Hacker Perspective: The Piano Guy

We're all hackers.  Not because we read 2600, but because any human with a properly functioning brain is.  Granted, those that read 2600 are more conscious, dedicated, and proficient at hacking, but we're all hackers.

To my mind, hacking is defined as using entities (devices, objects, living beings), sometimes using unforeseen combinations and or methods, to achieve goals not envisioned by the original creator of the entity.  I include social engineering in the hacker's toolset.  You do this, but so do many others.  So, if anyone calls you a hacker as a pejorative, let them know (and show them) that they too are a hacker.

The difference between 2600 readers and most of the rest of the world is that we are in a small subset of the population as dedicated, talented technology hackers, who can make the world run better than planned if we choose.  But to quote Spidey's uncle, "With great power comes great responsibility."

While I'm informed enough to make jokes about UDP (which I'll never know if you got), I'm far from the most technically-talented person that reads 2600.  And since my current employers have me under a strict NDA, a lot of my examples are not going to be computer-based.  That's okay, because this article is to teach a mindset, and to open opportunities you didn't think you had.

My "hacker's credo" involves three ideas.  First, work with what you have, but don't limit yourself to the written instructions.  Second, get what you lack, even if you're not sure how it will be useful.  Third, and probably most important, don't give up.

I started young, as many of us do, but I am old compared to some of you.  I remember the time before the first pocket calculators, so my first hacking was mechanical and electronics based.  I was given a RadioShack 100-in-1 Electronic Project Kit for my tenth birthday, and plowed through many sets of batteries, learning about electronic components and how they could be used together to make cool stuff.  As an aside, if you figure out my age from that data point, especially if you use Google to do it, you are a hacker.

I liked to eat too much (still do) and needed more money than my allowance to buy junk food.  To that end, I ran errands for the local stores to get pocket change.  When that wasn't enough for me, I saved the money and bought small hand tools, jumper wires, and my first Volt-Ohm Meter (VOM).  With those, I started asking the neighbors if they needed anything fixed.  Sometimes they did, sometimes they didn't, but they figured that they wanted to encourage the entrepreneurial kid.  They would give me their "broken junk," which I would mostly be able to fix, and then get paid money to go get my junk food.  This taught me to be an entrepreneur, and more important to me, I learned to take things apart only so far as I could put them back together again.

In ninth grade, I started electronics classes and volunteered with the Audio/Video (AV) department, since I liked fixing stuff.  Between that and my connection to music, I ended up on stage crew, learning about the technical aspects of theatrical production.  The AV manager was also in charge of the school locks and master keys.  All of the AV students carried master keys to all of the buildings, and knew how to change out cylinders.

Around tenth grade, I was having a lot of problems with my math classes.  That, along with me not taking a foreign language (it interfered with choir), convinced my high school counselor that I should be dropped from the college track and given the vocational school track.  Because I had shown a strong mechanical aptitude, I ended up learning major appliance repair.  This helped hone my mechanical hacking skills.

Graduating from high school with a background in electronics and mechanical repair, I put those two together and obtained a job fixing microfiche manufacturing equipment.  One of my better hacks at that job was making a custom cylindrical transport belt for one of the machines which was backordered from the manufacturer.  Some silicone hose from the aquarium store, some wire from RadioShack, and I had our replacement belt.  Hacking at its finest.  However, I ultimately lost that job due to a chemical accident which left me functionally blind for months.  Because of the accident and family issues (I've cut a lot out for length), I went to see a psychologist who was adamant I go to college, even if I didn't know what I was going to study.  This is a case of getting the tools even though I didn't know what I was going to do with them.

One of my college jobs was at my high school, again to work with the AV department, but this time for pay.  My best hack there was to fix their relay-based phone system.  It had 200 lines, could handle eight calls at a time, and five of the lines were shorted out.  They thought the process to find the shorted lines was to disconnect the wire pair, hit it with a VOM, find the shorts, and be done with it.  They figured that it would take ten minutes each by the time all was done, so they gave me 40 hours.  When I disconnected my first shorted-out pair, a bunch of relays clicked.  That gave me an idea.  I started shorting out the pairs with a needle nose pliers and listening for the relays to click.  If they clicked, then I knew the pair was fine and I released the short.  That took about five seconds per pair until all the relays settled down.  If I shorted out a pair and no relays clicked, then the pair was already shorted.  I finished finding the shorted pairs in minutes, and was paid for 40 hours.

Another thing I did for money in college was to carry tools and a slim jim in the car, which I could buy because I had "professional locksmith experience."  When I would see someone with car trouble or who was locked out, I would stop, offer to help them, and then afterward would say, "Gee, we never did talk about price.  Would you care to make a donation to my college fund?"  That was social engineering too, but this time I knew it.  With all of that, standard day jobs,and the occasional piano gig, I managed to put myself through my associate degree.

Finally, I went to a career counselor because I knew I needed a bachelor's degree, but I wasn't sure in what.  Through not enough counseling, I was told that I could "do anything."  Since I had done technical theater and liked it, I went into TV production.  I wanted more security than music, so I went into TV.  (I'll never know if you got that joke either.)  Had I had better guidance I am sure I wouldn't have ended up there, instead being counseled to become a lawyer, doctor, or even a plumber (which would have paid better than what I was doing).  But sometimes the puzzle pieces don't fall into place when we want them to.  Good hackers don't give up.

TV production school let me use my hacking skills too.  During loadout on a remote shoot, a fellow student crunched a cable connector for a camera viewfinder, bending it to the point that it wouldn't go into the camera body, making the camera useless.  The producer started yelling at him (she needed all the cameras), and I told her to calm down.  Seeing a guy laying under his car making a repair, I walked over to him and said, "Excuse me, but may I borrow a Vise-Grips, needle nose, and flat blade screwdriver?"  He agreed.  Ten minutes later, with some judicious bending, crimping, and patience, the viewfinder connector was fixed.

One of my assignments was to shoot a commercial for the local car dealer.  The dealership had peeling paint on their walls, and the cover shot of the dealership looked like crap any way I tried.  I finally realized that an aerial shot was the only way I was going to make this look okay.  I had no budget, so I convinced the fire department to put me up in a bucket truck to take the shot.  Bear in mind that in those days a TV camera that was "portable" required a separate VCR (about as big as a desktop computer) and a car battery to run it all.  We did it on a Sunday morning, and they didn't even charge me.  When the instructor saw the aerial shot during the client demo, he was stunned, as he didn't know how I could get an aerial shot.  But the client loved it.  The fire department started getting asked so often that they had to start saying no.  Sometimes being first is best.  This is a case of getting what I needed and using it in a way that was not anticipated.

We had analog tape editing without time code, so we were taught that animation wasn't practical because the accuracy of laying down two frames of video just wasn't there.  But I wanted to animate a pile of bills growing on a table for a different commercial (get a dish instead of cable TV).  To do the animation, I laid down a full second of video for each edit, overlapping it by two frames at the front, teaching my teachers how to do something they said couldn't be done.  Hackers try anyway, and sometimes succeed.

After graduation, I found that getting a job in TV was difficult.  I would call up and ask if a company was hiring, and was told by the receptionist to "send a resume."  I couldn't get past the gatekeeper.  To social engineer my way around that issue, I finally started a sole proprietorship, and then called receptionists saying "Hi, my name is (redacted), I'm the owner of (redacted), and I would like to speak to the vice president of production."  As a "peer," my calls were put through right away, which got me interviews and ultimately employment.

Around then, I was living with some people who had a computer, where I learned all about the world of computer Bulletin Board Systems (BBS).  I eventually moved out, but still wanted to use them.  I found a Wyse terminal for $50, bought a modem, and away I went.  Yes, I had to type in the AT codes, but a 286 computer back then cost $5,000.  I didn't even spend that much for my car, and wasn't going to spend that much on a computer.

Working in TV production professionally is where I really learned about computers.  TV production started using PCs in production.  We created instructional programs to teach office workers how to use computers.  This forced me to keep learning newer technology.  As an example, I reproduced the same 23-program instructional series three times for three different employers just to keep up with the change from videodisc/computer to CD/computer, and finally to something solely computer-based (involving programming in custom script languages).

When computers malfunctioned, I would have to fix them so we could meet deadlines.  I then started fixing computers on the side, first just as a hobby, but eventually as a second income.  Eventually I realized there was more employment, enjoyment, and income working in computers as a full-time gig.

I eventually landed a job as the sole IT employee for a 120-person non-profit.  I knew enough about security to know I didn't know enough about security, so I hired that out.  Watching them work and asking questions was my first real exposure to security beyond just telling a person in their home or small business to keep their anti-virus up to date.

During my time there, we went from having a UNIX box and a bunch of dumb terminals to running the organization on a new Windows/SQL based program.  I set up real email for everyone instead of the executives just using their personal Yahoo! accounts, and set up an IP-based network.  I didn't do this all by myself, but I supervised the contractors that came in to do all of it.  I also did a lot of the data conversion work myself, set up the custom Crystal Reports, and trained everyone on how to use it, all while still as the sole IT employee.  Being too much for one person, I finally told them I needed help.  They decided I was right, and told me to find someone.  I found a great guy - who they decided was so great that he became my boss.  That didn't work out well for me when they had to go through layoffs during the 2008 Great Depression.

I muddled through running my business, but decided I had to go get a full-time technology job again, and started working at Chrysler as a contractor doing audio/visual work.  It was steady, but really not a challenge.  They were converting from Lotus 1-2-3 to SharePoint for the calendaring system, and meetings had to be maintained in both places.  I built a coding system through Excel to make keeping them matched an easy process, even without admin credentials, because I was bored.  I learned to pick Targus laptop equipment locks, and became the guy to go recover them when someone locked one and forgot the combination.  Ultimately, the computer department (right next door) found out about my skill set and wanted to hire me.  The day they took me on a service call to check me out, I fixed what the interviewer said he couldn't (resolving an USB printer plugged in prior to drivers being loaded).  That got me that job.

At Chrysler, I was exposed to top-notch information assurance practices.  I expressed interest, and was told by the Chrysler CISO that if I could go get my CISSP, not only would they hire me, but everyone would take me seriously after that.  I didn't last long enough at Chrysler to get my CISSP, but I still pursued it.  I did get a non-security DoD job, so I ended up with a clearance, but even that wasn't enough.  Finally, I figured I'd take that clearance, my skills, my CISSP, and move to D.C. (i.e., Cybersecurity Mecca).  I haven't been able to stay unemployed since.

Since any decent hacker can easily find out who I am at this point (if you don't already know), I don't think it is a good idea for me to disclose the type of hacks I do at work now.  Aggregation is a real thing.  Suffice it to say that by applying the "hacker's credo" to my life, I have risen to places I wouldn't have even imagined as recently as five years ago.  Apply it in your life (if you haven't already), and see where it can take you.

Gary Rimar, a.k.a. "The Piano Guy," is currently working in a cybersecurity position where he tells people what they have to do, and they have to listen; in other words, a job that is a dream come true.  His goal in life is to use and share his wisdom and knowledge about cybersecurity to keep the good people in the world safer from the bad people.