Hackad (2021–…): Season 1, Episode 4 - När ditt hem blir din fiende - full transcript
/ ALARM /
Good morning, Klara.
Hope you have slept well.
It is sunny outside. The temperature is
7 degrees and it's quite windy.
Good morning, Molly.
Hope you have slept well.
It's Tuesday.
Don't forget, Molly has outdoor activities-
-and that Klara should
bring homework to school.
Start the coffee maker.
Sure. Setting it on level two.
Our homes are becoming increasingly connected
and filled with smart devices.
Features such as locks, alarms and -
security are today connected to the Internet.
And all digital systems
has flaws.
More and more home equipment is
connected to the network.
All this is hacked easily,
which the criminals know.
We will test
if our hackers can take control
over a connected home.
-They have 30 hours.
-I think we have to steal one.
What do you want me to do?
My name is Karl-Johan Lidenalv and
work as a system manager within IoT.
IoT means "internet of things" -
-and means
connected machines and things.
That is a basic precondition
to control the home
-without human interaction.
What will the weather be like?
In Karlskrona it will be
mostly sunny.
Temperatures of 2-16 degrees.
Our morning routine is based on that we
should easily get out of bed in time.
We raise curtains, and turn on the
light during the winter.
We start the radio. Everything to get
a awakening as possible.
Then our assistant informs us
what is happening today.
Let me talk to the store.
Hey! Already back?
What can I do for you?
Add pear drink to shopping list.
-Roger. What more do you need?
-Candy.
-Okay. Hope to hear from you soon.
-It will probably be added on Saturday.
The big thing we have is the automations.
But the children probably use the assistants
more than us adults, in general.
Best way to Bastasjön by bus
is to take the bus 3 which leaves at 7.27-
-from the AWA road that lies
10 seconds from your location.
The journey takes a total of 26 minutes.
I know the goal is to get in
and take over my smart home.
But I have not released information
and do not know where they'll start.
The smart home consists of
about 70 microprocessors and sensors
- in the house and the backyard.
Karl-Johan works from home
-but has poor view of the garden
and backyard, where the hackers are.
Now the hackers have to find a sensor
without Karl-Johan discovering it.
-Found something?
-Yes and no.
-Was there anything that felt connected?
-There's a sensor.
Is the guy an old soldier? There
might be mines buried.
We can be burglars.
Dibs for not being that.
-Are they home?
-There are people at home.
I don't know what we're doing yet, but
we're hacking a house with a gentleman-
-who has lots of connected tiny
computers that controls different things.
We need to access
his sensors in the garden.
They may contain secrets, so that
we can connect to the inside.
If anyone wonders what I'm doing there-
-I'll pretend to be
from land inspection or an estate agent.
Some kind of office worker,
because that's how I'm dressed.
Our plan is to follow cables in the–
backyard that can lead to sensors.
-Hey! Did you get it?
- Get this!
There's a fucking router here,
so we can connect directly to it.
He went in as a burglar
and scouted.
He probably found what we were looking for.
A box that probably has a control unit
to the stuff we want to hack.
But he also found
a router and power.
So really, we can just connect
here like a network unit.
Pretty sure I'm safe.
They will never get in.
Should they, against all odds, get in,
they can't take over my smart home.
This is the time they lose.
Here we have the router
which is the entrance to the network.
Everything is built together
and integrated with each other.
If you want to get in, this is it.
It's the heart of my smart home
and the most sensitive machine.
Here you see when someone has logged in
to the router. It's me, hopefully.
More and more home equipment is
connected to the network.
The lawnmower,
your alarm or your baby monitor.
Everything is connected.
Even the fridge.
All this is hacked easily,
-since most companies use the same
passwords for the entire series of products.
which the criminals know.
-And then take over.
You can turn off the alarm remotely
in your home, if it is of that type.
Yes, we are in a 2.10-network.
Now we have access to the inside.
We have found a router on the outside
which we have plugged into.
It has a bad connection
towards the rest of the house-
-but we have validated that it is the correct
network, so we reach devices in the house.
-Check quickly and map up the inside.
-It's slow, but I'm doing it.
Then we'll work from that.
I think I have somewhat higher
security thinking than the average user.
I have a real firewall, or
a real router with a firewall in.
I have my IoT devices segregated
on their own network.
So even if you take over the IoT devices
they can't take over my smart home.
I have rules in the firewall that
locks people out who behave badly.
- Do you see the access point?
-No, there's nothing.
-I don't see anything either.
-Have they turned it off?
The network disappeared for a bit-
-so we think someone pulled the cord
to the brain. Which is bad.
We no longer have access. The guy
was probably paranoid and pulled out the cord.
We do not see wifi anymore.
The hackers have lost contact
and need to find access.
Jesper wants to steal one of the houses
microprocessors. The clock is ticking...
We need to steal a device
to see how they are configured.
-You get a pair of pliers.
- Shall we cut it off?
We take the configuration
to the hotel-
and make a hacker button
during the night.
Then we can press Enter tomorrow.
That's as non-technical
I can make it.
You're not filming this, are you?
We'll just go and take that shit down.
A small circuit board on the different
sensors that contain secrets
-which we want to extract.
We need them physically.
I'll find a "Raspberry Pi"
and remove the memory card from it.
And Jesper will find the sensor.
The car is also connected,
which it wasn't from the beginning.
I have put in a gps tracker
in my automation layer.
I load the car's position-
-and when the car comes home,
the garage door open.
Jesper.
What's up? Had a good day?
- Did you have a good day as well?
-Did you check that the power did not die?
-Yes.
Now we have access
to one of the networks
-and can try to get further in
via that one.
We often have consumer products
that are wide open to a hacker.
It is a danger in several different ways.
We can be monitored.
Pictures and information
can get into the wrong hands.
An example is watches you have for
monitoring children and where they should go.
From them others have obtained
that information.
It's uncomfortable
if anyone else knows where all the children are.
It can also affect our society.
You then connect many IoT things,
for example cameras, in a huge network.
Then you use them to attack
for example authorities and newspapers.
Through your router criminals can
take over Internet-connected objects.
They can order thousands of devices
in thousands of homes-
-to send requests at the same time
to a company or an authority.
A so-called DDos attack.
The company's system is blocked, and they
can not perform normal tasks.
All this happens in silence without
you having an idea of what's going on.
You can buy a network of computers
in e.g. Russia-
-and pay per hour,
as long as you are going to use it.
- Do you want some food?
-Yes! We'll put it here.
Nothing has affected my work-
-but I have noticed that unknown devices
has accessed our wifi.
A switch stopped working at 13.55.
I'm a little nervous, I must say.
-Why didn't it say anything about the laundry?
-30 degree washes do not go to 100%.
They only go to 99%,
and then it does not have time to react.
My wife...
-I'm interested when it works.
-It always does.
I can't turn on a lamp
without using the phone.
I can't pull up the blinds anymore,
the strings are removed.
I remember
there was a weekend ...
... when it was dark, cold
and winter, and something went down.
All weekend I could not turn on
the lights. He wasn't very popular then.
When the garage door went up and down
at night she wasn't happy.
If I said it was annoying to go and
see if the laundry was finished
-he'd reply: "I'll fix it!"
We have a speaker that says:
"The washing machine is ready,
the hot tub is hot ... "
We connect it
and record a sound.
A lamp turns green when it's finished
and red when it's not.
The washing machine is ready.
-The...
-It's green now, so it's done.
It turns green during the second half.
-Is it finished, then?
-I heard it.
My wife is not entirely positive.
She thinks I'm a nerd and
that I do it for my own sake.
But it's happiness those times
that I make her think-
-that I've done good stuff.
The dryer is ready.
Let me talk to the store.
Do you have a recipe for gratin?
-ICA is unfortunately not answering right now.
-Do you have a recipe?
But Dad, Mom knows,
so ask her.
Yes, then we'll try it.
- Hi mom...!
Add margarine to the shopping list.
Add fruit to the shopping list.
Add salad to the shopping list.
The hackers go to the hotel
to work undisturbed.
They notice that Karl-Johan's system
is more advanced than they hoped for.
This IoT man is
like a mad scientist.
there are firewalls
and network segmentation.
So different networks for the different
devices. There are different accounts.
He's really thought of everything.
It's super hard to hack him.
We're trying to learn
to speak "curtain language".
We don't know what language they speak,
and therefore they do not understand us.
We can send data to them, however
they're sitting there in the window and like:
"What? No."
There are a number of networks.
We have access to two of them.
Inside are all the units
which we want to control.
But we don't know how to control them -
how the pool and blinds are controlled.
We have to log in to the other network
where the "levers" are located.
We have tools, but no levers.
It's a sharp learning curve
because no one has done it before.
What the fuck?
It just stopped working.
It's very strange.
Have we said we can handle this?
We're told you we'd give it a try.
-This...
-Oh, how frustrating.
We want to trick the devices on the network
to talk to our unit-
-so that we can record all traffic.
We hope
that they then send important information.
We want to record when a device
sends "lower the blinds".
If we catch this "request", we can
replay it and do the same.
Then we'll learn how it works.
Now we've been sitting all day, tonight
and quite late at night.
Jesper has given up.
He couldn't bear it and needed to sleep.
The sound engineer and others
from the film crew has given up.
Jinny and I are left
and we have to crack this.
But we'll see
because it's quite late at night.
I've found some interesting stuff.
Three new machines
which we have not connected to.
David has created an account that has
synced to the different devices.
We have now logged on to more devices.
We are administrators
on the entire network.
Imagine we are here, and so we find
a small path into the third network.
But we have not found the net
that controls the devices.
The plan now is to try to get in
on the "mother server" that controls everything.
From there, we can control all devices
instead of going to each device.
Instead of talking "blinds"
we are trying to talk "mom" -
-and then mom gets to talk blinds.
If we can learn how to do that,
we get access to everything.
I've probably found the brain.
Here is the "input number curtain bedroom".
We are not far from it now.
Shall we connect a hotspot
and just go from there?
So sick! We'll do it again.
-Radio: If I could ...
-Fuck, that scared me!
-Why did it start?
-Press...
Okay...
We can't count our chickens yet.
We've only opened the garage door.
So now we're scheming,
because we want to see what we can do.
Can we control the washing machine, the pool,
the curtains and Spotify?
We want to take over everything in the whole house.
We think
that we can speak these languages-
-and then we build a giant program
which turns everything on.
It's going to be awesome if it works.
Damn, good job yesterday! I didn't
have any energy left. You're awesome.
-I felt I couldn't give up.
-Good.
-Check Keybase.
-We want him to notice us.
I'll call you soon.
I'll sneak around a bit.
You're online.
-I've started Spotify in Klara's room.
-I was going to take the kitchen.
Do it. I'm running the death script now.
It's running.
-Run it in the kitchen too.
-Let's go.
- "Epic Sax Guy".
-Absolutely.
It's not that dangerously annoying ...
Let's turn up the volume.
Now it's "saxophone guy".
The garage door opens.
-Turn off.
- It's not us.
They have hacked our home.
They lower a little now and then.
They're lowering. Damn.
They lower, but I raise.
The garage door closes.
You can lower a little.
It's very loud in there.
I've lowered now.
It was a bit disappointing.
I understood that they had gotten in
and taken over the home.
"Guilty as charged."
Come, let me show you something.
You're a hero.
My God, how many units do you have!
A big compliment, then.
-Good work. You have succeeded.
-Not without us pulling our hair.
-It was quite a struggle.
-Shit, you have so much stuff. Cool.
I didn't think
they would get in.
The biggest discomfort came when
I saw devices online on my wifi
-which is not my IoT wifi.
Then I felt that the battle was lost.
Yesterday we were here and connected
on the Olympus network.
We had "access tokens" and everything, and
could talk to your "home assistant".
We opened the garage door
and lit a lamp somewhere in the house.
Was it opened last night?
I didn't notice that.
Yesterday I felt very confident
that they wouldn't come any further.
But I was wrong, and they got in.
The hackers gained a foothold
in the smart home network.
They gained access and hacked the net
that controlled all IoT devices.
From this position
Suppliers must deliver
safe products
-and have certification or labeling.
Everyone in Sweden will never be
IT security experts.
However, we understand if there is
a safety label on a product.
We need to protect our homes, so
if you have everything connected
-not only the router but everything else,
then you should have a secure password.
Otherwise, the bad guys will enter your home,
no matter how much you lock.
Check this out! Logged in as AppleStoffe.
You change a number in the password.
I really understand
that it's not perfect.
We're going to hack Therése Lindgren
and take over her online identity.
Subtitles: Karin Hellstadius
Swedish Media Text for SVT
Good morning, Klara.
Hope you have slept well.
It is sunny outside. The temperature is
7 degrees and it's quite windy.
Good morning, Molly.
Hope you have slept well.
It's Tuesday.
Don't forget, Molly has outdoor activities-
-and that Klara should
bring homework to school.
Start the coffee maker.
Sure. Setting it on level two.
Our homes are becoming increasingly connected
and filled with smart devices.
Features such as locks, alarms and -
security are today connected to the Internet.
And all digital systems
has flaws.
More and more home equipment is
connected to the network.
All this is hacked easily,
which the criminals know.
We will test
if our hackers can take control
over a connected home.
-They have 30 hours.
-I think we have to steal one.
What do you want me to do?
My name is Karl-Johan Lidenalv and
work as a system manager within IoT.
IoT means "internet of things" -
-and means
connected machines and things.
That is a basic precondition
to control the home
-without human interaction.
What will the weather be like?
In Karlskrona it will be
mostly sunny.
Temperatures of 2-16 degrees.
Our morning routine is based on that we
should easily get out of bed in time.
We raise curtains, and turn on the
light during the winter.
We start the radio. Everything to get
a awakening as possible.
Then our assistant informs us
what is happening today.
Let me talk to the store.
Hey! Already back?
What can I do for you?
Add pear drink to shopping list.
-Roger. What more do you need?
-Candy.
-Okay. Hope to hear from you soon.
-It will probably be added on Saturday.
The big thing we have is the automations.
But the children probably use the assistants
more than us adults, in general.
Best way to Bastasjön by bus
is to take the bus 3 which leaves at 7.27-
-from the AWA road that lies
10 seconds from your location.
The journey takes a total of 26 minutes.
I know the goal is to get in
and take over my smart home.
But I have not released information
and do not know where they'll start.
The smart home consists of
about 70 microprocessors and sensors
- in the house and the backyard.
Karl-Johan works from home
-but has poor view of the garden
and backyard, where the hackers are.
Now the hackers have to find a sensor
without Karl-Johan discovering it.
-Found something?
-Yes and no.
-Was there anything that felt connected?
-There's a sensor.
Is the guy an old soldier? There
might be mines buried.
We can be burglars.
Dibs for not being that.
-Are they home?
-There are people at home.
I don't know what we're doing yet, but
we're hacking a house with a gentleman-
-who has lots of connected tiny
computers that controls different things.
We need to access
his sensors in the garden.
They may contain secrets, so that
we can connect to the inside.
If anyone wonders what I'm doing there-
-I'll pretend to be
from land inspection or an estate agent.
Some kind of office worker,
because that's how I'm dressed.
Our plan is to follow cables in the–
backyard that can lead to sensors.
-Hey! Did you get it?
- Get this!
There's a fucking router here,
so we can connect directly to it.
He went in as a burglar
and scouted.
He probably found what we were looking for.
A box that probably has a control unit
to the stuff we want to hack.
But he also found
a router and power.
So really, we can just connect
here like a network unit.
Pretty sure I'm safe.
They will never get in.
Should they, against all odds, get in,
they can't take over my smart home.
This is the time they lose.
Here we have the router
which is the entrance to the network.
Everything is built together
and integrated with each other.
If you want to get in, this is it.
It's the heart of my smart home
and the most sensitive machine.
Here you see when someone has logged in
to the router. It's me, hopefully.
More and more home equipment is
connected to the network.
The lawnmower,
your alarm or your baby monitor.
Everything is connected.
Even the fridge.
All this is hacked easily,
-since most companies use the same
passwords for the entire series of products.
which the criminals know.
-And then take over.
You can turn off the alarm remotely
in your home, if it is of that type.
Yes, we are in a 2.10-network.
Now we have access to the inside.
We have found a router on the outside
which we have plugged into.
It has a bad connection
towards the rest of the house-
-but we have validated that it is the correct
network, so we reach devices in the house.
-Check quickly and map up the inside.
-It's slow, but I'm doing it.
Then we'll work from that.
I think I have somewhat higher
security thinking than the average user.
I have a real firewall, or
a real router with a firewall in.
I have my IoT devices segregated
on their own network.
So even if you take over the IoT devices
they can't take over my smart home.
I have rules in the firewall that
locks people out who behave badly.
- Do you see the access point?
-No, there's nothing.
-I don't see anything either.
-Have they turned it off?
The network disappeared for a bit-
-so we think someone pulled the cord
to the brain. Which is bad.
We no longer have access. The guy
was probably paranoid and pulled out the cord.
We do not see wifi anymore.
The hackers have lost contact
and need to find access.
Jesper wants to steal one of the houses
microprocessors. The clock is ticking...
We need to steal a device
to see how they are configured.
-You get a pair of pliers.
- Shall we cut it off?
We take the configuration
to the hotel-
and make a hacker button
during the night.
Then we can press Enter tomorrow.
That's as non-technical
I can make it.
You're not filming this, are you?
We'll just go and take that shit down.
A small circuit board on the different
sensors that contain secrets
-which we want to extract.
We need them physically.
I'll find a "Raspberry Pi"
and remove the memory card from it.
And Jesper will find the sensor.
The car is also connected,
which it wasn't from the beginning.
I have put in a gps tracker
in my automation layer.
I load the car's position-
-and when the car comes home,
the garage door open.
Jesper.
What's up? Had a good day?
- Did you have a good day as well?
-Did you check that the power did not die?
-Yes.
Now we have access
to one of the networks
-and can try to get further in
via that one.
We often have consumer products
that are wide open to a hacker.
It is a danger in several different ways.
We can be monitored.
Pictures and information
can get into the wrong hands.
An example is watches you have for
monitoring children and where they should go.
From them others have obtained
that information.
It's uncomfortable
if anyone else knows where all the children are.
It can also affect our society.
You then connect many IoT things,
for example cameras, in a huge network.
Then you use them to attack
for example authorities and newspapers.
Through your router criminals can
take over Internet-connected objects.
They can order thousands of devices
in thousands of homes-
-to send requests at the same time
to a company or an authority.
A so-called DDos attack.
The company's system is blocked, and they
can not perform normal tasks.
All this happens in silence without
you having an idea of what's going on.
You can buy a network of computers
in e.g. Russia-
-and pay per hour,
as long as you are going to use it.
- Do you want some food?
-Yes! We'll put it here.
Nothing has affected my work-
-but I have noticed that unknown devices
has accessed our wifi.
A switch stopped working at 13.55.
I'm a little nervous, I must say.
-Why didn't it say anything about the laundry?
-30 degree washes do not go to 100%.
They only go to 99%,
and then it does not have time to react.
My wife...
-I'm interested when it works.
-It always does.
I can't turn on a lamp
without using the phone.
I can't pull up the blinds anymore,
the strings are removed.
I remember
there was a weekend ...
... when it was dark, cold
and winter, and something went down.
All weekend I could not turn on
the lights. He wasn't very popular then.
When the garage door went up and down
at night she wasn't happy.
If I said it was annoying to go and
see if the laundry was finished
-he'd reply: "I'll fix it!"
We have a speaker that says:
"The washing machine is ready,
the hot tub is hot ... "
We connect it
and record a sound.
A lamp turns green when it's finished
and red when it's not.
The washing machine is ready.
-The...
-It's green now, so it's done.
It turns green during the second half.
-Is it finished, then?
-I heard it.
My wife is not entirely positive.
She thinks I'm a nerd and
that I do it for my own sake.
But it's happiness those times
that I make her think-
-that I've done good stuff.
The dryer is ready.
Let me talk to the store.
Do you have a recipe for gratin?
-ICA is unfortunately not answering right now.
-Do you have a recipe?
But Dad, Mom knows,
so ask her.
Yes, then we'll try it.
- Hi mom...!
Add margarine to the shopping list.
Add fruit to the shopping list.
Add salad to the shopping list.
The hackers go to the hotel
to work undisturbed.
They notice that Karl-Johan's system
is more advanced than they hoped for.
This IoT man is
like a mad scientist.
there are firewalls
and network segmentation.
So different networks for the different
devices. There are different accounts.
He's really thought of everything.
It's super hard to hack him.
We're trying to learn
to speak "curtain language".
We don't know what language they speak,
and therefore they do not understand us.
We can send data to them, however
they're sitting there in the window and like:
"What? No."
There are a number of networks.
We have access to two of them.
Inside are all the units
which we want to control.
But we don't know how to control them -
how the pool and blinds are controlled.
We have to log in to the other network
where the "levers" are located.
We have tools, but no levers.
It's a sharp learning curve
because no one has done it before.
What the fuck?
It just stopped working.
It's very strange.
Have we said we can handle this?
We're told you we'd give it a try.
-This...
-Oh, how frustrating.
We want to trick the devices on the network
to talk to our unit-
-so that we can record all traffic.
We hope
that they then send important information.
We want to record when a device
sends "lower the blinds".
If we catch this "request", we can
replay it and do the same.
Then we'll learn how it works.
Now we've been sitting all day, tonight
and quite late at night.
Jesper has given up.
He couldn't bear it and needed to sleep.
The sound engineer and others
from the film crew has given up.
Jinny and I are left
and we have to crack this.
But we'll see
because it's quite late at night.
I've found some interesting stuff.
Three new machines
which we have not connected to.
David has created an account that has
synced to the different devices.
We have now logged on to more devices.
We are administrators
on the entire network.
Imagine we are here, and so we find
a small path into the third network.
But we have not found the net
that controls the devices.
The plan now is to try to get in
on the "mother server" that controls everything.
From there, we can control all devices
instead of going to each device.
Instead of talking "blinds"
we are trying to talk "mom" -
-and then mom gets to talk blinds.
If we can learn how to do that,
we get access to everything.
I've probably found the brain.
Here is the "input number curtain bedroom".
We are not far from it now.
Shall we connect a hotspot
and just go from there?
So sick! We'll do it again.
-Radio: If I could ...
-Fuck, that scared me!
-Why did it start?
-Press...
Okay...
We can't count our chickens yet.
We've only opened the garage door.
So now we're scheming,
because we want to see what we can do.
Can we control the washing machine, the pool,
the curtains and Spotify?
We want to take over everything in the whole house.
We think
that we can speak these languages-
-and then we build a giant program
which turns everything on.
It's going to be awesome if it works.
Damn, good job yesterday! I didn't
have any energy left. You're awesome.
-I felt I couldn't give up.
-Good.
-Check Keybase.
-We want him to notice us.
I'll call you soon.
I'll sneak around a bit.
You're online.
-I've started Spotify in Klara's room.
-I was going to take the kitchen.
Do it. I'm running the death script now.
It's running.
-Run it in the kitchen too.
-Let's go.
- "Epic Sax Guy".
-Absolutely.
It's not that dangerously annoying ...
Let's turn up the volume.
Now it's "saxophone guy".
The garage door opens.
-Turn off.
- It's not us.
They have hacked our home.
They lower a little now and then.
They're lowering. Damn.
They lower, but I raise.
The garage door closes.
You can lower a little.
It's very loud in there.
I've lowered now.
It was a bit disappointing.
I understood that they had gotten in
and taken over the home.
"Guilty as charged."
Come, let me show you something.
You're a hero.
My God, how many units do you have!
A big compliment, then.
-Good work. You have succeeded.
-Not without us pulling our hair.
-It was quite a struggle.
-Shit, you have so much stuff. Cool.
I didn't think
they would get in.
The biggest discomfort came when
I saw devices online on my wifi
-which is not my IoT wifi.
Then I felt that the battle was lost.
Yesterday we were here and connected
on the Olympus network.
We had "access tokens" and everything, and
could talk to your "home assistant".
We opened the garage door
and lit a lamp somewhere in the house.
Was it opened last night?
I didn't notice that.
Yesterday I felt very confident
that they wouldn't come any further.
But I was wrong, and they got in.
The hackers gained a foothold
in the smart home network.
They gained access and hacked the net
that controlled all IoT devices.
From this position
Suppliers must deliver
safe products
-and have certification or labeling.
Everyone in Sweden will never be
IT security experts.
However, we understand if there is
a safety label on a product.
We need to protect our homes, so
if you have everything connected
-not only the router but everything else,
then you should have a secure password.
Otherwise, the bad guys will enter your home,
no matter how much you lock.
Check this out! Logged in as AppleStoffe.
You change a number in the password.
I really understand
that it's not perfect.
We're going to hack Therése Lindgren
and take over her online identity.
Subtitles: Karin Hellstadius
Swedish Media Text for SVT