Kevin Mitnick (2017)

I wouldn't call it paranoid, skeptical is a better word. It depends on the situation. Let's go with a 6.

Thanks man. I do still have those cards and Canada shouldn't be a problem, you can get them from my website if you like, or catch me at a show.

While I was in a Federal Detention Center in LA I could look out the very small window and was able to see an airplane with a "FREE KEVIN" banner flying around.

Don't follow in my footsteps. Become good at offense using virtual machines and the various toolsets that are available. Learn about development and network administration to get your fundamentals before going directly into security.

The consequences are certainly more severe, and likely will only get worse. This is because of rise in publicity of hacking with public events such as the Russian hacking during the recently election and news around Edward Snowden. What your seeing in the making is a "War on Hacking" to replace the "War on Drugs".

That a federal judge in northern California had an intercept on his line. I would check to see if any of my friends had a tap on their lines and stumbled upon the fact that a judge had one on his line.

Ha! I'll tell you what, get your certificate over to KnowBe4 with a copy of this thread and I'll make sure that I sign it personally.

My biggest accomplishment was turning my life around, lemons to lemon-aide. I'm able to take all my skills and use them to improve security. I'm extremely fortunate that I've been able to take this "mischievous" behavior and use this to help businesses to protect themselves from the other Kevin Mitnicks that are out there. Look at it this way, it's like Pablo Escobar becoming a successful pharmacist.

Edit, to answer your last question, I never thought about harming myself. I did think about trying to escape but I didn't want to end up getting shot, that would go directly against my general desire not to harm myself or others.

Brett already paid me to keep quiet

Right now: It depends on what area of security, for me I'm always looking to hire expert pen testers. I look for people with skill sets in physical/technical/wireless areas.

What's hard to find today are those that have the skills to find find bugs in web apps.

10 years? I need my crystal ball because I have no fucking idea. I would say that one needs to constantly and vigilantly keep up to date with what is going on on both sides of the fence. It's a matter of keeping aware of the landscape as it evolves. 10 years in this industry is 100 years in any other industry. What did we have to watch for 10 years ago?

I think it's a positive effect, it gives the public another way to pay for products and services somewhat anonymously. It's just another tool that can be used by society in a positive manner.

My position is that Ed is a whistle blower, not a traitor. I was happy when he revealed that the US government was breaking the law by spying on our citizens. That was an illegal activity and needed to be revealed.

It's my position that Ed shouldn't have revealed our operations related to the monitoring of foreign entities, that's what the NSA is expected to as part of their mission, just like foreign entities do with us. That's the spy game.

Wow! I better raise the price of my cards!

It really depended upon the target. Some sites really did have a lot of security even back in the day. The biggest difference is the availability of toolkits, it was much harder to get/use/QA those types of things.

There was less security awareness back in the day, now there is a lot more awareness. However, that's been somewhat negated by the huge availability of tools that an 11 year old could pickup and try to use against targets.

I would probably be competing against David Copperfield as a magician because I love magic.

I don't have to hack, I could just ask uncle Jack.

Nice to meet you as well. I haven't messed around with police scanners since the 90s. I do occasional ham radio.

I've spoke Jonathan very few times, he had really distanced himself from me due to the prior history with the Shimomura hack. Now that the statue of limitations has run he has nothing to worry about.

Regarding languages, my first programming was at 21st Century Fox as a COBOL programmer. I'm familiar with many languages but modifying the existing assembly was how I did the work on the Motorola.

I look forward to meeting at some point, I don't have anything scheduled in NC at the moment. Check my website as I keep my speaking schedule there. Mitnick Security

I would say it's the same. Systems were less secure but to compromise them you had to write your own exploits. An effective method was social engineering the operators of the systems, a tactic that is still very successful today. That part works the same today as it did yesterday.

While I was in custody I continued to read and follow what was happening in the wild. I couldn't use a computer for 3 years so there was some catch up to do but I wasn't completely in the dark about what had been going on. People sent me books on HTML and whatnot while I had no access to computers.

I could tell you but then I would have to kill you. Are you trying to do reconnaissance on me?

I will say I like OSX and I like the aesthetics of the Apple hardware. I'll use VM for my Windows systems. I do use Linux and I typically go with Debian or Ubuntu.

It's really hard to find skilled security people, we really need to help develop people's skills in security testing. Testing security is an important step that needs to be taken.

Burp Proxy Pro is really a great tool. XKeyscore is what blew my mind the most. Back in the 90s it was direct access to the DMV in CA.

I pretty much just role my eyes and chalk it up to non-technically astute writes. However Mr. Robot has changed that and are getting things spot on.

BTW, I do type at 1,000mph, 1,024 to be exact.

I would say the book was 90% false and defamatory, the movie was 99%. The good news is that Jeff Estin, creator of White Collar, is doing the script for Ghost in the Wires. I hope that the script is picked up and it turns into something picked up by a production company.

Really thinking out of the box, expecting the unexpected. Really to me, the thought process is like puzzle solving. It's much harder to protect than it is to attack, the attacker needs only to find one hole to make it in.

What motivated me to get into hacking was because I was involved in phone phreaking and used to pull pranks on my friends. I wanted more control of the systems involved and one thing led to another. My first tool was a telephone, after that was a VT100 terminal and a Hayes 300 baud modem. Remember I started in 1978.

Hire a private investigator

I'm not actually 4Chan, sorry to break that news.

Not common knowledge? Use 2 factor authentication, use a password manager, use VPN when on public WiFi, and be aware of phishing attacks. Phishing is likely the number one way someone would be able to get you.

Regarding Mr. Robot, I love it. I've had the pleasure of meeting several of the people involved with that production.

I really appreciate your compliments and in fact that book is written for the non-IT person. It was my hope that people could use it as a tool to protect their privacy.

In the security and IT field there are so many things that are changing on a daily basis so you can't be good at everything. Right now there is a big need for people with the ability to find exploits in web apps.

An interesting bit of data is that when my company does engagements I still involve myself because I really enjoy the hacking process.

I have many favorite stories but I really enjoyed Kevin Poulsen's attack on Pacific Bell. I was very impressed by his bravado and how he would physically go into facilities. I would have liked to have met him earlier on in my hacking career when I was hacking the phone companies as that was my true love back in the 90s.

I think sophistication that was behind the John Podesta phishing was highly exaggerated. This was a case of standard phishing, basic security awareness training would have prevented this. It wasn't a huge technological achievement, it was simple spear phishing.

No need, it's already been done.

Fun fact, when I had my role on the show Alias I was still on probation and not allowed to use a computer. For my scene with a computer I had a prop computer with a monitor that was being operated remotely to follow my actions.

AV is a necessary evil for a personal system. That said, whenever I'm involved in ethical hacking we always work our way around AV.

I don't have kids yet but I believe they'll be the best social engineers in the world. They'll get good practice on their parents.

Thai chicken pizza from CA Pizza kitchen!

Yeah, not so much. Check out Ghost in the Wires for the full story.

No, I wasn't interested. My goal was to determine that my communications were secure for self preservation.

Don't get caught and if you're using cell phone to dial in always keep moving :P

Seriously,because then I don't have to deal with fraud.

I actually prefer to give them out for free in person but I have them for sale if someone can't make it out to see me.

I use this bad boy

I can not confirm or deny

It's well, thank you

Funny thing you would ask, the very first program I wrote was in Fortran. It simulated the login process of my teachers computer and I used that to phish his login credentials. I never did "hello world", I got my teacher's password as my first project.

C and Python make more sense but if the university says you need it, well, you probably should learn it. But certainly don't stop there.

The Albert Gonzalez case, you can read about it here

Peanut butter and chocolate, Reese's

My kind supporters sent me lots of materials, including books, emails and information. At one point my watchers tried to stop this, saying that I was getting encrypted data on how to escape in the mime headers of the printed emails.

I don't play music while I'm working because it's distracting. When I am listening it's Def Leppard, Lynyrd Skynyrd, Eagles, AC/DC and other classic rock. And throw in some Eminem and Black Eyed Peas.

Well said

Yes, I don't think I could have any others at this time.

I believe I was introduced via friend, we did communicate via IRC and telephone. At that time we were running MS-DOS, primarily to use comms programs and store data.

At the time one my favorite movies was 3 Days of the Condor. In the movie Robert Redford called up the CNA bureau to get someones number. I was impressed that the writers had included such an accurate detail.

Yes, I love it. It has been my passion since the 70s, hacking is the ultimate game. I love playing and I love winning.

Constantly, all the time. Since there are so many ways to compromise a target I completely reload all of my systems at least once every 6 months from a trusted source. If I was on Windows I would do it every week.