Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kevin Mitnick has died

dignitymemorial.com

Post reply on HN
Print view View original

491–500 of 666 posts

Re: Kevin Mitnick has died

#491

Post by muzani »

OJFord wrote: post #488
alex-moon wrote: post #368

Earlier quoted context omitted.

All of the stories in his books are like this. An existing seemingly sensible system is used in a creative way to get access. Every time you read one the creative solution is so elegant you just go "Ah, can't believe I didn't think of that" (and then go try it yourself obviously - had lots of fun as a teenager taking down websites/stealing ppl's passwords/etc as a party trick for my friends).

Seemingly sensible? This one? > the authentication mechanism was reading out your own account number in your voice That's the most suspect part of it to me - even vulnerability to malicious attack like this aside, who would think that's a good idea or going to work well? What percentage of people could successfully use a voice assistant to make a note of their bank account number the first time? Nevermind have it det…

I think something was lost in the retelling. It could just be an era when people didn't figure out biometrics yet. It makes sense today, but caught up in new hype, people often implement cutting edge technology where it doesn't belong.

Re: Kevin Mitnick has died

#492

Post by joshmanders »

mcv wrote: post #415
ChuckMcM wrote: post #193

I was not aware he was ill. Always sad to hear people that are taken by cancer. I didn't know Kevin, but am friends with Tsutomu Shimomura who worked with authorities to get him arrested. Tsutomu worked with me a bit when I was at Sun trying to get a cryptographically secure subsystem into the base system specification. It was fun to listen to his side of this story. The 80's was a really weird time for computer enth…

> I was not aware he was ill. Always sad to hear people that are taken by cancer. It was pancreatic cancer, which is the deadliest cancer. It kills very quickly and as far as I know, it's impossible to cure. It killed my mom: 3 months between diagnosis and death. She didn't want treatment because it couldn't save her; it would only postpone the inevitable and she didn't want to spend the rest of her days in hospitals…

A friend of mine survived it, I wouldn't wish pancreatic cancer on even my enemies. That stuff is tough. I do the Purple Stride with her every year to celebrate her battle.

RIP Kevin, hearing your stories and the movie Hackers was a huge inspiration in me getting into what we do.

Re: Kevin Mitnick has died

#493

Post by henrik_w »

I really enjoyed reading his book Ghost in the Wires. It is the story of Mitnick’s hacking career, from the start in his teens, through becoming the FBI’s most wanted hacker, to spending years in jail before finally being released. It’s a fascinating book that at times reads like a thriller. One of the things that struck me when reading it was how often he used social engineering to gain access to systems.

I wrote more about it here:

https://henrikwarne.com/2015/12/27/social-engineering-from-k...

Re: Kevin Mitnick has died

#494

Post by detourdog »

larntz wrote: post #478
noSyncCloud wrote: post #447

Earlier quoted context omitted.

This comment is very hard to parse, but after reading it, I feel a general sense of relief that I'll never use Schwab.

At first I thought this was a reference to the movie Sneakers ( https://www.youtube.com/watch?v=-zVgWpVXb64 ), but after searching it seems Wells Fargo also does this, https://www.wellsfargo.com/privacy-security/voice-verificati... .

I just thought it was an interesting contrast to the bank executive story. Which demonstrated how the passphrase may have evolved and that moving money is done by voice authentication today.

Using just ones voice is bad. Using a phrase is better. Using a phrase that is unique and describes its function may set-off alarm bells for some.

I never connected the phrase with Sneakers.

Re: Kevin Mitnick has died

#495

Post by rjbwork »

CPLX wrote: post #452
AnthonyMouse wrote: post #397

Earlier quoted context omitted.

> The causal leap from flamboyant hackers to the DMCA/CFAA That isn't much of a leap. The penalties aren't rooted in the actual damages, because for most of this kind of curiosity-based intrusion, there isn't any real damage and the damage imputed to them is the cost of cleaning up after the vulnerability, which the "victim" ought to have paid regardless. Getting trolled by some kid isn't what costs you money, implem…

It'll make more sense when you realize that promoting the competence of American corporations is, in and of itself, an explicit policy goal of the American government.

If they wanted to promote competence then the damages would be applied to the corporation for implementing the vulnerability, not on the attacker for exposing it. This way, corporations are given a shield for being incompetent and can place the blame and damages upon an individual that brings them to light.

Re: Kevin Mitnick has died

#496

Post by thesuitonym »

eduction wrote: post #473
josh2600 wrote: post #48

Mitnick was a hacker hero of mine in my youth. I think I’ve understood his role as jester prior to conviction less as I’ve grown older, but there’s something about the boyhood charm of being so divorced from the potential consequences of one’s actions that is almost unique. Mitnick had so many stories that entranced the people around him. I heard one second hand of Mitnick dealing with a bank who had early voice veri…

He has the CEO’s number and successfully calls him, and through some miracle gets through directly to ask this trivial question — as opposed to getting the number from the assistant who answers his phone - sure ok but then under what pretense does he then ask him to repeat his phone number? “Please repeat the phone number I just dialed.” The phone number contains all the digits needed to recreate the bank account num…

He was already meeting with the CEO in some capacity, so it's very clear he had access to the CEO, maybe as a security consultant. Then getting him to read the number is easy, "Hey, I just got a new cell, but I might have given you my old card, can you read the number back to me?"

Getting a phone number with all the necessary digits is a bit of a stretch, but not impossible. And I would suspect, because this is the way phone systems generally work, that there was no bound on the number of attempts to enter the account number. Account numbers are all the same length, so you know exactly how many characters to input, it's just a matter of brute forcing the number--and for all I know, there may be some kind of structure that Mitnick found out.

Meeting with the board sounds like an embellishment for sure, especially for Mitnick's initial report, but I could definitely see--especially if someone was looking for a big chunk of money to strengthen the system--the report eventually being given to them.

The check on the silver platter is the most believable part of the story. Have you ever met a CEO? And why wouldn't the architect of the system be there to receive the report on the security of the system? Who else should be there?

For me, the only truly unbelievable part of this story is that he needed the CEO's voice at all. And for all we know, he just said he recorded the CEO's voice for a laugh.

Re: Kevin Mitnick has died

#497

Post by mekoka »

eduction wrote: post #473
josh2600 wrote: post #48

Mitnick was a hacker hero of mine in my youth. I think I’ve understood his role as jester prior to conviction less as I’ve grown older, but there’s something about the boyhood charm of being so divorced from the potential consequences of one’s actions that is almost unique. Mitnick had so many stories that entranced the people around him. I heard one second hand of Mitnick dealing with a bank who had early voice veri…

He has the CEO’s number and successfully calls him, and through some miracle gets through directly to ask this trivial question — as opposed to getting the number from the assistant who answers his phone - sure ok but then under what pretense does he then ask him to repeat his phone number? “Please repeat the phone number I just dialed.” The phone number contains all the digits needed to recreate the bank account num…

I understood it as him (Mitnick) asking his own phone number back. "Did I give you my card earlier? Is it the new card? I don't recall. Which number does it have?"

If you've already identified a security system that has this vulnerability you get a phone number with all these digits and begin shopping for any institutions that bough that system.

Re: Kevin Mitnick has died

#498

Post by blindriver »

nicetryguy wrote: post #385
blindriver wrote: post #224

Wow, this is seriously upsetting. The fact that so many people are dying of pancreatic cancer is very, very scary to me, and it's so many young people at this point.

It's one of the few that's still difficult to detect, and by the time you show symptoms you are basically stage 4... it's treatable if you catch it early, but therein lies the problem; My grandfather passed away from it.

I'm sorry to hear that, someone I knew closely died of pancreatic cancer and died 6 weeks after diagnosis which is why it scares me so much. Did your grandfather smoke, or drink a lot of alcohol? Or drink a lot of tea or coffee?

Re: Kevin Mitnick has died

#499

Post by radicalace »

jeremy_carroll wrote: post #318

To be candid; fuck this narrative. Nobody "Beats" cancer based on sheer will. Same scenario as those that did not "Fight hard enough". It's a disease. It does not care about your wants, and needs.

wrong. this would be correct if doctors gave you perfect instructions as a rule. but doctors dont care about maximizing the probability of good health or long lifespan. they only care whether your outcomes are up to the standard defined by the medical establishment and the expectations of laypeople. as long as your doctor meets those standards, they wont be sued, lose their practice, be fined or suffer an insult to their high status. so often there are better treatments and overlooked treatments that got lost in that incentive scheme. patients who are proactive and singleminded will definitely do better with all illnesses including cancer. never understood this until i saw both my parents through cancer. but by far the biggest advantage is to have advocates, family with you at all times, especially in the hospital.

Re: Kevin Mitnick has died

#500

Post by nathancahill »

jjkaczor wrote: post #471
mcv wrote: post #415

Earlier quoted context omitted.

> I was not aware he was ill. Always sad to hear people that are taken by cancer. It was pancreatic cancer, which is the deadliest cancer. It kills very quickly and as far as I know, it's impossible to cure. It killed my mom: 3 months between diagnosis and death. She didn't want treatment because it couldn't save her; it would only postpone the inevitable and she didn't want to spend the rest of her days in hospitals…

It took my dad last year, diagnosis in April, gone by mid-June. It was so aggressive he chose "medical assistance in death" (MAID), because he didn't want to be in hospitals all-the-time. He had half-completed the process, then had a stroke on June 4th, where he was then admitted to hospital. The stroke cause aphasia, so he couldn't communicate very well (speech was very disjointed, but he could understand everyone)…

Sorry for your loss.
Post reply on HN