Fancy Bear Goes Phishing

The Dark History of the Information Age, in Five Extraordinary Hacks

By: Scott J. Shapiro

Narrated by: Jonathan Todd Ross

Long-listed, Amazon.com Best Books of the Year, 2023

"Unsettling, absolutely riveting, and—for better or worse—necessary reading."—Brian Christian, author of Algorithms to Live By and The Alignment Problem

An entertaining account of the philosophy and technology of hacking—and why we all need to understand it.

It’s a signal paradox of our times that we live in an information society but do not know how it works. And without understanding how our information is stored, used, and protected, we are vulnerable to having it exploited. In Fancy Bear Goes Phishing, Scott J. Shapiro draws on his popular Yale University class about hacking to expose the secrets of the digital age. With lucidity and wit, he establishes that cybercrime has less to do with defective programming than with the faulty wiring of our psyches and society. And because hacking is a human-interest story, he tells the fascinating tales of perpetrators, including Robert Morris Jr., the graduate student who accidentally crashed the internet in the 1980s, and the Bulgarian “Dark Avenger,” who invented the first mutating computer-virus engine. We also meet a sixteen-year-old from South Boston who took control of Paris Hilton’s cell phone, the Russian intelligence officers who sought to take control of a US election, and others.

In telling their stories, Shapiro exposes the hackers’ tool kits and gives fresh answers to vital questions: Why is the internet so vulnerable? What can we do in response? Combining the philosophical adventure of Gödel, Escher, Bach with dramatic true-crime narrative, the result is a lively and original account of the future of hacking, espionage, and war, and of how to live in an era of cybercrime.

A Macmillan Audio production from Farrar, Straus and Giroux.

©2023 Scott J. Shapiro (P)2023 Macmillan Audio

Critic reviews

"Ingenious coding, buggy software, and gullibility take the spotlight in this colorful retrospective of hacking . . . Shapiro’s snappy prose manages the extraordinary feat of describing hackers’ intricate coding tactics and the flaws they exploit in a way that is accessible and captivating even to readers who don’t know Python from JavaScript. The result is a fascinating look at the anarchic side of cyberspace."—Publishers Weekly

“This is an engrossing read . . . An authoritative, disturbing examination of hacking, cybercrime and techno-espionage.”—Kirkus Reviews

"The question of trust is increasingly central to computing, and in turn to our world at large. Fancy Bear Goes Phishing offers a whirlwind history of cybersecurity and its many open problems that makes for unsettling, absolutely riveting, and—for better or worse—necessary reading."—Brian Christian, author of Algorithms to Live By and The Alignment Problem

Good pacing, but a little all over

Overall good. But when he said "Apartment 28" instead of APT 28, my inner cyber analyst cringed. I enjoyed the content and could make a drinking game out of the number of times he says "up-code" or "down-code".

A Decent Read / Listen

Writing can be cringy and narrator has problems with some pronunciations but otherwise a decent read.

Familiar stories with new twists

Although I've heard some of these stories a hundred times, I still learned new things. The angle he took to describe everything is very accessible and I encourage anyone from beginner to advanced to check out this book. The narrator's voice was great and he only fumbled a couple times over some of the IT terms. I visited the author's social media and was not disappointed. I'd definitely take any course he decided to teach.

Great combination of history and current events

Really enjoyed the in depth stories about the origins of our operating systems, early hackers, and the premise and motives behind hacking events. I appreciate the author’s research and ability to share their personal knowledge and experience in a way that makes the book compelling to the reader.

Exceptional exploration of modern day hams and their perpetrators

It is rare to find a book written by a university law professor that is both engaging and informative. This one is exceptionally clear and deals with the number of complex issues, as well as their real world reflections in popular society. It is definitely recommended reading for anyone interested in cyber security and modern day technological evolution on social media. The discussion of the difference between upcode and down code is also very elucidating. The clear distinction made between hacking and cyber warfare is also very helpful to an understanding of of why interference in a state’s politics is not an act of war. Enjoy!

interesting

Myself not having a background in cyber security, found the information and explanations easily processed.

Long

The story is too long and wandering. It could be more concise. I’m sure it’s very informative for some.

Decent history, but quite flawed

While much of the history and research in this book is good, I have to take everything with a huge mound of salt due to a clear display of biases and my own knowledge with certain topics. This is most clear in a few areas, such as his explanation as fact that women are just as terribly oppressed and opposed in gaming today as in the 1980s, omitting any mention of the ever-growing market share of female gamers, their popularity on social media and content creation platforms, and rise of women working in the gaming industry, all over the last 15 years or so.

He also states at one point "Cybersecurity failures are never just technical failures. They are always the result of systemic failures through the up-code stack." I've worked in cybersecurity for several years, and this is hilariously inaccurate. This circumstance is clearly sometimes the case, but it's absolutely not the only reason. The statement also just invites abdication of responsibility by shifting it up the chain. In reality, responsibility can be on any or all heads in the chain (security analyst, team lead, product manager, all the way to CISO, CEO, and board of directors). We can be given all the best resources and people in the world, and we will still sometimes make mistakes that are entirely own fault. Security technicians, engineers, and developers are not exempt.

There's a section toward the end of chapter 6 where the author clearly favors a particular person who had previously plead guilty to several federal crimes over several years, always expressing remorse but ending up committing the same types of crimes again, ultimately staying he believes the felon has "aged out" of cyber crime. I'm fine with having this opinion, but as with many other topics the author discussed, it's never directly expressed as opinion. The line between opinion and fact should never be this abundantly blurred.

Near the end of chapter 8, the author refers to someone as "another Trump minion" instead of any other term, such as "campaign associate" or anything else besides minion.

In chapter 9, the author goes out of his way to make a tangent about anime references one hacker uses. He explains the main characters, except in those series, these are not the main characters. (For Yuno in MIrai Nikki, there's an argument, but it's mostly Yuki. In Shimoneta, Ana is nowhere near a main character.) Given this, I am quite uncertain about the factuality of other tangents in the book, especially those littered with personal opinion. Why would you go out of your way to explore a topic you fail to have basic facts on?

Not a very complete sotry

impossibly high level overview of cybersecurity with brief discussion of recent events and hacks.

Self-aggrandizing author

Did I lean something? Definitely. Many interesting tidbits and a solid narrator. I was super interested to read another viewpoint on some of the early hacking communities and malware as I’ve read a few books in this area.

However, the author attempts to educate the audience in a variety of ways that are self-aggrandizing of his expertise in an area where he clearly is not. I understand the need to break down complexities for an audience but wow this was painful at times. This includes a seemingly simple description of Middle Eastern geopolitical conflicts as something he has the authority to speak on as well as make matter of fact statements on how entire countries will react to situations.

I found the opening background of his education and how he came back to this topic over the top, but there are so many worse examples throughout the book. Do yourself a favor and learn about malware from someone in the field that wants to tell you about their field. Not someone that passes opinion along as smoothly as fact.