zlacker

[parent] [thread] 33 comments
1. educti+(OP)[view] [source] 2023-07-20 12:52:28
He has the CEO’s number and successfully calls him, and through some miracle gets through directly to ask this trivial question — as opposed to getting the number from the assistant who answers his phone - sure ok but then under what pretense does he then ask him to repeat his phone number? “Please repeat the phone number I just dialed.”

The phone number contains all the digits needed to recreate the bank account number?

He somehow has the bank account number?

He meets the CEO (despite just being a security consultant) and gives his report to the board of directors?! That is not how companies usually work, especially the board part.

Check on a silver platter? architect of the voice system is brought into the room with the board to be humiliated? This reads like something a 13 year old would dream up (nothing against OP maybe someone even Mitnik really did claim this happened).

The tale is absolutely embellished if it has any truth at all.

replies(16): >>morito+o1 >>Closi+N1 >>jvande+o2 >>thesui+u5 >>mekoka+06 >>samsta+h8 >>stuff4+B8 >>breeze+Vm >>conduc+by >>AlecSc+Cy >>pelasa+Nd1 >>tiffan+zA1 >>jahsom+482 >>thathn+ti2 >>Spooky+i53 >>redbar+h05
2. morito+o1[view] [source] 2023-07-20 13:00:26
>>educti+(OP)
Mitnick could have been hired as a advisor for their system, personally by the CEO.

He calls the CEO to ask a "personal question" so to skip the assistant, asks something innocent, then let's the CEO he has a new number and provides a fake number. He asks the CEO to confirm he heard the number correctly, but it's a bad line, so speak clearly please.

The "new phone number" has all the digits of the bank account he's trying to hack. The account is likely the account number that he's being paid for the consultancy work with. He could have got this simply by asking to confirm from which account he'd be paid from to confirm the transaction.

He is asked to report his review of the new security system to the board (given it was a large investment by the Bank, or just the wrong word used) and the architect would of course be invited to his own project's review?

The board then asked Mitnick to design a new system and said that cost wouldn't be an issue.

That all seems pretty easy to put together?

replies(2): >>mywitt+uD >>dumpst+Zi2
3. Closi+N1[view] [source] 2023-07-20 13:03:07
>>educti+(OP)
> He somehow has the bank account number?

Being able to login if you have the bank account number is still a pretty big flaw.

If you are a bank, your security threat model should assume that a hacker has access to somebody's account number and basic personal details.

Particularly for a high profile/value account, you can see how it might be possible to get soundclips of them saying the numbers 1 to 9 (see: https://www.youtube.com/watch?v=xWcldHxHFpo)

replies(1): >>outeri+cn
4. jvande+o2[view] [source] 2023-07-20 13:06:12
>>educti+(OP)
If you're dealing with the bank in a security-consultant capacity, then these kinds of requests would be both intriguing and informative.

If he's a customer of the bank, then it had better be a very small bank or I'm also skeptical.

5. thesui+u5[view] [source] 2023-07-20 13:23:19
>>educti+(OP)
He was already meeting with the CEO in some capacity, so it's very clear he had access to the CEO, maybe as a security consultant. Then getting him to read the number is easy, "Hey, I just got a new cell, but I might have given you my old card, can you read the number back to me?"

Getting a phone number with all the necessary digits is a bit of a stretch, but not impossible. And I would suspect, because this is the way phone systems generally work, that there was no bound on the number of attempts to enter the account number. Account numbers are all the same length, so you know exactly how many characters to input, it's just a matter of brute forcing the number--and for all I know, there may be some kind of structure that Mitnick found out.

Meeting with the board sounds like an embellishment for sure, especially for Mitnick's initial report, but I could definitely see--especially if someone was looking for a big chunk of money to strengthen the system--the report eventually being given to them.

The check on the silver platter is the most believable part of the story. Have you ever met a CEO? And why wouldn't the architect of the system be there to receive the report on the security of the system? Who else should be there?

For me, the only truly unbelievable part of this story is that he needed the CEO's voice at all. And for all we know, he just said he recorded the CEO's voice for a laugh.

replies(1): >>outeri+Ym
6. mekoka+06[view] [source] 2023-07-20 13:26:38
>>educti+(OP)
I understood it as him (Mitnick) asking his own phone number back. "Did I give you my card earlier? Is it the new card? I don't recall. Which number does it have?"

If you've already identified a security system that has this vulnerability you get a phone number with all these digits and begin shopping for any institutions that bough that system.

replies(1): >>Bringe+cF1
7. samsta+h8[view] [source] 2023-07-20 13:36:37
>>educti+(OP)
The 80s was a helluva drug.

Mitniks social engineering really formed me. And I did all sorts of nefarious stuff in the 80s, from mapping the 411 call centers, to the tape vending machine hack and other phreaking as I had an original captain crunch whistle to (not a hack) but there was a bunch of easy fraud to be had with “calling cards” back in the day

8. stuff4+B8[view] [source] 2023-07-20 13:38:57
>>educti+(OP)
This is the 90's and early 2000's. We didn't have the security processes and checks like we do nowadays. I worked for a bank right after the dot-com crash and was in charge of their internet banking web presence. I was witness to other employees passing around CDs and printouts containing the private information of hundreds, maybe thousands of customers. This was the era when your SSN was your userid. So these CDs contained SSNs, names, addresses, bank account numbers, passwords (not even encrypted, much less salted), etc. I moved into a new cubicle one time and saw these CDs just left over. It was a free-for-all for people like Kevin Mitnick.
replies(3): >>butter+Pe1 >>quartz+1l1 >>maestr+UP1
9. breeze+Vm[view] [source] 2023-07-20 14:39:19
>>educti+(OP)
He was pretty famous when he started doing security consulting so it doesn't seem like a stretch to me.

Bank account numbers are written on the bottom of checks along with the routing code. If you have a check from them, you have their checking account number.

Phone numbers are ten digits long. So a number like (213)485-7690 contains all digits from 0 to 9. Caller ID spoofing is trivial even back then. For example, you could ANI fail to a calling card system which would drop you to an operator. Then you just tell them the number you're "calling from" and that number would show up as your Caller ID and ANI.

Using voice authentication is pretty stupid but, iirc, at least one US bank still does something similar. That said, I imagine part of the authentication was probably caller ID based. This was/is also why voicemail systems don't prompt you for a PIN when you call them from your own phone - they use caller ID for authentication.

◧◩
10. outeri+Ym[view] [source] [discussion] 2023-07-20 14:39:31
>>thesui+u5
213-954-8607

Random number, legit area code. Unless you are looking for all 10 digits, pretty easy social hack

replies(1): >>psychp+dx
◧◩
11. outeri+cn[view] [source] [discussion] 2023-07-20 14:40:29
>>Closi+N1
basically anyone that has gotten a check from me has my checking account number...
◧◩◪
12. psychp+dx[view] [source] [discussion] 2023-07-20 15:18:53
>>outeri+Ym
Yeah, the only worry is someone saying mine fifty four. And you don't catch 5.

But that's pretty easy. Sorry I didn't catch that could you do it one number at a time?

replies(1): >>mywitt+FE
13. conduc+by[view] [source] 2023-07-20 15:22:01
>>educti+(OP)
He probably gained the CEO's trust at some point. Something like "I bet I can break into your personal bank account given public info?"

CEO interest is piqued. Gives him a business card, let's talk soon.

The on the call,

KM: what is your checking account number?

CEO: that's private

KM: it's printed on every personal check you write, so definitely not private

CEO: ok, good point, #######

KM: great, now tell me the numbers on the card I gave you

CEO: your phone number?

KM: yes

CEO: ok, ########

KM: ok I think I have what I need

CEO: really? that's it?

KM: yep, let me get to work, we'll talk soon

14. AlecSc+Cy[view] [source] 2023-07-20 15:23:18
>>educti+(OP)
I read it as he asked the CEO to repeat the number that Mitnik had given him earlier to ensure that it was correct.
◧◩
15. mywitt+uD[view] [source] [discussion] 2023-07-20 15:42:51
>>morito+o1
It's also possible that the CEO knew what Mitnick was getting at and played along to a degree.

Kind of like when your company has a security presentation about this new "report phishing button" in your email and you suddenly see this weird phishing-like email come through a few hours later. Hopefully you connect the dots.

◧◩◪◨
16. mywitt+FE[view] [source] [discussion] 2023-07-20 15:47:53
>>psychp+dx
"Was that sixty four, as in six-four?"

"Sorry, no 54, five-four."

"You said five ... four?"

"Yes, five ... four."

Doing the thing you want people to do is actually a pretty good strategy.

Recognizing when people are employing this strategy on you and intentionally not doing the thing is good fun too.

17. pelasa+Nd1[view] [source] 2023-07-20 18:15:12
>>educti+(OP)
maybe just a legend, who knows. Thats part of his Myth. Now it doesnt matter anymore.
◧◩
18. butter+Pe1[view] [source] [discussion] 2023-07-20 18:19:41
>>stuff4+B8
I was once asked by Target for my SSN because I was returning a product. That was in the early 2000s
replies(2): >>stuff4+Or1 >>JohnFe+472
◧◩
19. quartz+1l1[view] [source] [discussion] 2023-07-20 18:44:48
>>stuff4+B8
The 90s were wild. We used to just print entire credit card numbers on the receipt!
replies(1): >>jrnich+ue2
◧◩◪
20. stuff4+Or1[view] [source] [discussion] 2023-07-20 19:10:42
>>butter+Pe1
LOL, I was asked by a pet shelter for my SSN in order to adopt a cat. I stupidly put it down on the paper form and then asked why they needed it. She didn't have an answer and rejected my application to adopt. But she kept the paper form in case I tried to reapply in the future. I ripped it out of her hands and left. I should have just put a phony one in there...
replies(1): >>kuhewa+rm3
21. tiffan+zA1[view] [source] 2023-07-20 19:51:40
>>educti+(OP)
Nonsense like "silver platter", almost certainly embellished (unless a "Barnum" or "Wonka" or some shiite was running the bank). The fundamentals, totally believable.

It's incredibly easy (still) to do certain kinds of "social engineering". Terms like "psychological sleight-of-hand" can sometimes make it a little clearer how humans just have blind spots - ways our perception works and doesn't. And, people who are used to being VERY "in control", intelligent / experienced (compared to others in room), etc., can sometimes be the easiest to manipulate in certain ways.

But, really, it boils down, sometimes, to something as simple as "how long can you keep a person talking?" Mitnick was probably in a good position to do these sorts of things - assuming the story is from after he "turned White Hat". And, in this case, the even simpler deal with the numbers is something like "oh, shoot, I had a misprint on old cards, did I give you the right one? What's the phone number on it?" Drop something abruptly like that, at some random point in a conversation, most people wouldn't think twice... Even if their current context involves a heavy dose of thinking about voices and numbers. They might easily enough realize in the morning, but, too late, by then. Further, getting bank account numbers is not necessarily hard either. Could even be as simple as "dumpster diving", back then. Did the CEO always shred every single document, with a "secure shredder" (as much as that's possible) when home? Or maybe burn everything, always?

And, in any case, you're even mixing up aspects of the story. The phone number isn't the bank account digits, it's just all the numbers from 0 through 9 (you can even get one twice, for a 10-digit [w/ area code] number).

I propose that your sureness in dismissing this story, misapprehensions about it, etc., make you an unwittingly "good mark."

◧◩
22. Bringe+cF1[view] [source] [discussion] 2023-07-20 20:17:40
>>mekoka+06
Prime social engineering.
◧◩
23. maestr+UP1[view] [source] [discussion] 2023-07-20 21:10:21
>>stuff4+B8
In the mid-/late-80's, you could easily get full PII (SSN, Name, DOB, address, mother's maiden name, etc) green-bar paper reports someone tossed in the trash when finished.
◧◩◪
24. JohnFe+472[view] [source] [discussion] 2023-07-20 22:52:07
>>butter+Pe1
I used to keep Richard Nixon's SSN in my wallet for just these sorts of situations.
25. jahsom+482[view] [source] 2023-07-20 22:58:18
>>educti+(OP)
Based on my understanding of the story in the post, Mitnick asked the CEO to read back the number he gave the CEO earlier that day.

I don't disagree it's likely all bullshit, but if you're going to post snarky, nitpicking comments at least make sure you're understanding what was communicated. It makes it all too easy to dismiss any valid points you may have when there are such fundamental flaws.

◧◩◪
26. jrnich+ue2[view] [source] [discussion] 2023-07-20 23:44:05
>>quartz+1l1
Getting credit card numbers out of the trash at a local Enterprise Rent-A-Car location was a weekly thing for us here, especially corporate accounts. I don't think some folks nowadays realize just how effortless it was to find such information laying out in the open.
27. thathn+ti2[view] [source] 2023-07-21 00:19:31
>>educti+(OP)
You know that your checking account number is on the bottom of every check you right?
◧◩
28. dumpst+Zi2[view] [source] [discussion] 2023-07-21 00:24:21
>>morito+o1
> then let's the CEO he has a new number and provides a fake number

I came to a similar conclusion regarding the implementation of the attack. The scenario in my head was slightly different, but very similar (still includes a new number):

Kevin provides his business card and sets up a meeting with the CEO to report on his progress (or whatever). When the CEO calls at the scheduled time - Kevin doesn't answer. Sometime later Kevin calls the CEO and apologizes for missing the call, and explains that he didn't see any missed calls.

At that point the CEO explains that he tried to call, and even left a message. Kevin has a sudden flash of insight and realizes that he may have given the CEO one of his old business cards.

"What's the phone number on the business card I gave you? I'm wondering if I've been handing out my old business cards to people... that would actually explain a lot." (presumably the phone number on the business card in question would include digits 0-9 in a not-super-obvious way)

The CEO reads back the phone number on the card and Kevin slaps his forehead because that is in fact the wrong business card. Kevin gives the CEO his new number, and they finish the scheduled meeting. On future calls the CEO is able to contact Kevin using the new number, which lends credence to the attack.

29. Spooky+i53[view] [source] 2023-07-21 08:53:37
>>educti+(OP)
I take it you haven’t been exposed to Important People(TM).
◧◩◪◨
30. kuhewa+rm3[view] [source] [discussion] 2023-07-21 11:39:12
>>stuff4+Or1
Why did you get rejected
replies(2): >>realae+Ho3 >>stuff4+US3
◧◩◪◨⬒
31. realae+Ho3[view] [source] [discussion] 2023-07-21 11:56:27
>>kuhewa+rm3
Perhaps they thought such a clever person wouldn't be suitable for a cat, since cats like to have "owners" they can actually train.
replies(1): >>kuhewa+776
◧◩◪◨⬒
32. stuff4+US3[view] [source] [discussion] 2023-07-21 15:04:18
>>kuhewa+rm3
They asked if I was going to let the cat outside. At the time we had another cat we adopted from a vet and we let it outside so it made sense that we'd let this one out too. That was a hard no (although they didn't tell you that). It was basically a trick question and if you didn't answer to their liking, they rejected you. That was 20 years ago. Nowadays the cat I do have is kept indoors at all times.
33. redbar+h05[view] [source] 2023-07-21 20:06:38
>>educti+(OP)
«Can you see the number I’m calling from? Just to make sure, could you read it aloud to me. Slowly, please. … Thanks, yes it’s correct.»
◧◩◪◨⬒⬓
34. kuhewa+776[view] [source] [discussion] 2023-07-22 04:23:26
>>realae+Ho3
clever people are trainable like all the rest, they are that much better and fooling themselves
[go to top]