Slashdot Mirror
Mitnick Calls for Hacker Stories
ram writes "Famed hacker and master social engineer Kevin Mitnick has been commissioned to write a new book following the success of his first text The Art of Deception. The new book, tentatively titled 'The Art of Intrusion' will tell the stories of real hacks, with the names of attackers obscured to protect them from the authorities and their victims. Mitnick has called on retired hackers to come forward with their stories, offering a $500 (283) prize for the best story that makes it into the book, and a $200 payment for all stories that make the final draft."
He is a famous hacker because he got caught. There are thousands of hackers much better (if that's the right word), so why does he get all the attention?
When anger rises, think of the consequences.
Confucius (551 BC - 479 BC)
he will take care to protect the identities of the targets too. I can see no end of trouble when "A Big Co." finds out they were completely rooted and had no idea..
IANAL - lets say for the sake of argument I was an ex-hacker with a story to tell that ended up in print. Even with this much vaunted anonymity I would still be worried about publically confessing my misdeeds. Especially in the UK where hacking offences can be covered with anti-terrorist legislation these days.
I don't read your sig, why do you read mine?
1. Get others to produce the content of your book
2. Publish
3. ???
4. Profit!
How does he intend to confirm the stories are true? If he is trying to keep indentities quiet, he is going to have problems confirming them.
1. Perform illicit activity (crime: 'hacking' or 'cracking' for those who prefer that term)
2. Get away with it.
3. Get paid for story publishing.
4. Profit!!!
Seriously though, as I'm sure many of these hackers/crackers will be heralded as (demi-)heroes by many visitors of Slashdot, and I understand that often the sentences for those caught are ridiculous, it should not be forgotten that they -did- commit a crime.
Now, they were 'smart' enough to not get caught for that crime, too. Which means they can gloat about their hack/crack in private of with tight friends or do whatever the heck they want with it already.
But now they're getting paid to talk about those hacks/cracks - and retain their anonimity ?
There's something very wrong with that picture, in my humble opinion.
...and I'll be happy to give to you some kinda fish story. Yea, there was that time back in '83 where some buddies and I were sitting 'round our dorm room and thought, "Hey, how long's it been since someone's busted into Langley's database?" And so, we all tossed five bucks in a pot for the first to break in and find the SS# of the Director of the CIA...
Really, how are you gonna know that these stories are actually real?
Even if the book includes as many as 100 stories, that's only $20,000. We can be sure that Mitnick will be making a lot more than that, and the publisher will be making much, much more.
Don't most honest, law-abiding people nowadays disapprove of criminals profiting from their crimes? Well it sure seems like Mitnick is profiting from his crimes with this book because the publisher is using his name to sell it.
Kinda cheap and sleazy if you ask me, which you didn't.
We all know Mitnick is in quite a bit of trouble, but the fact that he's a good social engineer still persists. He was traumatized in jail, and most of what he was severely punished for was probably due to non-cooperation, in that "hacker" attitude, with very influential people. Most likely, he got out of such things by giving in and cutting deals.
Before you send in any good stories, be they fact or fiction, think of this: what if FBI / Homeland Security agents are on the case working with Mitnick, reading those letters that will supposedly go into the book and tracing who sent them? They've been known to do similar things to get people to brag before, which is the easiest way to catch people, or at least make it seem that way. With John Ashcroft and Tom Ridge in the government, they will stoop to any low to put hackers, whom they view as terrorists, behind bars.
I think he needs the anonymous hacker contributions as a smokescreen for some of his old unknown hacks.
//Pingo
This guy has probably done more than he is accused for and has got an urge to brag about all his hacks. Doing so might get him into more legal trouble and he needs some anonymous hackers as legal frontends.
--- Linux or FreeBSD, it's like blondes or brunettes. I like both. ---
For people like us (slashdotters) these books are mostly tales and overly obvious statements. Interesting and sometimes fun to read. That's about it.
To people NOT like us (read: small/mid company admins and even some larger company admins) alot of this is actually an eye opener. Case in point: Some of you may know that I work for a smaller, privatly owned ISP. Because of this, we cater to a bunch of mid/small businesses. I have suggested his first book for them to read. I have gotten no less than 20 call backs after they read the book with statements like "Wow, I never even thought of that!" and "Thanks for the book tip! Helped me out alot and we have tightned up security with our staff." You're lucky to find a semi-competent admin in companies this small (or an admin at all) let alone one who understand or has even heard of social engineering or any type of specific attack out side of what the main stream media reports.
Keep in mind that alot of admin in these companies have heard DoS and DDoS before, maybe even the names of a few well know worms but they don't even know what they stand for or what they do. They are nothing more than the catch phrase of the week. Books like this are pretty invaluable to them as they are not written from a tech stand point (Hardening Cisco comes to mind) and are eaisly understood and easy to put into practice by someone who is the admin because they know what HDD stands for or were hired on the lowest possible salary.
Don't get me wrong here, these are not the end all be all security books but they are a great boon to the customers that I service.
People are getting all righteously indignant and aren't seeing the real purpose of this offer. By appearing to anonymously post OTHER'S stories, he will be free to publish HIS OWN stories under some cover. He will be able to use the journalist's right to conceal the names of his sources to protect himself - and yet still tell his stories. I'm sure he will still use a few others, but the only ones that he can know really happened for sure are those HE performed.
Curious George
***General Consultant to the Human Race*** My opinions are free. You get what you pay for.
As I see it Mitnick remains of the same mindset as when he first showed off his cracking skills to a group of peers and was surprised when they turned him in.
Among his various complaints about his treatment by the Feds are that he was held without bail (gee, can you say 'established flight-risk'?), and that they held onto all of his computers (gee, after he declined to provide the encryption keys needed to access them as evidence?).
He's also clear about being bitter toward the author of 'Takedown' (advice, "never get in an argument with someone who buys ink by the barrel and paper by the train-car") and Shimomura(sp?) (Let's see, you break into lots of machines, eventually you come up against someone better'n you and now you complain that they exact some revenge?)
His notoriety seemingly guarantees a certain audience for he and his publisher to profit.
Personally I've got no desire to help this guy along. In the excerpts from his book he has the brass to include himself in the 'hacker' ethic of places like LCS, Berkeley, JPL. Sorry, that image doesn't pass.
Linux is Linux, if One need clarify their dist: <Dist>/GNU Linux
bsds are of course just BSD
These types af articles always seem to be a little strange. Would the "300 passwords" that he stole be a single password file, that maybe he brute forced the "Packers" password out of?
And what's up with the bit about threatening the President? It's illegal to collect guns and bombs for use in harming the president. It's not illegal to say that you want to harm the president.
More typical wierdness:
He admitted what? How much employee time? At $40/hour, that's 480,000 hours. That's 240 full-time employees at $40/hr for a year. That's not including the audits and "encryptions upgrades".Too much nonsense in there.
There are no trolls. There are no trees out here.