Kevin Mitnick, a reformed hacker who was once one of the FBI's
"most wanted" cybercriminals, has died at the age of 59.

Mitnick spent five years in prison for computer and wire fraud
following a two-year federal manhunt in the 1990s.

But after his release in 2000 he reinvented himself, becoming a
renowned "white hat" hacker, cybersecurity consultant and author.

He died on Sunday following a 14-month long battle with
pancreatic cancer.

"Kevin was an original; much of his life reads like a fiction
story," his obituary reads.

"He grew up brilliant and restless in the San Fernando Valley in
California, an only child with a penchant for mischief, a
defiant attitude toward authority, and a love for magic."

In the 1990s, Mitnick gained notoriety breaking into government
websites and corporate networks, including Pacific Bell, and
stole corporate data and credit card information.

He was involved in the theft of thousands of credit card numbers
and data files across the country in addition to working his way
into the country's cell networks, vandalizing corporate,
government and university computer systems.

A brief history of hacking
He was dubbed as the "most wanted" computer hacker in the world
by investigators.

A two-year-long nationwide FBI manhunt led to his 1995 arrest
and he eventually pleaded guilty to computer and wire fraud.

Authorities believed he had access to corporate trade secrets
worth millions of dollars.

In his 2011 memoir, Ghost in the Wires, Mitnick denied using his
skills to steal or exploit information for financial gain.

"Anyone who loves to play chess knows that it's enough to defeat
your opponent. You don't have to loot his kingdom or seize his
assets to make it worthwhile," he wrote.

His arrest sparked a 'Free Kevin' movement in the hacking
community, which lobbied on his behalf, including with rallies
outside the prison where he was held.

Following his release from prison, he became a "white hat"
hacker, writer and public speaker.

A "white hat" hacker aims to use their skills and identify
vulnerabilities or security issues of organisations to test
security configurations.

In 2003, he founded Mitnick Security Consulting, which advised
Fortune 500 companies and government agencies on cybersecurity.

In 2011, he became "chief hacking officer" and part owner of
KnowBe4, which offers phishing security awareness training.

"Kevin will always remain 'the world's most famous hacker' and
was renowned for his intelligence, humor and extraordinary skill
with technology, surpassed only by his talent as the original
'social engineer,'" the company said in a statement on Thursday.

https://www.bbc.com/news/world-us-canada-66263235

Some of us continue to question whether Mitnick actually hacked
a VMS system as claimed, or simply took advantage of a careless
system manager who failed to change the default password on a
certain account. Shimomura knows the truth of the matter and so
does that SYSMGR.

-DTC03

On Thursday, July 20, 2023 at 11:08:54 PM UTC-7, Nomen Nescio wrote:

(snip)

> Some of us continue to question whether Mitnick actually hacked
> a VMS system as claimed, or simply took advantage of a careless
> system manager who failed to change the default password on a
> certain account. Shimomura knows the truth of the matter and so
> does that SYSMGR.
As far as I know, that counts.

Reminds me of the story of the plumber fixing a sink.
Goes under the sink, and a few minutes with a hammer, fixes it
and gives the bill for $50 to the owner.

Owner complains about so much for just a little work.

Then a new bill:

Applying hammer to drain: $1. Knowing where to do it: $49.

Not all hackers will know the default passwords for VMS.

For those that do, it counts.

On 7/26/2023 6:53 PM, gah4 wrote:
> On Thursday, July 20, 2023 at 11:08:54 PM UTC-7, Nomen Nescio wrote:
>
> (snip)
>
>> Some of us continue to question whether Mitnick actually hacked
>> a VMS system as claimed, or simply took advantage of a careless
>> system manager who failed to change the default password on a
>> certain account. Shimomura knows the truth of the matter and so
>> does that SYSMGR.
>
> As far as I know, that counts.
>
> Reminds me of the story of the plumber fixing a sink.
> Goes under the sink, and a few minutes with a hammer, fixes it
> and gives the bill for $50 to the owner.
>
> Owner complains about so much for just a little work.
>
> Then a new bill:
>
> Applying hammer to drain: $1. Knowing where to do it: $49.
>
> Not all hackers will know the default passwords for VMS.
>
> For those that do, it counts.

Who would consider knowing default passwords "hacking" ???

--
David Froble Tel: 724-529-0450
Dave Froble Enterprises, Inc. E-Mail: davef@tsoft-inc.com
DFE Ultralights, Inc.
170 Grimplin Road
Vanderbilt, PA 15486

On Wednesday, July 26, 2023 at 8:53:39 PM UTC-7, Dave Froble wrote:

(snip)

> Who would consider knowing default passwords "hacking" ???

Knowing and using them.

Note that if you leave your door unlocked, and someone walks into the
house, that counts as "breaking and entering". They don't need to pick
a lock, or break the glass. Just push the door open is enough.

On 27/07/2023 06:07, gah4 wrote:
> On Wednesday, July 26, 2023 at 8:53:39 PM UTC-7, Dave Froble wrote:
>
> (snip)
>
>> Who would consider knowing default passwords "hacking" ???
>
> Knowing and using them.
>
> Note that if you leave your door unlocked, and someone walks into the
> house, that counts as "breaking and entering". They don't need to pick
> a lock, or break the glass. Just push the door open is enough.
>

Not under UK law it doesn't

--
Chris

Den 2023-07-27 kl. 13:56, skrev Chris Townley:
> On 27/07/2023 06:07, gah4 wrote:
>> On Wednesday, July 26, 2023 at 8:53:39 PM UTC-7, Dave Froble wrote:
>>
>> (snip)
>>
>>> Who would consider knowing default passwords "hacking" ???
>>
>> Knowing and using them.
>>
>> Note that if you leave your door unlocked, and someone walks into the
>> house, that counts as "breaking and entering".   They don't need to pick
>> a lock, or break the glass.  Just push the door open is enough.
>>
>
> Not under UK law it doesn't
>

Same here (SE). If you leave you house (or car) unlocked,
your insurance doesn't work.

In article <a56192c3-b74a-4050-b42c-a08850ad0efdn@googlegroups.com>,
gah4 <gah4@u.washington.edu> wrote:
>On Thursday, July 20, 2023 at 11:08:54 PM UTC-7, Nomen Nescio wrote:
>(snip)
>
>> Some of us continue to question whether Mitnick actually hacked
>> a VMS system as claimed, or simply took advantage of a careless
>> system manager who failed to change the default password on a
>> certain account. Shimomura knows the truth of the matter and so
>> does that SYSMGR.
>
>As far as I know, that counts.
>
>Reminds me of the story of the plumber fixing a sink.
>Goes under the sink, and a few minutes with a hammer, fixes it
>and gives the bill for $50 to the owner.
>
>Owner complains about so much for just a little work.
>
>Then a new bill:
>
>Applying hammer to drain: $1. Knowing where to do it: $49.
>
>Not all hackers will know the default passwords for VMS.
>
>For those that do, it counts.

The passwords were printed in the manuals.

I don't wish to speak ill of the dead; I met Mitnick once (I
probably still have one of his "lock pick" business cards
somewhere), but I don't think anyone thinks he was particularly
technically adept. His hacking "skill" was more along the lines
of social engineering, at which I understand he was masterful.

- Dan C.

On 7/27/2023 8:00 AM, Jan-Erik Söderholm wrote:
> Den 2023-07-27 kl. 13:56, skrev Chris Townley:
>> On 27/07/2023 06:07, gah4 wrote:
>>> On Wednesday, July 26, 2023 at 8:53:39 PM UTC-7, Dave Froble wrote:
>>>> Who would consider knowing default passwords "hacking" ???
>>>
>>> Knowing and using them.
>>>
>>> Note that if you leave your door unlocked, and someone walks into the
>>> house, that counts as "breaking and entering".   They don't need to pick
>>> a lock, or break the glass.  Just push the door open is enough.
>>
>> Not under UK law it doesn't
>
> Same here (SE). If you leave you house (or car) unlocked,
> your insurance doesn't work.

It is still illegal to steal from a house with an unlocked door.

The only questions are:
- if going through an unlocked door and breaking a window are the
same or two different paragraphs in the criminal code
- if the fact that the door was unlocked can be used by the
insurance company to reduce or entirely refuse claim

Arne

Dan Cross <cross@spitfire.i.gajendra.net> wrote:
>
>I don't wish to speak ill of the dead; I met Mitnick once (I
>probably still have one of his "lock pick" business cards
>somewhere), but I don't think anyone thinks he was particularly
>technically adept. His hacking "skill" was more along the lines
>of social engineering, at which I understand he was masterful.

He had very limited technical skills.

But he spent no more than five minutes on the phone with our head of
computer security and we had to shut every system on the field down
and change every password.
--scott

--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On Thu, 2023-07-27 at 19:17 -0400, Arne Vajhøj wrote:
> > Same here (SE). If you leave you house (or car) unlocked,
> > your insurance doesn't work.
>
> It is still illegal to steal from a house with an unlocked door.

Reminds me of the time I realised my key to my very ancient but long
gone Ford Fiesta Mk1 could be used to unlock other Fords.

Oh dear.
--
Tactical Nuclear Kittens

In article <u9uvfm$1j9$1@panix2.panix.com>,
Scott Dorsey <kludge@panix.com> wrote:
>Dan Cross <cross@spitfire.i.gajendra.net> wrote:
>>
>>I don't wish to speak ill of the dead; I met Mitnick once (I
>>probably still have one of his "lock pick" business cards
>>somewhere), but I don't think anyone thinks he was particularly
>>technically adept. His hacking "skill" was more along the lines
>>of social engineering, at which I understand he was masterful.
>
>He had very limited technical skills.
>
>But he spent no more than five minutes on the phone with our head of
>computer security and we had to shut every system on the field down
>and change every password.

Oh my.

Sounds like the quip where the prosecutor told the judge that he
could whistle nuclear launch codes and start World War III over
the phone.

- Dan C.

On Fri, 28 Jul 2023 15:53:03 +0000, Dan Cross wrote:

> Sounds like the quip where the prosecutor told the judge that he could
> whistle nuclear launch codes and start World War III over the phone.

Funnily enough, in the 'blue box' days I learned to whistle a 'clear down'
signal in the UK. That cut off a call from a payphone.

It was useful at university when someone in a booth was taking too long...

Dan Cross <cross@spitfire.i.gajendra.net> wrote:
>In article <u9uvfm$1j9$1@panix2.panix.com>,
>Scott Dorsey <kludge@panix.com> wrote:
>>Dan Cross <cross@spitfire.i.gajendra.net> wrote:
>>>
>>>I don't wish to speak ill of the dead; I met Mitnick once (I
>>>probably still have one of his "lock pick" business cards
>>>somewhere), but I don't think anyone thinks he was particularly
>>>technically adept. His hacking "skill" was more along the lines
>>>of social engineering, at which I understand he was masterful.
>>
>>He had very limited technical skills.
>>
>>But he spent no more than five minutes on the phone with our head of
>>computer security and we had to shut every system on the field down
>>and change every password.
>
>Oh my.
>
>Sounds like the quip where the prosecutor told the judge that he
>could whistle nuclear launch codes and start World War III over
>the phone.

Well, our computer security director didn't know anything about computers
either, so he had a tendency to overreact in berserk ways. 2600 Magazine
profiled him and said he was "like a tickle-me-elmo doll... just mention
Sendmail and watch him go into convulsions."

But if Mitnick's goal was to shut everything down and cause chaos, which I
suspect it was, he was very successful.
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On 7/29/2023 2:37 PM, Scott Dorsey wrote:
>
> But if Mitnick's goal was to shut everything down and cause chaos, which I
> suspect it was, he was very successful.

I just wish people would stop trying to make heroes out of criminals.

bill

On 2023-07-29, bill <bill.gunshannon@gmail.com> wrote:
> On 7/29/2023 2:37 PM, Scott Dorsey wrote:
>>
>> But if Mitnick's goal was to shut everything down and cause chaos, which I
>> suspect it was, he was very successful.
>
>
> I just wish people would stop trying to make heroes out of criminals.
>

Sometimes the low-level criminals do the good guys a really big favour
by exposing serious vulnerabilities before the _really_ bad guys come
along and cause massive damage.

Talking about heroes in general, do you see the people speaking out about
UAPs in the US as heroes ?

(Or, OTOH, are they considered to be cranks or part of a general plan
to prepare the world for certain revelations ?)

IOW, how you look at this depends on what your vested interests are.

Simon.

--
Simon Clubley, clubley@remove_me.eisner.decus.org-Earth.UFP
Walking destinations on a map are further away than they appear.

On 7/31/2023 9:23 AM, Simon Clubley wrote:
> On 2023-07-29, bill <bill.gunshannon@gmail.com> wrote:
>> On 7/29/2023 2:37 PM, Scott Dorsey wrote:
>>> But if Mitnick's goal was to shut everything down and cause chaos, which I
>>> suspect it was, he was very successful.
>>
>> I just wish people would stop trying to make heroes out of criminals.
>
> Sometimes the low-level criminals do the good guys a really big favour
> by exposing serious vulnerabilities before the _really_ bad guys come
> along and cause massive damage.

Those that are interested in such a service can contract a
security expert to test.

Those that are not interested in such a service -
well they don't want it.

Arne

On 2023-07-31, Arne Vajhøj <arne@vajhoej.dk> wrote:
> On 7/31/2023 9:23 AM, Simon Clubley wrote:
>> On 2023-07-29, bill <bill.gunshannon@gmail.com> wrote:
>>> On 7/29/2023 2:37 PM, Scott Dorsey wrote:
>>>> But if Mitnick's goal was to shut everything down and cause chaos, which I
>>>> suspect it was, he was very successful.
>>>
>>> I just wish people would stop trying to make heroes out of criminals.
>>
>> Sometimes the low-level criminals do the good guys a really big favour
>> by exposing serious vulnerabilities before the _really_ bad guys come
>> along and cause massive damage.
>
> Those that are interested in such a service can contract a
> security expert to test.
>
> Those that are not interested in such a service -
> well they don't want it.
>

Nobody _wants_ the bad guys roaming around their systems. :-)

However, there are multiple categories of bad guys...

Simon.

--
Simon Clubley, clubley@remove_me.eisner.decus.org-Earth.UFP
Walking destinations on a map are further away than they appear.

In article <kilc9iFiv46U1@mid.individual.net>,
bill <bill.gunshannon@gmail.com> wrote:
>On 7/29/2023 2:37 PM, Scott Dorsey wrote:
>> But if Mitnick's goal was to shut everything down and cause chaos, which I
>> suspect it was, he was very successful.
>
>I just wish people would stop trying to make heroes out of criminals.

Yeah, I never really understood his folk-hero status....

- Dan C.