Gone straight

06.02.2006
In a Q&A session, Kevin Mitnick, once a notorious hacker, now CEO and founder of Mitnick Security Consulting LLC, gives us an insight into his life as a hacker, and how the hacking community has changed.

Q. What drove you into a life of hacking?

A. When I was a kid I started phone freaking - basically playing pranks on people over the phone. However, as the telephone network became more and more computerised, I started taking a liking to the actual network. I wanted to know more about how the whole thing worked, and it just kind of seduced me, I guess.

Q. What was it like not being able to go near any electronic equipment - not being able to further your education, or work as a simple cashier?

A. Not being able to go near any electronic equipment was very frustrating. The prosecutors and judge said it was completely fair, as they needed to protect the public from me. The fact that I was not allowed to use a computer meant that I could not do any research, so therefore could not further my education. I could not even find a job as a cashier, as I would be using a cash register.

I was only allowed to use a notebook after two years, and I am banned from publishing my autobiography until January 2007.

Q. Are you going to publish an autobiography?

A. Yes, although I have not started working on it yet. I will, hopefully, get a chance to start once I arrive back from SA.

Q. It almost sounds as if the authorities could not quite grasp where your hacking abilities were. I read somewhere that people thought that you could launch a nuclear missile attack by simply whistling in the phone?

A. I do not think that it was a case of them not being able to grasp my hacking abilities - they knew I was some sort of menace to society. But what you mentioned above is quite true - and actually quite funny - imagine being able to launch a world-wide nuclear attack by simply whistling into the phone! This was just a ploy by the prosecutors to try and sway the judge more in their favour.

Q. You are known as a notorious hacker. You now run a security firm. This is quite a transformation. What does it feel like to be working on the other side of the fence? Do you miss the thrill of hacking? Any speculation?

A. I am very glad to have made the transition. I enjoy contributing something to the public. It is actually not that uncommon for a hacker such as myself to turn, and many hackers are turning to a lawful life. In response to the second part of your question, working on the other side is much the same as what I was doing before - the biggest difference being that I am now doing it legally. And yes, there is a lot of speculation from my competitors in the security field, many of them do not trust me because of my past.

The thrill of hacking is still there, finding weaknesses in a company's firewall still gives me that kick, however I am doing what I love, and I am now doing it to help people and companies, instead of merely for my own gain.

Q. You are coming to a security event later this year. Is there any particular message you hope to leave with your audience? Any key points/issues you think administrators should look at?

A. Well, I hope to leave South Africans with the message that they need a meaningful and secure system - and want to concentrate on the 'human factor'.

The human factor is that even though an administrator can have a very secure network, the employees could inadvertently give access to a hacker. One such way is through 'social engineering', which basically means the hacker gains the user's trust by posing as someone such as an administrator, and asking the user to log onto some Web site and download a 'patch' which actually turns out to be a key logger. I also want to highlight the security aspects of the wireless network.

Q. What changes have you seen in the security industry, and are we going to win the war on hackers?

A. The security industry is basically the same, yes the technologies have evolved somewhat, but so have the hackers and their techniques. It is a vicious circle, and I think it will continue that way for years to come.

Q. Has the hacking community changed at all?

A. Yes, the actual community has become smaller, underground companies are hiring small gangs of hackers to deface and fraud companies all over the world. Hacking is now more of an organised crime than anything.

Q. Internet banking and online shopping are the craze at the moment, yet the general feeling is that it is still not that secure. Do you use Internet banking, and, if so, do you trust it?

A. Yes I trust it. I mean you as the consumer do not really take the risk - it is the bank that does. If your credit card gets nailed, you just have to tell the bank and it will take the knock - not you.