 |
newsmaker To many, the name Kevin Mitnick is synonymous with "notorious hacker." He was caught by the FBI in 1995 after a well-publicized pursuit. Mitnick pled guilty to charges of wire and computer fraud and served five years behind bars.
Today, Mitnick is a computer security consultant and has written two books, including one on social engineering, his forte. He is a celebrity, especially at events such as the annual Defcon gathering of hackers in Las Vegas, where attendees ask him to sign their badges.
Mitnick spends much of his time on the road at speaking engagements. CNET News.com caught up with Mitnick after a gig at a San Francisco user event for SupportSoft, a maker of call center software, and talked to him about software security, the evolution of hacking and social engineering, and law enforcement's action against hacking.
What do you think of the state of software security these days? Is it
getting better?
Mitnick: Software is always going to have bugs because
there are human beings behind it doing the development. Hopefully, universities teach
secure coding practices. When I went to school, there were many programming
classes, but nothing that taught secure coding practices. So, hopefully, there
will be an educational process and companies will actually do source code audits
before they release their software and also train their people in secure coding
practices if they are already employed and not in school. That will reduce the
amount of problems, but there will always be problems.
Do you believe that the state of software security is better today than
five or 10 years ago?
Mitnick: No, though it depends on what software
you are talking about and what the company has done. I can't make one statement
for the whole industry. Take Microsoft, for example. I think their current
code base is more secure than Windows NT was.
Would you say Microsoft is a leader and the rest of the industry is still
catching up to that?
Mitnick: It is whatever the market demands--and
Microsoft is up there, front and center, because they have such a broad user
base. Maybe you can call them a leader, but I am sure there are other companies
who are taking security seriously. I am waiting for a case where a software
maker gets sued for releasing buggy code, but they will probably cover their ass
with the long license agreements that nobody ever reads.
We've been talking about weaknesses in technology, not weaknesses in
humans, which can also be a threat. You're one of the social engineering gurus.
Do you see it evolving?
Mitnick: They are always coming up with new
scams. A year ago it was Nigerian scams. Now callers purport to be from the
MasterCard or Visa fraud department, calling you to try to trick you into
revealing your CVV (Cardholder Verification Value) number on the back of your
card. The human mind is very innovative and the attacker will build trust and
confidence to gain cooperation.
Are the social engineers or the people who do such attacks becoming more
criminal, like computer hackers are becoming more criminal?
Mitnick: You
can have a teenage kid who is using social engineering to get into his friend's
AOL screen name or you can have a military spy using it to try to break in
somewhere, and everyone else in between. Social engineering is simply a tool
used to gain access.
Do you see a difference between social engineers today and when you were
doing it?
Mitnick: When I got started, when I learned about social
engineering, it was during the phone phreaking era, the predecessor to the
hacking era. That was more about calling different departments at phone
companies to gain an understanding of their processes and procedures and then
being able to pretend to be somebody at the phone company and having somebody do
something for you.
Social engineering happens quite frequently now. It happened with Network Solutions, it happened with Paris Hilton. These are the attacks you hear about. There are many social
Play video
There are currently no comments for this post.