Movies & TV Stack Exchange is a question and answer site for movie and TV enthusiasts. It only takes a minute to sign up.
Sign up to join this community
I was watching The Girl with the Dragon Tattoo, and Lisbeth Salander was really good at hacking computers as well as other security breaking skills, to the point where it was way too easy to do from a real life standpoint. This isn’t the first movie that’s treated hackers this way, showing them breaking stuff too easily, or going about it in a fantastic way.
Why do movies make hackers out to be geniuses, or show spectacular ways to hack computers?
First, movies are unrealistic in these regards. It's no different than the "realism" of zooming in on security cameras and cleaning up the images. It's just not realistic, but it makes for good entertainment and helps with plot advancement.
However, that said, there are plenty of people with easy-to-guess passwords. I know plenty of otherwise intelligent people who don't bother with good passwords, don't change them frequently, etc. Intelligence is no deterrent to bad password management, and therefore, super-villains and bad guys are just as likely to have easy-to-guess passwords.
If I were to try to crack into an account without brute force, I'd start with the basic easy-to-guess passwords, and count on the stupidity of the people I'm trying to hack. Or I'd resort to social engineering. "I'm from the helpdesk and I need to get rid of a virus on your PC. Can you give me your username and password so I can log in and do it?" (You'd be surprised how many people fall for this.)
An easy way to induce "willing suspension of disbelief" for the sake of password cracking in the movies, I tend to favor the "weak password" scenario as it's the most realistic.
Pretty much all the hacking techniques in the Girl With The Dragon Tattoo are real and used regularly by not only the bad guys, but also law enforcement, penetration testing teams, and security auditors.
Sure, Hollywood dramatises them, but in this case, not by much. I have managed teams of individuals who can do the things shown in this film, and in my dim and distant past, I did some of them myself.
Have a look at this question on Password Strength for some useful information on password strength, and why humans are so bad at making strong ones.
Regarding video feeds from CCTV cameras, there are now a few companies with systems that pull information from multiple frames to interpolate/extrapolate high quality stills. But no, you can't turn the view round to face the opposite direction the camera was facing (Enemy of the State). And you can't zoom in and pan indefinitely (Blade Runner)
A really good example of real techniques used today by attack groups is given by the Mr Robot series. If we exclude the psychotic/hallucinogenic plot themes, all the hacking, intrusion and exploitation carried out by the hackers are real.
In almost every computer security paradigm the weakest link is the human portion. Some security algorithms are just plain bad which helps hackers. Social engineering and stupidity go a long way toward making hackers look really good before suspension-of-disbelief is required too.
Here is an interesting calculator that gives you a rough idea of different computing power scenarios and how long a brute-force attack would take.
Using a password like "power" you get a result of less than a millionth of a second with an array of computers designed for brute-force and a worst-case online attack time frame of less than 4 hours. On the other hand a password like "1We^gold" gives a simulated attack time of 1.12 minutes with the same super-computer, but over two thousand centuries using an online dictionary based attack.
All that to say, on one hand ANY password that doesn't lock out guesses can be brute-forced on a long enough timeline or with enough computing power. The Hollywood question then becomes, is it easier to convince the audience that the password was weak or that the hacker has access to a super-computing array? The second option would be nice for a change, but usually the issue is either just ignored or explained by the target's weakness.
Well, about cracking, some notes:
Because, it is boring to show hackers as engineers. They didn't show Zuckerberg as a person that like build things - same logic here. I would consider her as Script kiddie, though.
Your question raises a lot of Network Security arguments, but i'll try to explain you the essential starting from the beginning.
1) All hacking movies and books are very unrealistic so a hacker stereotype is someone who usually does everything someone asks, even breaking NSA (Nations Security Agency) systems, that is quite impossible.
2) There are a lot of ways to hack someone's computer, not just guessing the password (if there's a password based authentication protocol) by using brute-force attacks (that take very much if the passwords are long and pretty random) or social engineering. There are a lot of other possible attacks if there's a weak protocol:
Remember, the movie hacker is a stereotype that's able to do EVERYTHING, even that in real life is not so easy, sometimes not possible at all.
The don't always, What about Clear and Present Danger:
"In the movie, CIA computer whiz Petey (Greg Germann) cracks the password of the boat victim by manually guessing combinations of birthday numbers of the victim's family. " - IMDB
He later says something about having to write a program to crack a different account of someone with a better/higher CIA account (Ritter's I think)
My answer has to do with the personality of most people who take up such skills. Introverts.
Introverts, tend to score higher on IQ test, because their personality is a better fit for thinking and abstract problems. They actually enjoy these types of activities. It makes them feel good. It motivates them. She seams to be a classic introvert type personality, as do most hacker characters in movies. Speaking for my self, I know that I can spend 20 hours a day learning about how different things work.
As far as how easy it is to hack stuff, well it depends on how well you have prepared/practiced. What you see in the movie is a person, you don't see the 3 years she might have spent writing programs, building networks and testing her skills. It seams to me like she was not really working before the movie and did what ever she liked. She might have 10 years experience in cracking systems. She might not be actually cracking the system in the movie mearly gaining access through a back door she spent 6 months putting in place.
If you want to understand how easy it can be to gain access, their are software tools that you can download for free right now. That have sets of attacks pre-loaded to crack certain types of software. Even a moderately knowledgeable person would be able to figure out how to use this software. A highly motivated person could do quite a lot with it.
The weakness in most security systems is the people who use them. If you know them well enough it is quite easy to gain access.
One simple way to look at this is hacking is so poorly understood by the general population that hackers are viewed as either the boogeyman or a wizard. Regardless the act of hacking is pure black arts magic (in their mind), and films generally portray it as such.
This leads to all the nonsense you see on screen:
The best answer really is "Hollywood magic": the blow-by-blow work of software design does not look exciting to an observer, and so filmmakers look for heavily-visual metaphors that they hope capture the essence, if not the true form, of the activity. Sometimes they succeed in capturing the dimensions that matter to their story in a way that is honest if not literally true, like in Swordfish. Other times, they produce something patently absurd and comically stupid, also like in Swordfish. I think there is probably not just one best way to present software work in movies, because storytelling aims and context matter so much.
But that is not the only reason hackers and programmers in fiction seem to wield so much power so easily.
In the real world, people who work in software for many years collect tools that help them accomplish common tasks faster, better, and more easily. Programmers rely on re-use and automation to amplify their productivity.
Consider: the first time I try to guess someone's password, I probably have to write a program from scratch that can generate every possibility, and then write another program that can take an individual guess and actually try it out, and then I have to wire them together.
The second time I try to guess someone's password, I can probably re-use the first program, and I might be able to re-use the second program if their account is in the same system as the first account.
...
The 50th time I want to crack someone's password, I run my CollectTargetPersonalInfo program, which scrapes Google & Facebook & LinkedIn & Instagram & Twitter to try to collect any public info about the target -- full name, birth date, immediate family names, etc -- which then generates a "target profile" that my PasswordGuesser program uses to prioritize different regions of the keyspace.
...
The 700th time I want to crack someone's password, I just send an email with their name to my PasswordCrackerBot, which runs in the cloud. It adds the name to a list of people it is researching and attempting to crack. When it finally succeeds or gets locked-out, it replies to my email with the results.
