The Chaos Computer Club: What Ethical Hackers Teach Small Businesses

Hackers & Hooks | Season 1, Episode 6

In November 1984, two members of a German hacker group used a flaw in West Germany’s national online service to run up a charge of roughly 135,000 Deutsche Marks against a Hamburg savings bank, payable to their own club. Then they gave the money back and told the press exactly how they did it.

That stunt helped put the Chaos Computer Club on the map. On this episode of Hackers & Hooks, Nick Gipson and Isaac Reed look at a hacker group that has been active since 1981, why Nick calls it a “gray hat” club, and what its work on everything from online banking to fingerprint scanners means for small businesses.

A Club That Breaks Things to Prove a Point

The Chaos Computer Club, or CCC, was founded on September 12, 1981, in West Berlin, with Wau Holland among its founders. As Isaac described it, the club has long pushed questions most people were not asking yet: who controls technology, who controls the information it collects, and how safe it really is.

The 1984 hack is its best-known early stunt. The target was Bildschirmtext, or BTX, an online information service run by the West German post office, the Deutsche Bundespost. Club members Wau Holland and Steffen Wernéry found a bug that leaked data onto the screen, including the access credentials of a Hamburg savings bank. They set up a paid page on the service and had a home computer call it again and again for hours, billing the bank each time. Before the stunt, the club had shown the operator proof of the flaw, and the operator had publicly maintained the system was safe. After it, the club returned the money and went public.

The CCC has kept up that habit of proving a point for decades. In 2008, it published a fingerprint of Germany’s interior minister, Wolfgang Schäuble, lifted from a drinking glass, to protest the use of biometrics in German ID documents. In September 2013, shortly after the iPhone 5s went on sale, the club showed it could fool Apple’s new Touch ID sensor with a fake finger made from a high-resolution photo of a print left on glass.

Nick explains the hat colors this way. A white hat is an ethical hacker whose job is to find weaknesses before criminals do. A black hat is the attacker, out for money or personal gain. A gray hat sits in between. Nick considers the CCC mostly white hat but gray overall, because the club has not always asked permission first, and in his view a few people connected to it over the years crossed the line.

The BTX stunt shows why that distinction matters. The club returned the money, but taking it without permission was still a problem. In Nick’s words, just because you’re doing something for a good purpose doesn’t mean that you could just do it. For a business, the lesson runs both ways: anyone testing your systems should have written permission, and when someone responsibly reports a real problem, the right response is to listen. Nick’s advice to companies that receive a legitimate report is to say thank you, not to go after the messenger.

“There is no silver bullet to security. There is always a flaw somewhere in the system.”

Nick Gipson, Hackers & Hooks

What Went Wrong: Trusting Systems Nobody Tested Hard Enough

The BTX operator’s mistake was not the bug itself. Every system has bugs. The mistake was hearing about a flaw and insisting the system was safe instead of fixing it. The fingerprint demonstrations expose a different mistake: treating a technology as secure because it feels futuristic. As Nick points out, a fingerprint has to be turned into digital data at some point, and that process can be attacked. And unlike a password, you cannot change your fingerprint once someone has copied it.

Small businesses make versions of both mistakes. A vendor’s security warning sits unread in someone’s inbox. A reported issue has no owner. A new lock, scanner, or app gets installed because it looks advanced, without anyone asking how it fails. The results are familiar: data exposure, downtime, and hard questions from customers and insurers about why a known problem was left open.

The episode’s fishing segment carried the same theme. Nick’s catch came from an Arkansas lake, and it was a kind of bass that does not naturally live there. Isaac’s tie-in: the fish did not belong in the lake, and the hackers did not belong in the systems they explored. Being out of bounds can reveal surprises, but it also forces hard questions about ethics and responsibility.

“Curiosity can open doors, yet ethics decide how we step through them.”

Nick Gipson, Hackers & Hooks

Lessons for Small Businesses

• Assume there is no silver bullet. No single product, including biometric locks and scanners, makes a business unbreakable. Layer your protections and plan for the problem you did not see coming.
• Make it easy to report a problem. Give outsiders a simple way to report security issues, such as a dedicated email address listed on your website. Decide who owns those reports, and respond to them.
• Act on warnings. When a vendor, IT provider, or researcher flags a weakness, record it, assign it to someone, and set a date to fix it. A known, unfixed issue is a business risk, not just an IT task.
• Do not treat fingerprints as secrets. Biometrics are convenient, but you leave fingerprints everywhere and cannot change them. For important accounts and doors, pair biometrics with another factor instead of relying on them alone.
• Test with permission. A penetration test, where an authorized tester tries to break in and reports what they found, shows you what an attacker might see. Get the scope in writing before anyone starts.
• Have a response plan ready. Nick’s point in the episode: patch the vulnerabilities you know about, and have a plan and a system for responding to the ones you do not.

How Gipson Cyber Helps

Gipson Cyber is built for the second half of Nick’s point: the problems nobody knew about until they showed up. Our small business cybersecurity services start with Business SOCaaS, which provides 24×7 monitoring by real human responders who watch for signs of trouble across the tools you already have. We work alongside your IT team or MSP rather than replacing them, and we report what we find in clear, plain English.

If something has already happened, Business DFIR provides small business incident response: investigating what happened, helping you respond, and giving you clear reporting for your leadership. If you think you are being hacked right now, go to 800cyber.com.

No one can promise a system without flaws. What a business can control is how quickly it finds out about a problem and how calmly it responds.