Ex-hackers 'rubbish at security'