15

The movie Blackhat (2015) shows professional hackers sabotaging an atomic reactor and the stock market, as well as counterhackers trying to get on the blackhat's trail, finding out their identity.

As a relative layman in the field of hacking, I got the impression that the movie was trying to be very accurate when it comes to the processes involved in hacking and tracing a hacker. At least it seemed a lot closer to reality than most other films before it.

  1. How realistic is the hacking process depicted in the movie? Are the commands used onscreen actually meaningful and authentic? Or did they make up things to increase the dramatic effect? If so, which?

  2. Was the movie counselled by actual hackers of some sort, to increase authenticity?

  • There was an article about someone hacking a nuclear power plant in the middle east (iran?) and caused it to shut down after attacking a flaw in a tiny micro controller. – DustinDavis Jan 27 '15 at 16:56
14

Here's a Full Article according to Cyber Security experts, the hacking in the movie is quite realistic.

"When “Blackhat,” the cybercrime thriller starring Chris Hemsworth, was screened to a roomful of cybersecurity experts last week, everyone agreed that it was the most accurate depiction of hacking they’d seen in a film, he said.

According to Mahaffey, that’s important for a couple reasons: First, it highlights the real threats hackers pose to cybersecurity. And it will make clear to moviegoers the ways they’re actually vulnerable to hacks."

"In an early scene in the movie, hackers take a nuclear power plant offline. While this may strike many moviegoers as fantasy, it’s actually already happening. The Stuxnet computer “worm” is thought to have damaged Iranian nuclear centrifuges in 2010. In late 2014, a German steel mill was attacked by hackers, which caused machinery to spin out of control and created significant physical damage."

There also was a former hacker that advised on the movie.

"Back in Kevin Poulsen's hacker days, before he became writer and Wired editor, he pulled stunts like taking over the phone lines in a radio contest to win himself a Porsche, or breaking into the FBI's computer system when he ended up on the agency's Most Wanted list to change his physical description. He served a five-year sentence for his crimes. Now he's consulting for Hollywood hacker films."

  • 2
    What about the part in the trailer where the hacker says points to some gobbledygook on screen and says "this bit looks incomplete"? That looks complete nonsense to me. – DisgruntledGoat Jan 27 '15 at 21:58
  • 3
    @DisgruntledGoat: Around 10 years ago I was working on developing telemetry software for the power industry. While getting our system tested for compliance, one of our customer's engineers told us to pause the serial monitor (a very primitive protocol analyzer that prints gobbledygook instead of human-readable information) scroll up a page and pointed to two bytes that looks like "0E 15" in a long string of hexadecimal numbers and told us that the two bytes are wrong. It turns out that he was right. – slebetman Mar 16 '15 at 4:09
5

there is quite a bit of media out already on how realistic the hacking is in the movie. Poulsen was called in as a consultant early on in the production to improve authenticity. he's written about it himself for wired magazine. try these links

  • Is Blackhat the Greatest Hacking Movie Ever? Hackers Think So / Metz, wired

    Asked if Mann got anything wrong, Poulsen jokes, in his typically deadpan way, that the move is “100 percent authentic.” But in all seriousness, he’ll tell you that, whereas most movie hacking scenes are comically cartoonish, Mann gets most things right. “There are little things where he takes some liberties for dramatic purposes, and so that it’s understandable to the audience. But if you compare it to any other hacking movie, any other cyber movie, period, that has come out post-War Games, it’s head and shoulders above any of them,” Poulsen says. “It’s the first crime-thriller to hinge so heavily on hacking without becoming silly.”

  • Why I Hope Congress Never Watches Blackhat by Poulsen, wired

    Overall, the movie seems to be drawing radically polarized reviews, but I’m gratified that security geeks who’ve seen it have given it good grades on authenticity.

  • What Blackhat Gets Right: A Chat With Former Hacker Kevin Poulsen / gizmodo

    So far the feedback I've gotten from computer security geeks who've seen the film has been positive. So far, at least the people that have reached out to me that have talked about it have had good things to say about the level of authenticity. Obviously it's not a documentary but as far as, you know, like Hollywood blockbuster treatment of computer hacking, I think this is the most authentic that's been done.

  • also from the 2nd article: "It turned out Blackhat’s screenwriter had read my cybercrime book Kingpin, and he’d suggested me to [director] Mann." – vzn Jan 27 '15 at 19:45
  • Those Wired articles are want prompted me to see the film. I now have less respect for Wired. :) – DA. Jan 27 '15 at 19:49
1

Counter to many reviews, I'd argue the hacking in this film is highly implausible.

For starters, there is very little actual 'hacking' in this film. The 'big hack' that is the pivotal plot point in the film is where (spoiler):

He manages to get the password to NSA systems by getting an NSA official to open an malware infected PDF file to create a new password so he could install a keylogger.

Now while this is a plausible 'hack' if you were targeting, say, my mother. I find it incredibly un-realistic that the...

...NSA would a) Hire someone a dumb as this b) Not have email server virus scanners and c) Not have robust anti-malware detection on systems to detect keyloggers.

I felt rather duped by the reviews of this film in the likes of Wired where they said this was the most realistic hacker movie yet produced. Perhaps I was 'hacked' myself. Though the more likely theory is that the bar for plausible hacker films is just extremely low and it doesn't take much to be the 'best' in this particular genre.

  • 2
    It's not about the NSA guy being "dumb", look at the 2nd article I posted. The former hacker said "Oh, a guy like that would fall for something like that. That's how most sophisticated attacks begin these days, with what's called a spear phishing attack, so it's a phishing attack that's custom crafted to get a particular person. So it comes from somebody that that person knows. And it's an email that they're expected or that seems right for whatever's happening at the time. So that part is completely plausible." The results of the attack are implausible, but otherwise, it's realistic. – New-To-IT Jan 27 '15 at 19:35
  • @New-To-IT I can't agree. Even the most mundane jobs I've had at the most mundane companies tend to have extensive training and reminders about phishing and how to never enter a password into anything other than official sites, etc. Maybe it'd happen in certain companies to certain people, but I sure hope an entity like the NSA has some redundancy in their network to avoid simple phishing attacks. – DA. Jan 27 '15 at 19:37
  • You can't be certain though, that's speculation. The question was "How realistic is the hacking process depicted in the movie?", in which case yes, they are very realistic, as that's how a lot of attacks are started. Just because someone is trained to do certain things, doesn't mean they'll always do it. Someone is going to screw up at some point. – New-To-IT Jan 27 '15 at 19:40
  • 3
    It is, perhaps, worth considering the extremely low bar that has been set here by other Hollywood depictions of hacking. – KRyan Jan 27 '15 at 21:16
  • 1
    AFAIK the NSA's employees actually have two computers: One for the evil internet and one for their internal network. So a keylogger on the internet machine won't help you with getting access to their internal network. – Martin Schröder Feb 3 '15 at 16:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .