Hacked Again Chapter Summary

Scott Schober is an American businessman, cybersecurity expert, and CEO of Berkeley Vartironics Systems, a company that produces wireless analysis and threat detection systems. As a leading expert in security commonly seen on television and radio news shows, Schober is a frequent target for those he uncovers and defends against: hackers. In Hacked Again, Schober describes the feelings of panic and exposure that he felt after being hacked, imparts security knowledge and tips gained from working in the industry, and describes recent security breaches to help readers stay informed of how their information can be discovered and stolen in sometimes only a few clicks.

In Chapter One, Schober “learned the hard way” that his cybersecurity practices needed improvement because he did not bother to confirm that many unknown expenses deducted from BVS’s bank account were legitimate. As he states: “Since we had several debit cards corporate officers used…, I figured the charges were legitimate, albeit unknown to me.” However, after realizing the charges were unauthorized and reporting them, he states that “trying to prove a transaction is unauthorized is futile, as no documentation ever exists to show what you did not do” (page 3). My father was a victim

of identity theft last year when several checking accounts were opened in his name, and he went through a similarly long verification process. Schober’s statement could not be more accurate, especially when my father refuses to use a computer to sort and categorize his records.
In Chapter Two, Schober demonstrates that you always need to confirm a buyer owns the method of payment they provide. A buyer in Indonesia placed an order with a stolen credit card for $14,000 worth of wireless detection instruments, and many aspects of the conversation should have appeared suspicious (“new customer”, “needed them shipped priority international”, “the customer accepted the price up front without asking for a discount”, “somewhat rare”) (pages 8-9). I am very surprised that none of these requests didn’t seem out of the ordinary to Schober, especially since they each were from the same new customer. I can understand that doing business with the same honest buyers for many years can lead to leniency, but it is still vital to remain vigilant of buyers’ activities when selling online.
Schober switched banks in Chapter Three out of security concerns and for better treatment, but was still hacked despite his use of intricate passwords and multi-factor authentication. It was interesting to watch specific, targeted events take place against his business, leading him to understand that “someone with intricate knowledge of the bank’s inner workings was specifically targeting my company” (page 16). This made me question how the attackers discovered the switch so quickly. Later, he learns that banks are not the only point of failure in this situation as sensitive documentation could have been mishandled at his company. To me, that would be the next logical step. I find it exciting that towards the end of the chapter there was some revelation as to why the attacks were happening, and that Schober was able to obtain leads to trace like those of Clifford Stoll in The Cuckoo’s Egg.
In Chapter Four, Schober details several incidents of hackers targeting his website and explains how he learned the importance of DDoS protection the hard way. Many companies and individuals that speak out or protect against hacking need some form of DDoS protection because they are consistently targeted by hackers, but BVS had not. This seems strange to me as DDoS was still a problem in 2013, and as Schober said: “DDoS attacks prevent or impair…business…for a period of time” (page 22). After reading this chapter I was interested to see what changes Schober has made to his site since the incident. Currently, BVSSystems.com no longer contains a chat feature, instead replacing it with a marketing email address, and the domain is privately registered and locked.
Chapter Five emphasizes that Schober learned the hard way about the importance of confirming who you follow or are followed by on social media. It seemed odd to me that after the events of the last chapter he changed his website password, but not his Twitter passwords. I’m also surprised he says he immediately deleted a tweet that was posted without his permission, because later in the chapter he says: “Many cyberthieves will obtain a Twitter password, change it, and then take over the account and tweet out disguised links to ads or malicious websites” (page 27). If this was the case with his tweet, it could have led Schober to more info about who hacked him, and deleting it immediately might be deleting some information as to who posted it.
Schober pivots from discussing hacking events in his life to offering readers advice to protect themselves in Chapter Six. Here, he discusses the trust scam, where a young person impersonating a relative calls elderly individuals claiming to be in a bad situation (in jail, kidnapped, etc.) and needs a large sum of money to get out of a dangerous situation. He warns not to trust unsolicited callers requesting money without first verifying their identity. As Schober says, “if someone you do not know asks you for money or help, they are probably targeting you” (page 37). I received a call from my grandparents last month with this issue. My grandmother received a call from “her grandson”, and that I was kidnapped. She did not hesitate to try to send money until my grandfather stopped her.
In Chapter Seven, Schober explains many common types of malware, especially ransomware.

He begins by imparting all the typical security tips and how users can avoid being infected, such as not clicking on strange links or attachments, not installing unfamiliar software, and doing regular backups. However, his message becomes more interesting when he tells how easy it is for someone with malicious intent to start their own malware campaign. As Schober says, “Things have certainly changed, as now cyberhackers use advanced toolkits… that can be purchased in the underground dark web” to create and distribute malware (page 40). Just about anyone with the willingness to pay can get a premade malware kit to run their own

campaigns.
Chapter Eight repeats a fact that so many internet users hear daily: too many people put too much personal information on social media. Schober reiterates this lesson by proving to an audience at a conference that he could have stolen the identities of many of them simply from what they put on their LinkedIn profile. He connected with many members the night before the conference, and he pulled their full name, address, date of birth, and several potential security question answers from their profiles. My neighbor, who is very active on social media, but not very aware, had this happen to him. A person attempted to burglarize his family’s house while they were on vacation. The neighbor later recalled friending the person on social media and posting details of his trip there.
Schober lists common ways to identify spam and describes spammers’ methodologies in Chapter Nine. He also provides an interesting tip for readers: “Do not click on the bottom of a spam email and ask to be removed from the [e-mail list]. You will likely receive more spam because now they know you are a real person” (page 65), which is a tip I appreciate because few people seem to realize this! In high school, when I became the new admin for my robotics team’s website tnt3102.org as a sophomore, I found that no one had configured DKIM or DMARC for our email servers, and that our domain was listed in several blacklists for spam. I spent about a year improving our security practices and removing our domain from blacklists, and slowly I was able to block scammers from using our domain.
Chapter 10 discusses many different types of phishing attacks, and common advice to detect them. Schober begins by connecting spam and phishing emails, as they are often combined, and recommends (again) that users do not click links in unknown emails or emails they were not expecting, even if it is from someone you know. He also reiterates that you should not pass your login credentials over an unsecured connection, and sometimes scams will even redirect you to the legitimate site in a frame. However, I disagree with Schober that “scammers don’t want to spend more time ‘catching a big fish’, they work by casting the biggest net over the most fish” (page 69). While this is true, he disregards spearphishing or whaling attacks that target a specific, high-profile individual such as DNC Chairman John Podesta, who was the target of a successful whaling attack in 2016.
In Chapter 11, Schober reiterates the importance of strong, unique password for accounts that contain highly sensitive information. This should be basic knowledge for anyone that uses the internet, but sadly so many people disregard this advice out of laziness or convenience. Some other tips that Schober imparts are to use a password manager if you have many passwords, use two-factor authentication, and don’t use passwords that could be common knowledge. I would add to this list to use third-party sign-in services as often as possible to reduce the number of passwords you have, centralize sensitive banking or payment info with PayPal, and use two-factor or password-less authentication as often as possible.
Schober briefly mentions penetration testing, an important concern for businesses, in Chapter 12. He advises businesses that a complete penetration test is invaluable to deter hacks in the future. He also emphasizes that it is important to have an outside organization conduct penetration testing, because it is difficult to spot your own errors. I believe that Schober should also mention to those conducting penetration tests that as doing so without permission is a crime, and therefore you should always ensure that they have given you permission in writing in the case that the results reflect negatively on the organization’s IT department or uncover illegal business activities.