In brief: Ethical hacker Rob Shapland delivered the keynote speech at the Channel Islands Cyber Security Conference in Jersey last Friday, demonstrating the techniques he uses to breach corporate defences. The Jersey and Guernsey Cyber Security Centres process over five million potential cyber security events in the Channel Islands each year. Shapland warned that advances in deepfake technology are making cyber attacks significantly more dangerous.
Hacker for Hire, But the Good Kind
If you spotted someone wheeling a large Amazon parcel into your office last week, you might want to double-check who climbed out of it. Rob Shapland, an ethical hacker who tests corporate security by attacking it, gave the keynote address at the Channel Islands Cyber Security Conference, held at the Radisson Blu Waterfront Hotel on Friday. The event was organised by the Channel Islands Information Security Forum and brought together cyber security experts to discuss the threats facing Jersey and how the Island can defend itself.
Shapland explained his work to the Jersey Evening Post in straightforward terms. “I test company security from an offensive perspective, so I use the same tools and techniques that real cyber criminals do,” he said. “The difference is once I break into the network, I don’t then steal the information and sell it to other cybercriminals or do a ransomware attack. Instead, I help those companies defend against it.”
His methods go well beyond sitting at a keyboard. Shapland has gained physical access to workplaces by posing as a fake employee, complete with a badge design researched through LinkedIn, as a printer paper or coffee pot delivery person, and, memorably, by being delivered inside a large Amazon parcel and wheeled into an office before cutting his way out and walking off. It is the sort of thing that sounds implausible until you realise that most office workers will hold a door open for anyone carrying something heavy.
Jersey’s Defences: Quite Good, But Not Complacent
Shapland has worked with companies in Jersey on several occasions, including one engagement where he gained access by posing as a telecoms engineer fixing something in the building. His overall assessment of the Island’s digital defences was measured but encouraging: “quite good overall,” he told the JEP.
The scale of the challenge facing the Channel Islands is considerable. According to the Jersey Evening Post, the Jersey Cyber Security Centre and Guernsey Cyber Security Centre together receive and process notifications covering over five million potential cyber security events in the Channel Islands each year. In October alone, up to the point of the conference, that had already included 15,900 publicly exposed services, 499 known vulnerabilities, 329 suspected compromised systems, and 144 other potential threats. Those are not abstract statistics for an island whose economy depends heavily on financial services, where a successful breach of a firm’s systems could have consequences far beyond the immediate target.
Shapland noted that attending conferences such as this one gives him the opportunity to present techniques he has been using in the UK and abroad, and to gauge whether local organisations believe they could defend against them. It is, in effect, a live stress test of collective confidence, and a useful reminder that cyber security is not a problem that gets solved once and filed away.
The AI Threat: When the Voice on the Phone Isn’t Who You Think
Perhaps the most sobering part of Shapland’s address concerned artificial intelligence and the rapid advancement of deepfake technology. He highlighted how AI tools capable of cloning a person’s voice or generating convincing video of them could be combined with traditional social engineering techniques such as fraudulent phone calls and phishing emails to devastating effect.
“To have the ability to copy someone’s voice or create a video clone of them, and make them look like they’re saying ‘can you approve this invoice’ or whatever, it just makes those things a lot more powerful,” he told the JEP. “You’re trying to pretend to be someone you’re not. If you can also look and sound like them, that makes the whole thing a lot simpler to do.”
For Jersey’s finance industry, professional services firms and public sector bodies, this is a particularly pointed warning. The Island’s relatively small, close-knit business community, where many people know each other by name and reputation, might seem like a natural defence against impersonation. In fact, that familiarity could make a well-researched deepfake attack more convincing, not less.
Source: Jersey Evening Post
