X

Cybersecurity sleuths learn to think like hackers

From CNET Magazine: Kids around the US are competing in cybersecurity contests. To win, they need the same skills as the hackers they're trying to catch.

Laura Hautala Former Senior Writer
Laura wrote about e-commerce and Amazon, and she occasionally covered cool science topics. Previously, she broke down cybersecurity and privacy issues for CNET readers. Laura is based in Tacoma, Washington, and was into sourdough before the pandemic.
Expertise E-commerce, Amazon, earned wage access, online marketplaces, direct to consumer, unions, labor and employment, supply chain, cybersecurity, privacy, stalkerware, hacking. Credentials
  • 2022 Eddie Award for a single article in consumer technology
Laura Hautala
4 min read
Thomas Trutschel/Photothek/Getty Images

About 35 high-school students sit at neatly arranged rows of tables in the university's gym. Another 115 college-level contestants surround the high schoolers.

The room is pretty quiet, with only the occasional rattle from the New York subway tunnels below cutting into the hushed conversations.

There's not much distracting the teens from their computer screens. To the casual observer, the displays look as if they're filled with gibberish. But it's actually a crime hunt, with 12 high-school teams from around the US and the United Arab Emirates searching for the digital bread crumbs that will help them solve a fictional murder. To win, they have to think like hackers, a skill that might have gotten them in serious trouble just a decade ago.

"Everyone should know cybersecurity," says William Yang, an 18-year-old from the Arkansas School for Mathematics, Sciences and the Arts in Hot Springs, Arkansas, who tells me security needs to be baked into more software. In the meantime, he's having fun just figuring out the solution to the cyberpuzzle.

Yang is here at New York University's Brooklyn campus for Cyber Security Awareness Week. The largest event of its kind, CSAW comprises six competitions for high-school and university students and a career fair. At stake is more than $450,000 in college scholarships for the high schoolers and more than $11,000 in cash prizes for university winners.

teen-cybersecurity-hackathons-4195.jpg

The "capture the flag" competition run by (from left) David Hou, Crystal Su and Valerie Choung helps their high school classmates learn about security.

James Martin/CNET

For the event's 30 sponsors, including the Department of Homeland Security, IBM and Facebook, it's a chance to recruit a new generation to digital forensics. That's the science of uncovering cybercriminals' footprints. Businesses today are desperate to find skilled professionals. And no wonder.

"There is no data center or network in the world that hasn't been hacked," John Chambers, then-CEO of networking company Cisco Systems, said at last year's World Economic Forum in Davos, Switzerland. Worse: It usually takes companies three to four months to discover they've been attacked, he said. Consulting firm PricewaterhouseCoopers puts a number on the problem, saying companies and government agencies detected almost 43 million hacks, or roughly 117,000 a day, in 2014.

Puzzle pieces

Let's be honest. Digital forensics doesn't have the same tech-glam cachet of, say, writing software for a startup or working for Apple, Google or some other hot tech company. Instead, most cybersecurity experts end up working in corporations, finance companies and law enforcement. So what's the attraction?

The love of a good puzzle.

That's what hooked Emily Wicki, who tells me she might not have learned to think like a hacker if she hadn't been so keen on crime dramas. "A boy came over to me who knew I liked crime shows," says Wicki. He thought she'd like competing in NYU's security contest because she'd be solving a murder mystery.

Wicki is now a junior studying cybersecurity at NYU's Tandon School of Engineering. She also runs NYU's high-school forensics competition that I'm in Brooklyn to watch.

I can feel Wicki's enthusiasm as she describes the event as if it were Christmas. "I run around like sparkling glitter," she says. "It's the best time of the year!"

Gus Naughton, 18, from Pocono Mountain East High School in Pennsylvania, just enjoys thinking like a hacker. "It's fun to learn how to break the Internet," he says. Not to worry. Naughton and the other students are picking up sophisticated skills so they can piece together the puzzles that hackers have left behind.

For the fun of it

I'm at Mission San Jose High School in Fremont, California, where I'm meeting sophomore David Hou. Together with classmates Crystal Su and Valerie Choung, Hou runs an online "capture the flag" competition, where fellow high schoolers crack, decrypt and pull apart code to find a secret message, called the flag.

It's a lot like real hacking. They show me a technique that messes up the flow of data between a website and a computer server. It's a beginner move, but plenty of participants haven't heard of it. The three include it in their competition because they want other high-school students to know their websites could be open to this type of attack.

The contest is more than just a public service exercise for them. All three say they're having more fun hacking than playing video games. Hou even says solving cyberpuzzles makes him feel euphoric.

olivia-munn-cnet-magazine-5453.jpg

For more CNET Magazine stories, click here.

James Martin/CNET

Times change

Twenty years ago, Kevin Mitnick was among the world's most infamous hackers, arrested and sentenced to five years in jail for breaking into the computer networks of IBM, Nokia, Motorola and others. Today, he's a respected security consultant who breaks into clients' computer networks to show them their weaknesses.

It's called "penetration testing," and it's just one example of the sorts of jobs these future hackers of America could get when they graduate. At the NYU event, students pick up brochures that describe careers in digital forensics.

Businesses can't hire cybersecurity experts fast enough, according to labor market analytics firm Burning Glass. Job postings for security pros almost doubled between 2010 and 2014. On average, cybersecurity experts make $95,000 a year, according to tech job site Dice.

Professor Nasir Memon, who oversees the NYU contest, says most of the students will be working "on defense." That means stopping hackers from getting into systems.

Naughton, the contestant who enjoys learning to "break the Internet," already has a job as a systems administrator for a company that delivers online services, and he knows he'll have a career in cybersecurity.

Would he rather get paid to break in to systems, or to build technology to keep hackers out?

"A mixture," he says. "Finding a hole is super, super rewarding. But there's more legal money in defending systems." 

Laura Hautala (@lhautala) is CNET'S staff reporter covering cybersecurity and privacy. Her work has appeared in The Los Angeles Times and Politico. She is very choosy about baked goods.

Watch this: Obama finds ways to make cybersecurity funny (VIDEO)



This story appears in the spring 2016 edition of CNET Magazine. For other magazine stories, click here.