Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

thedrive.com

Post reply on HN
Print view View original

81–90 of 173 posts

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#81

Post by NitpickLawyer »

nunley wrote: post #32

I'm going to defend Kevin here because I see a lot of comments from people I am sure have no valid reason to be hating on him. Kevin was particularly annoying because he never failed to penetrate a target. The reason that's annoying is it just takes one slip, one weak point, one inattentive admin and it's over. People will stay mad about that. I get it. But those who say he had no talent are just ignorant. His goal w…

> I am sure have no valid reason to be hating on him.

TBF that's likely a symptom of social media and people commenting on things they don't know about with a bit too much confidence. You can see similar takes on snowden today.

Back in the day (90s, 00s) he was both widely supported and a bit of a myth in the early Internet communities.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#82

Post by alex1138 »

foobarbecue wrote: post #57
appden wrote: post #56

Ghost in the Wires is one of all time favorite reads, and I still hope to see it as a dramatized film. It would be a fun “period piece” taking the audience through the 80’s and early 90’s, with some hilarious social engineering scenes (kinda like Catch Me If You Can) and tense moments where the audience roots for Kevin. I really think a film adaptation would help introduce his story to a new generation and be a nice…

Except actually real whereas Frank Abagnale fabricated all of his supposed cons (read The Greatest Hoax).

Kevin Mitnick, substitute teacher

Kevin Mitnick, airline pilot. What's a deadhead?

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#83

Post by sersi »

leetrout wrote: post #24
mcfunley wrote: post #6

I worked at a company that had hired Mitnick as a security consultant. His report for a client that turned out to have been rife with SQL injection at the time was largely movie plot physical security stuff. Not wrong exactly, but not the center mass of the threat model they needed either. He seemed to lack systems thinking, producing a report that focused on calling out specific employees as dumb or incompetent. Cou…

Dude I was called out by name in the report either right before you got there or the first one you were there. I was called out in the one where they got B's Audi keys in his office. Whole thing was so dumb. A floor full of smart monitors that they could have put a keylogger on. A plethora of physical network access and I get called out for leaving my laptop on the lock screen and going downstairs for food. And they…

How would they have been able to install a hijacked Chrome if your computer was on the lock screen?

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#84

Post by garbagewoman »

wjnc wrote: post #80
skeaker wrote: post #25

Earlier quoted context omitted.

In all fairness, a genuine attacker WILL be abrasive and abusive. They WILL single out employees that are gullible and exploit them. It's not pretty because a genuine attack is not pretty. Of course a simulated attack will be indecent and discourteous in nature, that is how attacks are.

Yeah, this is a part about itsec I don’t understand in my firm. They run social engineering tests, but never notify management when individuals fail, only in general terms. While being psyopped needs to be activelly discussed among coworkers imho.

Assigning individual blame is missing the point of improving the security culture in general

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#85

Post by hypfer »

garbagewoman wrote: post #84
wjnc wrote: post #80

Earlier quoted context omitted.

Yeah, this is a part about itsec I don’t understand in my firm. They run social engineering tests, but never notify management when individuals fail, only in general terms. While being psyopped needs to be activelly discussed among coworkers imho.

Assigning individual blame is missing the point of improving the security culture in general

Yes and no.

Yes in general, because usually it's culture and not an individual failing. No in specific situations, because it's not just culture but also some people are just the weakest link.

Only focusing on either of these while ignoring the other is going to lead to bad results.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#86

Post by user_of_the_wek »

firefax wrote: post #26
colechristensen wrote: post #22

Earlier quoted context omitted.

He got all of the "Free Kevin" attention because of how long he was left in jail before trial and then being stuck in solitary confinement after sentencing for months. If he had been treated fairly by the justice system he wouldn't have gotten nearly as much attention. He was also autistic, a lot of the behavior can be explained through that lens.

>He got all of the "Free Kevin" attention because of how long he was left in jail before trial and then being stuck in solitary confinement after sentencing for months. That was uncalled for on the part of DOJ. >He was also autistic, a lot of the behavior can be explained through that lens. I'm autistic. Maybe I should go commit a bunch of felonies to increase my chances of a good job and stature in the hacker commun…

Vienna waits for you

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#87

Post by dmos62 »

wjnc wrote: post #80
skeaker wrote: post #25

Earlier quoted context omitted.

In all fairness, a genuine attacker WILL be abrasive and abusive. They WILL single out employees that are gullible and exploit them. It's not pretty because a genuine attack is not pretty. Of course a simulated attack will be indecent and discourteous in nature, that is how attacks are.

Yeah, this is a part about itsec I don’t understand in my firm. They run social engineering tests, but never notify management when individuals fail, only in general terms. While being psyopped needs to be activelly discussed among coworkers imho.

That's because susceptibility to attacks is a question of training. What would the goal of placing individual blame be? Shame? Drive them to seek training outside work? Further, if you periodically single out people, the organization will hate you.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#88

Post by vasco »

dmos62 wrote: post #87
wjnc wrote: post #80

Earlier quoted context omitted.

Yeah, this is a part about itsec I don’t understand in my firm. They run social engineering tests, but never notify management when individuals fail, only in general terms. While being psyopped needs to be activelly discussed among coworkers imho.

That's because susceptibility to attacks is a question of training. What would the goal of placing individual blame be? Shame? Drive them to seek training outside work? Further, if you periodically single out people, the organization will hate you.

Shame works for me. If I was ever the one that got sniped and my colleagues saw it I'd forever be paranoid about it. Like when my dad sat me down and told me that I couldn't keep losing hats all the time when I was a kid and that I wasn't a baby anymore and it was expensive, and that shame made me look behind me when I leave somewhere until today and stop losing stuff.

Specially for security, yes, shame the personal in a small setting, shame them in a positive way, as in lets all learn from this, but shame is very powerful. Much more powerful than saying "someone in this team failed this" and everyone thinks it was the other guy.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#89

Post by vasco »

teo_zero wrote: post #78
rixed wrote: post #77

Earlier quoted context omitted.

Isn't he famous for getting caught?

Getting caught didn't make him a superstar. Telling his techniques in books and public speeches did.

That's not true, he was already famous during his trial which made him well known before any books or public speeches.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#90

Post by hypfer »

vasco wrote: post #88
dmos62 wrote: post #87

Earlier quoted context omitted.

That's because susceptibility to attacks is a question of training. What would the goal of placing individual blame be? Shame? Drive them to seek training outside work? Further, if you periodically single out people, the organization will hate you.

Shame works for me. If I was ever the one that got sniped and my colleagues saw it I'd forever be paranoid about it. Like when my dad sat me down and told me that I couldn't keep losing hats all the time when I was a kid and that I wasn't a baby anymore and it was expensive, and that shame made me look behind me when I leave somewhere until today and stop losing stuff. Specially for security, yes, shame the personal…

I think people saw that old culture and thought "man, that's horrible. We must never do that". And the assessment was right, but also wrong.

Previously, shame (and other pressure) was just applied without first empathically inspecting why the node was acting in the way it did, thinking that just enough force will surely solve the problem. It kinda did, but with lots of collateral.

Essentially, the security consultants (and everyone else involved) were just being lazy and not doing their job correctly.

But now we have this overcorrection, because people are still lazy and do not want to do their job correctly, which leads to the systems failing in a different way.

___

The solution would be to understand the individual node and apply the correct corrective measure. This can be shame, but it might also not be. And the level of it is also highly dependent on the situation.

This is a hard problem to solve, but it needs to be solved for good results.

The problem here being that scaling that up is hard, but everything needed to hyperscale. With either the individual nodes or the system integrity picking up the slack.

Post reply on HN