Security threats Toolkit

Mitnick on hacking

Tags:
Social Engineering,
Software Security,
Hacker,
Kevin Mitnick

Joris Evers CNET News

Published: 04 Nov 2005 18:15 GMT

To many, the name Kevin Mitnick is synonymous with "notorious hacker". He was caught by the FBI in 1995 after a well-publicised pursuit. Mitnick pleaded guilty to charges of wire and computer fraud and served five years behind bars.

Today, Mitnick is a computer security consultant and has written two books, including one on his forte — social engineering. He is a celebrity, especially at events such as the annual Defcon gathering of hackers in Las Vegas, where attendees ask him to sign their badges.

Mitnick spends much of his time on the road at speaking engagements. ZDNet UK's sister site, CNET News.com, caught up with Mitnick after a gig at a San Francisco user event for SupportSoft, a maker of call centre software, and talked to him about software security, the evolution of hacking and social engineering and law enforcement's action against hacking.

Q: What do you think of the state of software security these days? Is it getting better?
A: Software is always going to have bugs because there are human beings behind it doing the development. Hopefully, universities teach secure coding practices. When I went to school, there were many programming classes, but nothing that taught secure coding practices. So, hopefully, there will be an educational process and companies will actually do source code audits before they release their software and also train their people in secure coding practices if they are already employed and not in school. That will reduce the amount of problems, but there will always be problems.

Do you believe that the state of software security is better today than five or 10 years ago?
No, though it depends on what software you are talking about and what the company has done. I can't make one statement for the whole industry. Take Microsoft, for example. I think their current code base is more secure than Windows NT was.

Would you say Microsoft is a leader and the rest of the industry is still catching up to that?
It is whatever the market demands — and Microsoft is up there, front and centre, because they have such a broad user base. Maybe you can call them a leader, but I am sure there are other companies who are taking security seriously. I am waiting for a case where a software maker gets sued for releasing buggy code, but they will probably cover their ass with the long license agreements that nobody ever reads.

We've been talking about weaknesses in technology, not weaknesses in humans, which can also be a threat. You're one of the social engineering gurus. Do you see it evolving?
They are always coming up with new scams. A year ago it was Nigerian scams. Now callers purport to be from the MasterCard or Visa fraud department, calling you to try to trick you into revealing your CVV (Cardholder Verification Value) number...

For more, click here...