Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kevin Mitnik FOIA Final

vault.fbi.gov

Post reply on HN
Print view View original

71–80 of 99 posts

Re: Kevin Mitnik FOIA Final

#71

Post by Muromec »

gmueckl wrote: post #52
rglover wrote: post #16

It should be illegal for the government to keep redactions in anything made public/declassified. It's a slap in the face to see entire sections of text (that most certainly contain important context) blocked out with a white blob.

There may be a middle ground where, with some effort effort, a watered down summary of the redacted information could be given (e.g. if a name of a person is redacted, replace it with some sort of unique handle). As long as this is done as an annotations for the visibly marked redaction, I see no problem. The reader may choose to trust those annotations or not.

Ukrainian court rulings do this -- it's always person_1 meeting person_2 at address_1, so only the parties have an unredacted ruling, while redacted one is publicly searchable

Re: Kevin Mitnik FOIA Final

#72

Post by jazz9k »

daghamm wrote: post #20
fabiensanglard wrote: post #14

Earlier quoted context omitted.

If you are into this topic, read as many point of view as possible and take a look at http://www.takedown.com/ (Tsutomu Shimomura's side of the story).

I've far more respect for Tsutomu. In the end he turned out to be the better hacker. Reading Mitnicks book I sometimes get the impression that the he is making up half of it.

I heard him on Art Bell multiple times talking about it. I many cases, someone else did the ground work and he just used it.

Re: Kevin Mitnik FOIA Final

#73

Post by jasonfarnon »

tptacek wrote: post #36
daghamm wrote: post #20

Earlier quoted context omitted.

I've far more respect for Tsutomu. In the end he turned out to be the better hacker. Reading Mitnicks book I sometimes get the impression that the he is making up half of it.

To the best of my knowledge, Mitnick didn't really code at all. There are (let's call them) intrusion specialists whose skillsets don't really involve systems programming, but rather intuition and tenacity, and there are others who write exploits. My understanding is that Mitnick was the former, and was using tools he got from friends and peers.

the steve jobs of hacking

Re: Kevin Mitnik FOIA Final

#74

Post by ajsnigrutin »

tptacek wrote: post #36
daghamm wrote: post #20

Earlier quoted context omitted.

I've far more respect for Tsutomu. In the end he turned out to be the better hacker. Reading Mitnicks book I sometimes get the impression that the he is making up half of it.

To the best of my knowledge, Mitnick didn't really code at all. There are (let's call them) intrusion specialists whose skillsets don't really involve systems programming, but rather intuition and tenacity, and there are others who write exploits. My understanding is that Mitnick was the former, and was using tools he got from friends and peers.

He didn't really code in the book either... maybe 5% of the book... he did some script kiddie type exploits, some copying of proof of concepts, and some minor modifications (like modifying the "logon" program to save passwords somewhere in cleartext).

75% of the book is spent social engineering over the phone and 20% doing stuff on phone switches and other equipment.

Re: Kevin Mitnik FOIA Final

#75

Post by ajsnigrutin »

genewitch wrote: post #58
itishappy wrote: post #54

Earlier quoted context omitted.

What's your name and address? (Rhetorical question, please don't answer.) Is that info you'd be comfortable sharing on a public forum? I presume you're not doing anything particularly wrong. This also assumes that we can all agree on a definition for "innocent." > what is there to protect? Their privacy. Some people have strong opinions on 3 letter agencies and poor reading comprehension. Some people are just mean sp…

Licensed ham radio operators give their address every 15 minutes by law. And their full name. Sometimes it's a PO box, but mostly a home address's. I can't think of anything more public than airwaves.

Sure, they know what they're doing and they're doing it on purpose.

If you rented out a room (or even a hotel room) to Eric Weiss (mitnicks alias, one of many), do you really want everyone here to see your full name and address?

Or if someone hacked some database of users and used your name/surname to socially engineer someone else.

or worse!

Re: Kevin Mitnik FOIA Final

#76

Post by kmoser »

colechristensen wrote: post #38
klodolph wrote: post #22

Earlier quoted context omitted.

> I doubt that insanity stops just because you're dead. It really does stop. What can you do with someone’s SSN? Get loans, open bank accounts, receive government benefits, set up utilities, etc. It harms someone because creditors falsely believe that the SSN’s holder owes the debt, or the government believes that the SSN’s holder received benefits, etc. People who are falsely reported as dead have a difficult time d…

If someone is asking for an SSN they’ll be doing a credit report which will show if you’ve died.

Well, it might show if you've been reported to have died. It's possible you were reported as dead but you're still alive. It's possible you weren't reported dead but are. And it's also possible that regardless of how you were reported, the credit agency will botch the lookup and report your dead-or-alive status wrong.

Given the amount of erroneous information in credit files, I wouldn't be surprised if the above scenarios happen regularly.

Re: Kevin Mitnik FOIA Final

#77

Post by kevin_thibedeau »

indrora wrote: post #39
daghamm wrote: post #20

Earlier quoted context omitted.

I've far more respect for Tsutomu. In the end he turned out to be the better hacker. Reading Mitnicks book I sometimes get the impression that the he is making up half of it.

Anyone who has studied the later parts of the phone system know that at least a few of his stories are actually bullshit. It wouldn't be until much later (in the 90s at least, while he was in prison) that the advent of pure digital switching would enable the random reassignment of phone lines like he describes in the story about turning his friend's home phone into a payphone. The lines were separated and had differe…

The 4ESS was a pure digital switch starting in 1976.

Re: Kevin Mitnik FOIA Final

#78

Post by tptacek »

MG9991ep545a1l3 wrote: post #64
daghamm wrote: post #20

Earlier quoted context omitted.

I've far more respect for Tsutomu. In the end he turned out to be the better hacker. Reading Mitnicks book I sometimes get the impression that the he is making up half of it.

Kevin hasn’t hacked anything at all. He ran with a few other characters who never received anywhere near the amount of attention that Mitnick did. For example, no one ever figured out who “jsz” was.

I think pretty much everyone in that scene knows.

Re: Kevin Mitnik FOIA Final

#79

Post by metadat »

hinkley wrote: post #13
dgacmu wrote: post #9

Earlier quoted context omitted.

Er, what risk does the release of an SSN pose to someone two years deceased?

TIL. Now I’m wondering how many other people in this thread don’t know he died (pancreatic cancer). 59 isn’t that old. And he was expecting a baby at the time, which suggests maybe they didnt think so either.

Here's to hoping for some early detection tech:

Cheap blood test detects pancreatic cancer before it spreads https://news.ycombinator.com/item?id=43035147 - Yesterday (233 comments)

Re: Kevin Mitnik FOIA Final

#80

Post by ASalazarMX »

tptacek wrote: post #51
vasco wrote: post #42

Earlier quoted context omitted.

In the book he spends a lot of time on the social engineering parts of it to be honest. It's been a few years but I remember him mostly bragging about that rather than developing custom exploits.

He also comes from an era of intrusions where systems were so bad you didn't really need to code to get into them. For an alarmingly long time, the most effective tool you could use to pop a network was simply `showmount`.

That time is still today, as people are still the weakest link. A talented scammer can convince people to give them access to their WhatsApp account despite the E2EE, 2FA, and SMS verification codes.

In Mitnik's version, he RTFMs, learned the technical lingo, procedures, and even the names of telco employees.

Post reply on HN