Mitnick had so many stories that entranced the people around him. I heard one second hand of Mitnick dealing with a bank who had early voice verification software. Upon meeting the CEO he gave the executive his card and departed for the evening. Arriving back at his hotel, he called the CEO and asked him to read his phone number to him. The phone number contained all ten digits which Mitnick had neatly tape recorded so as to make the CEO’s voice reproducible. He then proceeded to use the bank’s vocal banking system to transfer $1 from the CEO’s account to his as the authentication mechanism was reading out your own account number in your voice.

When Mitnick arrived back in the board room the architect of the voice verification system was crestfallen and the bank CEO delivered a check on a silver platter.

Now how much of that tale is embellished I will never know as it was second hand, but that was the kind of whimsy Mitnick brought to our world.

Rest in Power.

Finally I’m know that passphrase is tied to my phone number. Its not perfect but it is as good as any other consumer banks system.

I don’t recommend Schwab but my accounts are as secure as any.

Using just ones voice is bad. Using a phrase is better. Using a phrase that is unique and describes its function may set-off alarm bells for some.

I never connected the phrase with Sneakers.

I imagine that the mission parameters were that he take a check and remove money from the account.

It would also make sense that this is the CEO's account, or one he also controls, because he's in on the test and can give informed consent. Also, probably the CEO doesn't have any special access so breaking into his identity wouldn't impact the bank the way breaking into the IT manager's account might.

If this was a fake account (one with no real user) then they wouldn't have discovered this flaw because Mitnick couldn't have called the user. Having a real person be exploitable is essential to proper discovery of the full scope of the problems.

The man was beat down for his snark as much or more than his technical capability. He flipped off the cops and they crushed him for it.

Welcome to the american banking system.

The account number should be just an ID, not authentication mechanism.

Right? One of the many things (and I mean this without any hate whatsoever) I simply can't and will never understand about the US. A bank account number is your mailbox for receiving money. How does that country even operate when they build those mailboxes underground?

(Using a check, the very infrastructure we’ve been talking about!!)

I only send and receive money with Google/Apple Pay & PayPal at this point. This flow is reasonable (every transaction is authorised in a trusted location (ie: PayPal). Further transactions are impossible without additional authorization). It boggles my mind that banks & CC companies haven't made some standard for this. Would save them so much money in fraud protection.

Oh that’s easy enough. If they need a PIN it’s actually being run as a debit card over the debit card network. Otherwise it’s being run as a “check card” over the credit card network (with higher fees and better consumer protections). It’s just backed with money instead of a line of credit.

> Why do online stores need my name and address, but IRL ones do not?

IRL stores have access to the actual card (with your name) and having this artifact present makes it much less likely that you are a fraudulent fraudster committing fraud, so the processors are willing to take it.

> How can restaurants swipe my card now and charge me later?

the good news is if the store ever defrauds you, everyone knows where to find the store! Unlike fraudsters making purchases.

Ergo my "welcome to the american banking system".

I developed a strong dislike for Mitnick, however. As others have said, he came across as an adolescent with an over-sized ego. More "Jackass" than "Silicon Valley". Although I'm sure he's not the only "hacker" for whom illegal entry into computer systems gave him a sense of self-importance.

No thanks.

Edit: yeah, probably was "Cyberpunk: Outlaws and Hackers on the Computer Frontier". I still don't think "bullshit artist" is something to aspire to.

He was very good at that segment of the industry ("penetration testing" via social engineering).

Could have got the message out in a better way but the story of him avoiding the law provides that sort of thriller plot line that engages people.

Now I'm a cybersecurity consultant (glorified sysadmin) making a nice salary but without any of the joy that was present in my 20s rebelling against my F100 company's IT policy. Installing Dokuwiki on a shadow server just to get shit done. Helping write a custom request system to get shit done. Consequences came after.

I'm not comparing myself to Mitnick, rest in peace, only reflecting on the passing of a titan before my prime that represents a moment in communication hacking that may never exist again.

You just hit it. That feeling. Me too, nowadays I mostly go through the motions. No enthusiasm, no joy, no interest, no energy... no "spark". Mitnick lived and shined at a time when showing off didn't just land you in jail. Until it did.

Long live the legend.

Or the way my 3yo daughter does it these days; "beep".

When I read his books I alternated between fascination, revulsion, admiration, and shock. Mitnick above all wasn’t boring and I think “not boring” doesn’t get enough credit in the measure of a man.

My wife might agree or disagree with you, depending on the day.

I'm sorry about your ex, and I hope you have the support you need.

there are people with serious psychological disorders such that they can't control negative impulses and behaviors. Some people are born or develop an empathy void, but they are still human beings. Yes, we need to make sure they don't harm others, but pissing on them doesn't help you or anyone else, so why do it? All men are created equal, judge not lest ye be judged, ChristianGeek.

"Judgement is Mine." - Your Friend

> the authentication mechanism was reading out your own account number in your voice

That's the most suspect part of it to me - even vulnerability to malicious attack like this aside, who would think that's a good idea or going to work well?

What percentage of people could successfully use a voice assistant to make a note of their bank account number the first time? Nevermind have it determine that it was indeed their voice not someone else's.

Often you need one type for basic access (see balance), two for an actual transfer, three for say, transferring a million dollars. This may be something that people like Mitnick proved were necessary.

Ahem.

https://www.theguardian.com/money/2018/sep/22/voice-recognit...

The phone number contains all the digits needed to recreate the bank account number?

He somehow has the bank account number?

He meets the CEO (despite just being a security consultant) and gives his report to the board of directors?! That is not how companies usually work, especially the board part.

Check on a silver platter? architect of the voice system is brought into the room with the board to be humiliated? This reads like something a 13 year old would dream up (nothing against OP maybe someone even Mitnik really did claim this happened).

The tale is absolutely embellished if it has any truth at all.

He calls the CEO to ask a "personal question" so to skip the assistant, asks something innocent, then let's the CEO he has a new number and provides a fake number. He asks the CEO to confirm he heard the number correctly, but it's a bad line, so speak clearly please.

The "new phone number" has all the digits of the bank account he's trying to hack. The account is likely the account number that he's being paid for the consultancy work with. He could have got this simply by asking to confirm from which account he'd be paid from to confirm the transaction.

He is asked to report his review of the new security system to the board (given it was a large investment by the Bank, or just the wrong word used) and the architect would of course be invited to his own project's review?

The board then asked Mitnick to design a new system and said that cost wouldn't be an issue.

That all seems pretty easy to put together?

Kind of like when your company has a security presentation about this new "report phishing button" in your email and you suddenly see this weird phishing-like email come through a few hours later. Hopefully you connect the dots.

I came to a similar conclusion regarding the implementation of the attack. The scenario in my head was slightly different, but very similar (still includes a new number):

Kevin provides his business card and sets up a meeting with the CEO to report on his progress (or whatever). When the CEO calls at the scheduled time - Kevin doesn't answer. Sometime later Kevin calls the CEO and apologizes for missing the call, and explains that he didn't see any missed calls.

At that point the CEO explains that he tried to call, and even left a message. Kevin has a sudden flash of insight and realizes that he may have given the CEO one of his old business cards.

"What's the phone number on the business card I gave you? I'm wondering if I've been handing out my old business cards to people... that would actually explain a lot." (presumably the phone number on the business card in question would include digits 0-9 in a not-super-obvious way)

The CEO reads back the phone number on the card and Kevin slaps his forehead because that is in fact the wrong business card. Kevin gives the CEO his new number, and they finish the scheduled meeting. On future calls the CEO is able to contact Kevin using the new number, which lends credence to the attack.

Getting a phone number with all the necessary digits is a bit of a stretch, but not impossible. And I would suspect, because this is the way phone systems generally work, that there was no bound on the number of attempts to enter the account number. Account numbers are all the same length, so you know exactly how many characters to input, it's just a matter of brute forcing the number--and for all I know, there may be some kind of structure that Mitnick found out.

Meeting with the board sounds like an embellishment for sure, especially for Mitnick's initial report, but I could definitely see--especially if someone was looking for a big chunk of money to strengthen the system--the report eventually being given to them.

The check on the silver platter is the most believable part of the story. Have you ever met a CEO? And why wouldn't the architect of the system be there to receive the report on the security of the system? Who else should be there?

For me, the only truly unbelievable part of this story is that he needed the CEO's voice at all. And for all we know, he just said he recorded the CEO's voice for a laugh.

Random number, legit area code. Unless you are looking for all 10 digits, pretty easy social hack

But that's pretty easy. Sorry I didn't catch that could you do it one number at a time?

"Sorry, no 54, five-four."

"You said five ... four?"

"Yes, five ... four."

Doing the thing you want people to do is actually a pretty good strategy.

Recognizing when people are employing this strategy on you and intentionally not doing the thing is good fun too.

If you've already identified a security system that has this vulnerability you get a phone number with all these digits and begin shopping for any institutions that bough that system.

Being able to login if you have the bank account number is still a pretty big flaw.

If you are a bank, your security threat model should assume that a hacker has access to somebody's account number and basic personal details.

Particularly for a high profile/value account, you can see how it might be possible to get soundclips of them saying the numbers 1 to 9 (see: https://www.youtube.com/watch?v=xWcldHxHFpo)

If he's a customer of the bank, then it had better be a very small bank or I'm also skeptical.

Mitniks social engineering really formed me. And I did all sorts of nefarious stuff in the 80s, from mapping the 411 call centers, to the tape vending machine hack and other phreaking as I had an original captain crunch whistle to (not a hack) but there was a bunch of easy fraud to be had with “calling cards” back in the day

Bank account numbers are written on the bottom of checks along with the routing code. If you have a check from them, you have their checking account number.

Phone numbers are ten digits long. So a number like (213)485-7690 contains all digits from 0 to 9. Caller ID spoofing is trivial even back then. For example, you could ANI fail to a calling card system which would drop you to an operator. Then you just tell them the number you're "calling from" and that number would show up as your Caller ID and ANI.

Using voice authentication is pretty stupid but, iirc, at least one US bank still does something similar. That said, I imagine part of the authentication was probably caller ID based. This was/is also why voicemail systems don't prompt you for a PIN when you call them from your own phone - they use caller ID for authentication.

CEO interest is piqued. Gives him a business card, let's talk soon.

The on the call,

KM: what is your checking account number?

CEO: that's private

KM: it's printed on every personal check you write, so definitely not private

CEO: ok, good point, #######

KM: great, now tell me the numbers on the card I gave you

CEO: your phone number?

KM: yes

CEO: ok, ########

KM: ok I think I have what I need

CEO: really? that's it?

KM: yep, let me get to work, we'll talk soon

It's incredibly easy (still) to do certain kinds of "social engineering". Terms like "psychological sleight-of-hand" can sometimes make it a little clearer how humans just have blind spots - ways our perception works and doesn't. And, people who are used to being VERY "in control", intelligent / experienced (compared to others in room), etc., can sometimes be the easiest to manipulate in certain ways.

But, really, it boils down, sometimes, to something as simple as "how long can you keep a person talking?" Mitnick was probably in a good position to do these sorts of things - assuming the story is from after he "turned White Hat". And, in this case, the even simpler deal with the numbers is something like "oh, shoot, I had a misprint on old cards, did I give you the right one? What's the phone number on it?" Drop something abruptly like that, at some random point in a conversation, most people wouldn't think twice... Even if their current context involves a heavy dose of thinking about voices and numbers. They might easily enough realize in the morning, but, too late, by then. Further, getting bank account numbers is not necessarily hard either. Could even be as simple as "dumpster diving", back then. Did the CEO always shred every single document, with a "secure shredder" (as much as that's possible) when home? Or maybe burn everything, always?

And, in any case, you're even mixing up aspects of the story. The phone number isn't the bank account digits, it's just all the numbers from 0 through 9 (you can even get one twice, for a 10-digit [w/ area code] number).

I propose that your sureness in dismissing this story, misapprehensions about it, etc., make you an unwittingly "good mark."

I don't disagree it's likely all bullshit, but if you're going to post snarky, nitpicking comments at least make sure you're understanding what was communicated. It makes it all too easy to dismiss any valid points you may have when there are such fundamental flaws.

The IT person easily figured out it was me and then tricked me into thinking I would be expelled within days. She pulled me out of class, told me such in the hallway, let me return to class where I held in tears until the end of the day.

Nothing happened and the school year ended a few weeks later. Towards the end of the summer I realized it had been a bluff and I wouldn’t be punished. Took me a few years later to realize how much of a favor that all was! The county school of conduct clearly said cybercrime was punishable by expulsion so she could have absolutely put me in some kind of hell. The fear set me straight hah.

Similar. I wrote a program to emulate a the logon text on a PDP-11 terminal in high-school in the mid-80s and steal a bunch of student passwords. Didn't do anything with them. They were like "trophies."

Nevertheless, the computer teacher found out and had mercy on me. He gave me a project to work on to help him compile stats on a student survey. He was a nice guy.

edit for clarity.

It was just a simple QBASIC program (that's all that was available on the Computer Room machines) running under my own login, which would write usernames and passwords to a text file in my user directory. I figured that I'd harvest a few passwords until someone got frustrated enough to call for the IT admin, at which point he would try to log in and reboot the PC when it failed, apparently "fixing" the problem and erasing any evidence of my dastardly crime.

I was right, and for a few glorious days I got away with it... until one particular arsehole picked on my best friend during recess, and I used his stolen credentials to log into his account and trash his files.

Long story short, I ended up getting expelled, which by a curious confluence of events put me on an unorthodox path that completely changed my life. Funny how things turn out.

This was precisely my logic as well.

> put me on an unorthodox path that completely changed my life.

Hopefully it was a happy path!

Yeah, I remember watching "Freedom Downtime" as a teenager and thinking how ludicrous it was that he was sentenced to prison for computer hacking, but now that I think about it as an adult of course he should have been. Sure solitary confinment, the specifics of his sentence, etc. may have been extreme and I'd like to think that the court system has progressed in their knowledge of computer security since then, but what he did was still a breach of corporate security. He knew at the time it was illegal, and he just thought he was too smart to get caught.

That idea that we had at the time that it was a "victimless crime" or something was very immature.

One of my fond memories with my now-dead mother was going to see him during a prison transfer in Los Angeles and yelling outside the place until he waved to us and the rest of the crowd through a window.

https://fogbeam.com/free-kevin.jpg

And FYI, while he died unexpectedly young, a 57-year-old man in the US has only a 50% chance of living to see their child reach 23 years of age. I, personally, wouldn't feel comfortable risking leaving a child with a likelihood of dealing with my death at that relatively young age.

This is an issue of social status. There is a computer mafia in America, and it is interwoven into the IC, SV and infrastructure providers. It exists to the benefit of the privileged.

Having been threatened with murder and then blackmailed, with zero consequence to the perpetrators, I have first hand experience dealing with such corruption.

Post Snowden, these abuses have become more entrenched, locked down, and a bit less cowboy/wild west

Care to elaborate? This sounds like something too heavy to leave behind as a remark on a comment

Panopticon put in place thereafter

Big tech abuse has been going on since well before snowden

Directly experienced this secret police gestapo crap, incl'g a series of incidents whereby connected folks abused their privilege; my investigation escalating to a serious murder threat, blackmail, and other related misconduct

Choose your battles. A wise person will slowly back away when encountering a dangerous animal. I dont suggest standing up to corruption by powerful people. they have ways of making more trouble for the defiant

You're free to take his assertion as credible or not, but that is my source.

Your assertion about delusions is funny. Likely you are also an arrogant bully IRL as well.

I live in a transitional shelter in Indiana. Fakeconcern not welcomed.

https://news.ycombinator.com/newsguidelines.html

The good die young if they don't realize the game they are playing quick enough. Godspeed.

andrew busamante cia dew

Mr Mitnick would want truth to prevail, even if uncomfy

The world has some primordial evils in it. Only when you fall into a honey pot of the state, will you understand the level of evil and malevolence that exists as part of rule, law, and order.

The death and destruction isn't contained in neat bows, it happens on US soil in disturbing ways.

I am not special in any regard, I just have seen more than most. Enjoy the ride and don't forget that most outlier statistics aren't anomalous accidents, they are symptoms of a process that is subtle.

Chisel off the serial numbers of these stories and have at it.

I'm sorry you've gone through such distressing experiences and definitely don't want to add to the distress, but I also don't want replies from HN commenters to add to it unintentionally.

Perhaps a clearer way to put it: a 57-year-old man in the US has a 50% chance of living to 80, which doesn't seem quite as shocking of a statement.

The poster above mentioned that Mitnick had more than 9 million shares of some company sold for ~25 dollars each. That would be ~225 million.

To me it seems more like he wanted to have a child with his wife before he passed so they planned it out so it would happen.

Obituaries mention surviving family members by convention, but otherwise leave very personal matters to the family.

The death of someone can be a reminder of our own mortality. Maybe a later HN post can work through some of those thoughts.

It's not like he gave himself cancer on purpose and chose to leave a child with nothing out of spite. He played the hand he was dealt, it seems.

"Mitnick has filed a 13G form with the Securities and Exchange Commission (SEC) disclosing ownership of 9,379,829 shares of KnowBe4, Inc. Class A (KNBE). This represents 6.9 percent ownership of the company. "

" companies announced on Wednesday that they have entered into a definitive agreement, with KnowBe4 stockholders set to receive $24.90 per share in cash, "

"Vista Equity Partners to Acquire Security Awareness Training Firm KnowBe4 for $4.6B"

https://fintel.io/news/mitnick-kevin-discloses-stake-in-knbe...

https://www.securityweek.com/vista-equity-partners-acquire-s...

The man didn't hang himself, he got a case of severe bad luck. I'm sure he'd be here doing the father figure stuff if he could, but if he can't, that doesn't mean the kid shouldn't have been created, and really, that's their family's own personal decision to make.

Ultimately, he did a good job for his family and the kid will be fine.

People shitting on him on the day he died for choosing to have a kid that he leaves very well taken care of just seems wrong in several different ways.

I mean, we could all be at work trying to provide for our theoretical kids right now and we're sitting here saying dumb shit on the internet instead.

I think what's going on here is that some people (myself included) find it extraordinarily offensive to question someone's right to procreate, whether they're "good enough" by some metric to have done so. Are you young enough, rich enough, smart enough, tall enough, moral enough, etc.

Of course, the offense can be a combination of being offended on behalf (of Mitnick in this case), and also projecting (what if we lived in a world where people questioned whether I should have children for reasons of age, wealth ... or worse reasons.)

I think we live in a world where we need all kinds of people from all kinds of parents; when we start to pick at who "should" have children, we risk losing something.

And Warren Buffet will tell you that you want to give your kids enough money so that they can do anything, not so much that they can do nothing. Have you spent time around kids who know they will be millionaires when they grow up? Really messes with your head. A buddy of mine was supported by his parents as an expat in a resort city and ended up brutally murdering his dad after they clashed about money.

And FWIW, I will be able to give my kid enough money to do anything, have been carefully developing his mental and physical aspects, travel abroad, language immersion, etc. So your attack is inaccurate in my case.

It's virtually always impossible for almost everyone to be able to simultaneously 1] have kids while you're still young 2] wait until you have "enough" money.

Warren Buffet's quote doesn't make sense, because both "anything" and "nothing" are relative. You can "do nothing" with extraordinarily little money. You can also not be able to do "anything" even with billions of dollars (start an asteroid mining company?).

If you give your kids the moon, you just have to make sure they still have motivation and character, it's still possible. Not everyone who inherits money is a layabout.

I can stop now though, I think we just fundamentally have different opinions on this and probably won't budge much.

I've always loved his lockpicking business card: https://www.mitnicksecurity.com/kevin-mitnicks-famous-lockpi...

While I assume this is real, part of me does feel like a combination of how young he is and who is is leads me to be slightly skeptical. Assuming it's real, hopefully he would have appreciated the skepticism.

They did ship the card to me.

“Lamo was best known for reporting U.S. soldier Chelsea Manning to Army criminal investigators in 2010[7] for leaking hundreds of thousands of sensitive U.S. government documents to WikiLeaks.[8][9] Lamo died on March 14, 2018, at the age of 37.[10]”

Kind of the wrong side in history there. But RIP, regardless.

Manning’s leaks included vast numbers of documents related in no way to a legitimate whistleblowing issues, some of which helped spark the Arab Spring which precipitated in an ongoing civil war in Syria, slave markets and the beheading of religious minorities in Libya, and on and on all over the region affecting 100s of millions of people. I don’t know about Lamo, but Manning certainly isn’t on the right side of history and deserves to be still in jail.

You're mistaking Manning's leak with the CIA.

https://www.nytimes.com/2017/08/02/world/middleeast/cia-syri...

As for the Arab Spring, you can blame it for revolutions in Tunisia, Libya and Egypt (some good, some bad), but I don't think Syria has anything to do with it. And ISIS was the direct result of the US invasion of Iraq.

Without being mind readers all we can know is what Manning claimed about intentions. People who break their oaths aren’t the most trustworthy cohort. Regardless, good intentions do not absolve anyone from high crimes and precipitating mass murder.

> ISIS was the direct result of the US invasion of Iraq

Without weakened or destroyed regimes across the region due to Manning’s actions there wouldn’t have been as much freedom for ISIS to spread. Manning shares the blame.

Care to elaborate?

I might not be up to speed with a particular instance of that in his life though. Perhaps that's where my lack of understanding stems from.

I’m sorry he stole your cc.

But he wasn't a first famous social engineer. That was extremely old hat by then.

People keep claiming he is a notable technologist, but I can't think of how. The Internet and other systems had intrinsic design flaws in the early day because it was birthed as an overly trusted network of well-known peers. Poking for flaws in those days didn't require any skill. The Morris worm, for example, was extremely skillful.

My biggest exposure to anything related to him is KnowBe4 and it is an utter piece of crap. It provides training modules that have no idea who their audience is so it veers wildly between terrible advice and overly technical advice with alongside the correct advice.

And lastly, and I mean this sincerely, my condolences to his family and friends. No one should have to go through this so young.

My Amex account number was stolen a month ago. It took me three minutes on the call with a rep to get it locked + a new card issued. I think I spent more time and effort on the phone with my dentist later that week.

https://en.m.wikipedia.org/wiki/Fair_and_Accurate_Credit_Tra...

This gave prior anti-fraud legislation more teeth and had a huge impact.

Source: Someone cashed a fake check against my terminally ill father's People's Bank checking account this year and it was a couple months of work to deal with the fallout. Faking a check is absurdly easy and US banks kinda suck at dealing with it.

Credit card numbers and medical records are worlds apart in actual sensitivity.

Really sad day, RIP - will definitely have a drink for him tonight.

#dang

&dang

?dang

!dang

~dang

:’(

Nobody's perfect.

All software engineers are now more vulnerable with Kevin gone. Stay paranoid friends, now more than ever.

"Where are you going to night boys?"

"Oh, we're going to hang out with Kevin."

(this meant a night of trashing telco dumpsters, fucking around with payphones, and various other dubious activities)

"Oh, OK. Well, be careful."

That sort of thing.

Wow. Never saw this coming. I didn't even know he'd been ill.

Anyway... RIP, Mr. Mitnick. May there be clueless operators to social engineer, on "the other side".

https://youtu.be/3zgLHEqIlJg?t=528

[1] https://seedsecuritylabs.org/Labs_16.04/PDF/Mitnick_Attack.p...

Remember when Yahoo! was defaced with a "FREE KEVIN" message? Good times.

RIP dude.

https://en.wikipedia.org/wiki/Ann_Turner_Cook

People here are mostly reminiscing about Mitnick the myth, not the man.

[1] https://www.reddit.com/r/cybersecurity/comments/uk6wgd/why_d...

[ftr, I have no idea what his demeanor was; like many, it's quite likely he softened over time.]

To this day I know the difference between a cracker and a hacker :)

RIP.

Sad to see, he was way too young to go. RIP

https://www.youtube.com/watch?v=PlbUYl67LTY

Abbie Hoffman's Steal This Book and Kevin Mittnick taught me the noun form meaning of exploit. RIP

RIP

I also can't find mention of him having pancreatic cancer, but that's not necessarily a confirmation of anything. He certainly could have kept it private.

Sad to hear the news :\

That seems to have been reverted pending a reliable source:

Edit: <https://en.wikipedia.org/w/index.php?title=Kevin_Mitnick&old...>

Revert: <https://en.wikipedia.org/w/index.php?title=Kevin_Mitnick&old...>

Wikipedians typically resolve such issues pretty quickly.

There they make it clear that the New York Times columnist and book author John Markoff made up absolutely everything.

The movie "Track Down" (US) / "Takedown" is also full of BS.

https://www.amazon.com/Ghost-Wires-Adventures-Worlds-Wanted-...

There's no such thing as objective moral and ethical good. To me, Mitnick is a hero deserving of the highest praise. He inspired myself and many others to get started in this world. It may be difficult to understand if you didn't come into computers in the late 80s/90s.

Anyway, I suppose you could make the case that Mitnick was taking on “the Man” which is more utilitarian, but that’s a bit anemic imo.

I'm curious how your framework handles some particularly unpleasant examples.

E.g., is there nothing universally wrong with what Hitler / Mengele did to Jews? Or how about raping, torturing, and then killing toddlers?

I have trouble accepting an ethics in which there's no real basis for telling such people that what they're doing is genuinely wrong.

(I apologize if these examples seem like straw-men. It's possible I don't understand your original point.)

You can of course pick examples 99% of people agree with. Hitler is bad, killing kids is wrong, beating your wife is bad, Mao killed millions, stalin killed millions, etc. This still doesn't make these objective. Just agreed upon. An objective system is one in which there is no other possible answer. I'm am sure we can find at least one person for each example of these whose moral and ethical system is consistent with the tyrant's behavior. It runs afoul of society at large and generally how we expect people to behave. But it is still subjective. Whether it deserves respect is what I think you are conflating objectivity with.

Take a less inflammatory example: dropping the nuke on Japan. Was that evil? On one hand it's true it killed hundreds of thousands of innocent lives. However, on the other end it stopped an unnecessary blood bath that could've killed millions more.

All right and wrong is dictated by a moral and ethical system. Society has a commonly agreed upon moral and ethical system but it does not make it right for every single case. If you really wanted to corner me you'd have brought up abortion. But, in fact, abortion is the perfect example of a subjective interpretation of morality and ethics. In the case of Kevin Mitnick, I do not see him as a criminal. I see him as a victim of a system that failed to understand computers.

What I consider bad, Hitler for example, is my subjective view of reality.

Apologies for the pedantry, but these two are objective; calling them wrong/bad would be subjective.

> Society has a commonly agreed upon moral and ethical system

We do?!

Yes, generally it's the legal system we live under. When you boil it down laws are technically just an encapsulation of the larger view society takes on issues of morality.

Now, you may not agree with every law. I don't. But I think most people would agree stealing, killing, etc are bad. This is sort of what I was getting at with a commonly agreed upon moral and ethical framework. People expect you not to kill from, or steal from them, or whatever else. If someone killed your son/daughter/wife/husband/etc your framework might justify seeking revenge. You'd run afoul of societies agreed upon framework but consistent in your own. Does that make you evil? Not necessarily. Perhaps society would think you are though. It's interesting when you think about things that way. How far afoul of the agreed upon framework can you run before you end up having more people hate you than love you.

SBF seems like an average white collar criminal next to Mitnick. He wanted to become those big corporations with their names on stadiums.

He also educated the entire industry on how it works. Most people today show off that they're a security consultant but they haven't really had any experience breaking into things, and a lot of the advice is impractical. Like everyone knows that MD5 is insecure, but who's going to actually use it as an attack vector? Mitnick does the attack and then documents it. Some people claim he made stuff up, but even having the kind of imagination to make up these scenarios puts him above many security experts.

<https://news.ycombinator.com/newsguidelines.html>

<https://news.ycombinator.com/newsfaq.html>

(I'd just made this suggestion via email on seeing this post.)

Is the submission for someone who just died the right place to write something you already know is harsh? Considering the kind of person Kevin was, I'm sure a bunch of his friends are on here, reading these very comments so maybe just a tiny bit of respect would be suitable.

It’s the age old issue if someone can’t understand something therefore there can be no understanding in it.

While many people are remembering the Free Kevin phenomenon, the random places the t-shirts would appear for years.. like other things Kevin appeared to do - it’s a decision that’s entirely Kevin and his wife’s business, and they seem more than capable of it.

https://news.ycombinator.com/newsguidelines.html

a.k.a. please don't feed the trolls

https://news.ycombinator.com/newsguidelines.html

Some are calling for the black bar to be shown. Let's reserve it for people who have actually achieved something useful in life.

The website you're using is called "Hacker News" for a reason.

a.k.a. please don't feed the trolls

https://news.ycombinator.com/newsguidelines.html

What vile and quite obviously delusional people!

I seriously doubt he ever tried to hack SCN.

For those who haven't seen it, Freedom Downtime is a movie by the 2600 gang which is mostly about Mitnick's imprisonment, and the whole Free Kevin movement.

(I wonder who wrote the obituary, it's especially wide-ranging, and poetic in parts.)

https://www.youtube.com/watch?v=77ILA5Cso3w

Just out of curiosity, does anyone have anything else corroborating this? Everywhere seems to be sharing the same dignitymemorial.com link.

I was just a university Freshman just starting my CS classes, and seeing this discussion, it was like I had entered some underground revolutionary meeting. It opened my eyes to mischief and testing the boundaries of systems and order where this guy who was on IRC as root@system was just calmly saying how the technical universe I was just learning about was controllable in ways I had no clue about.

I never followed the case after he was prosecuted, and I didn't go down the hacker route in my career, but it was a life-changing moment for me to see this outsider live out "War Games" in real life.

RIP, root. Your crimes and mischief certainly didn't define you, especially as you went down the ethical hacker path (the first?). Pancreatic cancer is a horrible way to go, I am sorry to see this story today and condolences to his family and friends.

A name of inspiration, igniting curiosity across ages. And of course, the only crime was curiosity.

RIP

> These are two causes of great importance to Kimberley and Kevin; both organizations put the majority of donated funds to work in the communities they serve.

If Kevin inspired you, perhaps a donation in his name would be a nice gesture.

I was tempted to send a box of donuts as a gift... but instead I think I'll send the two dozen as a donation to the EJI instead.

https://eji.org/

An icon for many of us here. I feel worse for his mate and unborn child. Losing a mate is very, very, hard. Going through that myself...

Sorry to hear that

https://www.cmu.edu/randyslecture/

Here’s an HN discussion from a few years ago.

https://news.ycombinator.com/item?id=24972377

https://en.m.wikipedia.org/wiki/Henrietta_Lacks

I.E. x% more patient survive after n years while using this or this treatment. And same treatment could increase odds of dying sooner from other decease out of scope with the research years later.

I knew a guy who was diagnosed with stomach cancer at 27 years old. Never had a health problem in his life, he didn't even know how insurance worked yet. It was late stage and he was given 6 months to live. He was recently engaged before that and they moved their wedding up to 3 months away in order to have it before he passed. But he was gone from us just 6 weeks after the original diagnosis. He fought like hell to survive. He had every reason to. He was diligent with everything the doctors told him and he was gone within weeks despite being given months.

Cancer is horrible and it is unpredictable by its very nature. Cancer is literally at its definition a collection of unpredictable mutated cells. Thats why it is so hard for doctors to estimate or predict. It is unpredictable. Sometimes the unpredictability works in your favor and sometimes it works against you. But cancer cells do not listen to willpower, despite the common narrative. The reality is it is good and bad luck that often determines your fate.

As a secondary anecdote. I have a friend who's mom had skin cancer, a small patch the size of a dime on her hip. Skin cancer is generally incredibly survivable and low risk (in the world of cancers). She had it removed as a simple procedure and thought she was fine. 3 months later she started having periods of confusion or getting lost doing simple things like going to the store for milk, she would end up gone for the hours and hours forgetting why she even left the house and ending up on the other side of town. It turns out it spread to her brain and she died just 10 days after that first episode. Cancer is brutal.

I know I am going to be hated for this comment, but... Given my own experience with the medical system, I can't resist and state the (for me) obvious: Maybe that was the reason for him to pass so early...

(To put my comment in context, I was abused for a medical experiment by a high ranking doctor at the age of 7, and am 100% blind since then.)

Your point though seems to be rooted in what happened to you as a child. I'm sorry to hear it. Could you share something about what happened please?

And no, I am not going to post my personal medical history on HN in detail. My short description of the incident is already personal enough. Besides, what would that help? Everyone picks their own convenient opinion these days, all that can come out of this is that people publicly will doubt my personal experience, which is not useful for anyone.

- Correlation is not causation: A medical error, followed by a death does not implies medical error caused death

- The study that claim is based (BMJ analysis), suggest that 62% of US hospital deaths are caused by medical errors. Which seems hard to believe, especially having similar studies instead suggesting a 3.6% in UK, 4.6% in Norway, and 5% in a meta study

- Experts do not agree which facts are medical errors

Most (All?) other claims were about high uncertainty. Small Ns and possible biases in the samples, many obvious and others even irrelevant criticisms

---

There's still a lot of uncertainty, even in the criticisms.

I think they could have easily made estimations with the UK, Norway and meta study hospital data to have a minimum estimate of medical errors to counter BMJ analysis with a more reasonable number.

We really should calculate more and talk less (I am already sinning with this comment --_(=/)_--)

I did some maths (Or Code interpreter did? but I did verified unsourced numbers are in the ball park, at least for UK)

So for UK the estimate of deaths by medical errors is ~11k deaths, which puts it at the 7th cause factor according to this chart https://ourworldindata.org/grapher/annual-number-of-deaths-b... just below dementia and above liver desease

---

Keep in mind that I am not sure if the 3.6% figure really means causation, I am tired!

GPT4 chat link:https://chat.openai.com/share/7d235295-c149-45f0-ac3d-2a0cfd...

P.S: My manual summary is still more succinct and accurate (see sibling comment)

Here are the main facts presented in the article:

    The claim that medical error is the third leading cause of death in the United States originated from a 2016 analysis published in the British Medical Journal (BMJ). This claim has since spread widely in the media and public discourse.

    Medical errors are a real issue in healthcare. They include wrong diagnoses, drug dosage miscalculations, and treatment delays.

    The claim about the prevalence of death from medical errors is an extrapolation from a few studies, which were not designed to provide a comprehensive view of the situation across the U.S. population.

    The original studies used to make this claim were not designed to uncover preventable deaths specifically, but rather to gather numbers on harm from medical care.

    The studies used for the analysis in the BMJ paper often reported a very small number of deaths and were based on populations that are not generalizable to the entire United States.

    The extrapolation made in the BMJ paper leads to an estimate that 62% of all hospital deaths are due to medical error, a figure that strains credulity.

    More recent studies from the UK and Norway, as well as a meta-analysis published in the BMJ in 2019, report significantly lower percentages of deaths due to preventable medical error (ranging from 3.6% to 4.2%).

    It is difficult to definitively determine if a particular case of patient harm was preventable or not. There is considerable disagreement among medical professionals when evaluating this.

    The claim that medical error is the third leading cause of death is often used by proponents of alternative medicine to suggest that conventional medicine is dangerous.

    Comparisons of the harms of conventional medicine to alternative medicine often do not take into account the respective benefits of each.

    The benefits of alternative medicine practices such as acupuncture, homeopathy, chiropractic, and herbalism are often limited, while conventional medicine involves a balance of risks and benefits.

    The healthcare system requires continuous improvements and active campaigning, but using exaggerated numbers from unreliable calculations to measure medical errors is not a solution.

Not everyone is “picking their own convenient opinion”. There are good people in this world that just want the best for others. I think that may be the case here.

Godspeed.

I understand. I hope my request to learn more came across as polite to you. The reason for asking was to understand more about the motivations and beliefs / experiences behind your comment.

> Everyone picks their own convenient opinion these days, all that can come out of this is that people publicly will doubt my personal experience, which is not useful for anyone.

I like to think HN is a forum where this is less likely, or where poor responses are flagged or downvoted, but of course I've seen it here too, and I understand your caution.

It is well known that your psychological state influences the immune system a lot, and even from anecdata, you can see that people rapidly deteriorate when they give up. It is not a coincidence all these terms are used.

Can all cancers be beaten by sheer will? Of course not.

But it does play a huge factor in many cases.

citation needed. This meta study seems to not have found many biological links: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1361287/

https://doi.org/10.1016/j.ejon.2003.09.003

https://doi.org/10.1080/16506078809455814

https://doi.org/10.1037%2F0033-2909.130.4.601

  Brief naturalistic stressors (such as exams) tended to suppress cellular immunity while preserving humoral immunity. Chronic stressors were associated with suppression of both cellular and humoral measures  

  The more a stressor deviated from those parameters by becoming more chronic, however, the more components of the immune system were affected in a potentially detrimental way.

Meanwhile, the rest of us ride on pure luck as we watch cancer destroy our loved ones. They gave my dad a month with a glial blastoma. He lasted about 6, most of which the dad I knew was not present for. Tbfh, I feel like he would have rather gone quick, not enduring the twisted shit we watched him go through.

https://pubmed.ncbi.nlm.nih.gov/24075798/

Whether it would be too late to do anything after getting the diagnosis is another question. Studies that look at sun exposure over time and mortality (e.g. Lindqvist's studies) show that it takes decades of sun exposure to lower the mortality risk by this amount.

The way I read u/ecohen16's telling is that Mitnick first beat apathy and bureaucracy just to have a shot at mitigating a disease, thereby postponed the inevitable.

I've lived it. Late 80s, I had a terminal diagnosis. Lucky me, my doc found a clinical trial, and fought like hell to get my HMO to pay. Justification was for org to use me to learn about emerging treatment (stem cell transplant is current variation).

A few years ago, my buddy got a terminal diagnosis. Apparent chronic sports related injury turned out to be a late stage tumor, which had spread. Prognosis was 3 - 6 months. None of his care providers were interested in escalating, only talking about palliative care and hospice. He did exactly as Mitnick. Managed to get enrolled in a clinical trial using immunotherapy for his precise diagnosis. Timing wise, a few weeks either way and he'd be dead. Dumb luck.

I can give a few more examples. (And 100s of counter examples.)

Do patients beat cancer?

Of course not. Among the survivors I know, disease (like cancer) is part of life and you deal with it. Or not.

But, some times, if we're really stubborn, and have sufficient resources and support and dumb luck, we can do things to live a little bit longer.

> that did not "Fight hard enough"

Sometimes the patient, family, and especially the care providers don't fight hard enough. For all sorts of reasons. Probably because awareness of mortality made humans neurotic and we're all just winging it. Probably because everything is russian dolls of triage.

Any way, it's just a metaphor. Chose the one that works for you.

Just like I refuse to victim blame/shame, I'm not going to judge another person's coping mechanisms.

Rule no.1 Be rich.

Rule no.2 Don't be poor.

He was definitely a legend.

[0] http://wiki.cas.mcmaster.ca/index.php/The_Mitnick_attack#The...

May he rest in peace.

https://en.wikipedia.org/w/index.php?title=Kevin_Mitnick&act...

Hope he is alive and well. May he rest in peace if not

RIP

He was always generous and kind yet professional, despite us kind of fanning out. He had the ease of someone who knew what they were doing and didn’t feel they had anything to prove, which of course he didn’t.

I was looking forward to working with him more. I hate how you never know how a thing’s going to go.

Here’s to the innumerable things about modern connected society that are the way they are, whether indirectly or directly, because of Kevin Mitnick.

Can’t believe there is no black banner. This is hackernews.

https://boingboing.net/2023/07/19/kevin-mitnick-1963-2023.ht...

https://www.securityweek.com/famed-hacker-kevin-mitnick-dead...

You're right, though, about my original post -- that was my bad! I read their blurb but didn't click through the link... thank you for the callout.

Although I haven't seen an "official" statement, I believe that this news is legitimate.

RIP Kevin.

His books "The Art of {Deception,Invisibility,Intrusion}" are absolute bangers for most of the people here. Can't recommend enough

I didn't know Kevin, but am friends with Tsutomu Shimomura who worked with authorities to get him arrested. Tsutomu worked with me a bit when I was at Sun trying to get a cryptographically secure subsystem into the base system specification. It was fun to listen to his side of this story.

The 80's was a really weird time for computer enthusiasts, and it was the period of time when what was then considered the "hacker" community schismed into what today we might call "white hat" vs "black hat" hackers.

As a person who considered themselves to be part of that community I was personally offended by how the story of Kevin painted everyone who thought of themselves as a "hacker" as a criminal. It made for good story telling to make these folks "pirate" or perhaps more accurately "privateer" types in their swashbuckling ways of sticking it to the man. People would say, "Exposing security holes is like solving puzzles (which is fun) and important because if I don't do it, well somebody 'bad' will." And while I'm here, why not make it hurt for them a little bit to incentivize them to fix this problem quickly!"

I didn't disagree with the importance of pointing out security problems, but the flamboyant way it was done scared the crap out of people who were both clueless and in a position to do stupid things. As a result we got the CFAA and the DMCA which are both some of the most ridiculous pieces of legislation after the so called "patriot" act.

The damage that did to curious people growing up lost the US a significant fraction of their upcoming "innovation" talent. While not diminishing the folks who leaned in to the illegality of it.

I hope Shimomura can realize that Mitnick made him a better version of himself, both personally and professionally.

Fuck the "boys will be boys" defense, and the people who still try to defend reprehensible behavior (and ultimately their own) by trotting out that old sexist canard.

I did find the inclusion of so many details of his romantic life a bit odd. It’s not that they were graphic or anything, there was just a lot of it and it didn’t have anything to do with the subject of the book.

Each was quite good within their speciality, and kinda crappy in the other's. And that's totally okay.

It's not that he dropped out of sight, it's that nobody wanted to work with him after reading his book.

If you really want to know about "the pursuit of Mitnick," watch Freedom Downtime.

https://en.wikipedia.org/wiki/Freedom_Downtime

https://archive.org/details/FreedomDowntime-TheStoryOfKevinM...

Sharknado is closer to reality than Track Down. The cringest part is Tsutomu's fictional gf.

However my cringiest take away from the book was Simomura's detailing of what he was eating which seemed to have so many mentions that at times I thought it was a healthy eating dialogue.

You'd be better off watching Freedom Downtime.

https://en.wikipedia.org/wiki/Freedom_Downtime

https://archive.org/details/FreedomDowntime-TheStoryOfKevinM...

> The damage that did to curious people growing up lost the US a significant fraction of their upcoming "innovation" talent.

The causal leap from flamboyant hackers to the DMCA/CFAA, and then to damaging the US's innovation talent feels... speculative.

That isn't much of a leap. The penalties aren't rooted in the actual damages, because for most of this kind of curiosity-based intrusion, there isn't any real damage and the damage imputed to them is the cost of cleaning up after the vulnerability, which the "victim" ought to have paid regardless. Getting trolled by some kid isn't what costs you money, implementing a vulnerability that allows some kid to troll you is.

The reason the penalties are high is because of that embarrassment. Some major institution that ought to have done better gets pwned by some pranksters and they lose face. So they want to throw the book at the guy to deter anyone else, not from maliciously causing them undue harm, but from making a fool of them in public.

But blaming the youth for bragging about it is blaming the victim. The perpetrators are the institutions that abuse the law, and the process of creating the law, to severely punish not evildoers but the child who points out that the emperor has no clothes.

> and then to damaging the US's innovation talent

These are the laws they use to charge the likes of Aaron Swartz, are they not?

The government is a lot more concerned with the image, and its effect on trade, over the substance.

It was pancreatic cancer, which is the deadliest cancer. It kills very quickly and as far as I know, it's impossible to cure.

It killed my mom: 3 months between diagnosis and death. She didn't want treatment because it couldn't save her; it would only postpone the inevitable and she didn't want to spend the rest of her days in hospitals.

Cleared by 2nd round of medical professionals to make the MAID decision on a Wednesday, so - we scheduled for Friday - he passed away naturally Thursday morning.

https://wikileaks.org/wiki/Steve_Jobs_purported_HIV_medical_...

Conclusion is that the documents shouldn't be taken at face value... so maybe not?

However, if he was HIV+ I can totally see why it would be covered up.

I guess it's a big question mark, but it's not unbelievable.

That said the following is me talking out my ass, but I have followed a very few number of pancreatic cases - jobs being one... and there is one anecdotal that I would hope people closer to such cases can chime into ; how much wine did these people drink (jobs was a prolific wine drinker)

Im wondering if sulfates from wine are a major player.

https://www.distractify.com/p/patrick-swayze-alcoholic

As you stated "*I need a lot of evidence*" - which is exactly what I am asking for. "Moar evidance"

And sulfates may not be the right metric...

So if we can fully identify dietary commonalities of pancreatic cancer patients, then we can get a little farther down this path to understanding...

What would be the most amazing use of "AI" would be to have a biological model of a pure human body (as far as nutrients and blah blah are concerned) - then cycle through feeding that biology various substances and seeing how it propogates through the system)

And I didnt meant to narrow - it was the more famous of what you states, and thank you.

My money is on tannins, but that is just me...

I work in healthcare in one of the wine capitals of the world, Napa County, CA.

We do not have a higher rate of pancreatic cancer than anywhere else. It is average. If sulfates from wine were a factor, it is quite likely that we would have seen a higher rate of pancreatic cancer here.

https://www.countyofnapa.org/DocumentCenter/View/11029/Main-...

RIP Kevin, hearing your stories and the movie Hackers was a huge inspiration in me getting into what we do.

https://www.mskcc.org/news/can-mrna-vaccines-fight-pancreati...

https://www.hopkinsmedicine.org/health/conditions-and-diseas...

Were you offered any kind of genetic testing?

https://www.cancer.gov/about-cancer/causes-prevention/geneti...

Source: experience.

Tools like traceroute cannot show you where your traffic is physically being sent because: there may be no geographic information in the router reverse DNS records, that information might not be accurate if it is present, and layer 3 tools cannot show you the underlying layer 1/2 path (which might be wildly different than the layer 3 hops would suggest.)

For instance, part of the tracroute from my house to Google looks like this:

6 be-33112-cs01.doraville.ga.ibone.comcast.net (96.110.43.81) 19.602 ms

7 be-33142-cs04.doraville.ga.ibone.comcast.net (96.110.43.93) 22.738 ms

8 be-302-cr13.56marietta.ga.ibone.comcast.net (96.110.39.49) 23.202 ms

You can see these hostnames are obviously meant to encode some geographic data -- strictly for the convenience of the provider, it doesn't mean anything else -- but you, as the user, cannot tell from these records that these routers are actually where you think they are, based on the host names.

Another issue is the server you're communicating with might take a completely different path to get back to you, and you'd have no real way of knowing that.

I was just a teen at the time, things could have changed.

It is very difficult to see how that is the case when pretty much every functioning nation has substantially similar laws.

I was once tasked to work with TPM 2.0 provisioning in an embedded position. They specifically chose me and pulled me from another team because of my skills in cryptography (I wrote Monocypher). Fast forward a couple weeks, I notice that the way the provisioning was specified, it would allow us to provision a fake TPM without noticing. My team lead didn’t believe me.

Sometimes later we had an actual provisioning procedure in place, and what do you know, it worked to completion even with a fake (software) TPM and a real certificate from the manufacturer. Because, well… we just didn’t compare the relevant public keys. My team lead was still sceptical.

I had to mention the issue in a meeting with some higher-ups and the security guy to be allowed to fix the problem. I believe this goes a bit deeper than a status game. I think it’s downright magical thinking: this hope that ignoring problems (especially vague threats like security vulnerabilities), could make the problem actually disappear.

I completely agree. There was a time when hacker did not mean criminal. That was the time during which Kevin was active. It was also the time during which I was active, not that that matters right now. But there was a rapid shift from computers being something you could explore to if you're exploring that then you are a bad person. And I also agree that trying to scare policy makers isn't necessarily going to work because they don't understand what they're scared of. Curiosity is no longer rewarded in general in our society.

Those of you who don't think what Kevin did was important, there seem to be a lot of people discussing him, aren't there?

I was escorted out of my job as a shipping clerk in 1999 for creating an entry in an NT 4.0 group with my name in it to impress the IT Admin so I could get a job in the computer department.

Does anyone know where this samples comes from?

about sample, i thought it was hacktivists recorded protest on television but 'this is digital hijack' doesn't fit into it.

search leads to etoy project https://etoy.com/projects/hijack/

and to book: Contemporary art - an introduction, page 129 (google books/search); "Artists have inhabited online space alongside corporations that made concerted efforts to force the change from forum to mall. That commercial colonisation has been a rich subject for net artists who have produced many sharp and sophisticated pieces designed to draw the shopper up short. One of the most notorious was etoy’s Digital Hijack which diverted surfers who had typed in keywords such as ‘Madonna’, ‘Porsche’ and ‘Penthouse’ into a search engine, and clicked on etoys’ top-rated site, being greeted by the response: ‘Don’t fucking move. This is a digital hijack’, followed by the loading of an audio file about the plight of imprisoned hacker Kevin Mitnick, and the hijacking of the Internet by Netscape (Stallabrass, 2002: 226). Mitnick became a cause celebre for the hacking community, and for those wishing to ensure freedom of expression on the net generally. "

this part is interesting: "followed by the loading of an audio file about the plight of imprisoned hacker Kevin Mitnick" hot!

after quick exploring hijack.org it seams that sold very cheap flexi record with song titled "the digitalhijack-song" but website doesn't have any audio files to check.

searching further, internet gave copy of etoy digital_hijack, https://www.ubermorgen.com/digital_hijack/track/track.html

only one file work and its cut: https://www.ubermorgen.com/digital_hijack/track/s_this_is_hi...

but ! its possible to search for file digital-hijack.mp3 on p2p media sharing platform which name begin with "So" ;)

Beyond that I remember reading about him in 2600 and my mind being blown. He definitely helped leave the world we live in better than when he found it.

I told him, this was the 'hacker' of the 80s, read how he managed to 'hack' all these places. My father replied, "I'm pretty sure I won't understand anything he would do". Me, "Just give it a chance, you'll be surprised"

When he gave the book back, I asked my father if anything Kevin did my father wouldn't have understood. My father said, "I understood everything he did". I asked, "Now, when you get a call from someone you don't know claiming to be an authority figure, what do you do?". Father: "Hang up"

He called someone, claimed to be an authority, knew the lingo, asked for help and time was the critical.

Someone calls your parents and claims to be an authority figure, that there is a crisis, and they must act now.

How would you classify supply-chain attacks?

Primary security was bypassed by breaking secondary security .. so there was security to be overcome, there was no social engineering aside from understanding procedures in play, and no disgruntled employees.

https://www.techtarget.com/whatis/feature/SolarWinds-hack-ex...

https://forensiccontrol.com/guides/unravelling-the-moveit-ha...

Over time they got more interesting and less like the "basic unsophisticated | opportunistic | social engineer | inside agent" description given above.

https://en.wikipedia.org/wiki/Lazarus_Group

Back in 2003 or so, my boss showed up at my desk at work, and looked like he was about to blow a gasket. There was a hack that was on the news, and it was getting featured in news stories all over the world.

He basically said he was going to fire me if it turned out it was my fault. (I built the servers that held the data that was compromised.)

Within a day, it turned out that it wasn't all the data, it was just one person, who had a lot of famous friends.

What had happened was that someone had accessed her account. The way that they did it was by guessing her password. Her password was the same as her dog's name, and she was a celebrity known to be seen at events with her dog.

Read Ghost in the Wire as a young man and it inspired me to get into computers

Rest in Peace, brother

Kevin Mitnick defined an era of computing. He inspired me to be curious about computers.

It’s sad he was taken so young. May he RIP.

Hopefully some of you on HN can check your insensitive remarks for a few minutes and respect a fellow human.

He lived about a year after his diagnosis, which occurred when he was jaundice. His health / quality of life was ok after, some weeks were good, some were bad, but yeah it was stage 4 when they caught it, and there is / was only so much you can do, especially 23 years ago.

Fun Fact: He worked on the Univac! Spent his career with Unisys afterward.

RIP Kevin, we’ll miss you so much.

Many many years ago, during undergraduate days, I used to study "Art of Deception", wanted to became a security hacker one day.

Now my topic of interest has shifted. Nevertheless, that book still reminds me that human is still the weakest link in security chain. You don't have to be super smart in exploiting code.

Hopefully our paths will cross again.

Rip. I've read Art of Deception in high school and I think it had a lasting influence on me. It reads like a collection of interesting stories. I recomend that book to everyone, especially to people outside of tech.

he gave us permission to explore the darker underbelly of technology and was emblematic of a freer (free as in freedom) time on the internet. yes, he was a convicted criminal, but he was also a complex character who loved to solve puzzles and his competitive nature ultimately drove his work.

the famous story of the fbi showing up at his house and kevin saying, "no problem, I'll report to the fbi office tomorrow"... yeah, that didn't work, but he was the type to try and that was beautiful.

I had learned about Mitnick few years prior to the movie and was fascinated by his life story and what he had done up to that point (including his "takedown" by the FBI). It's an understatement to say that his work, character and some sort of positive social manipulation put a great influence on my upbringing and later my professional career. Back then I enjoyed playing pranks with my friends and "hacking" them with all sorts of trojans and ejecting their CD roms :)

I am very sad to hear that he's gone. RIP Legend.

Back when he started doing consulting I ended up spending some hours on the phone with him over a week or so as an evenings/weekends side project (I had a more than full time job too). He seemed like a nice enough dude, basically a middle aged guy trying to put his life back together, and he was understandably not up to speed on web app security due to his recent stint in prison. I don't think that business ever panned out but he eventually pivoted and built a multi-billion dollar company around the concept he was known for (social engineering).

The second is embedded in his somewhat famous lock pick business card. It turns out those cards are a direct copy of a friend's card, conceived by me, designed by a second friend, and inspired by a third friend who'd discovered the shop that did etched steel cards. Kevin's card traded in usability by shortening the tools to make more space for contact information. Regardless, his ability to capture the spotlight helped ensure his version is by far the best known.

RIP.

The man who could whistle the nuclear codes has passed away. And now maybe I can strike the social engineering village before the sun comes up.

Cancer, if detected early, does not have to be a death sentence. In fact, many forms of cancer are treatable and even curable if caught in their initial stages. Our advancements in medical science and technology have indeed made it possible. Yet, they can only do so much if we, as individuals, do not take the responsibility of regularly visiting our doctors.

Never met the guy but you’re damn right I know who he is. And I come from the middle of nowhere.

https://twitter.com/kevinmitnick/status/551997777031340032

So many memories from way back, reading up on his story (and stories), reading his books, watching "Takedown" over and over again ...

No matter how polarising he was, his influence in the field and in leading many young people to get into computers and turn that into a career is unquestionable, imho.

RIP

I had a printout of the MIT guide to lock picking and used to try out stuff with some hand crafted "tools". I'd forgotten about Mitnick and later (probably via. Slashdot) came across his site again and saw this https://www.mitnicksecurity.com/kevin-mitnicks-famous-lockpi... which suddenly brought back the same image I had formed about him. Playful to the extent of not caring, irreverent, and curious.

Rest in Peace.

Pancreatic cancer is terrible. Hacking the disease with RNA would be the better homage possible to Mitnick. Lets pray for the vaccine coming soon.

https://www.nih.gov/news-events/nih-research-matters/mrna-va...

I do like some of his approaches to life. There are some similarities between him and Richard Feynman.

Who comes to mind if I would like to follow some still living people that has this rebellious, "joire de vivre" way of life?

What a strange way to phrase it. Why don't they mention his sister first? Is it plain sexism or were they in bad terms?

I have a brother-in-law; my wife's brother.

RIP Kevin.

"Sorry, you have been blocked"

"You are unable to access dignitymemorial.com"

;)

https://www.engadget.com/kevin-mitnick-formerly-the-worlds-m...

https://boingboing.net/2023/07/19/kevin-mitnick-1963-2023.ht...

RIP Kevin

He was kind of role model for me, i was inspired by the way he saw the world, in everything he was able to see hole and flaw and how to exploit them. Where "normal" people just don't think about it.

His stories and mischiefs will be missed for me.

Thanks for all you taught us Kevin, and thanks for being a beacon of curiosity and exploration.

Too young

A link to his famous business card which doubled as a lock pick kit. Rip Kevin.

I wrote more about it here:

https://henrikwarne.com/2015/12/27/social-engineering-from-k...

"FREE KEVIN" :'(

Hope he can hack his way into heaven.

RIP

A hacker far before it was cool.

A pioneer in so many ways.

A hero as I was growing up.

o7

He said "that's really cool" and signed a copy of Ghost in the Wires for me.

Really incredible guy. Rest in peace my friend.

I hope his family is doing well.

No disrespect to the dead, but I always thought he kind of lived in a lame timeframe. It used to be a lot easier to do what he did. If you check the terminal logs, he was a script kiddie at best (I know he's more famous for the social engineering). How many CVEs did Mitnick have to his name..? (AFAIK, zero)

Anyway, I'm prepared to get some downvotes but do check out the logs. It's pretty entertaining regardless.

I first heard of Kevin Mitnick in the early 2000's when I was watching "The Broken" with Kevin Rose and he interviewed Mitnick in one of the episodes.

I was 14-15 years old at the time! Wow!

Episode: https://www.youtube.com/watch?v=rcWByfwkf4k

He was so meticulous is setting up new identities and moving to random places around the country to avoid the authorities. But would then log back into his previously compromised systems in a way that would expose his current geographic location. It always seemed like such a glaring hole in his otherwise well thought out personal opsec. I'm sure the story was more complicated than what appeared in the press at the time, or in the 2600 knock-off zines that were going around at the time, or in his books. It always confused me. I could never figure out if that was an oversight, or he just wasn't aware he was being watched.

I think I share a similar pendulum swinging feelings about km as other folks here, especially as his story unfolded across many different phases of my life: from adulation as a teen, to realizing that he was just another a*hole who would lie to your face to get what they want. Recently it has swung waaay back the other way -- especially as more of our access to customer service for critical aspects of our lives get buried behind obstructionist systems -- to understanding that we always need people who can tear any system apart.

As an addendum...I think the term hacker should be handed to the sys admin that started was instrumental in getting km located by (If my foggy mind remembers correcly) by emailing logs or log stats to himself and noticing that size was shrinking so someone was deleting them -- that blew my mind at the time.

He will be missed.

He was not prepared for four years of solitary and unconstitutional delaying of his trial. He did not ultimately have a game plan for what to do if his opponent cheated.

If the government had acted justly (that is, according to their own laws) he would have been found innocent and walked at his trial. However, the prosecutors lied, they cheated, corrupted the system they claimed to protect, and that was it. Game over, no redos.

I wrote "Free Kevin Mitnick!" with a black marker on my tshirt and was walking around my town proudly wearing it. Nobody understood anything about it but it made me feel like involved into some secret society.

Next year I convinced parents to pay for me learning QBasic (the only computer course in my town back then), and 3 years later I got into university on an Information Security specialization. Some of my friends say that I was the reason why they got into IT. Well, I guess we all owe that to Kevin.

I talked to him in person once at a conference and was happy like a little puppy, but being socially awkward as I am I didn't tell him that he is my childhood hero. I hope now when he has trandcended to the cloud, he has a bird's eye view on our realm and can see all the positive impact that he had had on my life and lives of people I've influenced...

The very brightest memories

https://archive.ph/13uNy

Raising a child is more than genetics.

I never did get to meet Kevin, but it's clear that I missed out on an amazing person. RIP Mr Mitnick.