Hacked on National Television

## Overview

In this talk, freelance penetration tester Linus Kvarnhammar details his work on the Swedish public television (SVT) series *Häckad* (*Hacked*). The six-episode show was designed to raise cybersecurity awareness among regular citizens by demonstrating how real-world attackers compromise devices and personal accounts. Production was constrained to a strict budget of three days per episode to conduct both the hacking assessments and the filming, supported by team members David Jacoby and Jesper Larsson. Kvarnhammar shares the technical and social engineering methodologies used during the episode targeting everyday individuals.

## Participant Selection and Casting Pretext

To simulate consumer-targeted attacks: * **Recruitment Pretext:** SVT recruited participants via a Facebook group under the guise of an intentionally vague "digital experiment." * **Logistics & Staging:** During COVID-19 restrictions, 20 applicants were invited to an in-person casting call and split into groups of five. * **Insider Plant:** In each group of five, the fifth person was covertly team hacker Jesper, who acted as an inside social engineering agent to steer the targets.

## Attack Vectors and Execution

The team established a mock hacking office and executed multiple coordinated attack vectors:

* **Fake Portal & Credential Harvesting:** * Targets were instructed to fill out an onboarding form on a specially crafted website named "digital experiment." * The portal provided credential harvesting options, including fake Single Sign-On (SSO) login pages mimicking Facebook, Google, and LinkedIn, as well as native account registration where participants reused passwords. * **Credential Leak Databases:** * The team queried public breach and leak databases using the participants' email addresses to cross-reference reused passwords. * **Social Engineering & Malicious USB Drops:** * When users completed the web form, an intentional error message was displayed. * Jesper claimed to have encountered the identical error and handed targets a malicious USB flash drive containing weaponized PDF files intended to fix the problem. * **Backdoor Delivery:** * The USB drives carried trojanized PDF backdoors for both Windows and macOS. * While the Windows payload failed to execute properly due to a build flaw, the macOS backdoors operated successfully, compromising all 7 participants who brought Mac computers. * **Outcome:** * The team compromised usernames and passwords for all 20 participants, obtaining multiple credentials for several targets.

## Exploitation and Real-Time Tracking

After gathering credentials and backdoor access from the initial pool, the team selected two participants who were well-suited for television, focusing particularly on a participant named Frida: * **Host and Account Access:** The team maintained full remote access to Frida's Mac and several of her online accounts. * **Location Tracking:** By logging into her compromised Google account, the team turned on Google Location Services, allowing live geolocation tracking that pinpointed her location in Gothenburg (three hours away from the team's recording studio). * **Surveillance:** The team monitored her real-time activities and personal browsing habits, observing her LinkedIn lookups and Google searches regarding a person she had met during the casting process.