motivates them. She seams to be a classic introvert type personality, as do most hacker characters in movies. Speaking for my self, I know that I can spend 20 hours a day learning about how different things work.

As far as how easy it is to hack stuff, well it depends on how well you have prepared/practiced. What you see in the movie is a person, you don't see the 3 years she might have spent writing programs, building networks and testing her skills. It seams to me like she was not really working before the movie and did what ever she liked. She might have 10 years experience in cracking systems. She might not be actually cracking the system in the movie mearly gaining access through a back door she spent 6 months putting in place.

If you want to understand how easy it can be to gain access, their are software tools that you can download for free right now. That have sets of attacks pre-loaded to crack certain types of software. Even a moderately knowledgeable person would be able to figure out how to use this software. A highly motivated person could do quite alot with it.

The weakness in most security systems is the people who use them. If you know them well enough it is quite easy to gain access.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.