Q&A

Why Johnny Long Hacks Stuff

The Christian hacker talks about how he wrote No Tech Hacking, why he thinks social engineering is easier than hacking software, and how hes trying to get the hacking community to do charity work

By Katherine Walsh

CSO: Your actions make sites more secure. Was that your intent when you got into hacking?

Long: No, I had no clue. I’ve always had a passion for technology. Security and hacking was a really fun sideline. It’s similar to a child who takes to puzzles or math. Hacking for me was like figuring out this really cool puzzle. But even as a kid, I wasn’t doing anything malicious. I was just infinitely curious. It was a new territory to explore. When I got into college, I followed traditional advice and took typing classes. I thought I wanted to be a systems administrator because that’s what I was told my skills lined up as. I never imagined I’d be doing security work. I fell into it almost accidentally. Most of it was through Computer Sciences Corporation, where I work now. They hired me as a systems administrator, but they also had a security team. When I realized they got paid to break into networks and things like that, I was insanely curious. At first, members of that team were very skeptical of me. I was a little too interested, and I was young. I had an image of liking to buck the system and disliking the corporate world. Eventually I ended up founding a penetration testing team within CSC.

CSO: Are you disturbed by the vulnerabilities you detect as part of your work? Excited by it? A little of both?

Long: I think it’s like every other profession. After awhile you get used to it. Doctors see grizzly accidents and pull people back from the brink everyday. It can be such an incredible rush, but when you do it hundreds of times, it gets to the point where you push it off to the peripheral and it becomes hard to be surprised. I’m at the stage where I am rarely surprised anymore. I think I just have a sense of humor about it now more than anything.

CSO: You’ve created an organization enabling the hacking community to charity work. Do people have trouble understanding how hacking can actually be good?

Long: There is a definite stigma around who hackers are. There are a lot of people out there who really are just criminals using computers, and they are called hackers because they are doing all these malicious things. But the vast majority of people who actually fit the term hacker are more curious. They have unbelievable skills. We want them to apply those skills to areas where they are needed the most. In the case of AOET (an organization dedicated to helping poor orphans whose parents have died of AIDS in countries like Uganda) we are literally saving lives and getting supplies to where they are needed. We take the skills the hacking community is willing to offer us, run them through a rigorous vetting process, and the result is that we help not only charities, but hackers who are looking to get into the legitimate world and get a real job.

• Email
• Print
• Comments
• Digg This
• SlashDot

• The Problem with Employee Badges As a Security Mechanism
• 5 Ways Google Is Shaking the Security World
• Google Digs Up Malware With Binary Search