excerpt from "Ghost in the Wires" by Kevin Mitnik:
"We’re told that our medical records are confidential, shared only when we give specific permission. But the truth is that any federal agent, cop, or prosecutor who can convince a judge he has legitimate reason can walk into your pharmacy and have them print out all of your prescriptions and the date of every refill.Scary.
We’re also told that the records kept on us by government agencies — Internal Revenue Service, Social Security Administration, the DMV of any particular state, and so on — are safe from prying eyes. Maybe they’re a little safer now than they used to be — though I doubt it — but in my day, getting any information I wanted was a pushover.
I compromised the Social Security Administration, for example, through an elaborate social engineering attack. It began with my usual research—the various departments of the agency, where they were located, who the supervisors and managers were for each, standard internal lingo, and so on. Claims were processed by special groups called “Mods,” which I think stood for “modules,” each one perhaps covering a series of Social Security numbers. I social engineered the phone number for a Mod and eventually reached a staff member who told me her name was Ann. I told her I was Tom Harmon, in the agency’s Office of the Inspector General.
I said, “We’re going to be needing assistance on a continuing basis,” explaining that while our office was working on a number of fraud investigations, we didn’t have access to MCS — short for “Modernized Claims System,” the amusingly clumsy name for their centralized computer system.
From the time of that initial conversation, we became telephone buddies. I was able to call Ann and have her look up whatever I wanted — Social Security numbers, dates and places of birth, mother’s maiden names, disability benefits, wages, and so on. Whenever I phoned, she would drop whatever she was doing to look up anything I asked for.
Ann seemed to love my calls. She clearly enjoyed playing deputy to a man from the Inspector General’s Office who was doing these important investigations of people committing fraud. I suppose it broke the routine of a mundane, plodding workday. She would even suggest things to search: “Would knowing the parents’ names help?” And then she’d go through a series of steps to dig up the information.
On one occasion, I slipped, asking, “What’s the weather like there today?”
But I supposedly worked in the same city she did. She said, “You don’t know what the weather is!?”
I covered quickly. “I’m in LA today on a case.” She must have figured, Oh, of course — he has to travel for his work.
We were phone buddies for about three years, both enjoying the banter and the sense of accomplishment."
My Thoughts:
The actions Kevin Mitnik did alone in this hacking scheme is totally off the charts for inappropriate in terms of the ten computer commandments. He broke rules 2,3,5,7,and 10 all at once. And during his 20 year career of hack broke every rule on that list many, many times. And for his actions he eventually spent 5 years in jail.
