Introduction

Sufficiently advanced technology is indistinguishable from magic.

-Arthur C. Clark

For hackers, it's all about the challenge. To us, every system is a puzzle waiting to be solved, a chance to prove our skills. With laptops as our tools, we're not just tech enthusiasts, we're digital assassins, thriving on the adrenaline of outsmarting the most complex codes and anyone with the arrogance to claim their networks and systems are secure.

Sometimes it's almost too easy. Everyone wants to be a hero, and nobody likes a scene. It's all mine for the taking; I just have to see who today's lucky victim is. It's a public place-people everywhere walking and carrying on without a care in the world. Stores entice shoppers with sales and gimmicks everywhere-to me it's like taking candy from a baby. I don't know them, and it's nothing personal; everyone is fair game. If you haven't figured it out by now, I am a hacker. Today there is something special I need, something very specific. In this case, it's a link in a much larger attack. I like keeping things random, that way I'm less likely to be discovered. I'm not even worried about being caught with the tools I use. I promise you won't see them. I have the payload set for Android; now it's time to destroy someone's life.

I see you standing there looking like a zombie, head in your phone. I wonder what may have you so enthralled that the rest of the world has ceased to exist. But in reality, who cares? I'll look for myself soon enough. The overhead music is drowning out the muffled chatter of multiple conversations on the move. You're my target today because you meet the criteria I'm looking for. I would love to build your ego and say it's because you look like someone whose career choice or wardrobe would make you a target, but in this case it's not that sophisticated. The fact that you haven't looked up from your Android phone in the last five minutes and are completely oblivious to the world around you may be the perfect combination for what I'm looking for.

I know you are not paying attention as I close the distance between us, your head still in the phone, just as I expected. You haven't looked up in a while now; I hope whatever you are doing was worth it. The people around me seem to fade into the background. There is nobody else in the world for the next few minutes; it's just you and me. I have set the stage, all the pieces are in place, I will know whatever I want about you before the end of the day, and that's just the beginning. What's worse is I will use your device for that upcoming larger attack that will lead the authorities right to you. Imagine trying to explain that you had no idea that your phone was involved in a cyberattack against a large corporation with expensive lawyers. You have no idea what's about to happen, and even worse is when it's over, you still won't.

I'm shrieking at the top of my lungs, "Oh God, please help me! Please someone help me!" I think I have your attention. Now everyone is looking, anticipating what's going to come next. All they see is an older man in what appears to be in extreme distress screaming for help. Social engineering is only one of the tools in my arsenal; I have been doing things like this for a long time. "Please, you, I was just on a call with my daughter, and there has been an emergency with my infant grandchild. My battery just died. She was on the way to the hospital in an ambulance. I don't know where they are going"-insert crying and sounds of agony-"Please, you, can I use your phone to call my daughter back to find where I need to go? Please! Oh God!" Buckle up, let's go for a ride together.

All eyes are on you now, it may be just you and me in this little game, but we have quite the audience here watching my little spectacle. I selected this place for that exact reason: I need all these onlookers for my plan to work. At this point, how can you say no? Remember, in this day and age if there is anything exciting, someone is recording it on their phone. Do you wanna go viral? Do you really want to take the chance that this video could get out? Do you want to be the hero or the next meme about a heartless person? I am playing you; I just put you into a situation you can't get out of. How many bystanders are staring at us? I am sure you are feeling the pressure at this point, but I'm not-this is all by my design, and it's all playing out exactly like I want it to.

So, of course, you agree. What real choice did I leave you with? By this point, you may have even started to feel good about helping me. Who would want to be in my shoes if the circumstances were reversed? Nobody seems to notice the smile that comes to the corners of my lips as your arm extends to hand me the phone. The cold feeling of the case as it slides in my hand-the hard part is over. Now for the next act.

I start moving my arms around and start talking to myself out loud; I have to make this believable. "What's my daughter's phone number? Who remembers phone numbers anymore? They are all programmed into my phone!" During all my ministrations of my arms and keeping the focus on me, I look at the screen. Nothing, guess this one is going to be the full show. "Her area code is 313, 313.722? Oh God, my grandbaby!" Turning in circles in apparent shock and anguish, I swipe down from the top and quickly enable Near Field Communications (NFC)-thank you Android for standardization. Swiping back up with my thumb, I see what I have been waiting to see. I know it's psychosomatic, but I can't help but almost feel it.there's the pop-up on the screen.

URL redirection requesting a download. "313-722-6." Accept download. "What hospitals are close to here?" Accept Install from unknown source, done. "I can't believe I can't remember her number"-insert more crying and acting ashamed-"I can't remember. You have been so kind. Thank you so much, but I have to go plug my phone in to get the number." Nobody understands how hard it is to fight smiling now. It's time to go. Handing you back your phone, I thank you profusely as I slowly fade back into the crowd. Your phone is already connected to my command-and-control server. I have already compromised your phone, and you are still watching me walk away-possibly wondering what just happened, possibly saying a prayer for my injured granddaughter. Whatever the case, you will go back to your day, your life. The fact that I'm going with you inside the device that holds more data than your wallet or purse will stay my little secret.for now.

What was the purpose of this deception, you ask? To hack your phone right in front of your eyes-and you have no idea it even happened. I did it not just with you watching me; I did it with the whole crowd watching me and possibly live streaming the entire event. This is a testament to how blatant I can be and still not get caught.

You never saw me possibly enable NFC-you were put on the spot and were essentially just acting out the part that I had selected for you to play in this drama. How many normal end users know what NFC is used for? Would you even notice later it was on and think "I need to run anti-virus, anti-malware, scan my phone?" Of course not, because "phones don't get attacked like that; they are not computers."

Surprise: They do, and I can do it better than most. If you noticed at all, would you think that maybe you hit that NFC button by accident and turn it back off? If so, you'd missed the only clue I left-good luck with any investigation later. Would you even connect our little interaction as an attack, or would it be relegated to the back of your mind as a strange social event? Honestly, most devices have NFC enabled for the purposes of Apple Pay and Android Wallet. Can't have that convenience without opening a vulnerability for me.

I played you. I used misdirection to keep your eyes focused on me. You were looking at a man breaking down, not the fact that my thumb was accepting the download and installing my payload on your device. Before I explain how I pulled this off, let me ask you a question: if you did see the request for download pop up, what caused it to happen in the first place? How would you explain the fact that your device just magically decided to download my specific payload the minute it was in my hand?

You never saw the bulge in the top of my hand hiding a microchip as it energized from your mobile device; you never noticed that, while I had your attention, my fingers were doing something completely different, something destructive and invasive. You would know if someone was attacking your technology right in front of you.wouldn't you?

You see through the eyes of the old, expecting to see hackers sitting in a dark basement with a hoodies on, staring at a computer terminals with lines of green code in an endless loop of scrolling characters. But that's not the case anymore-I did hack you and your mobile device, and I used bleeding-edge technology to do it. It was so bleeding edge that I had to physically bleed to get it. It's all part of my body, and I have abilities that a normal human doesn't have. Unlike most hackers, I don't have to...