 |
COURTESY OF SNOW
Stephanie Carruthers, who uses the handle Snow, is a “white hat” hacker. Her dog Eros helps her fight crime online.
|
Stephanie Carruthers is a “white hat”
hacker known as Snow whose clients include both Fortune 100 companies and startups. In 2014, she won the Social Engineering Capture the Flag competition at DEF CON,
one of the world’s oldest and largest hacking conferences. She’s a frequent presenter at hacking conventions and shares her expertise with businesses hoping to beef up their online security.
We asked Snow over Twitter about the work she does and what tips she has for keeping people safer online.
I don’t think that I’ll ever feel safe online.
What exactly is a white hat hacker?
A white hat hacker is an ethical hacker. Specifically, I am a social engineer, which is a people hacker. One of the easiest ways to explain what I do is by saying, “I lie and break into buildings.” I perform different types of assessments, such as phishing campaigns and physical security assessments. My work is performed with the goal of being able to show my clients where their vulnerabilities are so that they can fix them before an actual attacker finds them.
How did you get into doing this? Social engineering became a passion while competing in the Social Engineering Capture the Flag at DEF CON, and I’ve been lucky enough to be able to grow into this career.
How safe do you feel personally online? I would never say that I am un-hackable. Data breaches are occurring at such a constant rate, it feels like a norm, and for that reason, I don’t think that I’ll ever feel safe online. Therefore, I take precautions to protect myself as much as possible.
What are some of the dumb things you’ve seen people post online? I try not to label things as dumb, but uneducated. I would hope that if someone truly understood the risk of the content which they are putting online, that they would reconsider posting it.
That being said, some of the things that I’ve seen online where the individual doesn’t understand the risk are:
- New drivers: Excited teens (or even parents) taking a proud but up-close picture [of their new license] that has all their personal information, including home address.
- New homeowners: Homeowners taking a celebratory picture of their new house key and geo-tagging their new house without realizing that it is [easy] to duplicate a physical key from a photo.
- Employees: Employees will often take selfies with complete disregard for what’s in the foreground or background of the picture, including passwords/sensitive information on whiteboards, computer monitors, voicemail passwords taped to their phones, etc. Also, for some crazy reason, employees post pictures of things like their paycheck. While some people may see nothing wrong with these types of posts, attackers can use these types of pictures to their advantage.
What should people never do on social media?