"By law, employees have to be able to leave a building without showing credentials," Long says. "So the way out is often the easiest way in."

Slideshows:
Cybercriminals' map of the world
Tips for keeping kids safe online

Case in point: Tasked with stealing data from an ultra-secure building outfitted with proximity card readers, Long opted for an old-fashioned approach. Instead of looking for vulnerabilities in the company's networks or trying to hack the card readers at the building's entrances, he and another hacker shimmied a wet washcloth on a hanger through a thin gap in one of its exits.

Flopping the washcloth around, they triggered a touch-sensitive metal plate that opened the door and gave them free roam of the building. "We defeated millions of dollars of security with a piece of wire and a washcloth," Long recalls, gleefully.

In other instances, Long has joined employees on a smoke break, chatted with them casually, and then followed them into the building. Sometimes stealing data is as simple as wearing a convincing hard hat or walking onto a loading dock, before accessing an unsecured computer or photocopying a few sensitive documents and strolling out the front door.

Fortunately for his victims, the companies that Long invades are also his customers. As a penetration tester for Computer Sciences Corporation security team, Long is paid to probe weak points in a company's information security. His job as a "white-hat" hacker is to think like the bad guys--the more evil genius he can summon up, the better.

Slideshows:
The dark side of the Internet
The latest in surveillance technologies

And if tactics like tailgating an employee through a backdoor or picking a lock with a washcloth don't seem like real hacking, Long would suggest fine-tuning the word's definition. To bring that other side of hacking to the public's attention, he wrote a manual cum manifesto titled No Tech Hacking, which was published this week. The book's goal, aside from pumping Long's already significant notoriety in the world of cyberpunks and script kiddies, is to show that hacking isn't always the realm of high technology.

Instead, he argues, it's still rooted in old-fashioned observation and resourcefulness. To obtain a corporate password, for instance, a hacker can pose as an employee and call a company's help desk or simply look over an employee's shoulder while he's on his laptop at a local cafe. To access a network, Long will photograph an employee, fake his badge or even his uniform, and slip past the front door security to find an unguarded terminal.

That kind of no-tech hacking isn't a new idea, but it's one worth remembering, says Jeff Moss, the organizer of cyber-security conferences Black Hat and Defcon. "There's a tendency in our industry to focus on the latest and most interesting attack," he says. "But Johnny is trying to show that the simple security problems that were spotted a long time ago haven't gone away, and the bad guys will use whatever's available."

That's a lesson that the security industry should heed: The average cost of a data breach rose to more than $6.3 million last year, up from $4.8 million in 2006, according to research by the Ponemon Institute. And physical security played a growing role: Lost or stolen equipment accounted for about half of those breaches last year.

With those kinds of costs at stake, hiring hackers like Long isn't cheap: For basic vulnerability assessment, CSC, which is based in El Segundo, Calif., charges a minimum of $35,000. For complete penetration testing, which often involves obtaining specific files to demonstrate a firm's security flaws, the team can charge as much as $90,000.

Slideshows:
7 ways your site can be sabotaged
Seven steps to identity theft prevention

But for the most in-depth hacking missions against well-protected companies, Long and the rest of CSC's security team are also rewarded with the illicit thrill of intrusion. "When you get that James Bond feeling of espionage, it's a huge adrenaline rush," he says. Long admits that the night before a major case, his team often watches the geek thriller Sneakers. "Penetration tests that involve a human element are so much more exciting than sitting in front of a computer screen, poking through a company's firewall."

As a kid in suburban Maryland during the 1980s, Long's hacking career began under less sensational circumstances. Surfing the pre-Web Internet, he browsed bulletin boards looking for pirated copies of video games. To pay for the growing long distance bills from his modem, he started charging his Web surfing to calling card numbers that he found on semi-legal sites. And when those phone-card sites started forcing users to pay for access, he found ways to circumvent the sites' security measures.

Soon, the challenge of bypassing firewalls and accessing distant networks was more interesting than any video game. "I would be on my Commodore 64, talking to a Unix system somewhere far away," Long says. "It was like traveling--the fascination of being in a place with a different culture and speaking a different language."

When he graduated from high school, Long skipped college and got a job at a local university as a systems administrator. Before he was 20, he moved on to a major health insurance provider that was in the midst of bringing its systems onto the Internet. Long wrote up a report detailing all the company's security vulnerabilities. It was ignored by his superiors. Feeling demoralized, he eventually left the company and landed at CSC's offices in Falls Church, Va.

At CSC, Long found his niche. In 1998, for instance, he suggested a simple social engineering method to gain access to a company's server that wasn't attached to the Internet. Long tracked down the name of the company's technical contact person on the Web, and made a phone call to its help desk pretending to be that person. The help desk's staff switched on the server's modem, and CSC's team was inside. "Once I connected with the security team, I brought some of the perspective that the security community was just starting to get then, a street-level hacker mentality," Long says.

From there, CSC began to experiment with the physical security hacks it now uses today, and Long began developing a set of techniques he calls "Google Hacking": using simple search engine queries to find hackable vulnerabilities in Web sites. Today CSC has one of the security industry's better-known penetration testing teams, and Long is a celebrity in hacker circles.

Since he first became a professional penetration tester, cyber-security has evolved dramatically, Long says. No Tech Hacking is partly about the latest social engineering methods used by a new generation of cyber-criminals. Instead of searching for holes in companies' increasingly tight security perimeters, their attacks are about drawing the target out, bringing employees to a compromised Web site that infects their network, or convincing an administrator to give up his or her password in an e-mail.

But the other lesson of the book , Long says, is that some things haven't changed. "No matter how savvy we think we are, the oldest attacks are still possible, and they're still prevalent," he says. "The smartest systems are still falling for simple tricks, and that's what keeps us in business."