A hacker invaded 2 CBS reporters' lives without writing a single line of code

By Dan Patterson, Graham Kates

/ CBS News

CBS employees volunteer to get hacked

The hacker had promised us a surprise, so we should have been ready when she handed us each folded strips of paper with our passwords written neatly inside. We shuddered and grimaced. We had asked Stephanie Carruthers, or "_sn0ww" as she's known to her colleagues at IBM Security, to spend a month hunting for our personal data online. It took her less than a week to discover enough information to fill a 20-page report. She had found this very personal information without actually hacking anything at all.

Most hackers attack computers systems by taking advantage of technical exploits hidden within computer programs. Carruthers is a social engineer, which means she "hacks" people as often as she attacks code. She's an expert at devising lures to trick targets into divulging sensitive information, and _sn0ww uses a toolkit of spy gadgets that lets her physically access facilities. She can also code mobile apps that spoof almost any phone number, or clone hotel and office ID cards, allowing her to sneak into buildings undetected, and she can role-play characters while wearing a disguise.

_sn0ww is employed by IBM X-Force Red and does not break the law. Instead, she and her colleagues help organizations stop malicious attackers by hunting for analog and digital loopholes. Companies hire hackers like _sn0ww because she's good at thinking like a criminal. The job of a social engineer is to gauge the cyber-readiness of an organization by fooling people into revealing critical information like passwords or the location of sensitive information. She describes her work as "hacking the psyche" because her targets rarely realize they were duped.

Tech security & privacy More

More in Tech security & privacy

"If I dress in street clothes and march into a building, then demand they give me their passwords, I won't get very far," explained _sn0ww. "But when I chat you up in disguise you'd never guess that I was secretly gathering information or that the device in my bag is copying your office ID."

Stephanie Carruthers, or "_sn0ww" as she's known to her colleagues at IBM Security CBS News

Like many social engineers, _sn0ww has a collection of corporate ID badges, many forged or painstakingly recreated from images she discovers online. _sn0ww hunts for corporate badge design in pictures posted by employees to social media and video uploaded to YouTube. Then, wearing a disguise, she will visit the corporate office of her target and stand near an employee in the lobby. She uses a special device hidden in her purse to copy the unique key data imprinted on an employee's ID card. Finally, she copies the key to a blank badge, and uses a home printer and Photoshop to recreate the corporate ID design. The final result is a near-perfect replica.

Social engineers also frequently rely on publicly-available open source intelligence, or OSINT, to research targets. OSINT is information like court documents, the location of military bases, broadcast transmission data, financial assessments, corporate email addresses, social media sites and other forms of data that's publicly available but often scattered or difficult to obtain.

"Hacking is all about combining solid research with the art of deception," said Carruthers. "Some is digital, some is in person. All of it helps me target later hacks, like phishing."

_sn0ww used a combination of social engineering and OSINT to generate our personalized dossiers. Everything she did to learn about us was legal, but she warned that there are plenty of cyber-attackers with similar skills who hack for criminal, financial, or political motivations. These social engineers take advantage of the data leaked through major hacks to gather information ranging from personal financial data to addresses and passwords, using this material to further hone in on their targets as they move from the digital realm to real-world interactions.

First published on June 25, 2019 / 9:22 AM

© 2019 CBS Interactive Inc. All Rights Reserved.

Dan Patterson

Dan Patterson is a senior producer for CNET and CBS News. He covers the tech trends that shape business, politics, and culture.

cbs-hacker-snow.jpg

Judge rules sufficient evidence to reopen 2020 census case

The Supreme Court is expected to make decision on whether or not the citizenship question can be included this week

40M ago

The Obamas hang out with the Clooneys on Lake Como

Italy with the Clooneys was just one stop on the Obama's star-studded European vacation

49M ago

Trump says columnist who accused him of sexual assault is "not my type"

She alleges Mr. Trump threw her up against a wall in the dressing room of a New York City department store and forced himself on her

56M ago

Hackers targeted telecom companies to spy on high-profile people

A new report says hackers believed to be linked to China gained access to VIPs' call records and location data

57M ago

AbbVie to buy Botox maker Allergan for $63 billion

The acquisition aims to diversify AbbVie beyond its top-selling drug Humira, which will soon lose patent protection

1H ago

Judge rules sufficient evidence to reopen 2020 census case

The Supreme Court is expected to make decision on whether or not the citizenship question can be included this week

40M ago

Trump says columnist who accused him of sexual assault is "not my type"

She alleges Mr. Trump threw her up against a wall in the dressing room of a New York City department store and forced himself on her

56M ago

FTC announces major crackdown on robocalls

"Operation Call it Quits" includes 94 actions targeting operations around the country

1H ago

N.Y. district attorney candidate looks to decriminalize sex work

Tiffany Cabán​, with backing by prominent Democrats Alexandria Ocasio-Cortez and Bernie Sanders, is taking on five other candidates in Tuesday's Democratic primary

11H ago

Trump says he'd fill Supreme Court vacancy before 2020 election

The president and the Senate majority leader have both contradicted their stances from the 2016 election

13H ago

Iran lashes out at White House over "idiotic" new sanctions

President Hassan Rouhani suggests Trump admin. "afflicted by mental retardation" as his country declares diplomacy dead

1H ago

U.S. man jailed for "attempt to overthrow" Vietnam's government

Calif. resident Michael Nguyen entered guilty plea, but Communist regime doesn't tolerate dissent; wife calls sentence a "slap to the United States"

4H ago

Frida the hero rescue dog retires

The 10-year-old yellow Labrador retriever is credited with helping to rescue a dozen people over the course of her career

7H ago

3 astronauts complete "once-in-a-lifetime ride" home after 204-day stay in orbit

A Russian cosmonaut, a Canadian and a NASA astronaut return to Earth late Monday after station stay

9H ago

Dominican minister of health says recent tourist deaths not related

The minister of health said autopsies on at least eight Americans show they had at least one pre-existing condition

14H ago

The Obamas hang out with the Clooneys on Lake Como

Italy with the Clooneys was just one stop on the Obama's star-studded European vacation

49M ago

Himesh Patel on new film "Yesterday"

The Beatles had 20 number one singles on the Billboard Hot 100 Pop Chart, and they remain one of the most influential bands of all time — but a new movie, "Yesterday," is set in a world where an aspiring singer named Jack is the only musician who remembers them. Jack becomes famous by pretending the songs are his. Himesh Patel, who plays Jack, joins "CBS This Morning" along with the film's director, Danny Boyle.

updated 1M ago 05:57

New on Netflix, Hulu and Amazon

Shows and movies you'll want to stream soon

13H ago 33 photos

Antetokounmpo wins NBA MVP honors, cries as he thanks family

Tears rolled down his cheeks as Bucks star thanked his mother and brothers in the audience while crediting his late father for pushing him toward his goals

1H ago

Cops release new videos in Smollett case

New video from the Jussie Smollett hate crime case shows what appears to be a noose around the "Empire" actor's neck. Video from a Chicago police body camera was taken inside Smollett's home in January, when he told them he was attacked. It's part of nearly 1,200 files, including more than 90 hours of footage, newly released by the department. Adriana Diaz reports.

updated 48M ago 02:30

Hacker invades CBS reporters' lives without writing a single line of code

She is a social engineer and a master of disguise who is paid to think like a criminal in order to "hack" the human psyche.

9M ago

CBS News exclusive: Instagram head asked about its advertising

Instagram head Adam Mosseri opened up to "CBS This Morning" co-host Gayle King about how the social media platform targets users

10H ago

Seeing red: Mankind gets closer to Mars

NASA and SpaceX are both readying unmanned missions to the Red Planet, with the goal of putting human-filled boots on the ground

Jun 23

Iranian hackers wage cyber campaign amid tensions with US

Hackers believed to be working for the Iranian government have targeted U.S. government agencies, as well as sectors of the economy

Jun 22

For Apple, scaling back in China is easier said than done

Although the tech giant is eager to avoid tariffs, shifting some of its production out of China could take years

Jun 21

Video captures giant squid in the U.S. for the first time ever

NOAA said the squid was about 10-12 feet and it appeared to wrap its tentacles around an underwater camera

18H ago

Almanac: Sex researcher Alfred Kinsey

The biologist who achieved fame with a pair of best-selling books about male and female sexual behavior was born on June 23. 1894

Jun 23

Seeing red: Mankind gets closer to Mars

NASA and SpaceX are both readying unmanned missions to the Red Planet, with the goal of putting human-filled boots on the ground

Jun 23

Apollo 11 50th anniversary: 50 photos from the moon

50 photos to celebrate the 50th anniversary of the moon landing

Jun 21 50 photos

Seal learns to sing "Star Wars" theme song

A grey seal named Zola was a standout

Jun 21

AbbVie to buy Botox maker Allergan for $63 billion

The acquisition aims to diversify AbbVie beyond its top-selling drug Humira, which will soon lose patent protection

1H ago

Coffee could help you burn fat, new study finds

New research says a cup of caffeine could help you lose weight by stimulating brown fat, the fat in your body that keeps you warm by burning calories

11H ago

Trump signs executive order on health care cost transparency

The executive order aims to provide patients costs for procedures ahead of time

9H ago

San Francisco poised to ban e-cigarette sales

Vaping sales ban pits city against one of its best-known hometown startups, the e-cigarette maker Juul Labs Inc.

18H ago

Another American tourist dies in the Dominican Republic

Vittorio Caruso, age 56, died on June 17 after "drinking something," according to his sister-in-law

14H ago

Hackers targeted telecom companies to spy on high-profile people

A new report says hackers believed to be linked to China gained access to VIPs' call records and location data

57M ago

AbbVie to buy Botox maker Allergan for $63 billion

The acquisition aims to diversify AbbVie beyond its top-selling drug Humira, which will soon lose patent protection

1H ago

Two-thirds of American workers regret their college degrees

Science, tech, engineering or math majors were least likely to report regrets, while those in the humanities were most likely

9H ago

CBS News exclusive: Instagram head asked about its advertising

Instagram head Adam Mosseri opened up to "CBS This Morning" co-host Gayle King about how the social media platform targets users

10H ago

Most college-educated workers in the U.S. are now women

For the first time, the number of women with degrees exceeds men, though their wages still lag

15H ago

Crime

Cops release new videos in Smollett case

New video from the Jussie Smollett hate crime case shows what appears to be a noose around the "Empire" actor's neck. Video from a Chicago police body camera was taken inside Smollett's home in January, when he told them he was attacked. It's part of nearly 1,200 files, including more than 90 hours of footage, newly released by the department. Adriana Diaz reports.

updated 48M ago 02:30

Missing mom's family responds to theory she staged disappearance

Lawyer for Jennifer Dulos' estranged husband suggests she staged her own disappearance in a plot similar to the book and movie "Gone Girl"

2H ago

N.Y. district attorney candidate looks to decriminalize sex work

Tiffany Cabán​, with backing by prominent Democrats Alexandria Ocasio-Cortez and Bernie Sanders, is taking on five other candidates in Tuesday's Democratic primary

11H ago

Why angry residents blasted Pete Buttigieg at a town hall

A fatal police shooting has highlighted long-standing tensions between the police department and the city's African American community

11H ago

Truck driver charged in crash that killed 7 motorcyclists

Authorities announced that 23-year-old Volodoymyr Zhukovskyy has been charged with seven counts of negligent homicide

12H ago

3 astronauts complete "once-in-a-lifetime ride" home after 204-day stay in orbit

A Russian cosmonaut, a Canadian and a NASA astronaut return to Earth late Monday after station stay

9H ago

SpaceX Falcon Heavy makes dramatic night launch

SpaceX Falcon Heavy rocket carrying 24 satellites heads into orbit; also on board: portions of the cremated remains of 152 space enthusiasts

5H ago

SpaceX faces difficult rocket launch

SpaceX is expected to launch a Falcon Heavy rocket carrying 24 satellites for the Defense Department and the ashes of 100 people, including those of actor James Doohan, who played "Scotty" on "Star Trek." Founder Elon Musk called the launch the company's most difficult to date. Vladimir Duthiers and Anne-Marie Green have more.

15H ago 00:39

NASA discovery could signal life on Mars

NASA scientists say its Curiosity rover discovered high amounts of methane gas on Mars. On Earth, the gas is typically produced by living things. CBS News space consultant Bill Harwood joins CBSN to discuss if this observation could mean there's life on Mars.

Jun 23 05:16

Seeing red: Mankind gets closer to Mars

NASA and SpaceX are both readying unmanned missions to the Red Planet, with the goal of putting human-filled boots on the ground

Jun 23

New on Netflix, Hulu and Amazon

Shows and movies you'll want to stream soon

13H ago 33 photos

Evidence photos from the police shooting of Danroy "DJ" Henry Jr.

Evidence from the scene of Pace University student DJ Henry’s fatal encounter with Officer Aaron Hess in Mount Pleasant, N.Y.

Jun 22 19 photos

Apollo 11 50th anniversary: 50 photos from the moon

50 photos to celebrate the 50th anniversary of the moon landing

Jun 21 50 photos

Deadliest highway in every state

These are the highways with the highest rate of fatal crashes

Jun 20 50 photos

Mount Everest deaths: Inside a deadly climbing season

A look at a treacherous 2019 climbing season on the world's highest peak

Jun 20 39 photos

Popular

CBS employees volunteer to get hacked

CBS News investigative reporter Graham Kates and CNET senior producer Dan Patterson voluntarily got hacked by a social engineer in the name of research. What she found was highly sensitive information. Kates and Patterson joined "CBSN AM" to discuss what social engineering is and how massive breaches are used to mine personal information.

updated 4M ago 10:06

Himesh Patel on new film "Yesterday"

The Beatles had 20 number one singles on the Billboard Hot 100 Pop Chart, and they remain one of the most influential bands of all time — but a new movie, "Yesterday," is set in a world where an aspiring singer named Jack is the only musician who remembers them. Jack becomes famous by pretending the songs are his. Himesh Patel, who plays Jack, joins "CBS This Morning" along with the film's director, Danny Boyle.

updated 1M ago 05:57

Three Meals: South Carolina voters on 2020

The first Democratic presidential debates of the 2020 campaign begin tomorrow. Across two nights, 20 candidates will pack the stage in South Florida. In a "CBS This Morning" original series "Three Meals," CBS News contributor Steve Inskeep visited three South Carolina cities to talk with voters over breakfast, lunch, and dinner about what they hope to see in 2020.

updated 8M ago 05:49

Why you should know the Constitution

The Supreme Court is about to release two rulings that could shape American politics for years to come. The justices will decide this week whether to let the Trump administration ask about citizenship in the 2020 census. They're also expected to decide whether congressional district maps in North Carolina and Maryland are unconstitutional because they are too politically slanted. CBS News legal analyst and law professor Kim Wehle joins "CBS This Morning" to discuss her new book " How to Read the Constitution—and Why."

updated 25M ago 03:52

Trump says accuser is "not my type"

President Trump says a New York-based columnist that accused him of sexual assault is "not my type." In an interview with political newspaper, The Hill, the president said an encounter described between him and E. Jean Carroll, "never happened" and that she's "totally lying." Jericka Duncan reports.

updated 41M ago 02:28