Hackad (2021–…): Season 1, Episode 1 - Jag har inget att dölja - full transcript

We have to find a good way
to steal this.

The entire budget, passes,
business reports–

-Private photos and CV ..

Oh! passport.

We have access to everything.

We now live in the digital world.

One of the chain's suppliers has
been affected by a hacker attack.

More of our lives are connected
to servers around the globe.

More of our everyday activities
are mapped every second, every day–

-By the big IT giants.

Society and companies have critical
functions in the major IT systems.



Foreign powers steal
research, development, drawings.

Sensitive info
about banks, alarms –

And the safety of the country
is exposed online.

We are one of the most digital
places with exciting IT solutions.

But we are not as good at security.

SVT has let four professional
hackers attack individuals–

and companies, to show how vulnerable
we are in our connected society.

The plan was to find things. And
your findings must be fixed, urgently.

The attack was extremely easy
to perform. It's extremely serious.

How easy can one map out your life -

-Or access community functions,
companies? How to protect ourselves?

We use the internet,
but don't grasp it.

Therefore we don't know what weaknesses
or risks we are exposed to.

We are professional hackers, we
help companies with their security.



We attack on order, to
find weaknesses they can then fix.

- Here we go.....
–Nice!

Headquarters.

We'll sit here.

We'll hack people who come here
to the room. There will be groups.

We don't usually hack individuals,
so it becomes more personal.

They have signed.
The cause is bigger.

They are guaranteed to fall for
it. Our methods are perfect.

We use technology,
psychology, their behavior.

We use things
which are very hard to see.

In this episode,
individuals will be hacked.

How easy is it for someone
to hijack your digital identity?

We invited 20 people
to a casting.

They only knew they were
in a digital experiment.

We were taken in one by one
and had to sit around a table.

We had our own laptops
and got to connect to the wifi.

We had to download a document and
answer a form about the Internet -

And how to use the internet.

Before the interview, everyone reads
and signs an agreement

-That gave us right to steal
passwords and information.

All participants sign.

The question is if they grasp
what they signed.

We do this because it is
an order and to show

-How serious it can be when you
perhaps compromise on your security.

They may have nothing to hide,
but have forgotten what's sent-

And what they did online.
And we can find that.

She is logging in again and again.

- Did we have her pass?
–Frida Linnea Nilsson.

She's on Mac.

If I get root on it, she
might get an SMS-code on iMessage.

She can't see us, but we see her.

But it feels uncomfortable
that she's looks at me

- and I don't know if she sees me.

When he goes to Frida, I'll press.

- You keep eyes on Jesper.
-Yes here we go!

I got this. You too?

Yes, I got it on a usb memory.
Here take it.

I also got that when I
logged in first, the error.

I disconnected and connected.

I'm not here
to participate in the casting.

I'll infiltrate and manipulate them
to do what we want them to do.

Jesper is our secret weapon
who sat among them.

He has been helping us
hack them.

He looks at signs and gives them
information from us in the room.

Jesper has been our door
out to them.

-But what to do now?
- Did you get instructions?

No, I just rolled. I logged in
with Facebook and got a document.

I work as an IT security expert.

I get paid to intrude
in different infrastructures.

I got this.
-If you got that then take this.

- What's on it?
–Just a pdf.

That you are a group that does this
activity together builds trust.

You are not alone.

If they open documents, and
if they log in, then you do too.

Herd behavior and peer pressure
make you lower your guard.

"If they did it, So will I."

Us doing things that we
shouldn't, is very common.

We are lured by offers,
We want to make a bargain.

If something is free, we accept–

-Without thinking about what the
planted USB-stick might contain.

If you go downtown one night
and a guy behind a fence yells:

"Throw over your wallet,
and I'll give you diamonds! "

You won't throw over your wallet.
But on the internet you would.

"Invest in this, we'll give
ten times back. "-" Absolutely! "

There's a lot here.
Business reports, a lot.

-Interesting things here.
This is good stuff!

I think it is
some kind of test–

-About what can happen
on social media and how naive we are.

I'm very naive when it comes to
passwords. I am an ordinary person–

- with a common name. Who would care
about me? I have nothing to hide.

You think
that you have nothing to hide-

-But everyone has stuff to hide.

Students usually say, "It
is just the internet, not reality. "

But if I suggest they surrender
their phone, then no one wants to.

It turns out if you dig a little,
everyone has something to hide.

Everyone has a friend with troubles
, Everyone has been to a shrink–

-Or the youth clinic. You don't
want just anyone to know that.

The hackers got usernames and
passwords from all participants.

Most could be used
to log in to other services.

Seven people infected their
laptop with the hacker's backdoor.

Others were saved by their
behavior or anti virus software.

The Swedes have a bit left to
equip their digital self-defense -

And enable their mental firewall.

Think about it, take a step back.
"Is this really true?"

"Is this a person who wants
something good, or to trick me? "

We know so little of security
because we never got to learn.

Had we done the same with driving
then people would have died like flies.

We're driving on eight-lanes
full speed-

- without traffic laws, airbags
or requirements on me as a driver.

Here I come in my Tesla,
and we have aircraft–

- and suddenly, a donkey
on its side. That is our Internet.

Jesper, Linus and Jinny, I thought
that we should discuss plans.

I'm turning you.

My name is Jinny
I'm an IT-security expert.

Dad took home a PC when I was
small. I lived on a field.

Build computers or swipe poop
- those were my options.

I got started with IT-security
early and became fascinated.

The idea was cool - to get in
where you shouldn't.

We have picked two profiles.

It's Frida, 26 years old.

And Andréas Lundberg.

Two people are selected.

We see how far the hackers can come
with the stolen login details.

First goal is to take over
their accounts and identities.

Second goal is to track them
using their digital tracks.

Everything retrieved - usernames,
password - use everything.

- Then we'll take Frida.
- We'll take Andreas.

-We okay with that?
–Yes I'll take the email.

I'll go Facebook
and check apps and stuff.

I tested the password she entered
here on Outlook, and it works.

Then I go Gmail.
Is there an online client?

- I got into the mail.
- Same password.

Awesome. "Re-use".

We have too easy passwords and we
uses the same on multiple platforms.

If I use it everywhere-

- then it is enough to hack one
for my password to become useless.

The attackers check all services -

-To check if the leaked
password is used elsewhere.

The data got at Frida's, that was
her Google account.

Google account is often a center
of many different digital identities.

Then we can reset the passwords
on the services and lock her out–

-And then take over
and be her on the internet.

I'm looking at her history here.

She was in the same group
as a dude.

-Is that were you put your pics?
-That is not where I store them.

Yes.....

So at 17:50 she looked up
this guy, his home address.

She has since also befriended him
on Linkedin.

Okay, I have a sick thing here. I
know where she is. In Gothenburg.

Went by train. Shall we check
her booking, when she gets back?

One of our goals was–

- that we would try to predict
where she is.

Here are two pings. She was on
the platform and logged in. Two pings.

We found train tickets,
but no return ticket.

Here is a booking, and another.

There! The journey home.

17:11 on Thursday. Today.
We can... today?

-In half an hour.
- Shall we go and meet her?

She arrives on train 1083.

This was a goal
we never thought we could reach.

But now we can, if we are fast.

If I'm right now,
we're going to 2B.

Drive! oh fuck!

This is quite confrontational.

It's a bit of invasion of privacy
that a TV crew meets you like this.

She's coming to 2B ... in five min!

Stay there, I'll check first.

This is crazy.

No, no, no ... Track changed. 4A.

Go to 4A. Now!

Up here, up here.

Wanna talk a bit? Has it
been nice? You got up early today.

Feel like coming with us?
Can we go that way, or?

We haven't been honest ...

- What was his name, opposite to you?
–André.

You searched for him on Google
and found his home address–

- before you befriended him
on Linkedin and Facebook.

-I haven't befriended anyone.
- He is waiting a reply.

I have read your history and have
eyes on your phone, tracked you.

- These are my colleagues.
-Nice to meet you!

Behind me was
a hidden room.

- They sat there.
- We hacked you.

From when you logged in
to the website-

- we hacked your computer
in iterations.

-I changed my password!
-It's too late.

I'm still logged in.

One detail:
You reuse passwords everywhere.

God ... So ashamed.

You used passports
to identify you online.

If we have them,
we can identify as you.

I understand that you can, but why
would you do that to me?.

Organized crime.

With your passport I buy
ten Iphone and Playstation 5.

It's hard for you to say, 'It
was not me. "I have your passport.

Last year, 1.9 million Swedes
were exposed to identity theft.

In 74% of the cases it came
via email.

About 200,000 Swedes
got hijacked–

-Which can lead
to very unpleasant consequences.

Those who steal identities
are usually not superhackers.

They may be from countries
where 10 Euro is a large income.

Can they use your information,
use your Facebook, change password -

And lock you out, then they can
contact all your friends–

-Who get Messenger from "you":
"Kan you send money?"

And if gear up a bit, then they can
access your Internet bank as well.

And how much money
do you have there?

What's in the salary account?
Your child's accounts? Everything.

It is illegal to gain access to
other peoples private information.

But here, everyone has
given their consent–

-So the we can perform
our attacks legally.

-Holy shit.
-This is so uncomfortable!

We are really going to far.
They have no idea.

It's an experiment. The paper stated
what can and cannot do.

I don't think they understand
how much you can access–

- via someone's account.

It doesn't feel good. individuals
can't fend as companies can.

They at the mercy of the platforms
they use, and it doesn't feel good-

- to map their lives
and things that they keep private.

What saves me
in terms of ethics and morals

- is that we tell the world ...

- We do this to ...
–... for a great purpose.

We had no back door on Andreas'. The
password didn't work on his email.

The challenge was to move on,
so we checked open sources.

Lots of leaked passwords online-

- which we search for to see if
his password has leaked before.

His email address.

- Shall we test Gmail?
-Can you do it?

-We'll check.
-Then we have ...

It says: "Your password
was changed four days ago. "

-Oh, he got a code!
-No! Was it a ping?

I have noticed some activity
around my accounts–

-So of course I have wondered
what the paper was I signed–

-When I went into the casting
about what would happen.

It may be that we find
any username or anything else.

- A restore address that is not Gmail
-I'm checking.

I'll check leaks
and sync with Jinny.

Andréas has entered a username
and pass in the email -

-But when try it, we can't get
around the two factor authentication.

We want a phone number for
resetting with SMS-code or something.

We are also looking at if there are
accounts, emails, old stuff.

Data in apps, we don't know what
happens to it or where it goes.

It is a serious risk,
and a concern I feel quite often.

- Do you recognize this place?
-Yes, I was here a week ago.

-Hey! Linus.
–Andréas.

-Hello! We meet again.
- You recognize him?

Yes, we were at the casting.

We were sitting in here
and looked at your behavior–

-And sent some commands
to the laptops.

You seemed quite aware
about this with IT security.

You were a bit careful.

That may well be true. I may have
some knowledge of how it works.

The experiment was about
hacking you, but we didn't get far.

So we searched,
in open sources.

So I have something to show you.
Can you login to Facebook?

It turned out that someone changed
my password and logged me out.

You are logged out. We have
hijacked your digital identity.

Yes I can see that...

I was logged out
because my account was hijacked.

And then you feel
a bit betrayed.

In public sources,
anyone can find your info.

Your info leaked
on the internet.

And that email address in turn is
linked to very many services.

Facebook, Microsoft 365,
Instagram, Linkedin, etc.

When you get in there,
then you can get on Facebook.

And you can log in to other
services with a Facebook account.

-Very many services.
- We have access to all of them.

It's scary how easy they get
access to so much information.

It's pretty easy
to hijack a person's identity.

What else? Microsoft 365 contains
same features as Facebook.

You have email, calendar, files
and family control -

- on 365.

We could map your whole family,
add ourselves as a member -

And move money. Your Paypal
is linked to the account.

It was a lot of V-Bucks from
the kids playing Fortnite etc.

We could have transferred money
to us. And your kids would love-

-If we adjust the screen time, so
that they can play all night.

-That's what I want to control.
-But we have control over that.

-Right. Now you have it.
- We are in control.

At present, anyone can hijack
your whole digital identity.

That's all this.

It turned out that I was hacked
in many places.

It's terrible, and scary.
I was in shock.

Right now I really want to change
all my passwords really fast.

It will probably take all night.

The hackers were able to hijack them
both and lock them out.

They managed to track Frida via
a Gmail account, and surprise her.

Your login details are today
one of your most important assets.

It's the entry
to a large part of your life.

The most important thing is to be
fully convinced of

- who you are talking to,
who you get sms or email from.

Before clicking on links
one should be completely clear about–

- that it is the person or company.

How do you do that?
Yes, why not simply call them:

"Did you send this to me?"

Or it can cost you
a lot of money.

If we don't protect ourselves, the
risk is that we lose a lot of money.

Usually it's about that. Or that
someone is destroying our reputation.

OR blackmailing
- then you have both problems.

That someone steals your identity
and do things in your name.

It's like a burglary.
You are terribly offended.

"Someone has gone through my
private stuff, vacation photos"-

- "and emptied my accounts." Of
you'll feel exposed.

The so-called caretaker is on
his way into the office, be quiet.

We are on the correct network.