Black Hat, White Christmas

Every year, a new batch of holiday movies are released with the same themes and tropes. But, we had another idea. What if we turned the holiday tropes on their heads and shared a cybersecurity perspective on the holidays? 

We present to you: ZeroFox’s Black Hat, White Christmas. 

The meet-cute

There was a gentle dusting of snow across the top of his laptop as he hurried into the crowded shopping center. He wasn’t your (stereo)typical hoodie-clad malicious hacker. Cal (named for his father, Uneth E. Cal), dressed like a businessman because in his mind, he was one. He’d moved to this small, unassuming town looking for a treasure trove of unsecured networks. He had one goal in mind, and it wasn’t spreading holiday cheer. He only needed the personal information and credentials of 1000 unassuming victims so he could sell them on the dark web. Then he could get home in time for New Year’s Eve, where he planned to watch the ball drop before getting to work finding more businesses that dropped the ball, letting their guards down online. When the cybersecurity professionals were on vacation at a ski resort, he would be logged into cheap hotel WiFi ready to hack. 

He never suspected that in just one day, everything would change. 

—-----------

It was Christmas Eve and Cal sat at a table inside of a coffee shop, readying himself for the task at hand. A college student sat nearby, clearly cramming for exams as he stuffed coffee shop croissants into his cheeks, a deep heavy sigh escaping his panicked lips before taking a sip of near-scalding coffee. A mother sat at another table, gently rocking her child’s stroller with one hand, checking her bank account on her phone with the other between gulps of macchiato, exhaustion emanating from her like vapor. A little boy, no older than five, handed his father an iPad, begging for the password. “It’s your birthday, bud. 042818 remember?” 

Same as all their passwords I’m sure, Cal thought to himself 

Bingo. Cal had an in. Maybe it was only the iPad password, but chances are he’d be able to access more than just the boy’s videos of Peppa Pig. 

He was almost in when someone stopped by his table. 

“You dropped this.” 

He looked up, the person’s white hat obscuring their face. 

“Thanks,” he mumbled, fumbling as they handed him a slip of paper.

He glanced back at his screen, people had no clue just how unsecure these networks really were. 

*Blocked* 

*Blocked*

*Blocked*

He didn’t expect this. Every attempt he made to penetrate their devices was blocked. Could it be that this quaint Christmas town was going to surprise him yet?

The well-meaning meddler and the choice

No worry, Cal had another solution; he’d always heard small towns were great for phishing. He only needed the bait. He opened his bag where he had saved the laminated pages of QR codes he’d prepared, which bore the names of the local bank, pharmacy, and coffee shop. Gathering his laptop and his bag, he was quickly swept away in the crowd where nobody noticed as he taped the QR codes to the front windows of each location.

“Scan here for mobile banking!” 

“Scan here for our new drink menu! Rewards members exclusive!” 

“Need prescriptions fast? Login to your pharmacy account to skip the line!” 

QR codes were just too easy. Everyone scanned them without batting an eye. 

He could feel his phone buzzing in his pocket. Unsuspecting townsfolk were already entering their private information, and he was already practically getting them hand-delivered – who said delivery times were always late during the holidays? It couldn’t be easier. But the best part? The businesses would have to deal with the repercussions, not him. Cha-ching. 

Phone buzzing, with his ever-present smirk, he wandered the town, looking at the holiday decorations and wondering how anyone could ever live in such a town that seemed so determined to overdo everything for the holidays. He had no intention of finding love for anything other than his own work. He was a lone wolf. He liked it that way, in business and in life. 

As he gazed at the town’s outdoor ice rink, he was hit with a sudden awareness: his phone had stopped buzzing. Searching his bag, he began to run back to the shops. In his hurry, he bumped into the same person who had handed him the paper note in the coffee shop – except this time there was a wave of heat as they collided, coffee spilling everywhere. 

“Watch where you’re going, White Hat!” he grumbled. 

“I know what you did.” They whispered in his ear. “I saw you posting those QR codes. I know what you are.” 

He stopped, standing toe-to-toe and ready to face-off. 

“I don’t care if you know what I do or think you know who I am. I’m not some R.A.T. or corporate bigshot coming to shut down the town. I’m not some lonely person who has given up on Christmas until the town hosts a talent show to save the factory like all of those holiday movies. I’m here for a job, and I have zero days left. Now back off, I have somewhere to be,” Cal huffed, his voice flowing out in a cloud of condensation. 

But they didn’t leave or stand down. Cal turned, heading back to town as White Hat trailed behind, a coffee scented ghost of Christmas Past determined to make him turn from big city bad actor to small town good guy in time to make it home for the holidays. 

As Cal approached the shops, he saw that his QR codes were still posted. Panicking, he checked his phone. His phishing sites were all down. Every last one. Each phishing profile on social media was removed, and web browsers no longer brought his typosquatted sites up. 

“I don’t understand. They were just working,” Cal whispered to himself. In the reflection of the window, he could see White Hat standing behind him, smiling. 

“I understand. We may be a small town, but our businesses take cybersecurity seriously. And you can join us. You don’t have to run around town, deploying phishing attacks, or hacking into some little kid’s iPad. You can make the internet safer. Better. And with any luck, you WILL make it home for your white Christmas.” 

Cal was dumbfounded. He’d never seen businesses protect themselves beyond traditional firewalls. Maybe it was time to trade in his black hat for a white one – or better yet, a red one. 

The talent show

As the sun set, the annual holiday talent show in the town’s square began. Cal pulled his warm cloak over his shoulders, expecting to hear screeching renditions of Mariah Carey’s All I Want for Christmas is You. Instead he was greeted to a row of laptops under a large, canvas pavilion. 

White Hat was onstage, winking as Cal stepped toward the front of the crowd. 

“We’re pleased to announce our first ever cybersecurity red team hack-a-thon! We need a man in the middle. Anyone in the crowd interested in joining?”

Cal shivered. “What the heck. I’ll do it.” he sighed, raising his hand. 

The next hour was a blur. But with every passing moment he knew it was time to make a change. Maybe it was the holidays, maybe it was the snow, or maybe it was the quaint small town and the metaphorical angel on his shoulder, but he felt the winds shift in his heart. He knew that his life of phishing for and selling stolen credentials on the dark web were numbered. He knew that his empty apartment was no match for the lights of this town square. And he knew that if he ever wanted stability, he’d need a real job in cybersecurity with benefits, PTO, and a supportive team. He was almost ready to admit that the whole lone wolf thing was a facade. 

By the end of the hour, Cal didn’t win the talent show hack-a-thon. But shoving his hand into his pocket, the jagged edge of a slip of paper caught his attention. It was the paper White Hat had handed him in the coffee shop. 

Breath fogging the air in front of his face, his numb fingers unfolded the small scrap. 

“If you ever want to switch sides and get a job in cybersecurity, let me know.” The phone number had been smudged, but a website was written clearly in block letters at the bottom. 

zerofox.wpenginepowered.com/careers. 

White Hat stood just above Cal on the stage, smiling and looking down at him. Cal quickly called his family, the warmth of finding his true passion, cybersecurity, radiating through him. 

“Mom, I’ll be home for Christmas. I’m so sorry I was going to miss it. And please tell Dad that I am going to need his help. I have a resume to write.” 

—-----

To find out more about our cybersecurity job opportunities, visit zerofox.wpenginepowered.com/careers. 

*Note: Actual malicious content removal times vary. 

**Note: Must pass a criminal background check.