Thursday March 2
Convicted Hacker Says Humans Weakest Link
By Jim Wolf

WASHINGTON (Reuters) - A computer intruder deemed so dangerous that his parole from prison "unplugged him" urged Congress on Thursday to focus on the human side of information security to keep hackers like him from breaking in.

Kevin Mitnick, arguably the world's most notorious hacker, said he had been so successful in tricking insiders to share secrets that he seldom resorted to high-tech means to pierce networks.

``You have to do something to raise their level of awareness that they can be the victim of some sort of a scam over the telephone,'' he told members of the Senate Governmental Affairs Committee.

In testimony that drew raves from panel members, Mitnick suggested using videotapes among other things to alert workers to ruses such as those he said he used while posing as a colleague with computer problems. He spoke of rerouting telephone calls made to verify his bona fides to clinch a scam.

``I have gained unauthorized access to computer systems at some of the largest corporations on the planet, and have successfully penetrated some of the most resilient computer systems ever developed,'' Mitnick said.

Committee Chairman Sen. Fred Thompson, a Tennessee Republican, applauded Mitnick for highlighting an organization's personnel as the weakest link in the federal computer security chain.

Mitnick -- whose story was the basis for the best-selling books ``Cyberpunk'' and ``Takedown'' and a coming Hollywood movie -- began his testimony by noting the irony of advising the U.S. government on the very matter that had put him behind bars for nearly five years for his crimes.

He described himself as a kind of thrill-seeker drawn by the ``intellectual challenge'' of stealing the software codes that make modern networks hum. He said he never sought to make a ``red cent'' from any secrets he stole.

Mitnick, 36, told senators he pierced security at one victim company, Motorola, by persuading employees to cough up passwords on the pretext he was one of them. Citing the statute of limitations, he said he had also obtained confidential information from the Internal Revenue Service and the Social Security system.

He said training federal workers to recognize ``social engineering attacks'' -- bamboozling an insider into bypassing existing security rules -- was ``paramount.''

Mitnick walked out of a federal prison in Lompoc, California, on Jan. 21. He had been behind bars for nearly five years on an indictment alleging, among other things, illegal possession of computer files stolen from such companies as Nokia Corp., Motorola Inc. and Sun Microsystems Inc.

He told senators he also breached the security of Novell and AT&T.

Mitnick pleaded guilty on March 16, 1999, to five counts of wire fraud and computer fraud. Under a plea deal he was given credit for about four years served while awaiting trial.

Because of his history of breaking into computer systems and misusing cellular telephones, his probation order barred him for three years from touching a computer keyboard or ``anything capable of accessing computer networks.''

Sen. Joseph Lieberman of Connecticut, the ranking Democrat on the panel and co-author of a bill with Thompson to strengthen federal information security, twice called Mitnick's points ''illuminating.'' He said Mitnick would make a great lawyer.

Mitnick -- subject to what he called the most restrictive supervised release conditions ever imposed by a U.S. federal court -- shot back that he would probably need a presidential pardon to be admitted to the bar.

Also testifying to a crying need for tightened information security was the General Accounting Office, the audit arm of Congress, and Roberta Gross, the in-house watchdog at the National Aeronautics and Space Administration.

``Our work has shown that almost all government agencies are plagued by poor computer security,'' Jack Brock of the GAO's Accounting and Information Management Division testified.

Brock and Gross, the first inspector-general to launch a computer crimes unit, endorsed Mitnick's warning about the need for training and education of employees. ``This is very much a cultural thing,'' said Gross.

Back To The Study