Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

thedrive.com

Post reply on HN
Print view View original

121–130 of 173 posts

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#121

Post by wjnc »

NonHyloMorph wrote: post #94
vasco wrote: post #88

Earlier quoted context omitted.

Shame works for me. If I was ever the one that got sniped and my colleagues saw it I'd forever be paranoid about it. Like when my dad sat me down and told me that I couldn't keep losing hats all the time when I was a kid and that I wasn't a baby anymore and it was expensive, and that shame made me look behind me when I leave somewhere until today and stop losing stuff. Specially for security, yes, shame the personal…

"shame them in a positive way" Oh my. That's some HR type viciousness right here. (⌒▽⌒)

(Won’t fully repeat my other post.) Shame is such a big word. ‘Give people the chance to _teach_’ would be my reply. Which you probably would see as even more vicious, but it’s 100% sincere.

As a junior I made the front page of national news. I answered a question with a very big number on a Friday afternoon. Hit headlines on Saturday. Our prime minister had to defend my mistake in public. (He never admitted any mistake. With just enough spin nothing sticks.)

The head of the organization literally cursed and spat at me. In that same meeting from the no. 2 down they stood up for me. It’s still a great story about how to treat mistakes 20+ yrs on. Admit mistakes. What did __we__ (not: he) do wrong? (Hint: from medior to board everyone had an afternoon off and we had never discussed stakeholder management. I was in no position to say no to a ministerial request.)

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#122

Post by speedgoose »

simg wrote: post #101
sersi wrote: post #83

Earlier quoted context omitted.

How would they have been able to install a hijacked Chrome if your computer was on the lock screen?

perhaps, back in the day, when windows machines would automatically run autorun.inf if present on a cd or usb drive regardless of whether the machine was locked or not.

Little Snitch is Mac software though.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#123

Post by dmos62 »

wjnc wrote: post #116
dmos62 wrote: post #87

Earlier quoted context omitted.

That's because susceptibility to attacks is a question of training. What would the goal of placing individual blame be? Shame? Drive them to seek training outside work? Further, if you periodically single out people, the organization will hate you.

“Shame” is a big word. I wouldn’t shame a member of my team. Why would I!? They are great people. Same with “blame”. Everyone faults, everyone can be blamed something. That doesn’t change the basics of a person. Giving people a chance to discuss, as adults and professionals, how they got sniped beats any second hand training and experience by miles. Now we get to hear that x% of a sample failed including #y elevated…

Selective training makes sense. But, I heard a pentest professional provide this counter-argument: if you tell management which individuals failed the test, even if your intention is to provide those people with the training they lack, the management might, due to ignorance, shift blame for suboptimal security on those people, label them as lazy/incompetent/etc, and ultimately not put the necessary processes (testing, training) in place which are the true determinants of penetration rates. The idea is that you get inefficiency by selecting for training broadly, but you prevent extreme sabotage by ignorant management.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#124

Post by bonesss »

alex1138 wrote: post #29
jagged-chisel wrote: post #17

Earlier quoted context omitted.

Maybe I'm mistaken, but that sounds more like Chuck Norris. Wait ... no fists involved. My mistake.

It's in his (Mitnick's) autobiography Ghost in the Wires. In his telling of the story they put him in a more restrictive environment exactly because of the reason given (launching nukes by whistling into a phone)

At the time people were using whistles to make free long distance calls, so I can understand where they were coming from.

The part I can't understand is believing that phone-whistles are connected to our nuclear launch system and not simultaneously trying to put nuclear missile operators in jail for incompetence.

"Oh the world might end with some whistling? Definitely punish the whistlers, that's where the problem is..."

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#125

Post by nkrisc »

dmos62 wrote: post #87
wjnc wrote: post #80

Earlier quoted context omitted.

Yeah, this is a part about itsec I don’t understand in my firm. They run social engineering tests, but never notify management when individuals fail, only in general terms. While being psyopped needs to be activelly discussed among coworkers imho.

That's because susceptibility to attacks is a question of training. What would the goal of placing individual blame be? Shame? Drive them to seek training outside work? Further, if you periodically single out people, the organization will hate you.

You can discuss peoples’ own failures with them politely and professionally. To avoid and talk around the issue is political, not professional.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#126

Post by mesrik »

aculver wrote: post #60

Since we're talking about Kevin Mitnick on Hacker News, I have to mention: I recently re-read "Cyberpunk: Outlaws and Hackers on the Computer Frontier". It was published in 1991 and the first third of the book provides an early contemporary account of Kevin Mitnick. It's a great book that I first read in my high school library in the 90s and it completely captured my imagination. However, I had never connected the do…

Agreed what you wrote. It's great and well written book. I did read the book again last fall after couple decades.

Then few weeks after finishing book I ran into his LinkedIn post (bit OT sure) if what book told was his recollection still accurate in part where book refers his work at DEC Systems Research Center (SRC) at the time. Following is what he replied to me:

" markoff and hafner did extensive research and the book is accurate in all ways i could know. note that while mitnick has paid his debt to society (jail time), i've never received from him an apologia. my only other written mention of those breakins was here:

https://www.linkedin.com/pulse/burdens-blame-paul-vixie/ "

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#127

Post by moron4hire »

dmos62 wrote: post #115
dmos62 wrote: post #87

Earlier quoted context omitted.

That's because susceptibility to attacks is a question of training. What would the goal of placing individual blame be? Shame? Drive them to seek training outside work? Further, if you periodically single out people, the organization will hate you.

I am surprised how controversial this is. I feel like I'm in that episode of Always Sunny in Philadeplhia where they decide to do an intervention by cornering and berating, while a mental health professional looks on terrified.

Yeah, it's some bullshit 90s-era basement-dwelling "techie" attitude that even Linus Torvalds said he doesn't want to do anymore almost 10 years ago by now.

As someone who has been training and mentoring and managing people for over 25 years: shame is useless as a tool. There's no "you gotta have thick skin" in people management. That attitude is just covering for the deficiencies of the manager. Most people's natural reaction to shame is to shut down and either slink away or become vindictive. You don't get the right corrective behavior out of using shame.

One's employment of shame as a corrective technique also has a wide blast area. When one singles out and criticizes people in public, the people who aren't being criticized still see it and form new, negative opinions of the criticizer. You undermine your own authority as The Boss when you do that.

Truly being "results focused" means studying actual management theory, negotiation techniques, coaching techniques, and conflict management. Praise in public, criticize in private. Always. And when you do have to criticize, keep the emotion out of it and stick to just the facts.

I have two employees I've had to put on PIPs right now. One of them is actually improving. The other one is a habitual liar, for whatever reason HR won't let me fire him outright, but even him I won't break my rules for, regardless of how angry he has made me, because the rest of my team will see it. During the meeting where I informed them I would be formalizing the process, they were not surprised and agreed that it made sense, because I had done the work before then to establish expectations and work with them to try to improve. There's are also people in the past whom I have fired who have messaged me on LinkedIn, thanking me for being kind to them during the process, because it was what they needed to turn their lives around.

You can tell people they aren't meeting expectations. You can put people on official notice. You can fire people. And you can do all of those things in ways that preserve their dignity. And in that mode, you can get mediocre employees to be good, good employees to be great, and great employees to stay. Or you can treat people like shit and constantly have to go back to the recruiting well. I'm sorry, but I'm far too busy to be constantly interviewing and onboarding new people.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#128

Post by bootload »

mcfunley wrote: post #6

I worked at a company that had hired Mitnick as a security consultant. His report for a client that turned out to have been rife with SQL injection at the time was largely movie plot physical security stuff. Not wrong exactly, but not the center mass of the threat model they needed either. He seemed to lack systems thinking, producing a report that focused on calling out specific employees as dumb or incompetent. Cou…

“He seemed to lack systems thinking, producing a report that focused on calling out specific employees as dumb or incompetent.”

VS

2002 “Companies spend millions of dollars on firewalls, encryption, and secure access devices and it's money wasted because none of these measures address the weakest link in the security chain: the people who use, administer, operate and account for computer systems that contain protected information.” — Kevin Mitnik

“Amateurs hack systems, professionals hack people.” — Bruce Schneier

source https://archive.md/LiQN4> / (paywall) https://economist.com/special-report/2002/10/26/the-weakest-...>

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#129

Post by abanana »

nunley wrote: post #55
Barrin92 wrote: post #39

Earlier quoted context omitted.

>But those who say he had no talent are just ignorant. I don't think anyone says he had no talent, what rubs people the wrong way is that the thing he had talent for is the same thing that the people have who try to scam call your grandmother out of her pension money. You can be the world's greatest burglar, you're still a burglar. The whole cringy "social engineering" thing turned media persona and consulting busine…

That's just nonsense. First of all, social engineering was a small part of his work, and it's OK that you don't know that. But your totally blatant ignorance of what his career covered is exactly what I'm talking about. Look, I know that people form their opinions in a bubble. All I am saying here is you should expand your bubble. You know nothing about Kev. Again, that's OK, but it also means you should try to under…

> social engineering was a small part of his work, and it's OK that you don't know that... totally blatant ignorance... Kev was a good person. Full stop.

I understand you're defending your friend, but that's a little uncalled for. Personally, my first real knowledge of him was from his 2002 book The Art Of Deception, which is specifically a book about social engineering. That is how he himself chose to present himself - as a successful social engineer - so you can't criticise others for that.

There's good and bad in all of us. I don't think the person you responded to said Kevin was all bad, and made it clear it isn't hate.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#130

Post by RetroTechie »

sersi wrote: post #83
leetrout wrote: post #24

Earlier quoted context omitted.

Dude I was called out by name in the report either right before you got there or the first one you were there. I was called out in the one where they got B's Audi keys in his office. Whole thing was so dumb. A floor full of smart monitors that they could have put a keylogger on. A plethora of physical network access and I get called out for leaving my laptop on the lock screen and going downstairs for food. And they…

How would they have been able to install a hijacked Chrome if your computer was on the lock screen?

There's often ways around things. Back in the day I worked in a callcenter. You'd screen-lock & take a short break.

Screen-lock itself required a password. But lo & behold, if you'd pick up the headset & hit a button "accept call" (usually meaning you're back in action), screen would be unlocked.

Convenience (read: profit) trumps security every time.

Post reply on HN