Skip to main content

tv   Book TV  CSPAN  December 31, 2011 11:00am-12:00pm EST

11:00 am
it's heartbreaking, brutal stuff that doesn't necessarily reflect him well. but they were willing to show me be everything because i think they want to share that he listens to everything. >> host: and, again, how many does he respond to? >> guest: so, he usually responds to one or two a night. and some of these ones that he responds to really become almost transformative for him. you know, there's a cleaning woman featured in the book from ohio who writes because she's just been diagnosed with leukemia, and she doesn't have health insurance. he then comes to her hometown and gives a big speech. they stay in touch and write back many times. you know, and he sort of makes her the icon for his health care reform. and most of these stories are like that. the people he writes back and forth with many times. >> host: eli saslow's new book, "ten letters: the stories americans tell their president." ..
11:01 am
it is fantastic to be here. "ghosts in the wires" took two years. myself and my co-author bill simon bloggers will raise your hand, worked on this. [applause] i couldn't have done it without bill. we had much -- we had different work schedules. i usually slept in until 2:00 p.m. and worked until 5:00 a.m. and bill look of the 6:00 and worked until 6:00. i'd put him on spanish time for
11:02 am
two years. ready for the second edition? if you know my background obviously was a computer hacker that ended up in a lot of hot water. for seven years i restricted from writing this book. i was released from custody in 2000. in 2007 after seven years i was permitted tell the story. how i started with computer hacking was really from my love of magic. as a young kid ten years old used to ride my bike to the magic's board just to learn how the tricks worked because i was so fascinated with it. than when i entered high school. you will probably read a lot of this in the book. i met this kid who could do magic with the telephone system. was what you call the phone phreak. everyone read 2600 magazine? a few. he was able to do really
11:03 am
incredible stuff. for example i call forwarded my numbers somewhere he was able to break through. my parents had an unlisted number. the wiki could get it in 15 seconds. one day he said i will give you a cool trek. you call this telephone number, wait for a tone and put in five digit and you can call anywhere in the world for free. i go how does that work? must be a fluke with the phone company. later i learned it was some company's mci code. he showed all the schools things he could do. all these cool things he could do. i've taken aback by this technology. he showed me how to get information from the phone company. he could get a name or a friend's name and get the non published number. like the kid had full control over the phone company. i became a phone phreak.
11:04 am
but i loved -- what i used to do is call friends. one of my favorite prank was to modify my friend's phone service on the phone companies which so whenever he or his parents would make an outgoing call it would say please deposit a:coin. unable to enter the directory assistance. anyone calling directories assistance in providence. this will road widened rather than getting the operator they got the. you can imagine when you were 16 years old how much fund you could have with that and i did like what city bleak will providence. delay i have the name, bill smith. that number is 554-21/237. and she did know what? how wide dial 1/2? you didn't get the new phones. you have to go to the phone. i got into ham radio.
11:05 am
ham radio opened a whole new world for me. with my prankster persona and did my favorite hacks of all time. my favorite was actually to mcdonald's. imagine a customer drives up to the mcdonald's drive up window and i am sitting across the street. i could overpower the guy with the headsets in mcdonald's and see the mcdonald's customer service person. imagine what fun you have. i would like a big mac and large fries and we don't serve hamburgers anymore. we now serve tacos. police would drive up and ok, get rid of the cocaine. they are take your order? i could see the poor guy inside mcdonald's freaking out because he could hear everything that
11:06 am
was going on but couldn't stop it. 16 or 17 years old one of the pranks in the book is a customer drive forward, may i take your order please? we are offering free sausages. would you like a free apple juice? yes. our ice machine is broken. do you like small, medium or large? large. it is free. and play a recording of what sounded like being in a cup. please write forward. after irritating mcdonald's so much, the manager comes out of the store. in to every car in the parking lot trying to find the culprit. i was across the major street. he walked over to the speaker in the drive up window and puts his face so close that i couldn't resist. what are you looking at! and this guy flies back 10 or 15
11:07 am
feet stumbling. like the mcdonald's drive of window is possessed. so anyway, i pushed the envelope. after i got involved with hacking, mainly my hacking is more control over the phone company's system so i could play more francs and i got involved with packing all the phone companies in the united states and i started really pushing the envelope because i was having problems with the phone company security department to the point where when i was 17 years old sent a letter to my mom, we are removing your phone service and my mom was so angry with me that she grounded me. but i said don't worry about it. i can get our phone back. we live in a condominium complex. area that number was 13.
11:08 am
i called the phone department of the phone company that does provisioning for new line that said there was a new unit being provided the property. the unit was in 12 be. go ahead and provision it. a few days later i went to the hardware store and took down 13 and put up 12 be and ordered service for unit of b. i guess i had a little bit of chutzpah because i asked for a special number and asked i would like a number ending in 007 because my favorite shows were james bond. she says what is your name? jim bond. i would like a number ending in 007. she didn't even flinch. at an end of the conversation that that make the listing out to my real first name which is james. i had a number james bond 895-8007. we had that number for three weeks before the phone company
11:09 am
got wise and the phone went dead. six months later they gave us phone service back. at one point in my life i was arrested for hacking individual corporations and the government at the time needed to set an example for we have this behavior, this hacking is scaring us. we need to set an example for everyone in the united states. i remember when i was going for a detention hearing. a bail hearing in the case the federal prosecutor told a judge that no only do we have to detain mr. mitnick but we have to make sure he doesn't get near a telephone in prison. the prosecutor said the reason is mr. mitnick could pick up a phone, dial into norad and whistle the launch codes.
11:10 am
i am in court and i actually laughed because i thought was incredibly stupid of the guy and figured he would lose all credibility and wouldn't you know the judge bought it hook, line and sinker and i was in solitary confinement for a year. would you think putting someone like me in solitary confinement was going to stop me? no. they have a special list of phone numbers i could call. the marriage didn't work out because i will in custody but that is another story. as you can imagine. i was allowed to call my attorney, my mom and my aunt and i was in high security. before -- when you are moved from outside yourself a handcuff you and shackle your legs and move you to a phone room which has three pay phones on the wall and looked in a book and say what number do you want to call? i want to call mom.
11:11 am
he would kahlo -- dial the number and hand me the phone. and point three four feet and would take his eyes off of me. i am thinking how can i defeat this? the court was quite long so i walked back and forth scratching my back and rubbing my back against the phone and got a guard used to this behavior and i actually put my hand behind my back and could feel the switch hook. and i thought one day i was in a conversation and ended the call but kept talking as if the call didn't end and what i did was i leaned back and pulled down the switch and put my arm in front. 18 seconds before the phone would go be so i knew this from my phone hacking experience. took five seconds to scratch my back again and dialed 0 plus another phone-number and the next thing that is going to
11:12 am
happen is an operator will say who is the call from so i said tell uncle harry kevin says hello. that is when the operator goes to is the collect call from? i was able to call anywhere, anybody that would accept a collect call while on high security on a court order phone restrictions. that lasted only a few weeks. one day my cell door opened. it was the executive of the prison. they shackle me up and put me in this attorney/planned conference room and sit me down and the captain goes how are you doing this? i got my doing what? you are read dialing the phone. our officer is watching you and somehow you are read dialing the phone. i said i am not david copperfield. i don't know what is going on with your monitoring system but i don't know what you are talking about because of course i am in custody. why would i admit anything? two days later i hear some
11:13 am
commotion outside the door of my cell and specific telephone in stalin a jack. maybe these guys are installing a phone in my room so they won't have to bother with me anymore but i learned what happened the next day when i had to make a phone call and the guard plug the phone into the jack. they had a 25 foot had such cord. they placed the had set for the -- it reminded me of silence of the lambs and hannibal lector. one of my favorite hacks of all time not because i am proud of it but it illustrates a technique i have throughout the book called social engineering. where you use manipulation, the section and influence to get someone to do something they wouldn't ordinarily do. hackers as the password and 85% of the time, or get someone to do something to let the attacker
11:14 am
in. today they have a thing called spier fishing where an attacker will do some research, find somebody that works within the companies they want to compromise, find out who that person deals with, vendors and suppliers and customers and other facilities of the same company and manufacture an e-mail and send a booby trap edf file and it is booby trapped so when they open it exploits vulnerability and the hacker is connected to the internal network. that is an example of using social engineering to get somebody to do something that will give the attacker some benefit. so let's go back to 1993. i am living in denver, colorado. i was living under kevin mitnick. there were federal law enforcement agencies that wanted to talk to me and i didn't want to talk to them.
11:15 am
i was using the name eric weis. does anyone know who that is? harry houdini. i thought i had a sense of humor, but the fbi has no sense of humor. one of the guys that work in the it department handed me this brochure, the ultra light cellphone. this is the iphone of today. if you are a tricky fan reminds you of the star trek communicator. as a hacker, i wanted to understand how this worked. my number one driver was the pursuit of knowledge. i have a curiosity and i like doing things i wasn't supposed to do for the fun of it. wasn't about stealing money. i wanted to get access.
11:16 am
you can't call motorola and say i want your -- the code is proprietary. remember the orange julia powder? same concept. while i was in denver working at the law firm i walked across the office at 3:00 in the afternoon and called directory assistance for 800 numbers and got the number for motorola. i asked the operator obviously for the number, i am looking for the project manager of the ultralight project. the nice receptionist told me all the developments are handled out of illinois and asked if i would like the number. of course. i called that number and got the same story. looking for the project manager and i am transferred two or
11:17 am
three or five or eight times and talking to the vice president of research and development for all of motorola. all of their mobility devices and i said this is rick in arlington heights. in my previous phone calls i found out they have an r&d facility in arlington heights. i am looking for the project manager and he goes that is ham. she works for me. can i get her extension? sure. extension is such and such. can i touch you with anything? i set i will deal with ham but thank you very much. so i called pam and instead of getting pam i get an outgoing reading on her voice mail and told her callers she left on a two week vacation and if you need any help whatsoever to please call extension blob blob blob. that was the voice mail. who is my next call to? a lisa. i called a lisa.
11:18 am
this is a wreck with r&d in arlington heights. did ham leave on vacation yet? she did that before she left she was supposed to send me the source code for the ball sea-tac all for a light. walking by -- this time i am walking down broadway in downtown denver. warns were honking and i was trying to press the cellphone i was using really tight to my years so she couldn't hear the traffic. i was never expecting this to work. this was extemporaneous. she goes what version do you want? i don't even know their version number. it and check. how about the latest and greatest? she was typing on her computer and i could hear the key clicks going and she goes i found the latest release of doc 2.
11:19 am
and there's a problem. what is the problem? she goes there are hundreds of directories and within each directory there are hundreds of files. that is like wind is under windows. she goes know. would you like to learn? i could teach you? i would love to learn new things. so i became her instructor for the day and at the end of that day's lesson we had a three metlife file that contained the source code to the phone not wanted to study to understand how it works. my next question was do you know how to use ftp. file transfer program? precisely. after i am walking down i did prepare for this. she is going to send me the code. i couldn't send her by posting a hacker@colorado.edu. that is outside motorola's domain but i had a great memory
11:20 am
for ip addresses. are had anonymous accounts and gave her the ip address and when she tried connecting to would it would time out. she tried four times and then goes are am disappointed. , going to get the file? she goes par have to talk to the security manager what you're asking me to do because i think this is a security issue. i go no, no, weight and i am on hold. oh my god. the date is up. you know when you are waiting for somebody to return to the phone and seconds feel like minutes. are walking down the street on the way home to my apartment and it is five minute already. motorola is already hooking up the tape recorder. this will be exhibit a for court case later. she comes on the line and i don't actually talk. i talked to my security manager about what you're asking me to
11:21 am
do. the ip address is outside motorola's campus. notice i am not talking. she said the security manager told me we have to use a special proxy server to send files outside motorola. i go on home. i don't have an account on the proxy server. i guess i am sorry for moving back and forth. that have an account on a proxy server but my security manager was kind enough to give his personal user name and password so i could send you above file. i put the key in the front door of my apartment in denver, colorado. think about motorola. they are great company. they have the best securities that money can buy. firewall, intrusion detection. they didn't train their people well enough to fall for a gag like this and i ended up getting prosecuted for it. but it was so damn unique to do.
11:22 am
so easy. so eventually i became a fugitive. a lot of the book covers my cat and mouse with the fbi. the fbi sent an informant to help them nabbed me and i was able to figure out that this guy was truly an informant working against me and i was so curious what was going on i had to know if fact into the local cellphone provider kind of like at&t or t mobile. this was tactile cellular and i was able to identify the telephone of the fbi agents that were chasing me. i was able to do traffic analysis on the phone so i could see who was calling them at his they were calling it to were those people calling and i was able to get location information, watching the fed
11:23 am
trying to capture me and play this cat and mouse game. eventually i was able to set up the device at my office, working as a p i los angeles and set up a device. the fbi funds came in one or two miles of me it would send me an alert. part of my fbi early warning system. on september 28, 1992, walking into the office early, i've put in the code and keep hearing this be, what did they do? change the code? as our walked into my office the beating is getting louder and it is coming from the office and someone has a tracking device in my office. i go to my computer and is actually -- detected an fbi cellphone within the area two
11:24 am
hours ago. i figured out the fbi did not come to arrest me. they came to search my apartment. i wanted to help the mouth so i bought a big box after cleaning my apartment out, making sure there is nothing interesting. i got a big box and put fbi doughnuts on the box and put them in the refrigerator and they came to search and got irritated when they found a box but i was in this insane cat and mouse game with the federal government. eventually as always the fbi always get their man. i was arrested in 1995. they threw the book at me. i went through a long process dealing with the federal government. finally settled the case. three months after i got out of custody, who was calling? senator fred thompson and joseph
11:25 am
lieberman. they want me to come to washington to advise them how to protect any computer systems don't or operated by the federal government. i thought that was quite an honor. i was flattered that i was walking out of custody after being a bad hacker and the government was not asking me for my help. i went and testified and offered all the advice i could and i basically from that point became an ethical hackers. now i hack into systems all the time. a few days ago are broken to a server. the only difference is now i have authorization that the company allows me to hack in to find their security to fix them before the real bad guys break in and caused damage. a little about my policy. i have a system of demos to show you. when i do speaking engagements around the world nothing makes the audience happier than hacking demos. interested in taking a look?
11:26 am
perfect. six months ago i had an assignment to break physically into my client's building in san diego, calif.. have you ever seen at least a lot of access devices that are physical in these cards? this device -- i didn't build it. i simply bought it but it is available. a card scooper. of i can get close enough to someone wearing the card i can steal the access credentials and replace them into the device. if you are wearing a suit, you put this in the pocket, rub this up the sleeve and tape it. how are you doing? tap somebody on the shoulder and
11:27 am
won't be close enough to capture the credential. kind of cool. let me see. art have three demos to show you. this is the old -- this is like a hit reader. pay attention to the screen. hold on a second. murphy's law. where is my mouth? i think my machine froze. one second. are don't even see the mouth. is that there? do this right. there it is. all right, all right, all right. who is hacking into my machine?
11:28 am
all right. this is like a card id. 64038 and a site is 113. you have seen this a lot of doors around new york city so imagine i am a bad guy and i want to see all the credentials of this card so all i have to do is set this up and have this battery pack. obviously not going to carry a computer with you to do it. kind of like a magician, this is the antenna where you want to steal the credentials. how it works is pressed down this button it basically goes into a mode where one l e d is lit. if you pass it in front of the device there should be anything there. hold that up for me. i forgot -- nothing is there because there's nothing to
11:29 am
replay and what i do is i pressed down here and you will see another l e d. now it is in listen mode so it is waiting for you to steal the card credentials and pass it through and look at that light and touch the card and you will see the light goes off. it stole the credentials. now i want to -- now i want to use them. press the button again and it is in play mode so it is set up for a new system. sold the credentials. right? this is called an age it card scoopers so somebody is getting too close to you and patting you on the back and you have around the neck they might just be not really a good friend of yours. might be trying to steal your credentials. i use this in security assessment when companies hire me to break in. i find restaurants, starbucks where employees are and lots of them are wearing them on their
11:30 am
hit rather than around their neck. takes a second brush by the men's still there card credentials and i am done. kind of cool. let me show you another cool one. this is called -- everyone has heard of fishing bleaker still right? ever get an e-mail from citibank, ebay or paypal telling you there's a problem with your count, please click this hyperlink that brings you to a page that definitely isn't paypal or ebay. it is the scanner trying to steal your credentials. the industry has pushed the bubble or fraud on a fishing. it pops up somewhere else. now fischers are using the voice response systems to scam people. ever call your bank, never get a person any more. you get an automated system and they want you to insert your
11:31 am
credentials, account number or password and if it is correct they transfer you to somebody. imagine i could send you an e-mail, make it look like it is coming from your financial institution but instead of asking you to click on a link because your asked not to do that. everyone is smarter than that and not going to flop a form that there's a problem with your count, please call us within the next 24 hours or your account will be terminated. one of the chances -- let me show you what happens if i send you the e-mail and you call your bank. watch the screen. try to put this on speaker phone and this actually works so everybody can hear it because i don't have a phone here. what we are going to do is call chase. anybody have a chase card here? i don't know why nobody
11:32 am
volunteers. i have one. imagine getting an e-mail that says to call chase. is the number on the back. put that on speaker phone so you can hear it. then i want you to watch my computer as it happens. this is the real thing. >> credit card service -- the last four digits of your credit card account number. >> credit card account number. that is weird. >> we are sorry. the number you entered was not recognized. please enter your full 16 digit credit-card account numbers. >> some put in their credit card number. put your pans away. capturing the card number in
11:33 am
real time. >> please enter your zip code. >> that is how i authenticate with my zip code. 89074. >> to speak to an adviser please press zero anytime. your current balances 11,000. >> that is a big balance. expensive hotels in new york. anyway, how this actually works is a man in the middle attack. i give out a telephone numbers that looks like a toll-free number. when the victim calls they are calling my no. i have control of. it connects to a system and my system calls out the real bank. i am the man in the middle. i can do all the transaction to the customer service rep. and get your credentials. there is no way to detect this. the only way to detect it is to be worried if people send e-mail that check to make sure the
11:34 am
phone number belongs to the bank. the way hackers were doing this before and i thought of this as a better system, set up open source edf. a call banks bleed and credit-card companies and what they do is set up their own numbers so it sounds like the bank but if you put in your real credentials it doesn't work because what they do is basically say we are sorry, there is a problem with your count. please talk to our customer service rep. and we will transfer the music on hold forever. this is a better way. one last demo, i thought would be cool to show, is about getting information on people. i need a volunteer. what i'm going to try to do is get your address and phone number and date of birth and
11:35 am
social security number within 60 seconds. if i can do it, then you know the identity thieves can do it too. this is a wake-up call to show you how easily someone can get your information on the internet. looking for someone who doesn't have a name like bill smith, someone who has established credit. you have to allow me to display your stuff to everybody in this room. come on down. you have to give me your real name. not somebody else's. i know you are not donald trump. all right. you have a database -- you live in new york? all right. here is a database anyone can subscribe to and make the window a little different here. what we are going to do is do
11:36 am
name and state. what is your name? [inaudible] >> that is good. that won't be bill smith or terry jones. let's see what we can find. how long have you been in new york? >> 23 years. >> all right. let me show you what i did and what you can do. kind of scary. >> my lawyer can answer that question. >> you are 22. this is how easy -- get your social or date of birth or driver's license information. that is easy as well.
11:37 am
[inaudible] >> doesn't matter. doesn't matter. doesn't matter. in fact people think their mother's made names are secret. i will show you another -- what is your mother's made name? [inaudible] >> i will use that later. i am sorry. [inaudible] >> hold on a second. hopefully my count still works here. this is kind of scary. i was surprised. in case you are looking for my password kevin 123. that will make it easier. mother's made a name.
11:38 am
who played frank -- let me see -- let's see if we confine his mother's made name if i was an identity see if. it is spelled that way. all right. then we will look for anyone with leonardo. do a search. there we go. his mother's made name is indigburke. your mother's made a name and drivers license number and social security and date of birth and address and phone number. never use that as a password. i remember calling my bank five years ago and how do they authenticate me? i want to use a password. your social is secure. no one can get it. can i get your name? i want to show you something.
11:39 am
i can't do that. wasn't able to show the bank employee that the social is like an open book. i am here to sign books or we can open up for q&a and i have a gift for all of you that showed up tonight. the gift is my business card. what is cool about this business card? what is cool if is if you get locked out of your house this is a lock pick. i went to the airport -- i carry a lot of them. i get a bad check. they go that is cool. that is a circuit board. not a circuit board. and i explained it is a lock -- kenna have one? after my talk have a card for all of you as a gift. [applause] you can ask me anything you
11:40 am
want except my password. i will be happy -- and get through some book signings or whatever. >> is everybody -- please wait for the mike. just a second please. >> i am -- now that -- >> i know your name. >> now that you have revealed everything, how do i keep everything private? >> you have no privacy. that is the problem. that is why there is such a problem with identity theft in america. so easy to steal the information. it is simple. that is the problem. the system is broken. because you authenticate on your social security number or mother's made a name which is not the thing to do nowadays. >> do you agree with your friend
11:41 am
-- your friend adrian lemon? >> yes. >> do you agree with his decision to go to the authorities? >> i don't agree with why he put to the authorities. he turned in bradley manning who was the private in the u.s. army who told the modesto document and turn them over to wiki leaks. what i know is adrian's background and the only reason he did it was for the media attention. he didn't do it because he was a patriot were afraid to be a co-conspirator. he did it for the wrong reasons to inform on somebody for his own personal benefit. for that reason i don't agree with that. if on the other hand he did it to protect the country or if he did it because he was afraid of being prosecuted as a co-conspirator the 100% he should have done it. there is my answer. wait for the mike.
11:42 am
>> hi. i wondered if the people like reputation.com, whether that actually works. >> you get removed out of some but the information is already out there. only way to get yourself out of databases is do what i did. create new identities but i wouldn't suggest it. that is the only way unfortunately. you have the light? thank you. >> i wanted to thank you for a radio interview this morning. that is how i learned about this. i have been involved in education and i teach a lot of stuff. computers and robotic. a number of years ago i personally got into this saying with a company that was developing software basically that was encrypting your own
11:43 am
personal e-mail. your own personal messages. one company was using an algorithm called blowfish. that was his company. after that i have seen other things. to you have any idea why in present society people are so open with these communications and send stuff through the internet, through the air and everywhere without encrypting it or do you feel encryption is something that can be hacked and broken into and meaningless to use? >> when i was a fugitive the fbi used an encrypted radio transmissions. i wanted to know what they were saying in case they were close to me to ensure they were not talking about me so i could get out. so rather than trying to crack the key which would have been impossible to attack i did was
11:44 am
what we call denial of service attacks. one side was communicating with the other i would jam the signal landed this three four times. the agents thought their radios were malfunctioning. that was a way of cracking government without breaking the key. >> i was talking about sending you an e-mail so i know only you would be getting it. i am so terrified of this e-mail business. most of my communications with the outside world i use u.s. mail for almost everything. >> if i wanted to get your communications i wouldn't worry about it in real time. breaking your system using some sort of exploit and malware selected it to secure key stroke. because you use and grip the e-mail doesn't mean you are
11:45 am
secure. >> you are saying the end of the e-mail is -- >> depends on the end point. you could break into alice or bob's computer you could get the non encrypted communication without worrying. >> i have been a victim of two banks which is why i got to be so fearful of this. we are a municipal-bond being transferred from one bank to the other as pain agent and between the two banks it was robbed -- took them three years to try to trace it because i have sales receipts. that was the only thing that was physical on paper. from that point on i do robotics and programming. very much in public domain and i am terrified of e-mail and i think you understand the reason. thank you very much. >> i want to pass the mike to the gentleman over here. >> how did you get started with
11:46 am
the free kevin movement? >> it was 2600 magazines and what happened is because of the unusual things that happened in my case i went four years without a trial. they wouldn't give us access. there were a lot of issues in the case and manual gold steen after three years of this happening started the free kevin movement to get the word out what is happening with my case. >> how did you hear about originally? >> basically by family, people sending me mail when i was in custody. through telephone calls with family and friends. >> i thought was an interesting story of you putting this ticker up to the window. >> one i was in custody they send me some bumper stickers and on my 30 fifth birthday some people from 2600 magazine came out to the prison and i knew they were down there and i said
11:47 am
i can get a pass to the law library and had a free kevin bumper sticker and when i was in federal the tension they put the free kevin bumper sticker in the air. >> thank you very much. >> i think you are next. mike is next to you. i can't hear you. >> you do enough -- >> the microphone. >> does the white hacker gives you enough interest in what used to be -- >> my drive for hacking was intellectual capacity and pursuit of knowledge, deduction of adventure. never about stealing money for writing malware. i got a huge endorphin rush when i was able to crack a system because it was like a video game by passing a security obstacle.
11:48 am
i get the same endorphins today. i really feel good about it and it is thrill seeking. i get paid for what i did illegally years ago. which is pretty good. it is like how to take something that is a criminal activity and make it legal. >> when i saw you -- i knew -- nfc cellphone payments where they want to have -- it is -- is that pretty easily breakable as well? >> i haven't messed with that. there is a guy that if you google his name -- a hacker security code in las vegas was able to intercept at a substantial distance. the technology that i had to look at because of doing physical pen testing.
11:49 am
haven't looked at that. >> so obviously you have experienced problems with the system. what type of advocacy do you do today in order to fix these things? you testified before congress and stuff like that but is there any more underground stuff going on? >> i haven't advocated anything. i feel i am powerless to change the system so the world has changed. my case was prior to 9/11 and everything has completely changed. now we have a lot of laws passed to protect us from terrorism but the government wants to keep those laws on the books even after threats evolve because it gives them more power.
11:50 am
it has gone worse than it was in the 90s. we have to live with that. yes? >> mr. lopez. my question is my intrigues started at the age inspired by you. what was your first experience with a computer system that caught your intrigued? >> high school. i was a senior in high school and tried to get into a computer class and the instructor refused because i didn't meet the prerequisites of having calculus and all these other prerequisites under my belt so i started showing him the tricks i could do with the phone company and he said you can come to class. that was my first experience working with computers. of course the teacher probably regrets that decision today because i kind of drove him crazy.
11:51 am
one of the first programming assignments was to write a program that would find the first 1 hundred numbers. a sock that was boring. core program would be a program that would still everybody's password so that is kind of cool so the students would be at their terminals and log in but i wrote a lot in simulator so when their logging in they are talking to my program. now the computer's operating system. so i didn't have time to finish that assignment but i turned in my password stealer program and the teacher was impressed and gave me and a. and said kevin wrote this program and showed it to the class. today if you did it in school you would probably be arrested. back in my day hacking was not illegal and you were actually encourage by teachers that was a cool thing to do. because of these ethics that led me on the path where i started
11:52 am
out hacking and got so passionate with it that i didn't stop. any other questions? you got a question over there? >> i got it right here. when you were doing all your hacking and when you were on the lab did you think you were going to get caught and was it worth it at the end? >> no. when i was running from the government i was so adept at creating new identities that i thought it would be really difficult. i thought in the back of my mind if i keep doing the same thing eventually a figure i probably could get caught but i wasn't thinking when i was on the run that i am going to get caught. i thought i would outsmart the fbi which was a ridiculous notion but that was many years ago. what became a cat and mouse game
11:53 am
between me and the government and i looked at it as a video game. i didn't look over my shoulder. i wasn't afraid of every cop car that passed. i had bonafide government issued id and legitimate jobs. i was working at a law firm in denver and working at a hospital in seattle. i set up early warning systems at the law firm. one of my responsibilities was reporting the law firm's telephone system which was cool. the job description better myself. people would insert code into the phone system. anybody in the law firm called the u.s. attorney's office or the fbi would immediately send me a page with a code that was 6565 which happened to be the last four digits of the telephone number of the fbi in los angeles. i set up an early warning system so if anyone hit the trip wire i would be able to get out quickly enough. >> i wanted to know, obviously you were animated to do all this
11:54 am
for the thrill of it. is there anything you are seeing now that kind of scares you that people are doing things that are destructive? >> it has changed. it is all about organized crime, leveraging hacking skills or recruiting hackers to steal credit card accounts, identity theft, bank fraud. it is a huge problem because in my day people are associated with, it wasn't about the money. it was about the thrill of exploration and it has changed. you have groups of hackers that probably do it. it was more for the mia attention than trying to send a political message. most of the trend has gone towards profit. that i see. >> i have kind of a funny question. i heard a couple different
11:55 am
versions of the day you actually got arrested. so one of the versions has you coming to the board and the fbi agents say this is kevin. you are kevin. you denied it and said do you want me to show up tomorrow and for you for a loop. >> it is actually detailed in the book. the full details of what happened is i actually had the fbi -- they weren't sure i was kevin mitnick for about 3-1/2 hours. i was a good actor that day. at one point when they were searching my apartment they handed me a wanted poster, wanted for -- they handed to me and said doesn't it look like you? i studied it for a moment thinking can i get out of this? no it doesn't. what am i going to say? i had them going for three hours. they don't play games. they knew i was mitnick.
11:56 am
they don't have time to joke around. i was really hoping. at one point i was hoping i could get out of that situation. one of the agents said we have to take you to the fbi office and fingerprint you to see if you are mitnick or not. i said why didn't you think of that idea earlier? we wouldn't have wasted all this time. tell me what time to show up tomorrow morning. i tried. and had nothing to lose. i did my best and it didn't work. i did my best. >> my question was actually in essence your book is a lot about hacking and social engineering -- do you consider yourself more analogous to frank abigail
11:57 am
junior than you do understanding what a hacker is? what we see in movies like hackers -- do you think that is more what you do as opposed to what hank abigail jr. was doing? >> it was a hybrid of social engineering and technical attacks and for example let's say i use a technical exploit to get into a large company and looking for a piece of code. i wanted to examine that code because if i got access i could break into that type of operating system. i would use social engineering once i got into find out what server the coat i was interested in was on. it would be much faster than me sitting on the network looking for it. i use social engineering and technical exploitation but we focus more on the social engineering side because it was more interesting. frank abigail reviewed the book and liked it. he called me a master social engineer.
11:58 am
the know what that means in his category but i guess it is a compliment. i was very happy that he did because he never reviewed the book. was a great honor to have my book reviewed by him. any other questions? [inaudible] >> you follow me on twitter. jon markoff is the new york times reporter who wrote about me back in the 1990s and in his reporting he actually stated things as fact, that i hacked into norad in 1983 and almost started a nuclear war. that was right out of war games. among other ridiculous accusations, is elevated the interest of the government in the kevin mitnick case and his agenda, what i think was his
11:59 am
agenda was he wanted to write a book and do a movie so you have the new york times at your disposal imagine the interest you can create. on twitter the other day, i naturally born smart ass. i said new york times did a book review. i don't understand this. new york times did a book review but last three times they wrote about me on the front page and they're not on the front page this time. so markoff responded one or two days later and said maybe that is because it wasn't written well. kind of like a big. so i told him listen. i said let bygones be bygones. i really think he should become a fiction writer because you have a great imagination. then it all stopped.

227 Views

info Stream Only

Uploaded by TV Archive on