Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

thedrive.com

Post reply on HN
Print view View original

131–140 of 173 posts

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#131

Post by antonymoose »

mcfunley wrote: post #52
bawolff wrote: post #51

Earlier quoted context omitted.

Isn't he famous for social engineering/physical security type things? If you hire an expert in X, you are probably going to get X.

Yeah I agree, caveat emptor and all that. The blameful framing is bad work product though.

How did he go about it? Giving a manager a report saying Foo and Bar are suck at security gives the manager good information on who needs training.

If he walked into a conference room and called them out by name, that would be a touch abrasive.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#133

Post by scratcheee »

quantummagic wrote: post #96
garbagewoman wrote: post #84

Earlier quoted context omitted.

Assigning individual blame is missing the point of improving the security culture in general

Do you hold that same opinion for the training and testing of pilots and surgeons? Do you want to step on a plane with a pilot who is only there because we are too nice to assign individual blame for his inability to do the job properly? Do you want to be going into open heart surgery in a system that dismisses the idea of individual blame when analyzing the outcomes associated with each surgeon? Having no idea if th…

You’re both imagining different scenarios.

Scenario 1: 20% of staff tested failed. Individual targeting is pointless because the issue is systemic. This has happened in aviation, it’s common for accident investigators to conclude that the entire company culture (or even the entire industry) has failed to handle a problem. They don’t waste time in cases like this pointing at individuals.

Scenario 2: you test very regularly and nobody fails the tests. Except Bob, he fails the tests. In this scenario, your threat analysis document will recommend retraining, firing, or restricting Bob specifically.

Scenario 2 almost never happens because nobody has data that good. If your sampling frequency or ability to conduct tests are limited, no specific sample is enough to cover the entire problem. If you focus on a punishing (or just re-educating) the 20% who failed then your next test will fail for (potentially) 20% of the 80% who weren’t retrained, and thus didn’t learn anything.

TLDR: you need to choose the approach based on the situation, but we collectively tend to treat security poorly enough that we’re almost never in the fortunate situation where scenario 2 fits.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#134

Post by simg »

alex1138 wrote: post #28
ww520 wrote: post #16

I read the book by Tsutomu Shimomura, who caught Mitnick's hacking and tracked him down. It's a fascinating read. He was able to locate Mitnick in physical world based on his online activities and his cellular phone usage. In those early days, few people understood the cyber landscape and cellular technologies to exploit them.

Yes but AFAIUI Mitnick was upset Shimomura had the full weight of the police on his side, right? He used techniques that shouldn't have been available to him Interesting fact about Shimomura, he was a student of Feynman's

>used techniques that shouldn't have been available to him

odd for a hacker to take that attitude ...

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#135

Post by RetroTechie »

What I don't see mentioned here:

It's entirely possible to be on opposite sides of the fence, hate the other party's actions, but still respect (or even like) them on a personal level. Imagine yourself in their shoes & dial it up to 11.

[insert favorite movie scene here]

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#136

Post by HaphazardGuess »

ww520 wrote: post #16

I read the book by Tsutomu Shimomura, who caught Mitnick's hacking and tracked him down. It's a fascinating read. He was able to locate Mitnick in physical world based on his online activities and his cellular phone usage. In those early days, few people understood the cyber landscape and cellular technologies to exploit them.

to add to this:

I highly recommend this Youtube video....its 4 hours long but it is pretty amazing!

Takedown Evidence: Kevin Mitnick's "sessions" (Complete Transcripts) https://www.youtube.com/watch?v=r5EGMYsr6uY

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#137

Post by kgwxd »

nkrisc wrote: post #125
dmos62 wrote: post #87

Earlier quoted context omitted.

That's because susceptibility to attacks is a question of training. What would the goal of placing individual blame be? Shame? Drive them to seek training outside work? Further, if you periodically single out people, the organization will hate you.

You can discuss peoples’ own failures with them politely and professionally. To avoid and talk around the issue is political, not professional.

If i was a security consultant, id make it part of the contract that i will not name names unless legally required.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#138

Post by kgwxd »

vasco wrote: post #88
dmos62 wrote: post #87

Earlier quoted context omitted.

That's because susceptibility to attacks is a question of training. What would the goal of placing individual blame be? Shame? Drive them to seek training outside work? Further, if you periodically single out people, the organization will hate you.

Shame works for me. If I was ever the one that got sniped and my colleagues saw it I'd forever be paranoid about it. Like when my dad sat me down and told me that I couldn't keep losing hats all the time when I was a kid and that I wasn't a baby anymore and it was expensive, and that shame made me look behind me when I leave somewhere until today and stop losing stuff. Specially for security, yes, shame the personal…

Shame isn't wrong, shaming is. Your dad telling the truth isn't shaming. You just felt shame because you're a decent person that is embarrassed you were causing problems for other people.

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#139

Post by alfiedotwtf »

leetrout wrote: post #24
mcfunley wrote: post #6

I worked at a company that had hired Mitnick as a security consultant. His report for a client that turned out to have been rife with SQL injection at the time was largely movie plot physical security stuff. Not wrong exactly, but not the center mass of the threat model they needed either. He seemed to lack systems thinking, producing a report that focused on calling out specific employees as dumb or incompetent. Cou…

Dude I was called out by name in the report either right before you got there or the first one you were there. I was called out in the one where they got B's Audi keys in his office. Whole thing was so dumb. A floor full of smart monitors that they could have put a keylogger on. A plethora of physical network access and I get called out for leaving my laptop on the lock screen and going downstairs for food. And they…

He also took MG’s O.MG usb cable and got it manufactured and sold from under him.

All that “Free Mitnick” support from the early 2000s he got must have gone to his head, or he was just a dick all along

Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison

#140

Post by leetrout »

sersi wrote: post #83
leetrout wrote: post #24

Earlier quoted context omitted.

Dude I was called out by name in the report either right before you got there or the first one you were there. I was called out in the one where they got B's Audi keys in his office. Whole thing was so dumb. A floor full of smart monitors that they could have put a keylogger on. A plethora of physical network access and I get called out for leaving my laptop on the lock screen and going downstairs for food. And they…

How would they have been able to install a hijacked Chrome if your computer was on the lock screen?

Mac's had several vulnerabilities during that time including the ability to log in from lock screen with the user "root" with no password. There was also a vulnerability with executing a rubber ducky even with file vault. It was almost 10 years ago so I don't remember the specifics but the point was they had physical access to the building so they could do anything.

People walked to conference rooms and to get food without taking their laptop with them all the time (of course) so it's not like I did something out of the ordinary or against policy. I remember them accusing me of leaving my laptop over night but I was just working late.

And this was in a secure area with cameras within earshot of the over night crew and behind a door in a private shared office (glass door, glass wall so someone could have seen them) so it's not like I was at a common area and just walked out leaving my laptop on a random table).

Post reply on HN