10 ms·
Kevin Mitnik FOIA Final
- thembones 2y ago[flagged]
- 867-5309 2y agomuch appreciated
- LorenDB 2y agoThis will pair well with Mitnick's autobiography Ghost in the Wires, in which you get to read Mitnick's side of the story.
- fabiensanglard 2y agoIf you are into this topic, read as many point of view as possible and take a look at http://www.takedown.com/ http://www.takedown.com/ (Tsutomu Shimomura's side of the story).
- daghamm 2y agoI've far more respect for Tsutomu. In the end he turned out to be the better hacker. Reading Mitnicks book I sometimes get the impression that the he is making up half of it.
- sidewndr46 2y agoHe's also on the winning side, so I imagine it'd be in his best interest to make himself look better.
- tptacek 2y agoTo the best of my knowledge, Mitnick didn't really code at all. There are (let's call them) intrusion specialists whose skillsets don't really involve systems programming, but rather intuition and tenacity, and there are others who write exploits. My understanding is that Mitnick was the former, and was using tools he got from friends and peers.
- vasco 2y agoIn the book he spends a lot of time on the social engineering parts of it to be honest. It's been a few years but I remember him mostly bragging about that rather than developing custom exploits.
- tptacek 2y agoHe also comes from an era of intrusions where systems were so bad you didn't really need to code to get into them. For an alarmingly long time, the most effective tool you could use to pop a network was simply `showmount`.
- ASalazarMX 2y agoThat time is still today, as people are still the weakest link. A talented scammer can convince people to give them access to their WhatsApp account despite the E2EE, 2FA, and SMS verification codes. In Mitnik's version, he RTFMs, learned the technical lingo, procedures, and even the names of telco employees.
- devmor 2y ago100% The majority of corporate breaches are a combination of poor Least Privilege practices and phishing/smishing. Even with well secured, alert personnel, you often see ISPs and Telcos socially engineered to gain access to an employee account.
- d1sxeyes 2y agoYeah I think Mitnik’s abilities were mostly around thinking about doing stuff that no-one had considered that you could do. It’s still a big skill, but nowadays, there’s less stuff that no-one has thought about before.
- jasonfarnon 2y agothe steve jobs of hacking
- 2y ago
- indrora 2y agoAnyone who has studied the later parts of the phone system know that at least a few of his stories are actually bullshit. It wouldn't be until much later (in the 90s at least, while he was in prison) that the advent of pure digital switching would enable the random reassignment of phone lines like he describes in the story about turning his friend's home phone into a payphone. The lines were separated and had differences in sender frames just for payphones, plus typical phones weren't too happy when 130VDC was applied to them for very long. The fact of the matter is that Mitnick went around and shook doorhandles until something opened and occasionally convinced someone to open a door for him her and there, and the fact that the emperor had no clothes was too politically inconvenient for the kinds of companies that Mitnick hit up.
- kevin_thibedeau 2y agoThe 4ESS was a pure digital switch starting in 1976.
- quesera 2y agoMedium-sized US exchanges were being converted to ESS in the 1980s. I remember the day my busy signal changed from a buzz (350+440 Hz) to a tone (480+620 Hz).
- jamal-kumar 2y agoAfter hearing his voice messages in a fake asian voice trying to mess with Shimomura, I kinda lost all respect for Mitnick.
- MG9991ep545a1l3 2y agoKevin hasn’t hacked anything at all. He ran with a few other characters who never received anywhere near the amount of attention that Mitnick did. For example, no one ever figured out who “jsz” was.
- tptacek 2y agoI think pretty much everyone in that scene knows.
- jazz9k 2y agoI heard him on Art Bell multiple times talking about it. I many cases, someone else did the ground work and he just used it.
- 29athrowaway 2y agoJohn Markoff was the one that made everything up. Freedom Downtime is a documentary that explains it.
- freedomben 2y agoGhost in the Wires[1] is a really phenomenal and entertaining book btw. If you go audiobook, Ray Porter does the narration and absolutely crushes it. [1] Available DRM-free at Downpour (https://www.downpour.com/ghost-in-the-wires?sp=19991 https://www.downpour.com/ghost-in-the-wires?sp=19991) and at Libro.fm (https://libro.fm/audiobooks/9781483067216-ghost-in-the-wires https://libro.fm/audiobooks/9781483067216-ghost-in-the-wires)
- daft_pink 2y agoDo they have a processing step where they add in random dots everywhere?
- gwbas1c 2y agoIt's called noise. It's clearly typewritten text scanned at black and white.
- kobieps 2y agoSheesh now I feel old
- NikolaNovak 2y agoI get a dismissable dialogue box upon viewing the document, explaining the context and quality (i.e. scanning noise), including fairly explicit: "The image quality contained within this site is subject to the condition of the original documents and original scanning efforts." Hope that helps! :)
- sunjester 2y ago[flagged]
- Helithumper 2y agoSurprised that personal info such as Kevin’s SSN wasn’t removed prior to release.
- joering2 2y agoSteve's Job SSN is 549-94-3295. How can this release harm a dead person?
- spydum 2y agoDidn't you read Elon's post? SSNs database isn't deduplicated!
- cyberax 2y agoThat's because there are SSNs shared by multiple people.
- tormeh 2y agoWhat? That sounds less than ideal.
- caspper69 2y agoIt usually wasn't intentional: https://www.ssa.gov/history/ssn/misused.html https://www.ssa.gov/history/ssn/misused.html The system still has to disambiguate and support the prospect of it happening though.
- blindriver 2y agohttps://www.credit.com/blog/the-most-misused-social-security-number-100564/ https://www.credit.com/blog/the-most-misused-social-security...
- jfengel 2y agoHim, probably not. His estate, however, potentially. Perhaps one could get a loan, using his SSN, and his estate gets the bill and subsequent harassment. SSNs make terrible secrets and it's insane that you could harm a live person by knowing their SSN. I doubt that insanity stops just because you're dead.
- jonstewart 2y agos/Mitnik/Mitnick/
- rglover 2y agoIt should be illegal for the government to keep redactions in anything made public/declassified. It's a slap in the face to see entire sections of text (that most certainly contain important context) blocked out with a white blob.
- toast0 2y agoIf that were the requirement, documents would not be made public/declassified unless the entire document was considered safe to release. In many cases, a partial public document is better than no public document.
- taurknaut 2y agoA) a lot of what is censored ends up being publicly-known information already, so it's not a matter of safety but rather public image (imo), and B) this creates a perverse incentive to associate national security (...or other sources of unsafety) with unrelated topics to avoid having to hold yourself accountable for your work. Plus, there's little way of knowing for the documents for which we haven't seen the uncensored version if they aren't just censoring arbitrary things. It may be reality, but it's still pretty bad for any government that pretends to value transparency.
- timewizard 2y agoThe people who generate the documents /cannot/ be the people who decide if they're safe to release. There needs to be independent oversight. These are not agency documents they belong to the public. They may be classified but the moment they're no longer _objectively_ worth classifying they are absolutely public domain material. It's also extremely offensive to see the names of AUSA's (Assistant US Attourneys) and SA's (FBI Special Agents) redacted. They had personal involvement in this case so I genuinely don't understand why their names cannot or should not be a part of this document. They're public figures in a public role.
- dkga 2y agoI completely disagree. In this case, it is clear there wouldn‘t be a reprisal but in many case law enforcement agents and prosecution teams get involved in might involve serious reprisal threat for them or their loved ones. Their names should never be revealed.
- jamal-kumar 2y agoThis is pretty damn interesting, it's definitely the earliest example of a computer intrusion incident response report that I've ever seen. These reports detail stuff he was doing in 1980/1981 at the earliest I can see just skimming the top few pages. His own side of this particular chapter of his history is maybe worth a read, maybe not - he was known for embellishments: https://web.archive.org/web/20090317050834/http://www.thememoryhole.org/lit/deception-ch1.htm https://web.archive.org/web/20090317050834/http://www.themem...
- taylorbuley 2y agoThe password to the system was "BRIS," the name of the vendor.
- TimC123456 2y agoI laughed when I read that, too. Like locking up that “$2MM dollars of information” in a vault secured with a piece of string.
- mrsburis 2y ago[flagged]
- mrsburis 2y ago[flagged]
- toomuchtodo 2y agohttps://web.archive.org/web/20250206232604/https://vault.fbi.gov/kevin-mitnick/kevin-mitnick-part-01-final/at_download/file https://web.archive.org/web/20250206232604/https://vault.fbi...
- CodeWriter23 2y ago1981? Security mostly was knowing which phone number to dial in, according to a deceased friend of mine.
- SJC_Hacker 2y agoI guess thats why Matthew Broderick's character had a script which dialed random numbers in a target area code (I think he used Sunnyvale, CA in the movie) I wonder if anyone did that back in the day. Not sure how much the telco would have appreciated it ...
- CodeWriter23 2y agoNever used an auto-dialer myself, but it would be trivial to code one. Just send ATDT<number> out the serial port and see if "CONNECT" comes back before timing out. Back in that time, I think a good rate was $0.01/minute for a local call on a consumer landline. Unlimited calling plans came later. Not attributing any intent to the telco, just saying, there would be no cost issue to motivate an investigation.
- SJC_Hacker 2y agoIt definitely wasn't local - he was in Washington but dialed into Sunnyvale, CA. I can't remember charges for local exchanges (same area code), but I only remember as far back as the late 80s. It was something like 10 cents a minute. I remember all the adds about "friends and family" special rates/etc. Metering on voice calls persisted into the 2000s. But the calls were very brief (if they did pick up) unless he got a "hit". So thousands of calls could have no charge Or maybe he spliced into his neighbors line :-)
- 486sx33 2y agoI think a lot of this was social engineering, but at one time the fbi considered mitnik some kind of super hacker. How did that disconnect happen? I imagine because his targets didn’t want to admit to the fbi how crappy their security was, so they would just say omg! We got hacked! Big moments I remember from his book. 1. Gaining access to a telco C/O and social engineering his way out after being caught 2. Ultimately being caught by sloppy practices himself, logging into systems he was comfortable with and getting traced, and then forgetting some sort of identification in a ski jacket he hadn’t used in a long time, which was in his closet in a place he was living under a new identity. It’s been awhile so I could be partly off on those details. But I’d say at least those pieces are very believable.
- Peacefulz 2y agoI have read Ghost in the Wires many times. I'm excited to see the other side of the tale. Thanks for sharing!