Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mitnick Testifies on Telco's Security

Posted by michael on from the what-me-worry dept.

Woefdram writes "Our favourite computer criminal (?) Kevin Mitnick testified in a case against Telco Sprint that their security was like Swiss cheese: full of holes. The story on SecurityFocus quotes Mitnick, saying, 'I had access to most, if not all, of the switches in Las Vegas,' and tells how he came up with a list of 100 challenge-response codes." We've written about this case before.

12 of 206 comments (clear)

  1. Re:Publicity grubbing... by CodeMonky · · Score: 4, Insightful

    You left something out, Mitnicks response to the question.

    Mitnick suggested calmly that Sprint try the list out, or check it with Nortel. Nortel could not be reached for comment after hours Monday Perhaps he knew that spring/nortel couldn't be reached. But you should still at least include the response if you're gonna quote something like that.

    --
    --"Karma is justice without the satisfaction"
  2. Re:Publicity grubbing... by Your_Mom · · Score: 3, Insightful
    Let's face it, there have been thousands of better crackers...
    I have to say that Mitnick is one of the better crackers in recent memory, sure he gets the spotlight a lot, but I think thats because he got thrust into the public spotlight back during the Shimomura episode. I mean, how many crackers made the front page of newsweek?

    Yes, there are other deserving people out there, but I don't mind Kevin cashing in on his "fame". Who wouldn't?
    --
    Objects in the blog are closer then they ap
  3. from a former Nortel employee... by deander2 · · Score: 4, Insightful

    I worked for a year and a 1/2 on a project designed to replace the DMS-100 provisioning and configuration systems. I can tell you that those systems are complex in the extreme to set up correctly. I knew people who had worked with them for 20 years and still had questions about how they worked. It's not through Sprint's stupidity that they were hackable, it is a by-product of overly complex system engineering.

    This is a common problem in this industry. Having complex systems when you're the defacto standard makes a great revenue stream in your consulting and training systems, but kills the reliability of said systems. Nortel/Cisco/IBM never take the fall for it however, because they can just say "well, you didn't configure it right" and Sprint/etc can't even argue - it would take 2 years and 10 consultants to even find out.

    --
    http://kered.org
    1. Re:from a former Nortel employee... by WolfWithoutAClause · · Score: 3, Insightful
      To be fair to Nortel, these particular systems were hacked 7 years ago, at a time where encryption on the internet was a rarity, and orginally designed well over a decade ago. Security features weren't much of an issue with customers at that time, clearly security is becoming much more of an issue now.

      However, very few systems are proof against social engineering, encryption or not.

      --

      -WolfWithoutAClause

      "Gravity is only a theory, not a fact!"
    2. Re:from a former Nortel employee... by JUSTONEMORELATTE · · Score: 5, Insightful

      To be REALLY fair to nortel, while the web was young seven years ago, (the net was old, even then) that has absolutely nothing to do with this crack job.
      The DMS-100s were broken the good old fashioned way -- use a war dialer to find the dialup number, then call the switch directly. Once connected, try the obvious passwords first (either admin/admin or admin/NORTEL_DEFAULT_PASSWORD, which Mitnick had learned from Nortel docs)

      Deander2 got it right -- Nortel designed an absurdly complex product, and was unmotivated to clean house because they were able to rake in the consulting bucks. WHEN (not if) this comes back to bite a client in the butt (like it did with Sprint) Nortel takes no heat for it, and in fact most likely gets even MORE consulting dollars for a hasty clean-up effort.

  4. Re:Publicity grubbing... by Jesus+IS+the+Devil · · Score: 2, Insightful

    You have to compare apples to apples and oranges to oranges. Kevin did all of this back when the internet was still in its infancy. Back then there wasn't this vast sea of information script kiddies can just search for and dig up. If you wanted to crack, you had to figure it out by yourself. No doubt. He was one of the best crackers out there. His deeds were evil but he was a good cracker.

    --

    eTrade SUCKS
  5. Re:Publicity grubbing... by LittleGuy · · Score: 2, Insightful

    Gaining celebrity out of being on the wrong side of the law (whether justly or unjustly) has been long prevalent, from Jesse James to Bonnie & Clyde to Al Capone to John Gotti to 'Mayflower Madam' Sydney Biddles Barrow and beyond (with Winona in the on-deck circle).

    Why should we surprised by whoring notorious characters on the tech side?

    --
    Mod Karma -1: I sed bad wurds. If I cep my mouf shut, I wud be at riyses.
  6. What's the '?' for... by nochops · · Score: 3, Insightful

    Why use a '?' in the post?

    Is there any doubt that Mitnick is a criminal?

    Since is when is cell phone cloning, carding, and cracking legal?

    Since when is running from the law (he was a fugitive) legal?

    I think there's no question as to the legality of Mitnick's actions. Weather or not the legal system handled the case correctly is another story, but he is definitely guilty of those crimes.

    --
    "A terrorist is someone who has a bomb but doesn't have an air force." -William Blum
    1. Re:What's the '?' for... by blueskies · · Score: 2, Insightful

      It should have been:

      "Our favourite (?) computer criminal...."

  7. Re:Publicity grubbing... by Your_Mom · · Score: 3, Insightful
    I'll say it again: He's the computer equivalent to the shaking junkie who sticks a gun in the face of a 7-Eleven clerk to get money for a fix...
    No disagreement there, I think hes been quoted along the lines of not being able to stop despite knowing that he will eventually get caught.(Link anyone? I could be wrong)

    He left a trail a mile wide...
    I have to disagree here. There were no real ties between him and the Shimomura attacks. I think he was the target that first popped up on their radar screen after the attacks and was lassoed. There are a lot of weird bits in the "official" version of the story (unsigned warrants, etc) and instead of detailing them I will say:

    I strongly recommend reading both The Fugitive Game By John Littman and, to get the other side Takedown by John Markoff, I find Littman a much better read and does much more research into the story then Markoff. Littman presents the story from a impartial 3rd person, and scrutinizes both accounds (Mitnick, who he interviewed via phone while on the lamb, and Markoff's story from his book, NYT stories, and interviews.) I've lent Littman out to techie and non-techie friends and it always recieves high marks, and I think the "Something was Fishy with the govt's case" viewpoint usually results.

    --
    Objects in the blog are closer then they ap
  8. Re:Why is he a free man? by Phoenix · · Score: 2, Insightful

    Regardless of what you think of him, he did get shit upon by the justice system. As a citizen of this country he is entitled to a speedy trial. They left him to rot for a long time before they got down to putting up on trial. Personally I have no use for one such as he, but regardless of anyone's opinions he has rights to fair judgement under the constitution of this country. To deny such to him is to leave an opening to deny others of those same rights.

    For example...you are miffed at Kevin for what he did (as am I) but would you feel the same way if someone were arrested for hacking a CueCat scanner and making software that didn't report to the company, then left "to rot"? Or would you be shouting that the government was commiting a travisty of justice?

    You can not have it both ways...It has to be fair to all or fair to none.

    Phoenix
    (and yes I know that it frequently doesn't live up to the ideals on the Constitution, but let's not help make it worse Ok?)

    --
    -- Wiccan Army, 13th Airborne Division "We will not fly silently into the night"
  9. Re:Publicity grubbing... by nanoakron · · Score: 2, Insightful

    Cruel and unusual punishment, anyone? anyone?

    -Nano.