Ghost in the Wires_ My Adventures as the World's Most Wanted Hacker - Kevin Mitnick [51]
From a Convention Center pay phone, I dialed a number in Calgary, Alberta, Canada. “Novatel,” a lady’s voice came down the line.
“Hi,” I said. “I need to talk to someone in Engineering.”
“Where are you calling from?” she wanted to know.
As always, I had done my research. “I’m with Engineering in Fort Worth.”
“You should be speaking to the engineering manager, Fred Walker, but he’s not in today. Can I take your number and have Mr. Walker call you tomorrow?”
“It’s urgent,” I said. “Let me speak to whoever’s available in his department.”
Moments later, a man with a Japanese accent came on the line and gave his name as Kumamoto.
“Kumamoto-san, this is Mike Bishop, from Fort Worth,” I said, using a name I had read off a Consumer Electronics Show electronic message board only moments earlier. “I usually talk to Fred Walker, but he’s not in. I’m at CES in Vegas.” I was counting on the actual background noise to lend credence to the claim. “We’re doing some testing for a demonstration. Is there a way to change the ESN from the phone’s keypad?”
“Absolutely not. It’s against FCC regulations.”
That was a bummer. My great idea had just gotten shot down.
No, wait. Kumamoto-san was still talking.
“We do have a special version of the firmware, version 1.05. It lets you change the ESN from the phone keypad if you know the secret programming steps.”
Suddenly I was back in the game. A phone’s “firmware” is its operating system, embedded on a special kind of computer chip called an EPROM.
The trick at a moment like this is not to let your excitement come through in your voice. I asked a question that would sound like a challenge: “Why does it allow changing the ESN?”
“The FCC requires it for testing,” he said.
“How can I get a copy?” I thought maybe he’d say he would send me a phone with that version of the firmware.
“I can send a chip,” he said. “You can replace it in the phone.”
Fantastic. This might be even better than getting a whole new phone, if I could just push the guy a little further.
“Can you burn four or five of the EPROMs for me?”
“Yes.”
Excellent, but now I had hit a snag: how was I going to have them sent to me without giving my real name and a delivery address that could be tracked?
“Burn them for me,” I told him. “I’ll call you back.”
I was pretty sure those chips would make me the only person outside Novatel who could change the number of his Novatel cell phone just by pressing the buttons on his keypad. Not only would it let me talk for free, but it would give me a cloak of invisibility, guaranteeing my conversations would be private. And it would also give me a safe callback number anytime I wanted to social-engineer a target company.
But how was I going to get that package sent to me without being caught?
If you were in my shoes at this point, how would you arrange to get hold of those chips? Think about it for a minute.
The answer wasn’t all that hard. It was in two parts, and it came to me in an instant. I called Novatel again and asked for the secretary to Kumamoto-san’s manager, Fred Walker. I told her, “Kumamoto-san from Engineering is going to drop off something for me. I’m working with our people at the booth at CES, but I’m here in Calgary for the day. I’ll come by and pick it up this afternoon.”
Kumamoto-san was already busy burning the chips for me when I got him back on the phone and asked him to pack them up when they were ready and drop them off with Walker’s secretary. After spending a couple of hours wandering the convention floor, soaking up what was new in the world of electronics and cell phones, I was ready for my next step.
About twenty minutes before quitting time (Calgary is an hour ahead of Las Vegas), I got the secretary on the phone again. “I’m at the airport on the way back to Las Vegas unexpectedly—they were having problems at the booth. That package Kumamoto-san left for