Ghost in the Wires_ My Adventures as the World's Most Wanted Hacker - Kevin Mitnick [134]
Kathleen called Novell Security and said, “I have some good news and some bad news. The good news is that we know the identity of your hacker—it’s Kevin Mitnick. The bad news is, we have no idea how to find him.”
Long afterward, I met Shawn Nunley, and we became good friends. I’m happy that today we can laugh about the whole episode.
With the Novell hack behind me, I decided to target one of the biggest cell phone manufacturers, Nokia.
I called Nokia Mobile Phones in Salo, Finland, posing as an engineer from Nokia USA in San Diego. Eventually I was transferred to a gentleman named Tapio. He sounded like a very nice guy, and I felt kind of bad about social-engineering him. But then I put those feelings aside and told him I needed the current source code release for the Nokia 121 cell phone. He extracted the latest version to a temporary directory in his user account, which I then had him transfer (via FTP) to Colorado Supernet. At the end of the call, he wasn’t suspicious in the least and even invited me to call him back if I needed anything else.
That all went so smoothly that I thought I’d see if I could gain direct access to Nokia’s network in Salo. A call to an IT guy there proved awkward when his English turned out not to be all that good. Maybe a Nokia facility in an English-speaking country would be more productive. I tracked down a Nokia Mobile Phones office in the town of Camberley, England, and reached a lady in IT named Sarah, who had a deliciously thick British accent but used so much unfamiliar slang that I had to stay focused and pay close attention.
I cited my standard excuse of “problems with the network connection between Finland and the U.S., and a critical file to transfer.” The company didn’t have direct dial-ups, she said, but she could give me the dial-up number and password for “Dial Plus,” which would let me connect to the VMS system in Camberley over an X25 packet switched network. She provided the X25 subscriber address—234222300195—and told me I would need an account on the VAX, which she would set up for me.
At this point I was on edge, in a state of high excitement, because I was pretty sure I’d be able to get into my target, “Mobira,” one of the VMS systems used by Nokia’s Cellular Engineering Group. I logged in to the account and quickly exploited a vulnerability that gave me full system privileges, then gave a “show users” command to list all the users currently logged in, which in part looked like this:
Username Process Name PID Terminal
CONBOY CONBOY 0000C261 NTY3: (conboy.uk.tele.nokia.fi)
EBSWORTH EBSWORTH 0000A419 NTY6: (ebsworth.uk.tele.nokia.fi)
FIELDING JOHN FIELDING 0000C128 NTY8: (dylan.uk.tele.nokia.fi)
LOVE PETER LOVE 0000C7D4 NTY2: ([131.228.133.203])
OGILVIE DAVID OGILVIE 0000C232 NVA10: (PSS.23420300326500)
PELKONEN HEIKKI PELKONEN 0000C160 NTY1: (scooby.uk.tele.nokia.fi)
TUXWORTH TUXWORTH 0000B52E NTY12: ([131.228.133.85])
Sarah wasn’t logged in. Great: that meant she wasn’t paying much attention to what I was doing on the system.
Next I installed my modified Chaos Computer Club patch to the VMS Loginout program, which allowed me to log in to anyone’s account with a special password, first checking Sarah’s account to see if she might have access to the Mobira in Salo. I ran a simple test and realized that I had access to her account over a networking protocol called DECNET and didn’t even need her password: Mobira was configured to trust the VMS system in the UK. I could simply upload a script to run my commands under Sarah’s account.
I was going to get in! I was ecstatic.
I used a security bug to get full system privileges and then created my own fully privileged account—all in about five minutes. Within about an hour, I was able to find a script that allowed me to extract the source code for any Nokia handset currently under development. I transferred source code for several different firmware releases for the Nokia 101 and Nokia