爱问 爱问共享资料 爱问分类
首页 >教育资料 >学术研究 >Ghost In The Wires.pdf

Ghost In The Wires.pdf举报

简介:

世界顶级黑客自传:Ghost in the Wires::Kevin Mitnick

LITTLE,BROWNANDCOMPANYNewYorkBostonLondonFormymotherandgrandmother—K.D.M.ForArynne,Victoria,andDavid,Sheldon,Vincent,andElenaRoseandespeciallyforCharlotte—W.L.S.FOREWORDImetKevinMitnickforthefirsttimein2001,duringthefilmingofaDiscoveryChanneldocumentarycalledTheHistoryofHacking,andwecontinuedthecontact.Twoyearslater,IflewtoPittsburghtointroducehimforatalkhewasgivingatCarnegieMellonUniversity,whereIwasdumbfoundedtohearhishackinghistory.Hebrokeintocorporatecomputersbutdidn’tdestroyfiles,andhedidn’tuseorsellcreditcardnumbershehadaccessto.Hetooksoftwarebutneversoldanyofit.Hewashackingjustforthefunofit,justforthechallenge.Inhisspeech,KevinspelledoutindetailtheincrediblestoryofhowhehadcrackedthecaseoftheFBIoperationagainsthim.Kevinpenetratedthewholeoperation,discoveringthatanewhacker“friend”wasreallyanFBIsnitch,learningthenamesandhomeaddressesoftheentireFBIteamworkinghiscase,evenlisteninginonthephonecallsandvoicemailsofpeopletryingtogatherevidenceagainsthim.AnalarmsystemhehadsetupalertedhimwhentheFBIwaspreparingtoraidhim.WhentheproducersoftheTVshowScreenSaversinvitedKevinandmetohostanepisode,theyaskedmetodemonstrateanewelectronicdevicethatwasjustthencomingontotheconsumermarket:theGPS.Iwassupposedtodrivearoundwhiletheytrackedmycar.Ontheair,theydisplayedamapoftheseeminglyrandomrouteIhaddriven.Itspelledoutamessage:FREEKEVINWesharedthemicrophonesagainin2006,whenKevinwasthestand-inhostofArtBell’stalkshowCoasttoCoastAMandinvitedmetojoinhimashison-airguest.BythenIhadheardalotofhisstory;thatnightheinterviewedmeaboutmineandwesharedmanylaughs,asweusuallydowhenwe’retogether.MylifehasbeenchangedbyKevin.OnedayIrealizedthatIwasgettinghisphonecallsfromfarawayplaces:hewasinRussiatogiveaspeech,inSpaintohelpacompanywithsecurityissues,inChiletoadviseabankthathadhadacomputerbreak-in.Itsoundedprettycool.Ihadn’tusedmypassportinabouttenyearsuntilthosephonecallsgavemeanitch.Kevinputmeintouchwiththeagentwhobookshisspeeches.Shetoldme,“Icangetspeakingengagementsforyou,too.”SothankstoKevin,I’vebecomeaninternationaltravelerlikehim.Kevinhasbecomeoneofmybestfriends.Ilovebeingaroundhim,hearingthestoriesabouthisexploitsandadventures.Hehaslivedalifeasexcitingandgrippingasthebestcapermovies.Nowyou’llbeabletoshareallthesestoriesthatIhaveheardonebyone,nowandthenthroughtheyears.Inaway,Ienvytheexperienceofthejourneyyou’reabouttostart,asyouabsorbtheincredible,almostunbelievabletaleofKevinMitnick’slifeandexploits.—SteveWozniak,cofounder,Apple,Inc.PROLOGUEPhysicalentry”:slippingintoabuildingofyourtargetcompany.It’ssomethingIneverliketodo.Waytoorisky.Justwritingaboutitmakesmepracticallybreakoutinacoldsweat.ButthereIwas,lurkinginthedarkparkinglotofabillion-dollarcompanyonawarmeveninginspring,watchingformyopportunity.AweekearlierIhadpaidavisittothisbuildinginbroaddaylight,onthepretextofdroppingoffalettertoanemployee.TherealreasonwassoIcouldgetagoodlookattheirIDcards.Thiscompanyputtheemployee’sheadshotupperleft,namejustbelowthat,lastnamefirst,inblockletters.Thenameofthecompanywasatthebottomofthecard,inred,alsoinblockletters.IhadgonetoKinko’sandlookedupthecompany’swebsite,soIcoulddownloadandcopyanimageofthecompanylogo.Withthatandascannedcopyofmyownphoto,ittookmeabouttwentyminutesworkinginPhotoshoptomakeupandprintoutareasonablefacsimileofacompanyIDcard,whichIsealedintoadime-storeplasticholder.IcraftedanotherphonyIDforafriendwhohadagreedtogoalongwithmeincaseIneededhim.Here’sanewsflash:itdoesn’tevenhavetobeallthatauthenticlooking.Ninety-ninepercentofthetime,itwon’tgetmorethanaglance.Aslongastheessentialelementsareintherightplaceandlookmoreorlessthewaytheyaresupposedto,youcangetbywithit…unless,ofcourse,someoverzealousguardoranemployeewholikestoplaytheroleofsecuritywatchdoginsistsontakingacloselook.It’sadangeryourunwhenyoulivealifelikemine.Intheparkinglot,Istayoutofsight,watchingtheglowofcigarettesfromthestreamofpeoplesteppingoutforasmokebreak.FinallyIspotalittlepackoffiveorsixpeoplestartingbackintothebuildingtogether.Therearentrancedoorisoneofthosethatunlockwhenanemployeeholdshisorheraccesscarduptothecardreader.Asthegroupsingle-filesthroughthedoor,Ifallinatthebackoftheline.Theguyaheadofmereachesthedoor,noticesthere’ssomeonebehindhim,takesaquickglancetomakesureI’mwearingacompanybadge,andholdsthedooropenforme.Inodathanks.Thistechniqueiscalled“tailgating.”Inside,thefirstthingthatcatchesmyeyeisasignpostedsoyouseeitimmediatelyasyouwalkinthedoor.It’sasecurityposter,warningnottoholdthedoorforanyotherpersonbuttorequirethateachpersongainentrancebyholdinguphiscardtothereader.Butcommoncourtesy,everydaypolitenesstoa“fellowemployee,”meansthatthewarningonthesecurityposterisroutinelyignored.Insidethebuilding,Ibeginwalkingcorridorswiththestrideofsomeoneenroutetoanimportanttask.InfactI’monavoyageofexploration,lookingfortheofficesoftheInformationTechnology(IT)Department,whichafterabouttenminutesIfindinanareaonthewesternsideofthebuilding.I’vedonemyhomeworkinadvanceandhavethenameofoneofthecompany’snetworkengineers;Ifigurehe’slikelytohavefulladministratorrightstothecompany’snetwork.Damn!WhenIfindhisworkspace,it’snotaneasilyaccessiblecubiclebutaseparateoffice…behindalockeddoor.ButIseeasolution.Theceilingismadeupofthosewhitesoundproofingsquares,thekindoftenusedtocreateadroppedceilingwithacrawlspaceaboveforpiping,electricallines,airvents,andsoon.Icell-phonetomybuddythatIneedhim,andmakemywaybacktotherearentrancetolethimin.Lankyandthin,hewill,Ihope,beabletodowhatIcan’t.BackinIT,heclambersontoadesk.Igrabhimaroundthelegsandboosthimuphighenoughthathe’sabletoraiseoneofthetilesandslideitoutoftheway.AsIstraintoraisehimhigher,hemanagestogetagriponapipeandpullhimselfup.Withinaminute,Ihearhimdropdowninsidethelockedoffice.Thedoorknobturnsandhestandsthere,coveredindustbutgrinningbrightly.Ienterandquietlyclosethedoor.We’resafernow,muchlesslikelytobenoticed.Theofficeisdark.Turningonalightwouldbedangerousbutitisn’tnecessary—theglowfromtheengineer’scomputerisenoughformetoseeeverythingIneed,reducingtherisk.Itakeaquickscanofhisdeskandcheckthetopdrawerandunderthekeyboardtoseeifhehaslefthimselfanotewithhiscomputerpassword.Noluck.Butnotaproblem.Frommyfannypack,IpulloutaCDwithabootableversionoftheLinuxoperatingsystemthatcontainsahackertoolkitandpopitintohisCDdrive,thenrestartthecomputer.Oneofthetoolsallowsmetochangethelocaladministrator’spasswordonhiscomputer;IchangeittosomethingIknow,soIcanlogin.IthenremovemyCDandagainrestartthecomputer,thistimeloggingintothelocaladministratoraccount.WorkingasfastasIcan,Iinstalla“remoteaccessTrojan,”atypeofmalicioussoftwarethatgivesmefullaccesstothesystem,soIcanlogkeystrokes,grabpasswordhashes,andeveninstructthewebcamtotakepicturesofthepersonusingthecomputer.TheparticularTrojanI’veinstalledwillinitiateanInternetconnectiontoanothersystemundermycontroleveryfewminutes,enablingmetogainfullcontrolofthevictim’ssystem.Almostfinished,asalaststepIgointotheregistryofhiscomputerandset“lastlogged-inuser”totheengineer’susernamesotherewon’tbeanyevidenceofmyentryintothelocaladministratoraccount.Inthemorning,theengineermaynoticethathe’sloggedout.Noproblem:assoonashelogsbackin,everythingwilllookjustasitshould.I’mreadytoleave.Bynowmybuddyhasreplacedtheoverheadtiles.Onthewayout,Iresetthelock.Thenextmorning,theengineerturnsonhiscomputeratabout8:30a.m.,anditestablishesaconnectiontomylaptop.BecausetheTrojanisrunningunderhisaccount,Ihavefulldomainadministratorprivileges,andittakesmeonlyafewsecondstoidentifythedomaincontrollerthatcontainsalltheaccountpasswordsfortheentirecompany.Ahackertoolcalled“fgdump”allowsmetodumpthehashed(meaningscrambled)passwordsforeveryuser.Withinafewhours,Ihaverunthelistofhashesthrough“rainbowtables”—ahugedatabaseofprecomputedpasswordhashes—recoveringthepasswordsofmostofthecompany’semployees.Ieventuallyfindoneoftheback-endcomputerserversthatprocesscustomertransactionsbutdiscoverthecreditcardnumbersareencrypted.Notaproblem:Ifindthekeyusedtoencryptthecardnumbersisconvenientlyhiddeninastoredprocedurewithinthedatabaseonacomputerknownasthe“SQLserver,”accessibletoanydatabaseadministrator.Millionsandmillionsofcreditcardnumbers.Icanmakepurchasesalldaylongusingadifferentcreditcardeachtime,andneverrunoutofnumbers.ButImadenopurchases.Thistruestoryisnotanewreplayofthehackingthatlandedmeinalotofhotwater.InsteaditwassomethingIwashiredtodo.It’swhatwecalla“pentest,”shortfor“penetrationtest,”andit’salargepartofwhatmylifeconsistsofthesedays.Ihavehackedintosomeofthelargestcompaniesontheplanetandpenetratedthemostresilientcomputersystemseverdeveloped—hiredbythecompaniesthemselves,tohelpthemclosethegapsandimprovetheirsecuritysotheydon’tbecomethenexthackingvictim.I’mlargelyself-taughtandhavespentyearsstudyingmethods,tactics,andstrategiesusedtocircumventcomputersecurity,andtolearnmoreabouthowcomputersystemsandtelecommunicationsystemswork.Mypassionfortechnologyandfascinationwithithavetakenmedownabumpyroad.Myhackingescapadesendedupcostingmeoverfiveyearsofmylifeinprisonandcausingmylovedonestremendousheartache.Hereismystory,everydetailasaccurateasIcanmakeitfrommemory,personalnotes,publiccourtrecords,documentsobtainedthroughtheFreedomofInformationAct,FBIwiretapandbody-wirerecordings,manyhoursofinterviews,anddiscussionswithtwogovernmentinformants.ThisisthestoryofhowIbecametheworld’smostwantedcomputerhacker.PARTONETheMakingofaHackerRoughStartYjcvkuvjgpcogqhvjguauvgowugfdajcoqrgtcvqtuvqocmghtggrjqpgecnnu?Myinstinctforfindingawayaroundbarriersandsafeguardsbeganveryearly.Ataboutageoneandahalf,Ifoundawaytoclimboutofmycrib,crawltothechildgateatthedoor,andfigureouthowtoopenit.Formymom,itwasthefirstwake-upcallforallthatwastofollow.Igrewupasanonlychild.AftermydadleftwhenIwasthree,mymother,Shelly,andIlivedinnice,medium-pricedapartmentsinsafeareasoftheSanFernandoValley,justoverthehillfromthecityofLosAngeles.MymomsupporteduswithwaitressingjobsinoneoranotherofthemanydelisstrungoutalongVenturaBoulevard,whichrunseast–westforthelengthofthevalley.Myfatherlivedoutofstateand,thoughhecaredaboutme,wasforthemostpartonlyoccasionallyinvolvedinmylifegrowingupuntilhemovedtoLosAngeleswhenIwasthirteenyearsold.MomandImovedsooftenIdidn’thavethesamechancetomakefriendsasotherkidsdid.Ispentmychildhoodlargelyinvolvedinsolitary,mostlysedentarypursuits.WhenIwasatschool,theteacherstoldmymomthatIwasinthetop1percentileinmathematicsandspelling,yearsaheadofmygrade.ButbecauseIwashyperactiveasachild,itwashardformetositstill.MomhadthreehusbandsandseveralboyfriendswhenIwasgrowingup.Oneabusedme,another—whoworkedinlawenforcement—molestedme.UnlikesomeothermomsI’vereadabout,sheneverturnedablindeye.FromthemomentshefoundoutIwasbeingmistreated—orevenspokentoinaroughway—theguywasoutthedoorforgood.NotthatI’mlookingforexcuses,butIwonderifthoseabusivemenhadanythingtodowithmygrowinguptoalifeofdefyingauthorityfigures.Summerswerethebest,especiallyifmymomwasworkingasplitshiftandhadtimeoffinthemiddleoftheday.Iloveditwhenshe’dtakemeswimmingattheamazingSantaMonicaBeach.She’dlieonthesand,sunningandrelaxing,watchingmesplashinginthewaves,gettingknockeddownandcominguplaughing,practicingtheswimmingIhadlearnedataYMCAcampthatIwenttoforseveralsummers(andalwayshatedexceptwhentheytookusalltothebeach).Iwasgoodatsportsasakid,happyplayingLittleLeague,seriousenoughtoenjoyspendingsparetimeatthebattingcage.ButthepassionthatsetmeonalifecoursebeganwhenIwasten.AneighborwholivedintheapartmentacrossfromushadadaughteraboutmyagewhomIguessIdevelopedacrushon,whichshereciprocatedbyactuallydancingnakedinfrontofme.Atthatage,Iwasmoreinterestedinwhatherfatherbroughtintomylife:magic.Hewasanaccomplishedmagicianwhosecardtricks,cointricks,andlargereffectsfascinatedme.Buttherewassomethingelse,somethingmoreimportant:Isawhowhisaudiencesofone,three,oraroomfulfounddelightinbeingdeceived.Thoughthiswasneveraconsciousthought,thenotionthatpeopleenjoyedbeingtakeninwasastunningrevelationthatinfluencedthecourseofmylife.Amagicstorejustashortbikerideawaybecamemyspare-timehangout.Magicwasmyoriginaldoorwayintotheartofdeceivingpeople.SometimesinsteadofridingmybikeI’dhoponthebus.OnedayacoupleofyearslaterabusdrivernamedBobArkownoticedIwaswearingaT-shirtthatsaid,“CBersDoItontheAir.”Hetoldmehe’djustfoundaMotorolahandheldthatwasapoliceradio.Ithoughtmaybehecouldlisteninonthepolicefrequencies,whichwouldbeverycool.Itturnedouthewaspullingmylegaboutthat,butBobwasanavidhamradiooperator,andhisenthusiasmforthehobbysparkedmyinterest.Heshowedmeawaytomakefreetelephonecallsovertheradio,throughaservicecalledan“autopatch”providedbysomeofthehams.Freephonecalls!Thatimpressedmenoend.Iwashooked.Afterseveralweeksofsittinginanighttimeclassroom,Ihadlearnedenoughaboutradiocircuitsandhamradioregulationstopassthewrittenexam,andmasteredenoughMorsecodetomeetthatqualificationaswell.SoonthemailmanbroughtanenvelopefromtheFederalCommunicationsCommissionwithmyhamradiolicense,somethingnotmanykidsintheirearlyteenshaveeverhad.Ifeltahugesenseofaccomplishment.Foolingpeoplewithmagicwascool.Butlearninghowthephonesystemworkedwasfascinating.Iwantedtolearneverythingabouthowthephonecompanyworked.Iwantedtomasteritsinnerworkings.Ihadbeengettingverygoodgradesallthewaythroughelementaryschoolandinjuniorhigh,butaroundeighthorninthgradeIstartedcuttingclassestohangoutatHenryRadio,ahamradiostoreinWestLosAngeles,readingbooksforhoursonradiotheory.Tome,itwasasgoodasavisittoDisneyland.Hamradioalsoofferedsomeopportunitiesforhelpingoutinthecommunity.ForatimeIworkedasavolunteeronoccasionalweekendstoprovidecommunicationssupportforthelocalRedCrosschapter.OnesummerIspentaweekdoingthesamefortheSpecialOlympics.Ridingthebuseswasformeabitlikebeingonholiday—takinginthesightsofthecity,evenwhentheywerefamiliarones.ThiswasSouthernCalifornia,sotheweatherwasalmostalwaysnearperfect,exceptwhenthesmogsettledin—muchworseinthosetimesthantoday.Thebuscosttwenty-fivecents,plustencentsforatransfer.Onsummervacationwhenmymomwasatwork,I’dsometimesridethebusallday.BythetimeIwastwelve,mymindwasalreadyrunningindeviouschannels.Onedayitoccurredtome,IfIcouldpunchmyowntransfers,thebusrideswouldn’tcostanything.Myfatherandmyuncleswereallsalesmenwiththegiftofgab.IguessIsharethegenethatgavememyabilityfromveryearlyontotalkpeopleintodoingthingsforme.Iwalkedtothefrontofthebusandsatdownintheclosestseattothedriver.Whenhestoppedatalight,Isaid,“I’mworkingonaschoolprojectandIneedtopunchinterestingshapesonpiecesofcardboard.Thepunchyouuseonthetransferswouldbegreatforme.IstheresomeplaceIcanbuyone?”Ididn’tthinkhe’dbelieveitbecauseitsoundedsostupid.Iguesstheideanevercrossedhismindthatakidmyagemightbemanipulatinghim.Hetoldmethenameofthestore,andIcalledandfoundouttheysoldthepunchesfor$15.Whenyouweretwelve,couldyoucomeupwithareasonableexcuseyoumighthavegivenyourmotheraboutwhyyouneeded$15?Ihadnotrouble.TheverynextdayIwasinthestorebuyingapunch.ButthatwasonlyStepOne.HowwasIgoingtogetbooksofblanktransfers?Well,wheredidthebusesgetwashed?Iwalkedovertothenearbybusdepot,spottedabigDumpsterintheareawherethebuseswerecleaned,pulledmyselfup,andlookedin.Jackpot!Istuffedmypocketswithpartiallyusedbooksoftransfers—myfirstofwhatwouldbemany,manyactsofwhatcametobecalled“Dumpster-diving.”MymemoryhasalwaysbeenwaybetterthanaverageandImanagedtomemorizethebusschedulesformostoftheSanFernandoValley.Istartedtoroambybuseverywherethebussystemcovered—LosAngelesCounty,RiversideCounty,SanBernardinoCounty.Ienjoyedseeingallthosedifferentplaces,takingintheworldaroundme.Inmytravels,ImadefriendswithakidnamedRichardWilliams,whowasdoingthesamething,butwithtwoprettymajordifferences.Foronething,hisfree-roamingtravelswerelegalbecause,asthesonofabusdriver,Richardrodeforfree.Thesecondaspectthatseparatedus(initially,anyway)wasourdifferenceinweight:RichardwasobeseandwantedtostopatJackintheBoxforaSuperTacofiveorsixtimesaday.AlmostatonceIadoptedhiseatinghabitsandbegangrowingaroundthemiddle.Itwasn’tlongbeforeapigtailedblondgirlontheschoolbustoldme,“You’rekindacute,butyou’refat.Yououghtalosesomeweight.”DidItakehersharpbutunquestionablyconstructiveadvicetoheart?Nope.DidIgetintotroubleforDumpster-divingforthosebustransfersandridingforfree?Again,no.Mymomthoughtitwasclever,mydadthoughtitshowedinitiative,andbusdriverswhoknewIwaspunchingmyowntransfersthoughtitwasabiglaugh.ItwasasthougheveryonewhoknewwhatIwasuptowasgivingmeattaboys.Infact,Ididn’tneedotherpeople’spraiseformymisdeedstoleadmeintomoretrouble.Whowouldhavethoughtthatalittleshoppingtripcouldprovidealessonthatwouldsetmylifeonanew

相关资料推荐

  • 名称/格式
  • 下载次数
  • 资料大小

用户评论

0/200
暂无评论

资料阅读排行

该用户的其它资料

关闭

请选择举报的类型

关闭

提示

提交成功!

感谢您对爱问共享资料的支持,我们将尽快核实并处理您的举报信息。

关闭

提示

提交失败!

您的举报信息提交失败,请重试!

关闭

提示

重复举报!

亲爱的用户!感觉您对爱问共享资料的支持,请勿重复举报噢!

收藏
资料评价:

所需积分:5 立即下载
返回
顶部
举报
资料
关闭

温馨提示

感谢您对爱问共享资料的支持,精彩活动将尽快为您呈现,敬请期待!