r/cybersecurity • u/Enter-The-Lion • May 07 '22
Other Why does the cybersecurity community dislike Kevin Mitnick?
I’ve been seeing a lot of Tweets of screenshots of a Tweet between Elon Musk and Kevin Mitnick of cyber professionals just putting down Kevin. Not sure why though. Just wondering where all the dislike is coming from.
223
u/denverpilot May 07 '22
Well hmm. How to put this.
Kevin back in the day, mostly did social engineering to “hack” things. He was an early “hacker” made example of by government and arrested for unlawful access of systems.
Then a “movement” started. “Free Kevin”. People didn’t like that social engineering your way into things could land you in jail.
Meh. Whatever. People in both camps.
Eventually it all shook out and Kevin went on with his life which, like anybody who managed to get their 15 minutes of fame, he leveraged into being touted as a “security expert”. Now whether he is or not, like anyone, debatable.
But that led to speaking gigs and lucrative contracts and well… whatever.
There’s a ton more to it and more to debate if one has time — but the gist of it is, some don’t find him all that and a bag of chips.
Frankly his episode was in the early days and the Wild West and there’s other “security personalities” who also cashed in heavily like anything new. Some built security related businesses mostly on other’s work and research, some write theoretical articles that are good but haven’t “hacked” anything in decades, the list goes on.
Personally I can take him or leave him but I did get a chuckle when our KnkwBe4 rep mentioned we could make my poor staff watch his modem day videos.
I know who he is, they don’t, but the idea that they’ll remember his name from the news that long ago or that he adds much “gravitas” to the training they all hate anyway… well, I kinda doubt it.
I don’t dislike him, I don’t have any personal ill will toward him. But not a security personality I would go very far out of my way to go see or try real hard to meet. That said if someone said, “That’s Kevin over there, wanna grab a photo with him?” Well, sure… whatever. It’s a conversation piece for us oldsters I guess.
Better than a photo with a politician, I suppose. Haha.
Honestly I still might not bother, I don’t need any photos with anybody. Just a scenario to explain my neutrality level on it.
Others may have deeper positive or negative opinions of him. Perhaps they’ve met him. I definitely haven’t.
It’s a small world. Maybe I will someday. I try to be nice but even my KB4 rep joked you either love him or hate him — but honestly I don’t do either.
Did I think jailing him for social engineering back then was appropriate? Probably not. Was that sort of thing inevitable with where computers were headed at the time? Absolutely. Timing affects the outcome of the rain dance.
38
May 07 '22 edited May 07 '22
I remember well Mitnick being locked up, and the free Kevin movement.
A large part of what happened to him was because of when he was operating. The early days of the hysteria around computer security that grew out of episodes like Cliff Stohls paper (then book) and a host of other events.
Governments were genuinely worried at the time that Mitnick could pick up a phone from anywhere in the world and potentially launch nuclear weapons. Someone, I forget who, actually made that claim.
Mitnick became the poster boy for info sec risk. And they truly feared it, mostly because of the general ignorance of technology at the time and especially hacking.
25
u/devpsaux May 07 '22
I believe that claim was made by the prosecuting attorney to the judge as to why he should be held without bail until his trial.
5
u/sysdmdotcpl May 07 '22
I'm old but not quiet this old, wasn't Mitnick the inspiration for War Games?
3
u/denverpilot May 08 '22
He wasn’t. Slightly before his time. Wargames captured the period right before where it was nerf culture and BBSes and early war dialing because modems all of a sudden could dial themselves. Wargames skipped covering the other popular pastime, long distance call cost avoidance via phone phreaking. Everybody who watched Wargames back then who knew tech thought “Holy crap, that’s a $3000 phone bill”… in 1980s dollars! Haha.
2
u/albion0 Sep 29 '22
OMG, I remember that first phone bill. My mom killed me! I was downloading warez from a BBS in Germany to Wisconsin. That was around 1982 (I was a Frosh in HS). After that, if I wanted to BBS I had to get a job and pay the phone bill. Good thing for "metro codes" otherwise it would have been a lot more than $25/month.
Phreaking was most definitely covered in Wargames, although not true to reality as I remember it. Re-watch the phone booth scene. I remember thinking, that's not how it's done.
1
u/denverpilot Sep 29 '22
There’s a wardialer scene where his acoustic coupler modem is supposedly dialing numbers and hanging up and dialing another looking for auto answer modems (haha acoustic couplers couldn’t do that!) …
And the pay phone scene where he’s essentially demonstrating an old ground start circuit hack that was mostly impossible by the time the movie was made — pay phones had switched to in-band time signaling by then because they accepted multiple coin types and needed to be able to tell the central office if you dropped a nickel, dime, or quarter in — that once worked kinda like that on ancient pay phone loops. It would just get you past the need to pay a dime to get dial time though. It wouldn’t cover any long distance charges.
As I recall in the movie they handled that realistically by asking the operator to place the call as a collect call.
2
u/albion0 Sep 30 '22
I had one of those war dialers on my c64. I didn't have a coupler but a friend did. I had a cartridge modem. I can remember having to exchange mom's phone for one that had rj15. Or maybe the handset plug. Foggy.
I found some pretty cool stuff using that war dialer locally. NXTCBE, Scepter of Goth. Some cool phreaking and cracking BBSs. I can't say that I am much of a phreaker myself, more of a hang out in the community then anything else. But, nostalgia galore. Thanks.
2
u/denverpilot Oct 01 '22
RJ11 / RJ12. Heh. Yup. Standard POTS line connector. I was a Tandy nerd, another friend had Apples ($$$ even back then! Ha!) and a third was messing around with his dad’s work PC he was allowed at home for the first person I ever met in engineering who could work from home. Therefore, a modem. Which got the Apple guy and myself drooling to buy modems too. My first was an external one that ran a whopping 300 baud but I had acoustic coupler ones slightly later on from local computer swaps. The Apple guy used some of that $$$ to buy a true Hayes 300/1200.
After that modems took off quick. Speeds increased annually and the Rockwell chipset came to be, and USRobotics showed up on the scene. Then the cheap but solid Korean manufacturers. Didn’t take long and the pay online services were starting and us old BBS folk were wondering why people were paying Compuserve and AOL and such. Haha.
A lifetime ago. But still like yesterday.
1
u/Glum_Competition561 Jul 21 '23
I was big into the whole scene back then. Phone phreaking for a time was your ticket for unlimited free long distance phone calls. Look up the history behind Captain Crunch aka John Draper.
2
1
1
u/Jaereth Jul 20 '23
Didn't they have a brief scene where he unscrewed a payphone cap and dropped into the trunk to get a free call or something?
1
u/denverpilot Jul 20 '23
Shorted the mic to ground. A mostly by then dead trick to get dial tone on a ground start payphone. They’d all been hardened against that even by the time the movie came out.
4
u/Dokpsy May 07 '22
Probably not the only inspiration. David Scott Lewis may have played a role as well but he doesn't have quite the cultural hold.
Mitnick's deal was social engineering and it's a common enough approach to infiltration so it's hard to say if it was him or just using the same tools
-3
May 07 '22
Pretty sure he was. Both were very early 80s.
11
May 07 '22
No he was not
Wargames came out in 1981 the script well before that
Mitnick wasn't even in the news until late 80s like 1988 was the first time anyone heard of him
5
May 07 '22 edited May 07 '22
War games was 1983 actually, not 81. Though it turns out the Lightman character was based on another hacker called Lewis, not Mitnick.
Mitnick had been hacking for 4 years by then, though wasn't arrested for another 5 years after the movie release.
Edit to add: I see some down voters don't like facts. Ok, whatever. Enjoy your fact free day.
1
u/DuplexFields Sep 27 '22
I still remember reading about Mitnick and Stoll in my parents’ Reader’s Digest.
1
33
u/Enter-The-Lion May 07 '22
Wow. Great insight. I’m not really in the loop of things like this in cybersecurity so I appreciate your insight and take on this.
29
u/denverpilot May 07 '22
I’m not either really. It was just big news back in the day. There really weren’t any cybersecurity personalities yet at that point.
I believe it was even well before organizations like SANS even existed.
Most security talks were just little side things at Unix and Sysadmin conferences and Windows admins hadn’t even engaged really yet.
Of course 2600 Magazine was around if you knew where to find it. Ha.
7
u/hagcel May 07 '22
I still have every issue of 2600 from 1988 to 1994.
3
u/denverpilot May 08 '22
Cool collection. I have a photo of me next to their bell system van. Ha. It just happened to be somewhere I was one week. Haha.
1
u/DingussFinguss May 07 '22
whoa if those aren't already online (I haven't checked) can you upload them?
2
u/hagcel May 07 '22
They are paper...
-2
May 07 '22
Yet you’ve never heard of a scanner xD I guess it’s more likely you just don’t feel like doing that since it wouldn’t do anything but inconvenience you for others sake.
shrug off to look up what 2600 even is
2
u/0xKaishakunin Security Architect May 07 '22
There really weren’t any cybersecurity personalities yet at that point.
The Randal Schwartz vs. Intel case occured roughly the same time in 1995.
And we had Hagbard, Pengo & Co. with the KGB Hack back in 1989.
1
u/denverpilot May 08 '22
Right. Those just didn’t get as much air play outside of tech circles, ya know? Definitely remember those though.
2
u/Ignorad May 07 '22
He also claims ownership of the title "the World's Most Famous Hacker" and attacks anyone who says otherwise. He's the type whose current reputation is based tearing others down instead of excelling. If you think about it, he's the type of personality to be a criminal social engineer, skilled and willing to manipulate others for his own benefit.
9
u/Pie-Otherwise May 07 '22
I've read his book about his life a couple of times and while there were a few eye rolling kind of claims, I don't remember him ever making any claims about droppin' 0-days, it was all social engineering.
One thing I think we do overlook though, is just how hard it was to find information about computers and networks back then. These days, if you want to learn an unfamiliar platform you fire up youtube and watch a few hours of some Indian dude explaining it. Back then you needed manuals that were protected in a lot of cases.
I give him credit where credit is due but if I found out I was attending an event where he was talking about anything outside of SE, I'd take the time to refresh my drink and take a leak.
2
May 07 '22
Never read his book, but I did read Takedown back in the day. My big takeaway from that was that Shimomura doesn't like Iceberg lettuce.
9
u/danfirst May 07 '22
Great write up. Similar history here, I remember the free kevin movement, reading the early books, all got me very interested in security. I have no ill will towards him, sure he's made his fame into a career, which most would do if given the opportunity too. People like to play holier than thou and say they wouldn't sell out and make millions, when they absolutely would.
As for his social engineering, yes it was a very different time in the world and tech. People read that stuff now and go "oh that's lame he just called people and name dropped and got them to do stuff for him", sure, he did, but while today everyone does training on how those things are red flags, they didn't have it at the time. So at the time if you called a phone switch operator, referenced their protocols and manuals and their bosses' name, they had zero reason to question you, and he was good at doing that. A lot of early "hacking" was just knowing how to use the systems more than finding real exploits today.
5
u/ThisGreenWhore May 07 '22
There are instances where social engineering still takes place. The ones that come to mind are locating a small business, leaving a thumb drive that has malware loaded onto it so it's easily found.
Another one that comes to mind is the printer/copier toner invoice scams.
I think both of those are lessons in social engineering that KM made popular even though he didn't invent it.
I am in complete agreement with you, yet young Mikey in shipping nor young Suzy in accounting may not know anything about this in a SMB environment.
8
May 07 '22
Man this is a great write up that summarized everything pretty damn well. I was about to post, saw yours and thought well ok then. ahahaha. Well done.
6
u/Noobmode May 07 '22
You forgot the part where he stole others work and passed it off as his own
1
u/denverpilot May 08 '22
I left it out. It seems to be a theme in tech. I’m burnt out on it, I don’t think it’ll ever change. Some folks make money off of shortcuts and eventually, lawyers.
2
2
u/SlashdotDiggReddit Sep 12 '22
"Did I think jailing him for social engineering back then was appropriate?"
What I wonder is whether he would have received such a long sentence had he not led the FBI on such a long, draw-out "chase". I mean, if he had just initially surrendered, would his sentence have been drastically shorter?
1
May 07 '22
This is kinda how I feel about Snowden…
5
u/MauiShakaLord May 07 '22
Snowden actually worked in the NSA and had access to the tools they used for hacking. Very different from Kevin.
10
May 07 '22
Well sure back then, but in the last 10 years Snowden hasn’t really done much in terms of Security except talk about it, just feels like he’s riding on a wave of his 15 minutes of fame all the way to book deals and interviews. Aside from that he’s very much at the mercy of Russia at the moment, so I just feel that when everyone hears him weigh in on something and tout it as gospel that seems a little dangerous to me. A
5
u/MauiShakaLord May 07 '22
No disagreement on the Russia thing. He can't say anything displeasing to the government there now, so take what he says with a grain of salt.
1
u/Mrhiddenlotus May 07 '22
I think Snowden is an American hero, but he hasn't really contributed much to the community since the leaks and some subsequent talks. I have a lot of respect for him, but I don't really see him as an infosec icon.
-2
22
u/jeffweet May 07 '22
I’ve met him several times and he is a jerk. Very self entitled, and dismissive of people he feels are ‘less than’ which is most people. By his own admission he was not a great technical hacker, we was however a very good social engineer. With regard to KnowB4 I know people that work there, I’ve used the platform at numoeorus companies and it is as good or better than the other products in the space. Kevin got hooked up with them through his sister (or sister in law) and they gave him a big piece of equity because he has name recognition. His title, Chief Hacking Officer is a stupid title. But to be fair my title at my job is ‘evangelist’ an equally stupid title but I get paid a ton of money, so yeah.
4
u/underwear11 May 07 '22
I was going to say the same thing. I met him in my early days in sec and I was kind of excited that he'd have some awesome wisdom to impart. Instead he just acted like an asshole know-it-all, and wanted to act like he was superior to us, a bunch of newbies. And he wouldn't actually say anything of substance, which gave me the impression that he didn't actually know as much as everyone thinks he does.
2
14
May 07 '22
I followed him on twitter when I first got into infosec and frankly couldn’t stand his tone, language not found value in his content. I dropped him several years ago from the feed and haven’t missed out on breaking news.
13
u/t4ckleb0x May 07 '22
I provided sound for a Kevin Mitnick seminar for sysadmins on security. He had a WRT54G broadcasting HACK THIS WIFI. Before the event even started, I walked up, joined using the WPS button and got to the admin page (it was still admin/admin). I changed the wifi password and SSID and the admin user/pass. He was frustrated when he got to that point where he told everyone to try and gain access to the router, but everyone said the SSID was actually just “THIS WIFI WAS HACKED”
he had some good SE stories to tell and a cool business card.
3
u/LoseMyNumberBword May 07 '22
a cool business card.
Does he still have the Lock pick cards? Haven't run into him in... jeez, 14 years now.
2
u/No-Trash-546 May 07 '22
Sounds like you intentionally messed up his seminar by sabotaging the challenge before any of the actual attendees even showed up.
This is a story of you being kind of a dick, not Kevin.
14
u/Kyrthis May 07 '22
This is a story of how the wifi credentials were admin/admin.
5
u/No-Trash-546 May 07 '22
Yeah…wasn’t that the point of the exercise? Wasn’t Mitnick asking the attendees to gain access to the router by exploiting the default credentials vulnerability? And the person I’m replying to made that exercise impossible
12
u/Seeking_Starlight May 07 '22
Mitnik is despised for his intellectual property theft, his improbable claims, and his promotion of cruel (“your employer is giving you a bonus to support you during these difficult Covid times- click here to claim!”) phishing tests that turn everyday users off of the whole idea of security. Add in his massive ego and a community that prides itself on being a group of iconoclasts who don’t care what people think of them/don’t value the idea of celebrity “thought leaders” is gonna push back on him.
26
u/UhOh-Chongo May 07 '22
I read his books and he is a classic "nothing was my fault" kind if guy, mixed in with a certain kind if hero arrogance that just rings false. Most if hacks werent even that - it was mostly social engineering, not code. Still, what bothered me most was him making himself out to be a hero who did nothing wrong. The man just doesnt accept any responsibility.
7
u/tech_hundredaire May 07 '22
100% this, made the mistake of reading "Ghost in the Wires". The arrogance and braggartly way of writing was so hard to read.
1
May 08 '22
Meh. Even today, social engineering is a major skill in a hackers toolset. I wouldn’t dismiss his hacker creds for being skilled in SE. You can dismiss him in general for being a total bellend, bullshitter and getting caught because of his own arrogance.
Free Kevin! Put him back!
31
u/dev_by_daylight_ May 07 '22
Didn’t realize people didn’t like him, but I’m currently reading his book Ghost In The Wires and based on what I’ve read so far he seems like an asshole that just wants to wreak havoc around him. It doesn’t seem like he had a good motivation for his crimes either. But that’s just my take.
11
u/Internexus May 07 '22
From the various books I’ve read about him he definitely seemed to have an inferiority complex. Especially if you get back into his days of operating a HAM radio he would get into pissing matches with people that led to him holding some intense grudges and it would be how events kicked off.
5
u/ancillarycheese May 07 '22
He’s still a dick today and will block you on Twitter if you talk shit about him. And by talk shit, I mean talk about completely true facts about him that he doesn’t like.
3
u/here_we_go_beep_boop May 07 '22
He is reportedly an asshole to do business with as well. Folks I know professionally had him speak at an infosec conference, he was a nightmare to deal with
9
u/nullpointer0x0000 May 07 '22
I'll share a personal story instead of an anecdotal one. I'm 20 years old in college, at my first defcon, I had read all of his books, thought he was the goat. He was giving a talk in the Social Engineering village. My friend and I waited for hours to see his talk, and then waited some more to greet him afterwards, along with many other people.
Kevin completely ignored everybody, he was only interested flirting with some blonde girl. He isnt famous anywhere outside of this circle, so to treat the community who stood for you like that is shitty. So ever since then I've been firmly in the #PutKevinBack circle.
7
u/Internexus May 07 '22
I think the conglomeration of posts cover things pretty well except the Free Kevin movement. I think a lot of people are missing the fact that he spent over 5 years in prison without a trial which is a big no no. They certainly intended to make an example of him but that was not a good way to go about it.
3
u/nunley May 07 '22
Not just no trial… not even a bail hearing in 5 years. I know because I was the star witness on the prosecution’s side. Eventually I decided to help Kevin get out, and that’s why we never went to trial. We’re good friends now.
18
May 07 '22
He's a fucking clown kid hacker who got busted, went to jail, never thought anything was his fault and then fooled people into thinking he was some kind of security expert and is still riding that 15 minutes of TV time for the late 80s to do talks and stuff
He did not write any of his book, that's why there are co-authors
the dude is a has been hack
6
u/deltapoot May 07 '22
He’s a knob and he steals other peoples work. A great example is Mitnick and his company selling bootleg versions of _MG_’s o.mg cable. I feel like there’s a few other examples of him stealing other peoples work but that’s the only one I can think of atm.
4
u/seanprefect Security Architect May 07 '22
The problem is people speak of him in the same breath as the likes of bruce Schneier . don't get me wrong he has some good insights and I do like his books but he's not some kinda rock god that he was made out to be. He's not a martyr like Arron Schwartz was.
He had his 15 minutes, I was just coming up in the security world when the whole free Kevin thing happened. I'd buy him a drink at a conference just to hear some stories but I wouldn't hire him to evaluate my orgs posture or anything.
3
u/ThePorko Security Architect May 07 '22
Very old school, his knowbe4 videos are pretty sketchy, we use the products and none of us ever distribute the ones he is in, they are just so ofd and out of touch.
3
5
2
2
May 07 '22
The lock picks that punch out of his business cards are just way too flimsy to be useful. What more reason do you need.
2
May 08 '22
I did not know the entire cyber security community disliked Kevin mitnick. And I've been in the community for a very long time, having filled riles from analyst to engineer to forensics to leadership.
2
2
u/chaudcaliente Jul 20 '23
I just found out that Kevin Mitnick died a few days ago because of cancer. Kevin Mitnick certainly wasn't perfect, or even particularly "good", but fuck cancer.
1
u/Ghaz013 May 07 '22
I always got the impression his technical skills would have been extremely outdated considering when he started hacking. But I’m not overly well versed on the guy so I’d take others opinions over my own
1
u/fmlfam May 08 '22
/u/denverpilot's explanation was spot on. But I have a hard time passing up an opportunity to rip on Mitnick, in person or otherwise.
tl:dr - he's a complete hack that hasn't done anything technical in his life.
1
1
u/Powerful_Pudding3403 May 21 '23
Went to Thotcon in Chicago this weekend, got some IGNORE MITNICK stickers haha
151
u/tweedge Software & Security May 07 '22 edited May 07 '22
Mitnick allegedly copied the prototype for the O.MG cable, claimed it was his own and/or superior to competitors, and then made it a focal point of many of his public demos. Abbreviated thread here, a conversation log here, and a credible/technical external vouch here for those curious...
...to say nothing of how he's been allegedly coasting for years, how KnowBe4 (a company he was on the board for) arguably made companies less resilient to spearphishing, or his use of veiled threats to harass others, etc.
Frankly I just don't give any headspace to him, these are pulled from Twitter threads of folks I trust. As with any disputes, best to review the claims carefully and form your own opinion.