Kevin Mitnick: The Hacker Who Taught Us About Social Engineering

Kevin Mitnick became one of the most famous hackers in the world, and for years the United States government treated him as one of the most dangerous. The truth about his career is more interesting than the myth. His most powerful tool was not technical wizardry. It was a phone call, a confident voice and a willingness to ask for something that people were happy to give.

Early years

Mitnick was born in 1963 in California. As a teenager he became interested in phone phreaking and in the ways that organisations could be persuaded to reveal information. In one often-told early episode, he worked out how to obtain bus transfer punches and ride free in Los Angeles. By his own account he later gained entry to telephone company systems and to computer networks, largely by pretending to be someone he was not.

He was first arrested as a young man, and in 1988 he was convicted for copying proprietary software from Digital Equipment Corporation. He served around a year in prison.

What social engineering means

Social engineering is the manipulation of people to give up information or access. Instead of breaking a technical control, the attacker persuades a human to bypass it. Typical methods include:

• Pretending to be a colleague, supplier or support technician.
• Creating urgency, such as a deadline or an apparent emergency.
• Using small pieces of real information, like names and internal terms, to build credibility.
• Asking for something small first, then something larger.

Mitnick later argued that this was the most effective way into any organisation, and he wrote about it in several books, including The Art of Deception in 2002 and Ghost in the Wires in 2011.

The chase

After his 1988 conviction, Mitnick violated the terms of his supervised release in 1992 and went on the run. For more than two years he was a fugitive. During that time, in December 1994, someone broke into the computers of Tsutomu Shimomura, a computational physicist and security researcher at the San Diego Supercomputer Center. Shimomura took the intrusion personally and joined the effort to find the culprit.

Working with investigators and internet providers, he helped trace the intruder's activity. On 15 February 1995, the FBI arrested Mitnick in Raleigh, North Carolina. The event was a news sensation, and Shimomura co-wrote a book about the pursuit with journalist John Markoff.

A typical pretext

A classic social engineering attack, as Mitnick described it, is rarely a single call. The attacker starts by collecting harmless details, such as the name of a manager, the title of a project or the phone extension of a department. A later call uses those details to sound like an insider. The person on the other end, trying to be helpful, answers a question or resets a password. The attacker then uses that new access to gather more details and moves to the next target. Each step looks small. The chain is what matters.

Defences against this are mostly procedural. A rule that says "we never reset a password based on an incoming call" is dull, but it breaks the chain. So does a rule that all payment-detail changes must be confirmed by calling a known number.

Prison and controversy

Mitnick spent around four and a half years in custody before his case concluded, and a long stretch of that time was before trial. He pleaded guilty in 1999 and was sentenced to 46 months in prison, with additional time for violating release terms. He was released in January 2000, with restrictions on his use of computers and communications that lasted for some time.

His supporters organised a "Free Kevin" campaign, arguing that his treatment was disproportionate. Some of the claims made by prosecutors at the time, including large damage estimates and exaggerated descriptions of what he could do, were disputed by his defenders and by some journalists. It is fair to say that his reputation ran ahead of the documented facts, and that accounts of his career vary in tone depending on the author.

A second career

After his release, Mitnick became a security consultant. He founded a firm that carried out penetration tests, in which clients paid him to try to break in using the same techniques he had once used without permission. He also became a popular public speaker. He died in July 2023 at the age of 59.

Mitnick's later work for clients followed the same approach in reverse. He tested companies by trying to talk his way into their systems, and then reported which staff members had been persuaded and what rule would have stopped them. The point of the exercise was not blame but practice: people get better at recognising a pretext after they have met one.

Why it matters to site owners

Small businesses often assume that attackers care only about large companies. But social engineering is cheap and scalable, and it works on anyone. Typical examples today include a fake message claiming to be from your domain registrar, a call from someone who says they are your hosting support, or an email from a supposed supplier asking you to change bank details.

For a wider baseline of measures, see the security page.

The lesson for site owners today

1. Verify requests out of band. If someone asks for a password, a payment change or access, confirm through a channel you already trust.
2. Never share passwords. A legitimate provider does not need your password to help you.
3. Use two-step login. It reduces the damage if a password is given away.
4. Train everyone who has access. The weakest account is the one that matters.

Our own team will never ask for your account password. If you receive a message that claims to come from us and asks for credentials, forward it through our contact page. For more on keeping accounts safe, read the security page.