Kevin's in the news again.

I don't know why he just doesn't paint a big Bull's-Eye on his back.

Quote:

---

The contentious sparring between Hewlett-Packard Co. chief security strategist Ira Winkler and convicted hacker Kevin Mitnick came to a head Tuesday afternoon at RSA Conference 2003.

Under the guise of a general-session debate on whether enterprises should hire former criminal hackers to do network penetration testing, the session quickly dissolved into 65 minutes of Mitnick defending his transgressions and Winkler aggressively pressing the former hacker on his skills and those of his nefarious former colleagues.

Nevertheless, a packed session hall took in the verbal jabs with glee and boos throughout the event, with Winkler getting the bulk of the cheers, but absorbing a few jeers, as some applauded a few of Mitnick's points.

Trying to bring some sort of balance to the panel were Jennifer Granick, a hacker-sympathetic attorney who represented Mitnick, and Christopher Painter, who was her counterpart during the trial. Granick teaches at Stanford Law School and is director of the school's Center for Internet and Society. Painter is deputy chief of the Department of Justice's Computer Crime and Intellectual Property Section.

Granick stood by her client, trying to buffer many of the blows coming from Winkler, who opposes the notion that it's a wise idea to bring former criminals into the enterprise to probe and poke at networks to determine vulnerabilities and soft spots. Painter, meanwhile, hammered home the notion that enterprises must examine the risks involved before bringing criminals inside their firewalls.

Perhaps the true balance on the day were the attendees, some of whom fell in the middle of the debate.

---

Find the full story HERE

Cheers:

and here i thought hed be trying to sue JP for slander :)

That is really very interesting. I wonder what my fellow AO'ers think about ex- criminals working for securirty companies. Its also important to distinguish up to what level someone in this situation can be called a criminal. Would anyone of you hire an ex- "criminal/geek" for a security related buisiness?

Cheers.

Yes, good thread!
I read his book The Art of Deception and follow his life in the news....interesting!

I am all for exhackers/crackers as security experts, most of my friends from the BBS days are now doing network security we know what to look for and how to handle a system. If you where caught you where doing something wrong (lacked proper skills) and shouldn't be working in security.

I feel that if you are reformed and have paid your price, then there is nothing wrong with being employed in the field.

However, I think that Kevin Mitnick is just a media whore. He is not a hacker, he is a "social engineer", aka nothing but a con artist. His knowledge and experience in computers is also outdated. There is no way that someone who was banned from touching computers for years can be up to date with current technology. No matter how many books the guy read, he does not have hand on experience. In my book he is right up there with that idiot Kimble. They are both media whore idiots using their names to gain attention.

And to top it off, the guy is a *****. All he does is cry about being treated wrong. He always has a new reason of how he is being treated unfair. Screw him. He needs to grow up.

I'd tend to agree with bballad.

I'll speak from personal experience here for a second...

I have computer past I'm not overly proud when I think back on it now... I was never caught, never arrested but I did a lot of highly questionable and illegal stuff when I first started learning. I'd learn about something and then figure out how to break it. I ended up learning enough to become the most knowledgeabe geek in my HS and working on a related police investigation. Since then I've grown up a lot, and turned over to the legal side of things but at the same time that stuff taught me a hell of a lot about computers.

So yeah, I think it's a great idea to higher ex-hackers/crackers.. if the ex in front of their name is true.. and I also agree with bballad that convicts are a different story. I think it would have to depend on the circumstances of what they did though, each former convict would have to be dealt with on an individual basis and their past looked into.

This non-hacker is giving hackers a bad name.

Maybe when he's secured his own site, he can attempt to secure others.

He should shut his mouth and just continue selling more 'computer used by kevin mitnick to hack...' on ebay, he's pathetic.

But I do feel ex-hackers should be allowed to work for companies, I don't really see a draw-back, not many convicted hackers are going to be placing backdoors in your network for revenge at a later date now are they.

To choose between the security analyst and a hacker I'd choose hacker everytime, once you have someone `from the other side' on your side you know how the `enemy' thinks and behaves, and just how they grab your balls.

A lot of the media friendly "Hackers" and "security experts" (see Mitnick and Cliff Stole) don't know very much at all ( I fondly remember handing Mr. Stoll a print out of his mail box at a speech he did in my area) but are charismatic and good at BS. The government has known this for a while...Mr. Mitnick went to jail for his activities some of the guys I hung out with back in the BBS days went to the NSA high school/college internships, or Navy intell..

Wot a muppet.

Quote:

---

Originally posted here by jared_c
His knowledge and experience in computers is also outdated. There is no way that someone who was banned from touching computers for years can be up to date with current technology.

---

No kidding. The guy is in prison for how long and all of a sudden he is released into a completely different world of computers to become a computer security specialist? WTF!!! You turn your back on the industry once and you have to struggle to get back up to date, and if you take a vacation that coincides with some major exploits discovery, you come back and your whole network is 0\/\/n3d by highschool students that downloaded some ready-made program... He gets thrown into prison when computer dinosaurs still roamed the earth, gets let out in the space age, and is an expert?

Its rediculous. He was only a hacker because he was tried as one, which is the fault of the District Attorney not him. If they hadn't trumped up the charges and tried him like he had committed the crimes he had committed than he would have served his time, saved the courts some money and faded into history as the shmuck criminal that he is...

Dhej

at the end of the day I believe it's just a matter of skills and trust:
- skills: are you good at? Yes? Well I don't care about your past, you can work for me.
- trust: can I trust you as a person? Yes? Well, I don't care about your past, you can work for me.
Any of them is "no", well (again :), you ain't working for me.

About KM? Mhm, he's a very good "marketing" guy and he can sell his stuff. Good for him.

Bye.

I'm not trying to sound anti-hacker or anti-criminal no-sense. My point is there any redemption
among man kind. A man\woman has to make a living, especially living in such a capitialist world :-{

The media loves it job exploiting people, and silly as it sounds ppl...
they love listening to tha hype, especially those in power, they pay these nomanic ppl...
to miss lead the commoners.

Skill or not! U have to make a living:-V

Geez. Reading that article made me think of a circus act or freak show or a zoo exhibit. Why did he agree to do it if he knew what was going to happen? If all he's doing is rehashing stuff that people already know, then he's probably just out to be a media whore as others have stated. Maybe because of the fact his knowledge is outdated he's trying to hide from having to deal with it.

Redemption is one thing. I don't know if I'd hire a hacker to be a security officer. But then again, I'd be careful about who I'd hire in the first place. It's no different than other criminal types. I wouldn't hire a pedophile to run a daycare. They have an addiction about their "crime". A hacker can be no different. For same (re: The Cuckoo's Egg and @Large) hacking and breaking into systems is an addiction.

Correct, a employer would need to take precautions to who they hire or not.
I realized he is a media whore too. All I was stating, either give him a job or not. If not then the media shouldn't make it a there job to broadcast it to the world. Guess, uncle sam has to set a example for those interesting to see. I know it is also his bad, too by having the media
exploit him in the news like that just to have others to have sympathy for him. U cares, we have a life to live too. If he can get a IT-related job maybe should try another line of work or start is own business. Point is stop trying to get ppl... sympathy those who bought your book thank them. Or maybe become a Author, if all else fails :-T

Yawn. . .The company hired him for name only. . . Now they can tell investors, "Lookie, we have the most famous hacker working at OUR company! We are the safest!" Not even caring to realize that it's just all bullshit. He probably sits around playing solitare all day, and signing autographs to kids who think he's still all that. Yawn.

I have to respond to this one. Would you let a bank robber come back to your bank and work as a manager who has all the keys and codes to the money vault????????????
No me. Part of justice is not being able to have access to your former life style that caused you to commit the crime. Why reward this guy? Will he be loyal to his new company? Or at the frist sign of stress from his employer will he wreak havoc on their network. Leave a back dorr and post the password where everybody can get it. I would not trust a thief no matter how reformed with the keys to the house without at least some kind of heavy supervision. That my 2 cents....

The fact that it's a hacker who has faced imprisonment in his history actually shows that the `hacker' is less likely to hack you than your general security admin. If he's been caught before I'd severely doubt he'd do it again, where he's working, where's it's almost certain capture.

You face more of a chance of getting hacked by someone else with no history of hacking than one that does have a history.. and less they like prison.

Quote:

---

Originally posted here by ReLik
The fact that it's a hacker who has faced imprisonment in his history actually shows that the `hacker' is less likely to hack you than your general security admin. If he's been caught before I'd severely doubt he'd do it again, where he's working, where's it's almost certain capture.

You face more of a chance of getting hacked by someone else with no history of hacking than one that does have a history.. and less they like prison.

---

I think the fact that he went to jail shows that he wasn't very good at hacking which let him get caught (he was a wonderful social engineer, bad hacker). Especially in the late 80's early 90's there where plenty of ways into systems (there was a back door in Unix for a while, and passwords where plain text) that you didn't need to social engineer. Added to that the fact that a lot of companies still used PBX systems making phreaking easier and catching a good hacker was next to impossible. Kevin took on major companies where he didn't have the skills to do so.


I wonder what ever happened to No Where Man, or Hades? Most of the LOD? We never even learned the good hackers real names.

I a msure they are working in Computer security somewhere if computers don't bore them yet..

I wasn't necessarily talking about mitnick, he's more 'ha' than 'hacker', i was talking hypothetically about hackers getting jobs at companies as security analysts, admins etc.

who better to test security then people who spend all of thier free time trying to crack into systmes just for fun.

Quote:

---

Originally posted here by ReLik
I wasn't necessarily talking about mitnick, he's more 'ha' than 'hacker', i was talking hypothetically about hackers getting jobs at companies as security analysts, admins etc.

---

I have no problem with that . I am saying anyone who was caught doesn’t belong in the business they are just too dumb. Back in the mid to late 80’s and early 90’s it was so easy t o hack and phreak that if you got caught it shows a utter lack of a clue.

Being dumb and misplacing trust in people aren't the same things.

As someone who bears ultimate responsibility for enterprise-wide data security, and someone who does the hiring for all IT-related functions I can say that while I may hire a former hacker to help ensure a secure network, under no circumstances would I hire a convicted felon for ANY job in my company.

This has nothing to do with whether or not I feel that an individual can "pay for their crimes" and "turn over a new leaf" and everything to do with the idea of trusting corporate assets to an ex-con. The risk is just too high.

Director

I guess if a convicted criminals aren't too popular for jobs in general. It really doesn't matter how much they know, people aren't likely to trust them. Some people feel they have paid their 'debt', while most are distrustful.
In a lot of cases people have good reason to be distrustful. If however the perp is well inclined and has reformed it could be a worthy venture. Hey maybe the guy got tired of rooming with bubba and changed his ways. >;)

Ask yourself whether you'd trust an ex-hacker, then ask yourself whether you'd trust an ex-<crime here>.

And there you have your views about how much of a serious crime hacking really is.

Yes, it is a serious crime. There are a lot of serious crimes. Most always the person is screwed for life and working at the car wash regardless of what the crime was (white collar or otherwise). Good motivation for people to keep their nose clean and curiosity on their own networks.. hehe

Regards