Slashdot Mirror
Ask Kevin Mitnick
The hacker with perhaps the most famous first name around, Kevin Mitnick, has gone from computer hacking of the sort that gets one on the FBI's Most Wanted list (and into years of solitary confinement) to respected security consultant and author, helping people minimize the sort of security holes he once exploited for fun. His new book is called Ghost in the Wires: My Adventures as the World's Most Wanted Hacker; it's his first since the expiration of an agreement that he could not profit from books written about his criminal activity. Kevin's agreed to answer your questions; we'll pass the best ones on to him, and print his answers when they're ready. Note: Kevin also answered Slashdot questions most of a decade ago; that's a good place to start. Please observe the Slashdot interview guidelines: ask as many questions as you want, but please keep them to one per comment.
What and how much has changed nowadays? In other words, how would a (hacker) Kevin Mitnick getting started in 2011 hack and exploit?
Do you own a Guy Fawkes mask, or have an opinion of Anonymous' activities?
You have gone from hacker/cracker to security consultant via quite a difficult route. If you just wanted the money, there would have been far easier ways.
Today, the most well-known kiddies tend to do something high profile but requiring little technical brilliance and move quickly to "legitimate" jobs. The majority of "security consultants" don't really have much technical knowledge at all, being more public relations/ass-covering types.
With this in mind, what advice do you have to people who like to study security for its own sake? Should they keep quiet about what they do, developing an academic career so they can research to their heart's content without commercial pressures?
Or does everyone clever sell out in the end?
How do you think would have happened in a scenario where you managed to escape the FBI and the hackers that helped them?
What would you recommend to organizations to curtail the sort of social engineering break-ins for gaining unauthorized entry?
That's not what I meant.
Kevin Mitnick was recently on Colbert Report to promote his book. Here is the link if anyone's interested.
Should you find a security vulnerability (either in an open source project, a commercial product, or a company's hosted systems), what procedure would you consider "responsible disclosure" to the parties who are considered owners of the product? I recognize that each of the three cases listed above could vary significantly.
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
What cybersecurity threats do you see as the most dangerous to the Internet now?
Was it worth it? Is there an upside to your experiences the last ten years?
Huh? If they're dead, what's the problem? It would be much more evil to steal the identities of living people. If he killed the infants to steal their identities, then I think you'd have a point.
(Note: I don't actually know anything about this guy or what he did)
which is totally what she said
Would you agree that mostly there exists a tradeoff between security and convenience? If so, how much security (or convenience) do you think is worth sacrificing for the other?
When you were hacking and breaking into systems, how did you decide which ones to break into? Was it because of the difficulty/ease of doing it with different security setups? Or was it because of the actual people/corporations/entities behind the servers and what they stood for?
What are your opinions on the actions of groups like Lulzsec & Anon? Do you feel that they will, in the end, expand freedom on the net or just help government tighten the noose on internet restrictions?
Hi, Kevin. I was told that my credit card information was among the thousands you stole from Netcom, way back in the day.
I won't ask you what you did with the credit card info you stole, that might cause problems with self-incrimination. I wouldn't want that, oh no.
So let me ask this: How does it feel to be a 'respected' member of the security community now, after having frightened and hurt so many people back then? How does it feel to have the hacker community regard you as a hero when you've done some of the most amoral and harmful acts in modern computing history? I guess what I'm really asking is, how well do you sleep at night? Honestly.
Genocide Man -- Life is funny. Death is funnier. Mass murder can be hilarious.
What is your computer setup? I mean hardware, OS, software you use to work.
Has the gal from the Social Security Administration claimed her kiss? if so, was she hot?
What is the primary purpose of hacking? Has this purpose remained constant over the decades, or has it changed from your rise as a hacker up to today?
TFA Asserts that "Mitnick has agreed that any profits he makes on films or books that are based on his criminal activity will be assigned to the victims of his crimes for a period of seven years following his release from prison." The summary asserts that this is the reason you chose to wait before arranging for the publishing of a personal autobiography.
Given you had the opportunity to publish a copyrighted work and sell it for a profit prior to the release of your "official autobiography" under the pretense that the profits would be sent to the victims of your crimes (a number of which included theft of trade secrets and violation of copyright), why have you chosen to wait until the end of the agreement so that you could personally profit from this? And in a related question (unless you have answered it in the first), do you believe all of your crimes were vitcimless, some were, or perhaps none were?
Mitnick made his way by stealing the personal identification of *dead infants*. He's a sociopath.
Maybe if he stole them for shits and giggles, but the identities of dead infants have two significant properties: They're real identities and they're not in use. If there was another class of people with the same or better potential for clean identity theft, he probably would have stolen their identities too.
For you, after posting this question - it's not possible ;-)
I've worked for two of the major AV companies. In both cases, there were enough controls in place that, if it was financially happening, it would have become known. Even if you could have hidden the financials, if there was any sort of "collusion", someone would have leaked hard evidence by now, if only for the notoriety. Your paranoid imagination is just that.
The bottom line is that malware writers don't need the help. Think of it as information pollution. A manufacturer "saving" a few thousands per years in dump fees can cause a mess that costs millions to clean up. The malware writers' desires to get their botnets up and running to provide themselves collectively with a few million dollars per year are all of the incentive needed to produce the mess that requires billions in prevention and cleanup.
That is all.
It isn't. The crime is the digital equivalents of Breaking & Entering, Trespassing, Vandalism, Industrial Espionage/Sabotage...
hacked your way into a girl's panties?
I read the book and absolutely loved it. Best non-fiction I've read in a looong time. As I read it I kept wondering when you'd get to the part where you got into Microsoft's network and snagged the source code to NT or Excel. But you never did. Why not?
everyone was posting as AC and I wanted to be special :D
ics
As soon as I was told about it I canceled the card. Which was a hardship for me, considering I had just gone through a divorce and I was in bad financial straits at the time. He didn't hurt me much, but he frightened me plenty. There are others who were hurt far worse.
It frosts my chaps that this guy is treated as a hero by the hacking community. But I suppose people get the heroes they deserve. I was just wondering how Kevin feels about that.
Genocide Man -- Life is funny. Death is funnier. Mass murder can be hilarious.
Right - "I wasn't in her house to rob her, I just wanted to see what was in her fridge and see what kind of undies she liked."
He's getting rather old, but he's a good mouse.
The people who shouldn't sleep well at night is whoever thought credit cards where a good idea. Mitnick was responsible for 'stealing' 20k cards - they're responsible for all.
Seriously, a system where you have to give all the authorization info necessary to charge money to the company/person you're paying, and where there's only one single set of numbers, making it impossible to revoke access without canceling the whole card?
Who can trust it?
I don't know about yours, but here we have accounts where we can set up 'direct debits', which not only can have limits, but can be revoked on an individual basis without affecting the account. This is the minimum for a decent payment system.
Dilbert RSS feed
The reason was something akin to the fact that because the DA told the judge that Mitnick had the ability to call up NORAD and whistle in the phone and cause all sorts of havoc on our defense system, part of his sentencing stipulated that he be kept away from telephones.
This is the reason prosecutors should not have immunity. Solitary confinement is torture. DA tortured Mitnick based on a completely implausible rumor. Both the DA and the judge that signed off on it belong in jail.
Give me Classic Slashdot or give me death!
The people who shouldn't sleep well at night is whoever thought credit cards where a good idea.
Good, blame the victim. Mitnick was a thief and con man. I suppose you believe that people should only do the right things when they're forced to.
Hi, Kevin. I was told that my credit card information was among the thousands you stole from Netcom, way back in the day.
You moron.
He didn't 'steal' anything. That file with credit card numbers had been floating around for MONTHS. He was only guilty of having a copy, not for being the one who 'stole' it.
http://blockyourid.com/~gbpprorg/2600/the_world.txt
"With regards to the credit card numbers, this is far more misleading. For one
thing, only one computer system (Netcom) had its credit card numbers accessed,
not "computer systems around the nation." And this compromise was not even news
the Autumn, 1994, issue of 2600 reported it nearly half a year ago Apparently,
Netcom did nothing to secure the credit card numbers of its subscribers and,
despite multiple warnings and basic common sense, kept this sensitive
information online."
"Little mention is made of the fact that not one of the
20,000 credit card numbers lying around on Netcom was ever used by Mitnick, nor
was he ever suspected of benefiting financially or causing any damage."
[emphasis mine]
Hi, Kevin. I was told that my credit card information was among the thousands you stole from Netcom, way back in the day.
I won't ask you what you did with the credit card info you stole, that might cause problems with self-incrimination. I wouldn't want that, oh no.
So let me ask this: How does it feel to be a 'respected' member of the security community now, after having frightened and hurt so many people back then? How does it feel to have the hacker community regard you as a hero when you've done some of the most amoral and harmful acts in modern computing history? I guess what I'm really asking is, how well do you sleep at night? Honestly.
Seriously, put the kool-aid down.
First, when did Kevin Mitnick get into credit card stealing? Granted it's been awhile, I don't recall that being in any of the charges against him. And if he was stealing credit card info, i would imagine that would be part of the charges against him.
Second, Netcom isn't even listed in the targets he hit.
I'm going to guess, netcom fucked up, and to save face, they blamed Kevin Mitnick, and sent everyone info saying it was him, so you'd be pissed (which you still are) at him, when he wasn't the one responsible.
So, how does it feel to be played? Twice even? Seems like Netcom screwed ya twice. Hope you got a reach around with that.
Be seeing you...
As soon as I was told about it I canceled the card. Which was a hardship for me, considering I had just gone through a divorce and I was in bad financial straits at the time. He didn't hurt me much, but he frightened me plenty. There are others who were hurt far worse.
It frosts my chaps that this guy is treated as a hero by the hacking community. But I suppose people get the heroes they deserve. I was just wondering how Kevin feels about that.
The more you post , the more you seem like a complete idiot.
Of course, your too stupid to understand, but whatever.
All Kevin ever did was show that people are stupid everywhere, and your post confirms this.
Please, I need some proof that he hacked netcom and stoled credit card info, because all I've found is some "alleged that Kevin broke into netcom and stoled credit card info" of course, it goes to say that credit card info was commonplace on the net.
So, like i said in my other post to you, you got played by netcom.
Netcom security sucked dog shit, and they got broken into. They then decided to blame Kevin Mitnick, because he was hacker public enemy #1.
That is not unlike how we blame terrorist for everything today.
You sir, not only need to turn your geek card in, you need to stop posting.
Where did you buy your low UID from? Because it's apparent you haven't been on here that long and still be so clueless.
Be seeing you...
How does it feel to be blamed for other people's stupidity? I mean, when someone is too stupid, or lazy, to secure their systems and allows my personal information to get stolen, how does it feel when I blame you instead of the idiot that didn't take security seriously?
I guess what I'm really asking is, when someone hides their housekey under the doormat and some thief uses it to walk into their house and take stuff, how do you sleep at night?
Honestly.
In times of universal deceit, telling the truth gets you modded -1 Troll
Of course, your too stupid to understand, but whatever.
That line simply screams "Brilliant!"
But whatever.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
So I assume that your credit card info getting into Kevin's hands caused you grievous financial harm? Oh, it didn't? Well then.
I've yet to hear about any truly harmful acts Kevin Mitnick ever "perpetrated". Maybe I just never heard about something truly terrible and destructive, but I have my doubts.
I remember sigs. Oh, a simpler time!