Forgot your password?
typodupeerror
Security Books Crime News IT

Kevin Mitnick Answers 161

Posted by timothy
from the buy-one-mitnick-get-one-free dept.
Last week, you asked Kevin Mitnick questions about his past, his thoughts on ethics and disclosure, and his computer set-up. He's graciously responded; read on for his answers. (No dice on the computer set-up, though.) Thanks, Kevin.
Do you own a Guy Fawkes Mask?
by blair1q

Do you own a Guy Fawkes mask, or have an opinion of Anonymous' activities?

Anon & Lulzsec
by zero0ne

What are your opinions on the actions of groups like Lulzsec & Anon? Do you feel that they will, in the end, expand freedom on the net or just help government tighten the noose on Internet restrictions?

Kevin Mitnick: Sorry, I do not own a Guy Fawkes mask.

I don't think you can look at Anonymous as a single collective group. There appears to be many factions of it. Some are out there performing hacktivist activities that are being pursued with the true desire of keeping information free and holding our leaders accountable for their actions. Performing civil disobedience through illegal activities is probably not the preferred method, but I can understand what motivates these individuals.

As far as Lulzsec and other groups under the Anonymous banner that are just doing it for the "lulz," it reminds me of the prankster activities that many hackers have been involved in the past. This is part of the culture. Many of the attacks performed by these groups were going after the low-hanging fruit, and those vulnerabilities should have never been open to compromise. We trust these companies with our personal information. It is their responsibility to secure that data to the best of their ability. However, every time a major hack occurs, we are so focused on the attackers and never on the company that left your private information available to be taken. The media feeds this notion.

I don't think that the actions of groups like Anonymous will have much effect on expanding freedom on the net. Though some of their causes may be worthwhile, when you have groups like Lulzsec that just do it for the "lulz," the government has never understood these types of motivations and move harder to prosecute to make an example. So, the answer to your question is no. I would expect law enforcement would just make it a higher priority to curtail the actions of these kinds of groups.

Do as I do?
by wiedzmin

Do you lead by example, as in encourage hackers to do what you did, so that they can end-up as famous and well-paid security consultants? Or are you more of a "do as I say not as I do" type of role models?

KM: My hacking was always for personal pursuits. I never did it to make money. Naturally, I would try to dissuade anyone involved in legally questionable activities. There are so many opportunities these days to satisfy the challenge of breaking into systems and/or networks without breaking the law.

Though the fact that I am able to work as a professional security consultant and public speaker today is a blessing, the price I had to pay for it was pretty high.

How did you choose your targets?
by Rizimar

When you were hacking and breaking into systems, how did you decide which ones to break into? Was it because of the difficulty/ease of doing it with different security setups? Or was it because of the actual people/corporations/entities behind the servers and what they stood for?

KM: Usually, there was something of personal interest to me. I hacked into companies that developed operating systems to look at the source code. The reason I wanted to look at the source code was to discover security vulnerabilities in the operating system(s) that I could exploit. My goal was to become the best at hacking into any system I desired. To me it was like playing the ultimate video game, but with real world danger and consequences.

Later when I became a fugitive, I compromised cellular phone handset manufacturers to gain access to the handset source code for two reasons: (1) to create invisibility by modifying the firmware in my cellular phone; and (2) for the trophy; the harder the target, the more challenging it was to me.

Hi, Kevin. I'm one of your victims.
by Remus Shepherd

Hi, Kevin. I was told that my credit card information was among the thousands you stole from Netcom, way back in the day. I won't ask you what you did with the credit card info you stole, that might cause problems with self-incrimination. I wouldn't want that, oh no.

So let me ask this: How does it feel to be a 'respected' member of the security community now, after having frightened and hurt so many people back then? How does it feel to have the hacker community regard you as a hero when you've done some of the most amoral and harmful acts in modern computing history? I guess what I'm really asking is, how well do you sleep at night? Honestly.

KM: I did take a copy of the entire Netcom database, which also included the subscriber's credit card information, depending on the subscriber's payment method. I was never interested in the credit card information itself, only the user information associated with it that would allow me to reset passwords of Netcom users. The fact is, I was not the only one with these credit cards numbers. That database had been circulating on the Internet for months. I was merely one of many that had access to this information. This entire story is detailed in my new book — Ghost in the Wires — and once you read it, my objective for this hack will become clearer.

Was your identity ever compromised? Was your personal data ever leaked? If so, it wasn't me! That's because I never profited from my hacking activities, and there was never any disclosure of what I had come across or any of the source code materials that I obtained.

You stated: "You've done some of the most amoral and harmful acts in modern computing history?" You really need to get your facts straight. You sound like the government prosecutor who once claimed I could dial into NORAD and whistle into the phone to launch a nuclear missile. Or like the prosecutors who argued I caused 300 million dollars worth of loss by reading proprietary source code. It was a ridiculous argument.

According to the Securities and Exchange Commission rules, if any of the victim companies in my case suffered a material loss, they are required to report it to their shareholders. Did Motorola, Nokia, Fujitsu, NEC, Sun, Digital, and other public companies report any losses attributable to my conduct to their shareholders? Not at all. So did all the above companies defraud their shareholders by failing to report a loss, or did the Federal prosecutors lie in order to get me a harsh sentence? You work it out.

I paid a heavy price for my activities. I sleep like a baby!

Is it cool any more?
by Hazel Bergeron

You have gone from hacker/cracker to security consultant via quite a difficult route. If you just wanted the money, there would have been far easier ways.

Today, the most well-known kiddies tend to do something high profile but requiring little technical brilliance and move quickly to "legitimate" jobs. The majority of "security consultants" don't really have much technical knowledge at all, being more public relations/ass-covering types.

With this in mind, what advice do you have to people who like to study security for its own sake? Should they keep quiet about what they do, developing an academic career so they can research to their heart's content without commercial pressures?

Or does everyone clever sell out in the end?

KM: First of all, I disagree with your assessment that the majority of security consultants don't really have much technical knowledge. I have working relationships with numerous security people that have substantial technical skills. I encourage others to pursue their passion in security in either the commercial world or in academia depending on their goals. Even in an academic career, your pursuits will be limited, as there will always be a line. For many security professionals, they continue to research security, even on their own time, to keep up with new developments and techniques.

Cybersecurity Companies?
by bigredradio

Kevin, do you suspect any collusion on the part of cybersecurity companies such as Kapersky Labs or Avast! and virus creators? If there were not so many exploits in the wild, would there be a billion-dollar anti-virus industry?

KM: I don't know about Kaspersky but I think it's ludicrous to assert that any anti-virus company would be involved with malware creators. These are large companies and the risk of being involved in this type of unethical behavior is too great.

Responsible Disclosure?
by gcnaddict

Should you find a security vulnerability (either in an open source project, a commercial product, or a company's hosted systems), what procedure would you consider "responsible disclosure" to the parties who are considered owners of the product? I recognize that each of the three cases listed above could vary significantly.

KM: I think you have to notify the developer of the product, so that they may create a solution for the vulnerability. They should be given a reasonable amount of time to correct the situation, and then it should be made public.

NOTE — Kevin clarified with this addition: Note too, I believe the software vendor ought to pay for the vulnerability information as security researchers should be paid for their time.

cybersecurity
by Anonymous

What cybersecurity threats do you see as the most dangerous to the Internet now?

Re:cybersecurity
by zero0ne

What threat do you see as the most dangerous in 2, 5 and 10 years?

KM: Malware is probably the most substantial threat. Not only because it is so prevalent and being crafted better to avoid detection, but also because a large majority of internet users are oblivious to the dangers involved with clicking unknown links, authorizing Java Applets, opening attachments from people they don't know, and are easily fooled by average phishing attacks. People are still the weak link, and even intelligent ones make poor decisions. Case in point, the recent spearfishing attacks on Google and RSA, which proved highly effective.

Looking into the future is difficult as technology progresses so rapidly. In the next few years, as more and more corporations move towards cloud computing, these servers loaded with information are going to be the new playground for hackers. Layers of security need to be applied in any cloud-computing environment to minimize the risk.

With the recent hacks on Certificate Authorities, I would count on SSL becoming obsolete in the future and being replaced with a new, more robust secure standard, since the "web of trust" is no longer a feasible model.

With the proliferation of consumer devices coming onto the market that are internet-ready, I would expect to see more attacks at the heart of these new technologies. New devices, especially those branded by names like Apple, Microsoft, and Google, always tend to draw the attention of hackers from all over the world.

Cyberwar?
by mewsenews

The minor political movement surrounding your incarceration would likely not happen today. Hacking has become a state-sponsored activity, with China attacking Google and America/Israel attacking Iran. Do you think your life would be a lot different if you were born 10 years later?

KM: If you were asking if the circumstances would have been different had my hacking occurred ten years later, then I would say yes. The prosecutors would not have been able to convince the Court that I was a serious National Security threat, which resulted in me being held in solitary confinement for nearly a year, based on ridiculous claim that I could launch a nuclear weapon by whistling into a phone. Also, they would not have been able to claim the damages were the total R&D costs associated with the development of source code, which I merely looked at, without distributing it. I think my sentencing and treatment in the justice system would have been much different, as they would not have been able to exaggerate the harm like the Government did in my case.

Computer Setup?
by Anonymous

What is your computer setup? I mean hardware, OS, software you use to work.

KM: You send me yours along with the IP address, and I'll tell you mine. Good try at information reconnaissance.

SSA
by Anonymous

Has the gal from the Social Security Administration claimed her kiss? if so, was she hot?

KM: No, I don't know if she was hot and she has yet to contact me.

Ham radio license?
by vlm

Are you going to fight to get back your ham radio license or is that all water under the bridge now?

KM: I did fight the FCC and still have my ham radio license. The FCC allowed me to retain my license because they deemed me fully rehabilitated after a long administrative court proceeding.

"Justice ... "
by capnkr

Having experienced "justice" of a rather harsh sort (IMO, & possibly yours, too :) ) given that what you did was relatively inconsequential despite the claims otherwise, do you now do any work towards helping keep the sort of experience you had from happening again to other hackers (note: *not* 'crackers')?

KM: I have, and I do. I don't want to see someone's curiosity or desire to learn how to break into systems land him or her into prison. I remember supporting Dmitry Sklyarov when he was arrested at Defcon for exposing a bug in Adobe's e-books. I remember joining a group of people that were protesting his arrest for alleged DMCA violations in Santa Monica, California a while back.

In the end...
by NabisOne

Was it worth it? Is there an upside to your experiences the last ten years?

KM: I have no regrets in regards to my hacking experiences. I have always had a passion for learning, solving difficult challenges, and satisfying my own curiosity.

However, I do regret the effects that my activities had on my family and the companies that were damaged by my actions. I can't undo the past, and can just move forward to try and help others keep themselves safe from those trying to do them harm.

My recent experiences of the last 10 years have been nothing short of a miracle. One word has changed that for me: authorization! I now get authorization from my clients to test their security controls.
This discussion has been archived. No new comments can be posted.

Kevin Mitnick Answers

Comments Filter:
  • by fatphil (181876) on Monday September 12, 2011 @11:18AM (#37377004) Homepage
    The CA setup using SSL has never relied on the /web of trust/ model (where you can say how much you trust our neighbours), it's always relied on the /chain of trust/ model (where all trust is inherited).

    However, I agree that our CA setup should be clearly moribund now.
    • I'm curious if this was a slip, or if there are also problems with a "web of trust"?

    • by bragr (1612015) *
      Really? Because the last time I checked, there are different trust flags set for different root certs that are included with browsers.
      • Yeah, but it's all binary trust. I fully trust Verisign, but I wouldn't even trust Digicert to sign hacker.ru. There's a problem with that, because I am only really about 60 to 70 percent sure that Verisign won't be compromised or sell out to China's interests, and I don't really care if hacker.ru is signed by a cheap root authority so long as I'm getting my cracks and wares from them and not evilhacker.ru. The current CA model is a forest of trust model. Every root CA forms a fully trusted tree, and ev
      • by nullchar (446050)

        That's still a chain, just some links are "stronger" (more trusted) than others. You trust your browser/OS who trusts a large list of CA certs. There are no third parties (web) where some trust a CA (or individual cert) and some do not.

        A "web of trust" model is more along the lines of Moxie Marlinspike's proposed 'Notaries' system where you query different notaries for a service behind SSL and based on their responses (a web of them), you decide to trust the cert or not.

    • We already trust DNS to decide who can say where something is, why not include the ability to declare that you made it to the right place?

  • brave new world (Score:5, Interesting)

    by azalin (67640) on Monday September 12, 2011 @11:19AM (#37377014)

    If you were asking if the circumstances would have been different had my hacking occurred ten years later, then I would say yes. The prosecutors would not have been able to convince the Court that I was a serious National Security threat, which resulted in me being held in solitary confinement for nearly a year, based on ridiculous claim that I could launch a nuclear weapon by whistling into a phone. Also, they would not have been able to claim the damages were the total R&D costs associated with the development of source code, which I merely looked at, without distributing it. I think my sentencing and treatment in the justice system would have been much different, as they would not have been able to exaggerate the harm like the Government did in my case.

    They might have used it as an excuse to label him a terrorist though. At least back then they had to work around the law to pull off such shady stuff...

    • Good point! How would you feel about Gitmo, Kevin?

      They never did (and never will) understand taking such risks for no remuneration.

  • "Tighten the noose" (Score:1, Informative)

    by Anonymous Coward

    Come on, we're all adults here. So let's cut the bullshit and call a spade a spade. Government doesn't "tighten the noose" on human rights (including freedom of speech), nor do they "crack down" or cause "erosion". All of those terms imply that there was something immoral or unjust about what the victims were doing in the first place, and government (the criminal) is merely getting around to dealing with it, business as usual. As if government had more important things to worry about, but now the time has c

    • Most of what the government says, does, etc is nothing more than self serving propaganda, they will seize any opportunity to further expand their power (at the expense of civil liberties) example: 9/11 = "Patriot Act" (we ALL know what an unconstitutional nightmare that is) or how Nixon declared a "War on drugs" and so turned local police departments into occupying armies. The government foments fear among the American people using it's controlled media and using that fear as a tool of coercive mass contro

  • Surely he'll milk his fame for all it's worth. Endorsed mice, keyboards, perhaps a Kevin MitNIC Extr3m3 Networking Card?
    • He's been free for a long time, and I haven't seen any of those products. Near as I can tell he's become a relatively well respected security researcher specializing in pen-testing. And given his history, I expect him to be fairly good at that job.

      • by agbinfo (186523)

        I thought he'd only recently been allowed to profit from his "crimes" which is why he's now allowed to publish this book.

        • by SomePgmr (2021234)
          Well, he had books previous to this one, Art of Deception and Art of Intrusion. And he was allowed to earn a living acting as a security consultant. So I'd guess he could have done trashy things like the gp suggested... he just didn't.
          • by agbinfo (186523)

            I'm not a lawyer but I think there's a distinction between making money from your fame alone and making money from your profession. One is profiting from your crime. In any case, I don't believe he would have done any such thing. I'm merely pointing out that he might not have been able to even if he had he wanted to.

    • by azalin (67640)
      So what? This guy was sent to prison with completely overrated accusations and paid dearly for his wrongdoings. He has my blessing for using his "fame" in order to make some money.
    • by Lumpy (12016)

      Ohhh! where can I get a mitnick edition ironkey usb drive?

    • by pulski (126566)

      You mean the book he wrote almost 10 years ago now? http://en.wikipedia.org/wiki/The_Art_of_Deception [wikipedia.org]

      I imagine he's going to continue on with business as usual.

    • by Presence2 (240785)

      I wonder if he's getting a royalty for the cameo in Deus Ex: Human Revolution.

  • by LWATCDR (28044)

    It is hard to tell if what Kevin Mitnick did in the past was harmless pranks or not. In his case from these replies he seems to have paid the price and is now acting like a responsible person. I do not think anybody needs to give him a hard time about the past anymore.

    • I know plenty about what he did and he never did anything really harmful. He basically took information as trophies for his own personal use and has more than paid the price for it. It's the computer equivalent of picking the lock on company offices and looking at/taking pics of the products they were developing to satisfy your own curiosity. Yes it's trespassing and breaking & entering and you could say a violation of privacy. But he didn't cause any destruction or cause any company any real losses.

      • Well, he did steal a few people's identities, as well as who knows how many people's cellular accounts. Running up tens of thousands of dollars in cell phone bills for all of those people, with cell rates around $1 a minute.

        I don't think what he did was deserving of the punishment and poor treatment he received, but he did cause problems for a lot of people.

        Another thing not mentioned in his book is how many people might have lost their jobs for being too trusting to the "engineer calling from the IT
  • by chispito (1870390) on Monday September 12, 2011 @11:32AM (#37377132)
    I really enjoyed his book, but it's clear that if you ask him, he hardly ever hurt anyone. It's hard to believe a lot of what he says, since it comes from someone who achieved most of his goals by nonstop lying.
    • I really enjoyed his book, but it's clear that if you ask him, he hardly ever hurt anyone. It's hard to believe a lot of what he says, since it comes from someone who achieved most of his goals by nonstop lying.

      Name someone that got hurt? I'd have to agree with the second part of what you say though.

      His goal now is to make money - witness the plug for his new book in the answers. Why else would he even do a slashdot interview now?

      • by chispito (1870390)
        How about the people who footed his cell bill the whole time he was using cloned numbers? He says all they had to do was dispute the bill, but he's assuming they had the time/energy to dispute and that the carrier agreed to drop the charges.

        He conned countless employees into wasting who knows how many hours of productivity.

        He installed backdoor software at every turn, leaving the systems continually compromised.

        He continually abused people's good faith and manipulated them into doing what he wanted. He s
  • by Lumpy (12016) on Monday September 12, 2011 @11:43AM (#37377232) Homepage

    "If so, it wasn't me! That's because I never profited from my hacking activities, and there was never any disclosure of what I had come across or any of the source code materials that I obtained."

    If anyone was expecting honest gritty answers they were nuts.

    Honestly, he answered everything exactly the way I expected. Nothing at ALL that will be incriminating in any way, nothing revealing, PC and clean. Tow the line of "I was simply a curious kid that got into trouble! Help your local law enforcement!" response. and honestly after the legal and physical ass-raping they gave him I also would respond the same way.

    The united state government gave him a loud and clear message," The constitution is a ruse we have in place to pacify the masses. If we get our hands on you we can do to you anything we want and your lawyers cant do shit about what we do to you." Want an example? let's trout out the ridiculous "whistle launch codes" stunt...

    The Government pulled that on him as a clear sample of "we own you and can do what we want to you, so do what we tell you"

    OF course all his answers are very PC and very clean. What I want to read is his autobiography he has hidden somewhere to be released upon his death that covers what REALLY happened and names names. I really hope he is writing a detailed and 100% honest book that exposes everything that he is afraid to talk about.

    • by walkerp1 (523460)
      +1 Insightful Lumpy. The sterile answers are not so much a poor reflection on Kevin's character. No, they are an intelligent and calculated response to legal terrorism. We may delude ourselves and say that we are safer, but it is a poor trade indeed for the liberties that we've given up. It's all fun and games until the system turns on you. What follows is more animalistic than human.
      • Read Cory Doctorow's online book "Little Brother" (http://craphound.com/littlebrother/Cory_Doctorow_-_Little_Brother.htm) and ask yourself if KM went through it in real life.
    • Really? Hacking telecom manufacturers to see source code for cell phone firmware is legal, PC and clean? HA! I bet he wishes you were the prosecutor.
    • by tixxit (1107127)
      He actually does name a lot of names in his book (the majority of names and #s in the book are real, though dated). He also doesn't really hide his dislike for many of the characters in the book.
    • by jafac (1449)

      A lot of what he says sounds like the same canned rationalizations that were common in the "hacker" community in the 1980's and 1990's. Much of that became what was later known as the "Hacker ethic" and has, in my opinion, eclipsed into legend. Because when it comes down to it, when someone REALLY wants to do that - - - do the hard work of being a PROFESSIONAL computer security person, they quickly realize that they have two choices. They can work inside the law, or outside the law. Working outside the l

      • by Lumpy (12016)

        Problem is today you can do all the black hat stuff in your basement legally. less than $200.00 in hardware, heck FREE in most cases and you can set up a 20 machine network with firewalls, servers, etc.. all to hack upon. a old 486 running a hardened BSD install and cracking it is as 1337 as hacking citibank servers. You can get your hands on current MS server products for free for 30 days, hell you are uber 1337 for hacking it to last longer than 30 days... Start there kiddies!

        there is ZERO excuse to

        • Woah woah woah, a torrent?

          I'm afraid I'm going to have to ask you to come with me. No, you cannot speak to a lawyer.

  • What is your computer setup? I mean hardware, OS, software you use to work.

    KM: You send me yours along with the IP address, and I'll tell you mine. Good try at information reconnaissance.

    I have to imagine this would be a good deal, provided you could make yourself reasonably secure and reasonably trust his rehabilitation. I mean, no one cares what my hardware, OS, and software I use to work are, whereas "Hey, Kevin Mitnick uses _____" would probably be of interest to a lot of people.

    • Re: (Score:2, Funny)

      by Anonymous Coward

      My IP address is 127.0.0.1, and I run Mac OSX.....

    • by Teancum (67324)

      His paranoia is justified, however. Can you imagine what somebody would do to say "yeah, I hacked Kevin Mitnick and imaged his computer"?

      Security through obscurity can be helpful at times, and I think this is one of them. There is certainly no reason to disclose this kind of information.

      • Never said it wasn't.

        What I'm saying is that he's not paranoid enough in that he assumes everyone else is equally paranoid, and that he's setting up some sort of MAD scenario.

    • by jd (1658)

      I don't interpret it as evasion (although he's obviously free to contradict me on that). 99% of everything written about what he, and other hackers of his era did, talks about Social Engineering, getting people to reveal stuff that they'd normally consider confidential or private. I therefore interpret his answer here as "hey, you've got to think about what you're answering". Either that, or he doesn't want to be seen as endorsing a given solution given all the potential problems that might have. In either

      • Doesn't matter much to me what his reasons are. I'm just suggesting that if he really wants to pretend it's a bad idea to share this information, he shouldn't have made an offer like that, even rhetorically.

        It's a bit like when the Sony CEO offered to pay a bounty for PS3s found on shelves [penny-arcade.com]. Be wary of being so confident in your assumptions that you make a promise you can't keep. (Or, relevant but worse [penny-arcade.com].)

    • by swb (14022)

      At least show a sense of humor --

      "Mine is Linux, running on a pretty generic Dell laptop, IP address 10.0.0.1."

  • by TheOtherChimeraTwin (697085) on Monday September 12, 2011 @12:32PM (#37377696)

    KM: You send me yours along with the IP address, and I'll tell you mine. Good try at information reconnaissance.

    Oh please. The poor fanboy just wanted to have the same setup you are using. From your visit to Atlanta in 2008:

    "In his luggage, they found a MacBook Pro, a Dell XPS M1210 laptop, an Asus 900 mini-laptop, three or four hard drives, numerous USB storage devices, some Bluetooth dongles, three iPhones, and four Nokia cell phones (with different SIM cards for different countries).

    They also found a lock-picking kit and an HID proximity card spoofer that can be used to snag data stored on physical access cards by swiping it in front of them. The data can then be used to enter locked doors without having to make a forged access card. Mitnick says he used the device in a demonstration about security in his speech in Bogota, but that the customs agents' eyes lit up when they saw it, thinking it was a credit card reader.

    (Source: Kevin Mitnick Detained in Atlanta for having computer equipment on flight [cgisecurity.com])

  • He runs a hacked version of CP/M on a DEC PDP-11 (on an upgraded Fonz-11 chipset) and a 300 baud modem for internet access. After being locked up for so long, he's had a hard time adjusting to all the newfangled gear running around.

    Rumor has it the news of his setup emerged when he brought in a fried Qbus board to a local Radio Shack looking for some replacement ICs. Since it wasn't an RC car or Cell phone, he had to explain what the board was what it did. Alas, they had no ICs in stock.

  • "Computer Setup?
    by Anonymous

    What is your computer setup? I mean hardware, OS, software you use to work.

    KM: You send me yours along with the IP address, and I'll tell you mine. Good try at information reconnaissance."

    Oh come on! That was a general question that he should have answered! I would have liked to know what processor, speed, memory, and OS he was running. Not exactly enough detail to hang anybody or trade secrets. I would expect him to be secret about which applications he modified to break sec

Are you having fun yet?

Working...