I’m a big Mr. Robot fan. I have two t-shirts, an Fsociety mask, two patches, and a copy of Elliot’s journal from prison. This doesn’t sound like much, but it’s major for me because I’m not the type to collect Funko Pop, or wear tshirts of my favorite show, band, etc. So it’s funny to think back to when a coworker first recommended the show to me, and I rolled my eyes and ignored him.

Mr. Robot was a series that aired on USA beginning in 2015 about a Security Engineer by day, vigilante hacker by night, named Elliot Alderson (played by Rami Malick) who “wanted to change the world.” He meets up with a group of hackers called “F Society” to erase the world’s debt, and take on the “people who secretly run the world… top 1% of the top 1% who play God without permission…”

As stated above, I first heard about Mr. Robot from a co worker. I was discussing “Halt and Catch Fire”, which is another great show that aired on AMC. After I explained the story line, he asked if I was also watching Mr. Robot. “What’s that?” I asked. “I’m surprised you haven’t heard of it. It’s about a hacker…” I can’t recall anything he said after that line because I tuned out the rest. It wasn’t until he asked 2 more times that I finally decided to give it a chance. The first episode I watched was season 1 episode 5, where Elliot infiltrates Steel Mountain, and halfway into the episode I was hooked. I stopped the episode and decided I needed to watch it from the beginning. I was caught up the following day.

Why did I ignore it? Before Mr. Robot, no movie or TV show had ever accurately portrayed a hacker, or the act of hacking. Many had the right mindset and good ideas, but it was always overshadowed by a lack of realism. There was even a new term created for this epidemic called “HollywoodOS”. Even within the movies I liked, I could never fully enjoy them out of frustration and a little embarrassment. If you don’t understand what I mean, try watching the live action Mario Bros. Movie that was released in the early 90s. If you know anything about Super Mario Bros, you will quickly understand what I’m talking about.

I’ve mentioned before that the 1995 movie “Hackers” is what started me down the path of becoming a hacker, but that happened when I was in 7th grade. It didn’t take long for me to realize that the hacker community was not a big fan of the movie, and as I learned the trade I too realized how fake and silly the footage really was. Flying through a virtual world where directory trees are on large boxes? Where worms visually resemble a long twisted umm… worm? with tentacles? Viruses speaking ransoms and singing until they execute? There’s no logical rationale for any of it. Even the keyboard the network security team uses with it’s flat inverted keys, would make typing extremely difficult.

All that aside, the story line portrayed hackers as the good guys for once, and there were some legit hacks and good ideas mentioned, and even a few Easter eggs. “Hackers” fell victim to the same mistakes of every other Hollywood attempt at portraying hacking, and little has changed over the years.

Mr. Robot was the first to get it right (and hopefully not the last). Wargames was close, but most other films portrayed hacking as multiple, big screens with a lot of graphics, or speed typist writing hundreds of lines of perfect code on the spot. My favorite Hollywood hacker fail is the CSI scene where two agents are typing on the same keyboard at an attempt to fend off an intrusion.

Sam Esmail had a team of security professionals work with production to make the hacks as accurate as possible. He actually put forth the effort needed to get it right, and it shows that he cared. Wikipedia states:

“Aside from the pilot episode, Esmail hired Kor Adana (former network security analyst and forensics manager for Toyota Motor Sales), Michael Bazzell (security consultant and former FBI Cyber Crimes Task Force agent and investigator) and James Plouffe (lead solutions architect at MobileIron) as his advisors to oversee the technical accuracy of the show. By the second season, Adana assembled a team of hackers and cybersecurity experts including Jeff Moss (founder and director of Black Hat and DEF CON computer security conferences),^[77] Marc Rogers (principal security researcher for Cloudflare and head of security for DEF CON),^[78] Ryan Kazanciyan (chief security architect for Tanium) and Andre McGregor (director of security for Tanium and former FBI Cyber Special agent) to assist him with the authenticity of the hacks and the technology being used.^[79“

Sam Esmail was fascinated by hacker culture and stated that he had wanted to make a film about it for around 15 years. He was also inspired by the Arab Spring. This all came on the heels of the NSA leaks by Edward Snowden, which occurred in 2013, two years before Mr. Robot aired. This show was legit, and the timing was perfect. For the first time ever, the hacker and security community as a whole had nothing bad to say about what they were seeing.

Mr. Robot even took a few jabs at the past Hollywood attempts at hacker films. In season 1, before the Steel Mountain hack, Romero and Mobley are watching the movie “Hackers” in a hotel room, and Romero (being the older, seasoned hacker/phreaker) says “Hollywood hacker bullshit! I’ve been in this game 27 years. Not once have I come across an animated singing virus.” This is exactly what most hackers in the 90s would have said about the movie “Hackers”

In addition to the authenticity of the hacks, I think Sam Esmail also realized something in production that Hollywood had never considered. We get excited when you show software, or a pen-test tool being used accurately, that we ourselves have experience using, or helped develop. When I saw the HackRF being used in the last few episodes of the 4th season, I tapped my wife’s shoulder and said “Look! It’s a hackRF like you got me for our anniversary! You wanted to know what it does? There’s your answer.”

Another reason we love Mr. Robot is that it gives examples of use cases, usually being the worse case scenario. I’ve found myself showing clips to family and friends to help push the idea of why security and privacy is important. Anytime someone is loose on privacy, especially in a business setting, I tend to ask if they’ve seen Mr. Robot.

All that aside, you don’t have to be a hacker to love the show and understand the story line. This wasn’t really a show about hacking, it was a show about a hacker with serious personal issues, suffering from mental illness, creating a revolution, and questioning his reality. This all makes for a great show, but believe it or not, it goes even deeper..

Like most people, I had never heard of ARGs (Alternate Reality Games). Mr Robot introduced me that world when I decided to check the QR Code drawn in pencil in Elliot’s journal in Season 2 Episode 2. The day the show aired, I found myself seeking a copy online that I could pause and take screen shot of the QR Code. Once that was accomplished, I opened Paintbrush and drew over the blocks in black so that my phone could pick up the possible message or URL. As a result, I landed on Confictura Industries, which then looked like a 1990’s style home page for the notebook’s brand. Confused and curious, I Googled what I was seeing. I quickly found a group on Reddit called ARG Society. https://www.reddit.com/r/ARGsociety/

With the ARG, the first few findings offered prizes to the few people who found them and solved the puzzles. Season 2 offered an e-coin signup with prizes (ringtones, clues, wallpaper). As the show progressed and became more popular, the ARG became bigger, with more sites to find, clues that spanned across multiple social media sites, and increasingly more complex. Click the link above to see how complex season 4 became. With this, I found out there were many other ARGs and it became a new hobby. Some good one’s to check are “This House has People In it”, Cloverfield, Petscop, Dad, and the infamous Cicada 3301 (Whether or not this was an ARG is debatable) https://en.wikipedia.org/wiki/Cicada_3301

Many of us love it because Elliot’s problems mirrored a lot of our own. It’s no secret that there’s an epidemic of depression and social anxiety within the hacking and security community. Elliot’s mental health issues included all of that to an extreme, as well as drug abuse and Dissociated Identity Disorder. Elaborating on this subject could require spoilers, so I’ll end it with this…
Those of us that know that pain and shared those struggles with Elliot, now feel a little less alone in the world.

I have a few posts in the works, but personal matters have kept me too busy to invest the time they deserve. So I wanted to add a quick story for the few people that follow my blog.

My first hack happened in 8th grade, back in the late 90s. The computer lab at the school had just switched from a mainframe networked to workstations, to a LAN with Gateway 2000 PCs Windows 95. It was the school’s first computer lab with internet access, and the teachers were given email addresses. A few teachers proudly tacked them to the bulletin board on the wall at the front of the lab for everyone to see.

We had a new computer lab teacher, fresh out of college. She was genuinely nice and seemed very excited to be there.

The teacher explained that these machines had a program called “Deep Freeze” which prevented access to anything other than the shortcuts on the desktop, by locking out the Start Menu and prevented right clicking on the desktop icons and taskbar. The teachers were confident that the only abuse these computers could suffer was physical, such as gum in the keyboard.

Put yourself in my shoes for a moment. Imagine being a middle schooler in the 90’s who had watched the movie “Hackers” way too many times. The internet was like magic, and hackers were wizards wielding that magic. This middleschool wannabe hacker got excited by the restrictions the teacher was describing, and saw it as a challenge.

Before this, I had read a collection of text files called “The Happy Hackers Guide to Mostly Harmless Hacking.” It can now be found on textfiles.com. I knew becoming a hacker didn’t happen over night, and that I needed to crawl before I could run. From those texts I learned to use Telnet, and had a habit of scanning for ports on a server and using telnet on each port to see what would happen.

I sat in the computer lab with the rest of my class, opened Word, and rushed through our assignment. It was a tutorial on how to use Copy, Cut, and Paste, and how to open and save a Word document. The final instructions said to save the document when we were finished. I click “Save As” which opened to root directory (or C:\ Folder) and had an interesting thought…

I quickly saved my document to the Desktop, and clicked “Save As” again. I had never heard of Deep Freeze before that day, but I was already noticing a potential vulnerability. I changed the file type from “Documents” to “All Files” and started exploring directories within the Save As window. I made it to C:\Windows and decided to test it. I right clicked on mspaint.exe and selected “Open”. To my surprise, the Paint application opened on my screen. I closed it and grinned.

I found and opened Telnet.exe. “What should I do now?“ I thought, with no real plan in mind. The classmate beside me had taken notice and asked, “How did you open that?” While giving him the quick run down, I noticed the teacher’s email addresses on the bulletin board at the front of the room.

I already knew that nearby Virginia Tech had an SMTP server that would allow anonymous emails to be sent, and the address was easy to remember, smtp.vt.edu port 25. I decided to play a little prank. I opened a connection in telnet to VT and did the usual HELO commands with a fake sender address, and started composing an email to one of my teachers.

Before I could finish typing the message, I felt a hand in my shoulder. I turned to the guy beside me, who was frantically trying to close Nike.com in Netscape Navigator, and then looked up to see the computer lab teacher staring straight at me with a panicked look. She said “close everything and come with me…”

I followed her out of the classroom into the hall, and she closed the door behind us. In a panicked voice she said “(My name).. I’m getting calls from the school board telling me something is up. I don’t know what your doing, but you need to stop right this minute, or you will face suspension! Do you understand!?” I looked down and nodded, and we walked back into the lab.

I entered the classroom and realized the room had turned silent and my classmates were all staring at me, some were trying not to laugh. The lab teacher darted back to her desk and grabbed the phone that had been left on hold. Apparently the teacher had talked loud enough in the hallway for everyone inside to hear. I wasn’t the type of person to show off to everyone, and rarely got in trouble. I didn’t know whether to be proud or embarrassed.

Rumors spread fast in middle school, and despite my attempt so far to keep a low profile, many people were already calling me a hacker. Explaining what actually happened didn’t help things, and for a few days I was known as the kid that hacked Virginia Tech from the Middle School’s computer lab.