Name: "ハッキングの歴史」について質問ある？ (「ハッキングの歴史」について質問ある？| Tech Support | WIRED Japan)
Uploaded: 2025-07-17T09:00:10.000Z
Duration: 26 min 46 s

情態副詞

Hopefully we'll stay out of jail on this.

Ladies and gentlemen, start your lawyers.

女士們先生們，請啟動你們的律師。

I'm Jeff Kroom, I'm a cyber security architect and adjunct professor at NC State University.

我是 Jeff Kroom，網絡安全架構師，北卡羅來納州立大學兼職教授。

Let's answer some questions from the internet.

讓我們來回答一些來自互聯網的問題。

Atmatscary34 asks, who do you think is the most influential hacker in cyber history?

Atmatscary34 問：你認為誰是網絡史上最有影響力的黑客？

Some of the really great hackers are ones you've never heard of because they in fact were so good they didn't get caught.

一些真正偉大的黑客是你從未聽說過的，因為他們事實上非常出色，沒有被抓到。

Certainly one of the big names, he was certainly the most influential and infamous back in the day is Kevin Mitnick.

凱文-米特尼克（Kevin Mitnick）無疑是其中一位大名鼎鼎的人物，他在當時無疑是最有影響力和最臭名昭著的。

Kevin Mitnick was particularly known for his social engineering where he would basically try to con people, rely on their desire to trust each other and get information out of people by pretending to be someone else.

凱文-米特尼克（Kevin Mitnick）尤其以社會工程學而聞名，他基本上是利用人們相互信任的心理，通過假扮他人來騙取資訊。

He was arrested for abusing the phone system.

Back in those days, you had to pay for long distance calls.

那時候，打長途電話需要付費。

He was able to break into the phone system and make calls for free.

他能夠侵入電話系統，免費撥打電話。

Atraymengosh1 asks, where does the term hack come from?

Atraymengosh1 問：黑客一詞從何而來？

The term really traces its evolution from the 60s where at MIT, there was a model train club and they use the term hack or hacker to refer to someone who was able to use the technology in an unconventional way, in a creative way.

這個詞其實是從上世紀 60 年代麻省理工學院的一個火車模型俱樂部演變而來的，他們用 hack 或 hacker 來指能夠以非常規的方式、創造性地使用技術的人。

Then about the 70s, 80s, it kind of took a change and most people began to associate hacking with unauthorized access.

大約到了上世紀七八十年代，黑客技術發生了變化，大多數人開始將黑客與未經授權的訪問聯繫起來。

In the security community, we actually refer to at least three different types and we refer to them by their hat color, believe it or not.

在安全領域，我們實際上至少有三種不同的類型，我們用帽子的顏色來稱呼它們，信不信由你。

No, they're not actually wearing hats necessarily, but we refer to black hats as the ones who are breaking into systems in order to do damage, in order to steal things, operating without permission.

不，他們實際上並不一定戴帽子，但我們所說的黑帽子是指那些未經許可侵入系統進行破壞、竊取東西和操作的人。

The white hat hackers, those are more like that original terminology that we referred to with the group from MIT who were basically hobbyists trying to find out where the limits of the technology, this sort of thing.

白帽黑客，更像是我們提到的麻省理工學院那群人的原始術語，他們基本上是業餘愛好者，試圖找出技術的極限在哪裡，諸如此類。

They report those vulnerabilities and they're trying to do something for the overall good.

他們報告這些漏洞，是在為整體利益做貢獻。

Now you've got something in between a gray hat hacker where they claim to be doing some good, but maybe they don't, they cross a few lines here and there.

現在，你已經有了介於灰帽子黑客和黑客之間的東西，他們聲稱在做一些好事，但也許他們沒有，他們在這裡和那裡越過了幾條線。

Polk, how did computer hackers do their hacking back in the 60s and 70s?

波爾克，六七十年代的電腦黑客是如何進行黑客攻擊的？

It was all about physical access because computers, there was no internet.

這一切都與物理訪問有關，因為當時沒有電腦，也沒有互聯網。

All the computers that existed were pretty much in very known places.

所有存在的計算機幾乎都在眾所周知的地方。

A company had a data center, it was on raised floor, it had to be cooled with air conditioning.

一家公司有一個數據中心，位於高架地板上，必須使用空調降溫。

The entry and access to those systems was controlled via badge reader, there were cameras.

這些系統的進入和訪問是通過證件閱讀器和攝像頭控制的。

So it was basically security was guards, guns, and gates back in those days.

所以，那時候的安保基本上就是警衛、槍支和大門。

If you didn't have access physically to the system, you couldn't do much damage.

如果你無法實際進入系統，就無法造成太大的破壞。

Then it started moving to where attackers were starting to use the phone system.

隨後，攻擊者開始使用電話系統。

Hackers that were hacking on the phone system were known as freakers, phone hackers.

入侵電話系統的黑客被稱為 "Freakers"，即電話黑客。

They would do different things to try to figure out how they could get into the phone system and control it remotely, maybe from a pay phone.

他們會做各種事情，試圖找出如何進入電話系統並遠程控制它的方法，也許是通過公用電話。

There were not a lot of computer systems for them to break into yet.

他們還沒有太多的計算機系統可以入侵。

Now we didn't really have an internet that everyone had access to, but more and more systems were being made available over the public phone network.

現在，我們還沒有人人都能使用的互聯網，但越來越多的系統可以通過公共電話網絡使用。

So they had modems and you could call into a system and then get access.

是以，他們有調制解調器，你可以打電話進入系統，然後獲得訪問權限。

If you knew the password, you could log in and then maybe take control of the system that way.

如果你知道密碼，就可以登錄，然後也許就能控制該系統。

So that's what happened really more in the 70s.

這就是 70 年代發生的真實情況。

In the 80s, especially as we move into the 90s, then we had the internet.

80 年代，尤其是進入 90 年代後，我們有了互聯網。

And that's when really hacking changed very dramatically because everyone had access to everyone everywhere in the world.

從那時起，黑客技術發生了翻天覆地的變化，因為每個人都可以訪問世界上任何地方的任何人。

It was a great thing for pretty much everyone, including the attackers.

這對包括襲擊者在內的幾乎所有人來說都是一件大好事。

At Charlie's Curious asks, have hackers ever taken down a government website?

查理的好奇心》問：黑客是否曾攻陷過政府網站？

One of the first that I remember was back in about 1996 when the Central Intelligence Agency had their main website hacked.

我記得最早的一次是在 1996 年左右，當時中央情報局的主網站被黑客入侵。

And at least for a short period of time, it said, welcome to the Central Stupidity Agency.

至少在短時間內，它說，歡迎來到中央愚蠢機構。

Not a lot of damage done there, more just a reputational damage.

損失並不大，更多的是聲譽受損。

So what could people do to prevent their websites, for instance, from being hacked?

那麼，人們該如何防止自己的網站等遭到黑客攻擊呢？

One of the first things is make sure that you change all of the default user IDs and passwords.

首先要確保更改所有默認用戶 ID 和密碼。

Another is turn off all the unnecessary services.

另一種方法是關閉所有不必要的服務。

Every single thing that's turned on on a system is potentially another way a bad guy can use to get into your system.

系統上開啟的每一件東西都有可能成為壞人進入系統的另一種途徑。

Also keep your software up to date because all the time, vendors are fixing bugs in their software and many of those bugs are security bugs.

此外，還要及時更新軟件，因為供應商一直在修復軟件中的漏洞，其中很多都是安全漏洞。

And the bad guys will know about what those bugs are and they'll take advantage of them.

壞人會知道這些漏洞是什麼，他們會利用這些漏洞。

Needs to be at minimum multi-factor authentication.

Don't rely on voice recognition, by the way.

順便說一句，不要依賴語音識別功能。

We have deep fake technology from AI that potentially could fake that stuff out.

我們擁有人工智能的深度偽造技術，有可能偽造出這種東西。

Weedeeds asks, question for cybersecurity mavens.

Weedeeds 向網絡安全專家提出了一個問題。

Since Signal is open source, doesn't that mean that some intelligent adversary could determine its encryption algorithm and come up with a way to decrypt Signal communications?

既然 Signal 是開源的，這不就意味著一些聰明的對手可以確定其加密算法，並想出解密 Signal 通信的方法嗎？

Well, yes, in general, but first of all, don't add people to your group chat if you don't know who they are.

嗯，一般來說是的，但首先，如果你不知道對方是誰，就不要把他們添加到群聊中。

There's a notion in cryptography that's known as Kirchhoff's principle.

密碼學中有一個概念被稱為基爾霍夫原理。

And it says that nothing should be secret about a crypto system except the keys.

它還說，除了密鑰之外，加密系統不應該有任何祕密。

In other words, knowing how an algorithm works should not give you any insight into how to break it.

換句話說，瞭解算法的工作原理並不能讓你洞悉如何破解算法。

A good crypto algorithm will stand the test of time.

好的加密算法經得起時間的考驗。

Everyone can know how it works and yet they still can't break it.

每個人都知道它是如何工作的，但他們仍然無法破解它。

The only way to break an encrypted message is to guess what the key is.

破解加密資訊的唯一方法就是猜測密鑰是什麼。

So if the keys are the secret to the system, then one thing you want to be able to do is generate those keys and keep them secret.

是以，如果密鑰是系統的祕密，那麼你要做的一件事就是生成這些密鑰並保密。

You want a random key and then you want to store it somewhere safe.

你需要一個隨機密鑰，然後把它存放在安全的地方。

The more randomness you can get, the better your key will be.

And then you don't have to remember that.

You'll use some other form of multi-factor authentication or things like that in order to get access to the key.

你將使用其他形式的多因素身份驗證或類似功能來獲取密鑰。

But the key itself will be saved on your system.

And if it's really sensitive, you'll store it in a special place in hardware where if someone tries to access that without permission, it'll actually blank the key and just wipe it out completely.

如果它非常敏感，你就會把它存儲在硬件的一個特殊位置，如果有人未經許可試圖訪問它，它就會把密鑰清空，然後把它徹底抹掉。

Then that crypto device becomes effectively just a paperweight at that point.

這樣一來，加密設備實際上就成了紙老虎。

Deadbird Rugby says, I've seen some older generation folks on LinkedIn as cybersecurity analysts in the 90s.

Deadbird Rugby 說，我在 LinkedIn 上看到過一些上世紀 90 年代擔任網絡安全分析師的老一輩人。

From what I remember, the internet was like the Wild West in the 90s.

在我的記憶中，90 年代的互聯網就像狂野的西部。

A lot of focus was just on putting up a firewall, putting up some sort of technology that gave us an initial block, an initial front door to separate our internal network from the external Wild West.

很多時候，我們的重點只是安裝防火牆，安裝某種技術，為我們提供一個最初的屏障，一個最初的前門，將我們的內部網絡與外部的狂野西部隔離開來。

They weren't enough then and they're not enough now.

Well, there was a Wild West then on the internet because everything was kind of unknown and unmonitored.

當時的互聯網是一個狂野的西部，因為一切都是未知的，沒有監控。

We still have that today to a great extent, but then there's another layer deep below the surface that most people never see.

今天，我們在很大程度上仍然擁有這一點，但在表面之下還有另一層深層的東西，大多數人從未看到過。

Where you exist for the most part, if you're typical of most people, is you're on the surface web.

如果你是大多數人的典型，那麼你的大部分時間都是在網絡上度過的。

That's maybe 5% of the content that's on the World Wide Web.

這可能只佔網際網路內容的 5%。

And it's stuff that you can get to from your favorite search engine.

你可以通過最喜歡的搜索引擎找到這些內容。

So you can go to the search engine and find it.

是以，你可以通過搜索引擎找到它。

The other 95% is kind of, if you think of an iceberg, this is the stuff below the surface.

另外的 95% 就像冰山一樣，是表面以下的東西。

You know, the iceberg is deeper below the water level.

要知道，冰山在水面以下更深。

The other 95% that's below, that's the deep web.

It's just not stuff that everyone needs to get to.

只是這些東西不是每個人都需要去看的。

Only authorized users would be able to go in and authenticate and be able to see that stuff.

只有經過授權的用戶才能進入並通過驗證，才能看到這些內容。