Quick anecdote: About ten years ago I ran a prominent AOL hacking website called AOL-Files.com. AOL employees had admin rights tied to their screen names and th

Quick anecdote: About ten years ago I ran a prominent AOL hacking website called AOL-Files.com. AOL employees had admin rights tied to their screen names and the ones with the highest levels of access had to enter a SecurID token after they entered their normal account password. Since we were always trying to outdo each other, these high-level employees became a popular hacking targets. Getting an employee's password and SecurID token was very difficult, as you can imagine. Most phishing attempts failed, but every now and then we found an employee who would enter their password and SecureID pin into a bogus website, which we then had forwarded to us so we could immediately log onto their screen name before the pin changed. The most notable hack was when BMB, my co-founder, gained access to an account with keyword admin privileges. What this meant is that he could direct any keyword to any destination. He chose to redirect keyword "Welcome", which every AOL member is sent to when they sign on, to our website, aol-files.com. For a period of about half an hour, every single person who signed onto AOL was redirected to our AOL hacking website. We received over 100K hits in 30 minutes. I've got an archive of AOL-Files up on my blog [1], which has lots more information about this hack and many others. Ah, memories... [1] http://www.mattmazur.com/archive/aol-files.html http://www.mattmazur.com/archive/aol-files.html