Ghost in the Wires_ My Adventures as the World's Most Wanted Hacker - Kevin Mitnick [123]
Comments: this one is pretty serious. It has already been used on sun-barr to break root, and is one of the few security bugs that work for 4.1.X as well as 2.X e.g. ANY Sun released OS.
To use one of my favorite expressions, this again was like finding the Holy Grail. I now had access to every bug discovered internally at Sun as well as every one reported by any other source. It was like putting a quarter into a slot machine and winning the progressive jackpot with the first pull of the handle. The information from this database was going into my bag of tricks. I started thinking of the tune to the old Felix the Cat theme song, “Whenever he gets in a fix, he reaches into his bag of tricks.”
After the Sun system administrator in Denver reported the security incident, the company got wise that it had a gremlin deeply burrowed into its systems. Dan Farmer and Brad Powell, Sun’s top two security people, sent emails around the entire company warning staff to watch out for hacker attacks that also used social engineering. Then they began removing the bug reports from the database in hopes of hiding them from me. But I was still reading their internal emails. Many of the bug reports contained statements like the one in the message above—did you notice it?
If you need a copy of the breakin code see Staci Way (contractor) (staciw@castello.corp).
You probably already know what I’d do when I saw a message like this.
Right: I’d email Staci from an internal Sun account and social-engineer her into sending me the bug. It never failed, not once.
Despite my success in hacking into the company, the following year Powell would receive a “merit award” from Sun’s chief information officer “for his role in securing Sun and thwarting the attacks on SWAN by Kevin Mitnick.” Powell was so proud of the award that he listed it on his résumé, which I discovered on the Internet.
After about six months of morning and evening bus commutes, it seemed like a good idea to move nearer to work. The ideal location would be some place I could walk to work from every morning—plus the right place would put me within walking distance of the 16th Street Mall in downtown Denver, my favorite area to hang out on weekends. An old-style apartment building, the Grosvenor Arms, on East 16th Street, had a unit available on the fifth floor that I was excited to find—a very cool place, spacious, with windows all around, and even old-style boxes where the milkman used to leave bottles of milk every morning. This time I would have to undergo a credit check, but no sweat: by hacking into the credit reporting agency TRW, I was able to identify several Eric Weisses with reasonably good credit. I used the Social Security number of one of them on my rental application (different from the one I was using for employment). My paperwork sailed through without a problem.
Only about five blocks from my new apartment, Denver’s tourist district offered tons of terrific bars and restaurants. One in particular was a favorite, a Mexican restaurant at 16th and Larimer Streets that was a hangout for lots of great-looking girls. I was still avoiding serious relationships, but chatting up attractive young ladies at the bar didn’t cross any of my barriers of caution, and it helped me feel human. On occasion a gal would sit down next to me and let me buy her a drink or two… or sometimes even buy them for me. Great for the ego.
Having so many restaurants nearby held particular appeal: I ate out almost every meal, rarely fixing even oatmeal or bacon and eggs for myself.
Settling into the new apartment made me feel even more comfortable about being in Denver, yet I knew I could never let my guard down. With full access into PacTel Cellular, I was still keeping track of the cell phone calls that the FBI agents were making to Justin Petersen, aka Eric Heinz, and also watching to see if they were making any calls to Denver phone numbers. A check of Justin’s landline at the safe house showed that his long-distance service, MCI, was still in the name of Joseph Wernle—which meant