9 ms·
Mitnick was a hacker hero of mine in my youth. I think I’ve understood his role as jester prior to conviction less as I’ve grown older, but there’s something ab
by josh2600 3y ago
Mitnick was a hacker hero of mine in my youth. I think I’ve understood his role as jester prior to conviction less as I’ve grown older, but there’s something about the boyhood charm of being so divorced from the potential consequences of one’s actions that is almost unique.
Mitnick had so many stories that entranced the people around him. I heard one second hand of Mitnick dealing with a bank who had early voice verification software. Upon meeting the CEO he gave the executive his card and departed for the evening. Arriving back at his hotel, he called the CEO and asked him to read his phone number to him. The phone number contained all ten digits which Mitnick had neatly tape recorded so as to make the CEO’s voice reproducible. He then proceeded to use the bank’s vocal banking system to transfer $1 from the CEO’s account to his as the authentication mechanism was reading out your own account number in your voice.
When Mitnick arrived back in the board room the architect of the voice verification system was crestfallen and the bank CEO delivered a check on a silver platter.
Now how much of that tale is embellished I will never know as it was second hand, but that was the kind of whimsy Mitnick brought to our world.
Rest in Power.
- tomjakubowski 3y agoHow would he have known the CEO's bank account number? Did the CEO write him a check at some point? Or maybe a bank's CEO traditionally gets account number 1…
- walrus01 3y agoMitnick was exceptionally gifted at social engineering information out of various company departments over the phone.
- gabereiser 3y agoHe used the CEO’s voice to access AN account, I don’t think it was the CEO’s specifically. But just an account, verified by the CEO’s voice, to his.
- jhugo 3y agoI doubt the bank’s authentication system is built to allow the CEO’s voice to authenticate a transfer out of any account…
- detourdog 3y agoAt Schwab my voice is my password. Is how Schwab authenticates me by voice. That demonstrates to me schwab knows they need a voice passphrase that wouldn't be used in passing or without raising suspicion.
- noSyncCloud 3y agoThis comment is very hard to parse, but after reading it, I feel a general sense of relief that I'll never use Schwab.
- detourdog 3y agoAfter over 30 years of perfect service. Schwab has done something so egregious that I’m leaving them. They used to be the best bank I ever used. Finally I’m know that passphrase is tied to my phone number. Its not perfect but it is as good as any other consumer banks system. I don’t recommend Schwab but my accounts are as secure as any.
- larntz 3y agoAt first I thought this was a reference to the movie Sneakers (https://www.youtube.com/watch?v=-zVgWpVXb64 https://www.youtube.com/watch?v=-zVgWpVXb64), but after searching it seems Wells Fargo also does this, https://www.wellsfargo.com/privacy-security/voice-verification/ https://www.wellsfargo.com/privacy-security/voice-verificati....
- detourdog 3y agoI just thought it was an interesting contrast to the bank executive story. Which demonstrated how the passphrase may have evolved and that moving money is done by voice authentication today. Using just ones voice is bad. Using a phrase is better. Using a phrase that is unique and describes its function may set-off alarm bells for some. I never connected the phrase with Sneakers.
- craftkiller 3y agoBank account numbers aren't secret, they're written on the bottom of every check you write. The story lacks the details of how he got his hands on it but its not unreasonable to assume he was able to access such unprotected information.
- randombits0 3y ago[flagged]
- deleted 3y ago[deleted]
- tomjakubowski 3y agoYeah I know, I wondered in the comment whether CEO might have written Mitnick a check
- 77pt77 3y ago> How would he have known the CEO's bank account number? Welcome to the american banking system.
- krab 3y agoThe european bank account numbers are often posted publicly. If you are a VAT payer, you're supposed to check that the account you send money to is registered with the business in the public registry. Otherwise you may be held liable for the receiver's tax fraud. Many companies also show them at their webpage to make it easier to get paid. See e.g. https://www.pre.cz/en/contacts/bank-details/ https://www.pre.cz/en/contacts/bank-details/ The account number should be just an ID, not authentication mechanism.
- oli-g 3y ago> The account number should be just an ID, not authentication mechanism. Right? One of the many things (and I mean this without any hate whatsoever) I simply can't and will never understand about the US. A bank account number is your mailbox for receiving money. How does that country even operate when they build those mailboxes underground?
- sclarisse 3y agoYou send the money to a literal mailbox instead. That’s how. (Using a check, the very infrastructure we’ve been talking about!!)
- thfuran 3y agoBut then you've given out your bank account number, so the secrecy is bunk.
- internetter 3y agoThe US bank security system confuses me. To accept money, I need to give out my routing number and account number. Using those numbers, someone could theoretically withdraw money... Maybe... The whole system is built upon obscurity. Why do some stores need a pin on my debit card, and some do not? Why do online stores need my name and address, but IRL ones do not? How did that one online store charge me without my CVV? How can restaurants swipe my card now and charge me later? I only send and receive money with Google/Apple Pay & PayPal at this point. This flow is reasonable (every transaction is authorised in a trusted location (ie: PayPal). Further transactions are impossible without additional authorization). It boggles my mind that banks & CC companies haven't made some standard for this. Would save them so much money in fraud protection.
- deleted 3y ago[deleted]
- ddkwlfe 3y agoint(phone number) "contained all ten digits" is the main embellishment. KM used different acct#. check delivery was weeks later, after negotiations. either way kevin was OG AF ..|..
- alex-moon 3y agoAll of the stories in his books are like this. An existing seemingly sensible system is used in a creative way to get access. Every time you read one the creative solution is so elegant you just go "Ah, can't believe I didn't think of that" (and then go try it yourself obviously - had lots of fun as a teenager taking down websites/stealing ppl's passwords/etc as a party trick for my friends).
- OJFord 3y agoSeemingly sensible? This one? > the authentication mechanism was reading out your own account number in your voice That's the most suspect part of it to me - even vulnerability to malicious attack like this aside, who would think that's a good idea or going to work well? What percentage of people could successfully use a voice assistant to make a note of their bank account number the first time? Nevermind have it determine that it was indeed their voice not someone else's.
- muzani 3y agoI think something was lost in the retelling. It could just be an era when people didn't figure out biometrics yet. It makes sense today, but caught up in new hype, people often implement cutting edge technology where it doesn't belong.
- emodendroket 3y ago“Your voice is your password” kind of systems are still around.
- muzani 3y agoSure, but usually we have 2FA now. It tends to be what you have (token/documentation), what you know (password), and what you are (voice auth). Often you need one type for basic access (see balance), two for an actual transfer, three for say, transferring a million dollars. This may be something that people like Mitnick proved were necessary.
- 3y ago
- anon_tech 3y agothere is a bank in Italy currently that uses this voice recognition mechanism which with current AI tech is fakeable within 20 min. Nothing much changed since back then I guess
- giamma 3y agoI know a Bank in Italy that uses voice recognition but you also have to provide 2 digits from a "voice password" in addition to the voice match.
- Gordonjcp 3y agoAbout 15 years ago I was using telephone banking, when you had to put in a 4-digit PIN to access banking. I could still hear background call centre noise so I asked the operator if they were still on the phone when I put the PIN in, and he confirmed he was. "Okay, so you heard me type in the PIN? So now you can know my PIN?" "Oh no", he said, "it's just beeps, like this - ", and pressed a few digits. "Right so you typed 1 6 3 2 4, there." "..." "That's what you typed, isn't it?" "Uhm... yes, how did you guess?" "I didn't guess, I could hear the beeps. I've got a reasonable ear for pitch, so I can tell what the numbers are from the tones. Any chance you could escalate this to your manager after the call, and tell them to give me a phone if they've any questions?" They rang me the next day, and I explained the situation to them. Now, at least in the UK, you get transferred away from the call handler when you put your PIN in.
- abledon 3y agoI wonder if the same scenario happened today, where a Kid has an interaction like that with a bank CEO, showing an insane vulnerability... The kid would just be sentenced to jail time and charged as an adult.
- dirtybirdnj 3y agoOr have the Pinkertons sic'd on his home and family. Sup friendlyjordies?
- singlow 3y agoHe did this as an adult while being paid by the bank as security consultant.
- eduction 3y agoHe has the CEO’s number and successfully calls him, and through some miracle gets through directly to ask this trivial question — as opposed to getting the number from the assistant who answers his phone - sure ok but then under what pretense does he then ask him to repeat his phone number? “Please repeat the phone number I just dialed.” The phone number contains all the digits needed to recreate the bank account number? He somehow has the bank account number? He meets the CEO (despite just being a security consultant) and gives his report to the board of directors?! That is not how companies usually work, especially the board part. Check on a silver platter? architect of the voice system is brought into the room with the board to be humiliated? This reads like something a 13 year old would dream up (nothing against OP maybe someone even Mitnik really did claim this happened). The tale is absolutely embellished if it has any truth at all.
- moritonal 3y agoMitnick could have been hired as a advisor for their system, personally by the CEO. He calls the CEO to ask a "personal question" so to skip the assistant, asks something innocent, then let's the CEO he has a new number and provides a fake number. He asks the CEO to confirm he heard the number correctly, but it's a bad line, so speak clearly please. The "new phone number" has all the digits of the bank account he's trying to hack. The account is likely the account number that he's being paid for the consultancy work with. He could have got this simply by asking to confirm from which account he'd be paid from to confirm the transaction. He is asked to report his review of the new security system to the board (given it was a large investment by the Bank, or just the wrong word used) and the architect would of course be invited to his own project's review? The board then asked Mitnick to design a new system and said that cost wouldn't be an issue. That all seems pretty easy to put together?
- mywittyname 3y agoIt's also possible that the CEO knew what Mitnick was getting at and played along to a degree. Kind of like when your company has a security presentation about this new "report phishing button" in your email and you suddenly see this weird phishing-like email come through a few hours later. Hopefully you connect the dots.
- sbilstein 3y agoAs a kid I ate this stuff up. In the eighth grade, I defaced my middle school website. The IT person easily figured out it was me and then tricked me into thinking I would be expelled within days. She pulled me out of class, told me such in the hallway, let me return to class where I held in tears until the end of the day. Nothing happened and the school year ended a few weeks later. Towards the end of the summer I realized it had been a bluff and I wouldn’t be punished. Took me a few years later to realize how much of a favor that all was! The county school of conduct clearly said cybercrime was punishable by expulsion so she could have absolutely put me in some kind of hell. The fear set me straight hah.
- ntietz 3y agoI had a similar thing happen. I distributed some malware I wrote on the shared drive and had some people run it (it was extremely basic, just locked people out of the computer with no recovery by taking advantage of how locked down they were; but people lost a lot of work). My programming teacher, who was already dealing with me being a distraction in class, went to bat for me so I didn’t get strongly punished but made me clean it off the drive continuously; other students kept putting it back, so I had to monitor for it.
- busyant 3y ago> The IT person easily figured out it was me and then tricked me into thinking I would be expelled within days. Similar. I wrote a program to emulate a the logon text on a PDP-11 terminal in high-school in the mid-80s and steal a bunch of student passwords. Didn't do anything with them. They were like "trophies." Nevertheless, the computer teacher found out and had mercy on me. He gave me a project to work on to help him compile stats on a student survey. He was a nice guy. edit for clarity.
- neotek 3y agoI did the same thing, only my program pretended to be a DOS-based Novell Netware login screen. It was just a simple QBASIC program (that's all that was available on the Computer Room machines) running under my own login, which would write usernames and passwords to a text file in my user directory. I figured that I'd harvest a few passwords until someone got frustrated enough to call for the IT admin, at which point he would try to log in and reboot the PC when it failed, apparently "fixing" the problem and erasing any evidence of my dastardly crime. I was right, and for a few glorious days I got away with it... until one particular arsehole picked on my best friend during recess, and I used his stolen credentials to log into his account and trash his files. Long story short, I ended up getting expelled, which by a curious confluence of events put me on an unorthodox path that completely changed my life. Funny how things turn out.
- deleted 3y ago[deleted]
- steviedotboston 3y ago> Mitnick was a hacker hero of mine in my youth. I think I’ve understood his role as jester prior to conviction less as I’ve grown older, but there’s something about the boyhood charm of being so divorced from the potential consequences of one’s actions that is almost unique. Yeah, I remember watching "Freedom Downtime" as a teenager and thinking how ludicrous it was that he was sentenced to prison for computer hacking, but now that I think about it as an adult of course he should have been. Sure solitary confinment, the specifics of his sentence, etc. may have been extreme and I'd like to think that the court system has progressed in their knowledge of computer security since then, but what he did was still a breach of corporate security. He knew at the time it was illegal, and he just thought he was too smart to get caught. That idea that we had at the time that it was a "victimless crime" or something was very immature.