- Related Stories
Hilton hacker sentenced to juvenile hallSeptember 14, 2005
Alternative browsers pose challenge for cybersleuthsAugust 31, 2005
Mitnick: Security depends on workers' habitsMarch 4, 2005
Microsoft takes code to the classroomMarch 24, 2003
Gates: Security is top priorityJanuary 17, 2002
Mitnick released from prisonSeptember 21, 2000
Today, Mitnick is a computer security consultant and has written two books, including one on social engineering, his forte. He is a celebrity, especially at events such as the annual Defcon gathering of hackers in Las Vegas, where attendees ask him to sign their badges.
Mitnick spends much of his time on the road at speaking engagements. CNET News.com caught up with Mitnick after a gig at a San Francisco user event for SupportSoft, a maker of call center software, and talked to him about software security, the evolution of hacking and social engineering, and law enforcement's action against hacking.
What do you think of the state of software security these days? Is it getting better?
Mitnick: Software is always going to have bugs because there are human beings behind it doing the development. Hopefully,
Do you believe that the state of software security is better today than five or 10 years ago?
Mitnick: No, though it depends on what software you are talking about and what the company has done. I can't make one statement for the whole industry. Take Microsoft, for example. I think their current code base is more secure than Windows NT was.
Would you say Microsoft is a leader and the rest of the industry is still catching up to that?
Mitnick: It is whatever the market demands--and Microsoft is up there, front and center, because they have such a broad user base. Maybe you can call them a leader, but I am sure there are other companies who are taking security seriously. I am waiting for a case where a software maker gets sued for releasing buggy code, but they will probably cover their ass with the long license agreements that nobody ever reads.
We've been talking about weaknesses in technology, not weaknesses in humans, which can also be a threat. You're one of the social engineering gurus. Do you see it evolving?
Mitnick: They are always coming up with new scams. A year ago it was Nigerian scams. Now callers purport to be from the MasterCard or Visa fraud department, calling you to try to trick you into revealing your CVV (Cardholder Verification Value) number on the back of your card. The human mind is very innovative and the attacker will build trust and confidence to gain cooperation.
Are the social engineers or the people who do such attacks becoming more criminal, like computer hackers are becoming more criminal?
Mitnick: You can have a teenage kid who is using social engineering to get into his friend's AOL screen name or you can have a military spy using it to try to break in somewhere, and everyone else in between. Social engineering is simply a tool used to gain access.
Do you see a difference between social engineers today and when you were doing it?
Mitnick: When I got started, when I learned about social engineering, it was during the phone phreaking era, the predecessor to the hacking era. That was more about calling different departments at phone companies to gain an understanding of their processes and procedures and then being able to pretend to be somebody at the phone company and having somebody do something for you.
14 commentsJoin the conversation! Add your comment