When I wad 13 I printed out “FREE KEVIN” stickers and stuck them all over the locker room of my school. …kind of a weird thing to do in Australia back then.
Kevin Mitnick has died
481–490 of 666 posts
Re: Kevin Mitnick has died
#482Earlier quoted context omitted.
The european bank account numbers are often posted publicly. If you are a VAT payer, you're supposed to check that the account you send money to is registered with the business in the public registry. Otherwise you may be held liable for the receiver's tax fraud. Many companies also show them at their webpage to make it easier to get paid. See e.g. https://www.pre.cz/en/contacts/bank-details/ The account number shoul…
> The account number should be just an ID, not authentication mechanism. Right? One of the many things (and I mean this without any hate whatsoever) I simply can't and will never understand about the US. A bank account number is your mailbox for receiving money. How does that country even operate when they build those mailboxes underground?
[deleted]
Re: Kevin Mitnick has died
#483Mitnick was a hacker hero of mine in my youth. I think I’ve understood his role as jester prior to conviction less as I’ve grown older, but there’s something about the boyhood charm of being so divorced from the potential consequences of one’s actions that is almost unique. Mitnick had so many stories that entranced the people around him. I heard one second hand of Mitnick dealing with a bank who had early voice veri…
He has the CEO’s number and successfully calls him, and through some miracle gets through directly to ask this trivial question — as opposed to getting the number from the assistant who answers his phone - sure ok but then under what pretense does he then ask him to repeat his phone number? “Please repeat the phone number I just dialed.” The phone number contains all the digits needed to recreate the bank account num…
> He somehow has the bank account number?
Being able to login if you have the bank account number is still a pretty big flaw.
If you are a bank, your security threat model should assume that a hacker has access to somebody's account number and basic personal details.
Particularly for a high profile/value account, you can see how it might be possible to get soundclips of them saying the numbers 1 to 9 (see: https://www.youtube.com/watch?v=xWcldHxHFpo)
Re: Kevin Mitnick has died
#484Earlier quoted context omitted.
The european bank account numbers are often posted publicly. If you are a VAT payer, you're supposed to check that the account you send money to is registered with the business in the public registry. Otherwise you may be held liable for the receiver's tax fraud. Many companies also show them at their webpage to make it easier to get paid. See e.g. https://www.pre.cz/en/contacts/bank-details/ The account number shoul…
> The account number should be just an ID, not authentication mechanism. Right? One of the many things (and I mean this without any hate whatsoever) I simply can't and will never understand about the US. A bank account number is your mailbox for receiving money. How does that country even operate when they build those mailboxes underground?
[deleted]
Re: Kevin Mitnick has died
#485Mitnick was a hacker hero of mine in my youth. I think I’ve understood his role as jester prior to conviction less as I’ve grown older, but there’s something about the boyhood charm of being so divorced from the potential consequences of one’s actions that is almost unique. Mitnick had so many stories that entranced the people around him. I heard one second hand of Mitnick dealing with a bank who had early voice veri…
He has the CEO’s number and successfully calls him, and through some miracle gets through directly to ask this trivial question — as opposed to getting the number from the assistant who answers his phone - sure ok but then under what pretense does he then ask him to repeat his phone number? “Please repeat the phone number I just dialed.” The phone number contains all the digits needed to recreate the bank account num…
If you're dealing with the bank in a security-consultant capacity, then these kinds of requests would be both intriguing and informative.
If he's a customer of the bank, then it had better be a very small bank or I'm also skeptical.
Re: Kevin Mitnick has died
#486I was not aware he was ill. Always sad to hear people that are taken by cancer. I didn't know Kevin, but am friends with Tsutomu Shimomura who worked with authorities to get him arrested. Tsutomu worked with me a bit when I was at Sun trying to get a cryptographically secure subsystem into the base system specification. It was fun to listen to his side of this story. The 80's was a really weird time for computer enth…
> I was not aware he was ill. Always sad to hear people that are taken by cancer. It was pancreatic cancer, which is the deadliest cancer. It kills very quickly and as far as I know, it's impossible to cure. It killed my mom: 3 months between diagnosis and death. She didn't want treatment because it couldn't save her; it would only postpone the inevitable and she didn't want to spend the rest of her days in hospitals…
Note that it really depends on the type of the pancreatic cancer. While pancreatic adenocarcinomas are some of the worst cancers out there (overall 5y survival of 8%), others like pancreatic neuroendocrine tumours have a fairly good prognosis. Famously, Steve Jobs sought alternative medicine solutions to the latter, which was probably misguided.
Re: Kevin Mitnick has died
#487Mitnick was a hacker hero of mine in my youth. I think I’ve understood his role as jester prior to conviction less as I’ve grown older, but there’s something about the boyhood charm of being so divorced from the potential consequences of one’s actions that is almost unique. Mitnick had so many stories that entranced the people around him. I heard one second hand of Mitnick dealing with a bank who had early voice veri…
I wonder if the same scenario happened today, where a Kid has an interaction like that with a bank CEO, showing an insane vulnerability... The kid would just be sentenced to jail time and charged as an adult.
He did this as an adult while being paid by the bank as security consultant.
Re: Kevin Mitnick has died
#488Mitnick was a hacker hero of mine in my youth. I think I’ve understood his role as jester prior to conviction less as I’ve grown older, but there’s something about the boyhood charm of being so divorced from the potential consequences of one’s actions that is almost unique. Mitnick had so many stories that entranced the people around him. I heard one second hand of Mitnick dealing with a bank who had early voice veri…
All of the stories in his books are like this. An existing seemingly sensible system is used in a creative way to get access. Every time you read one the creative solution is so elegant you just go "Ah, can't believe I didn't think of that" (and then go try it yourself obviously - had lots of fun as a teenager taking down websites/stealing ppl's passwords/etc as a party trick for my friends).
Seemingly sensible? This one?
> the authentication mechanism was reading out your own account number in your voice
That's the most suspect part of it to me - even vulnerability to malicious attack like this aside, who would think that's a good idea or going to work well?
What percentage of people could successfully use a voice assistant to make a note of their bank account number the first time? Nevermind have it determine that it was indeed their voice not someone else's.
Re: Kevin Mitnick has died
#489Earlier quoted context omitted.
> The account number should be just an ID, not authentication mechanism. Right? One of the many things (and I mean this without any hate whatsoever) I simply can't and will never understand about the US. A bank account number is your mailbox for receiving money. How does that country even operate when they build those mailboxes underground?
You send the money to a literal mailbox instead. That’s how. (Using a check, the very infrastructure we’ve been talking about!!)
But then you've given out your bank account number, so the secrecy is bunk.
Re: Kevin Mitnick has died
#490Earlier quoted context omitted.
Would there be a modern version of this? I haven't read it and I'm interested, but mostly my parents are getting old, and with AI on the corner, I fear a bit the next level scams.
Any time a big hack makes the news it turns out that either some system had no security, they used social engineering, or a disgruntled former employee. Hackers aren't sitting there with a super computer in a Guy Fawkes mask trying to decrypt data. The scams are the same now as back then.
Two of the most recent most high profile hacks required a large degree of preplanning, scoping out, custom coding etc to achieve the breadth and depth of penetration gained upon execution.
How would you classify supply-chain attacks?
Primary security was bypassed by breaking secondary security .. so there was security to be overcome, there was no social engineering aside from understanding procedures in play, and no disgruntled employees.
https://www.techtarget.com/whatis/feature/SolarWinds-hack-ex...
https://forensiccontrol.com/guides/unravelling-the-moveit-ha...