Mitnick on hacking
Published: 04 Nov 2005 18:15 GMT
To many, the name Kevin Mitnick is synonymous with "notorious hacker". He was caught by the FBI in 1995 after a well-publicised pursuit. Mitnick pleaded guilty to charges of wire and computer fraud and served five years behind bars.
Today, Mitnick is a computer security consultant and has written two books, including one on his forte — social engineering. He is a celebrity, especially at events such as the annual Defcon gathering of hackers in Las Vegas, where attendees ask him to sign their badges.
Mitnick spends much of his time on the road at speaking engagements. ZDNet UK's sister site, CNET News.com, caught up with Mitnick after a gig at a San Francisco user event for SupportSoft, a maker of call centre software, and talked to him about software security, the evolution of hacking and social engineering and law enforcement's action against hacking.
Q: What do you think of the state of software security these days? Is it getting better?
A: Software is always going to have bugs because there are human beings behind it doing the development. Hopefully, universities teach secure coding practices.
When I went to school, there were many programming classes, but nothing
that taught secure coding practices. So, hopefully, there will be an
educational process and companies will actually do source code audits
before they release their software and also train their people in
secure coding practices if they are already employed and not in school.
That will reduce the amount of problems, but there will always be
problems.
Do you believe that the state of software security is better today than five or 10 years ago?
No, though it depends on what software you are talking about and
what the company has done. I can't make one statement for the whole
industry. Take Microsoft, for example. I think their current code base
is more secure than Windows NT was.
Would you say Microsoft is a leader and the rest of the industry is still catching up to that?
It is whatever the market demands — and Microsoft is up there,
front and centre, because they have such a broad user base. Maybe you
can call them a leader, but I am sure there are other companies who are
taking security seriously. I am waiting for a case where a software
maker gets sued for releasing buggy code, but they will probably cover
their ass with the long license agreements that nobody ever reads.
We've been talking about weaknesses in technology, not weaknesses
in humans, which can also be a threat. You're one of the social
engineering gurus. Do you see it evolving?
They are always coming up with new scams. A year ago it was
Nigerian scams. Now callers purport to be from the MasterCard or Visa
fraud department, calling you to try to trick you into revealing your
CVV (Cardholder Verification Value) number...
For more, click here...
Previous
Did you find this article useful?
195 out of 445 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
