Ghost in the Wires

Ghost in the Wires, Mitnick & Simon

Disclaimer: Kevin Mitnick is a personal friend, and this review is based on a late galley copy. I have no financial interest in this book. The above link is an affiliate link.

I have been reading books about Kevin Mitnick for years. Finally, we get to read the best one yet. All of the previous authors worked from information they could glean, and some limited interactions with Kevin himself. The problem is, he was playing most of them a lot of the time. What we have here is Kevin's own version of his story, written himself, along with his collaborator William Simon.

I'll just jump right in; I loved this book. If you have any interest in real-world hacks at all, read it. The other books and news stories didn't cover half of what he did. As I devoured in in two days, I kept turning to people to say "Read this!" or repeating one of his stories for co-workers.

I have some clear favorite stories, but I don't want to give any spoilers. It's that much like reading a thriller. My favorites are how he defeated the radio encryption used by the FBI, and how he would go about obtaining a new identity. Specifically, how and where he researched the identities, and got the appropriate document papers.

The sheer audacity that some of his tricks took is amazing to me. He admits things in the first few pages that surprised me. And after reading about how things went with his friends over the years, I finally have some appreciation for why he has such hatred of snitches.

Let's be clear, this is not a technical book like others I have read. He doesn't cover how to exploit a stack overflow. When he breaks into a Solaris box, he says "I used a Solaris exploit." He says that the reason for that was to make it more readable for the general public. And I don't think he's incorrect in that. The focus is story and history.

But even if you're a hard-core technical security person, I think you'll like the book for what it is. Unless you think that security begins and ends with writing a cool exploit. Do I think Kevin has technical skills? I do. But those aren't his greatest powers. Yes, he's a fantastic social engineer. And using those skills, he owned more things and companies than probably anyone else. A 0-day exploit that lets you break into a source control server is impressive. But I don't think it's quite as cool as calling up and getting them to just mail you a tape with the source. There's no patch for stupid.

You'll also enjoy the book if you have an interest in computer or security history like I do. It spans several decades, from when he was a kid interested in magic up to almost present day. There are the cameos from other well-known hackers that have had books written about them as well. I have enjoyed reading articles and seeing Twitter exchanges with Kevin and some of his old victims. (All amiable so far as I have seen.)

If you want the most accurate version of the Mitnick story available, here you go.

Gmail uptime

My manager at BigFix was having a discussion with our CFO about Gmail uptime (in the context of our email infrastructure uptime.)

Using this as a data source:
http://www.google.com/appsstatus#hl=en

and selecting Google Mail and Postini Services at the items to measure, he arrives at this:

Date	Service	Duration	Reason
4/9/2010	Postini	2:24	Unspecified Emergency Maintenance
4/7/2010	Core Gmail	11:20	HTML mode email down for "a small number of users"
4/2/2010	Postini	2:08	Failed Postini update
3/16/2010	Core Gmail	9:51	Inbound/Outbound Email was not routing
3/15/2010	Core Gmail	4:38	Users unable to access gmail accounts
3/10/2010	Core Gmail	0:50	Users unable to access gmail accounts
3/8/2010	Postini	0:29	Anti-Spam not anti-spamming
3/4/2010	Postini	0:58	Anti-Spam not anti-spamming
2/25/2010	Postini	7:46	Users unable to send email
		40:24

Total runtime (2 services) 2304
48 days, 24 hrs day, 2 services

Effective uptime
98.24%

I have not done my own math here to verify, just thought it would be interesting to share. Note that he gives them twice as many runtime hours since he's counting two services. I would tend to halve that, resulting in double the downtime percentage.

I thank Google for publishing their outage information, by the way.

Just a data point for the next time someone is asking you for more nines than is reasonable.

Contradiction

"They are all correct."

"How could they ALL be correct? They contradict each-other. You can't have Heaven and Valhalla be the afterlife. If Heaven exists then that means that Valhalla doesn't. And vice-versa."

"Think of it as parallel universes."

"But doesn't the idea of a God transcend multiple universes? Isn't God the god of all universes?"

"Yes."

"And so is Zeus?"

"Yes. Infinite, parallel parallel universes."

"Which universe is Earth in?"

"Earth is Earth. The afterlife is different. It is when you change over."

"So if I'm from Earth, which one do I go to?"

"It depends on what you believe. You determine where you go, when you cross over."

"So if I believe in Judeo-Christian Heaven?"

"Then you go there."

"But what if I believe in that, but don't think I lived well enough?"

"Then you go to Hell."

"Does that mean there isn't a God?"

"All of the gods are. You go to the one you believe in."

"What if I believe in reincarnation?"

"Then you will be reincarnated."

"On Earth?"

"On an Earth, yes."

"What about the atheists?"

"They cease to be."

"That doesn't seem fair. They die?"

"It is what they believe happens. It is what they cause to happen."

"So if you don't have faith in something, you die?"

"Faith is not a belief in what might happen. It is what happens. It causes it to happen. If you believe death is the end of your existence, then it is so."

"So where would I go?"

"What do you believe?"

"I don't know, really. I believe... or maybe I hope something happens. I always had a hard time believing one church was right and that the others were wrong. Or that any of them were right. I guess I figured I would find out when it happened. I hope I will have a chance to figure it all out afterward."

"That is how you ended up here."

Fixer-Upper

Continued from Welcome Home

The sunlight disappeared again, and he assumed he was wheeled into a building. He felt several turns and a jolt that he thought must have been his gurney being shoved through a swinging door. He came to a halt, and another bright light painted his face sheet. Very artificial light.

The sheet was pulled away. More surgical masks this time. There was an overhead light on an articulated arm. Buzzed, muffled voices, one of the masked individuals gestured at the light to another. The latter grabbed a handle on the side of the light with a gloved hand, and aimed it directly into his face, forcing him to squeeze his eyes closed.

He felt latex-covered fingers prodding his head and neck. A shadow fell over his face, and he opened his eyes to see a masked face with plastic glasses leaning over his, looking into his face. He assumed the face belonged to a surgeon. The mask, glasses, head cover, gown, mostly blue paper said medical to him. The surgeon's head was blocking the flow of light. He could see the surgeon's jaw moving behind the mask, looking at him, talking to him, but all he could hear was the buzzing, muffled sounds. The surgeon gave up, and shook his head "no" to someone beside him.

The head withdrew and the bright light shut his eyes again. The probing fingers returned, concentrating on his neck. They pressed hard, causing him to flinch from the pressure. Down the side of his neck they poked, until they were partway down his shoulders, where the poking was replaced by a slight pressure or tugging. This was repeated multiple times on each side. Poking hard enough to get a reaction higher up on his neck, and then gentle pressure as they went further down his shoulders.

He felt fingers at his ears, pulling them in different directions from the outside. He didn't feel them extract whatever had been shoved into his ears that kept him from hearing, but they inserted something cold and hard into his right ear. His ear was still numb and the sound was muffled, when he felt a sudden stabbing pain in his ear. He instinctively tried to jerk, but the movement was truncated by the screws that still held his head in place. It didn't stop the stars of pain from lighting up his closed eyes.

While he was concentrating on stilling himself, the intensity of the light on his face abated. He opened his eyes and blinked away the tears. Looking up, he saw the light was aimed further down his body. He tried to follow with his eyes, but he was lying flat, and there were tubes at his nose and mouth partially blocking his view. He could see the surgeon's side near his face. The surgeon was bent over his body.

He watched the surgeon take several scalpels in a row, and bend low over him each time. Each time, he would place the bloody scalpel on a tray. He couldn't feel any pain. He realized that he must have been heavily drugged most of the time for days, which is why he couldn't move and was so foggy.

He didn't have any memory of his capture or injuries. He didn't know who had him, or if they were the ones who did this to him. He had eliminated the possibility that it was just medical personnel. Hospitals don't use military transports, and they don't keep you moving for days before they operate. Unless he dreamed all of that. Unless he'd already received some treatment. But he couldn't have dreamed all of it. He knew they had found him.

Next the surgeon grabbed some kind of big pliers or clamp. He saw that they opened when the handles were squeezed as the surgeon flexed them. He must have left them in place, because he stood up empty handed. He was handed what looked almost like a soldering gun, but when the surgeon pulled the trigger, he could see a small blade vibrate at the end, almost like a tiny skillsaw.

His eyes went wide when he realized that it was a sternum saw, and that his chest was being cut open. His eyes went wide, and he tried to thrash. The panic made him able to ignore the pain as he writhed and his eyes rolled in his skull. The surgeon stopped momentarily and motioned in his direction with a tilt of his head. From behind, he felt a needle insert into his neck. A slight burning spread up the blood vessel in his neck. The needle was withdrawn, and they unceremoniously dropped the sheet back over his head box.

As he sank down below consciousness, he thought "why are they keeping me alive?"

Welcome Home

I thought I might experiment with some serialized fiction on my blog. I'm trying a slightly different style. I'm going to attempt to be a little gory and disturbing so if that bothers you, fair warning. I'll have a tag for these posts later.

-- end author's note

The jolt from the helicopter landing shook him into awareness. Another stab of lightning shot through his head and made his vision go white. Water leaked from behind his eyelids, squeezed tight from the pain. He knew it was a helicopter from the vibrations of the rotors. He had spent a little time on helicopters in his 20's.

He couldn't tell if it had been days, or a week, or more. He spent much of the time unconscious from pain or drugs. Or not being able to tell the difference between real and imagined. Rarely, he could catch a blurry glimpse of the inside of an ambulance or plane when they would remove his head covering to work on him. If he didn't have an overhead light blinding him.

Every face he caught sight of during this time was covered with a mask. These ranged from baby-blue or white surgical masks, to Army green and SWAT black gas masks.

He could tell words were being spoken all around him, but was unable to understand them. Not because they weren't English. He thought they were, from the rhythms of the words. He couldn't understand because they had shoved something in his ears days ago and left it there. Words came to him as a buzzing, scratchy sound. The loudest thing in his head was a constant tone, like an old modem trying to sync. He could "hear" the helicopter blades as a vibration in his skull. His ears hurt, but the pain level barely registered above the symphony of hurt that was his head.

Frightening to him, it was only his head that hurt. He had been able to see down his body twice. Each time, covered and strapped down. The whole time he was in custody, they had him strapped down to a gurney. He thought he had moved his arms and legs a few times while strapped down. Simultaneously light and drug-deadened.

Tubes ran through his mouth and nose. A machine pumped air in and out of him. He could feel temperatures and pulses slide through the tubes. His head was caged in a scaffold of bars, forming a box. At odd angles to the box were long, spiked screws that drilled directly into his skull, immobilizing him. The entire box was draped with a sheet.

Shadows across the sheet indicated that there were men at the sides of his gurney. It started to shake, and then it felt like he was rolling. He imagined fabric straps being release from the floor and walls and his wheels being unlocked. He was rolled towards what must be the helicopter door, and hoisted by his pall bearers. He floated through the air briefly until his wheels made contact with ground again. There was a qualitative difference between rolling on the steel floor of a vehicle and the rough pavement or concrete he rolled on now.

As he rolled, the shadow line suddenly crossed his sheet, and bright light illuminated his covering. He could immediately tell the sunlight from the artificial lights he'd been under. The warmth and color were unmistakable.

It was the last time he would ever see sunlight with his own eyes.