Kevin this is freaking awesome. Short , quick and to the point. Can I freely send this out to my user base. I am a CISO for a city government agency in Kansas. I am trying to change our culture to me more security minded.
During his hacking days he had hacked many high profile companies to steal millions of private customers information but he didn't use them. He only did it for fun, perhaps by implicitly sending a loud and clear message to companies that he hacked to fix that exploits. I tip my hat to Kevin. Most hackers out there are not like him, instead they use whatever they hack to their gains or advantage.
This is so lame, as a developer this is an easy to write program or an add-on that gets privileged for 365 emails app, all your email add-ons can do this
Lame, sure, but an effective demonstration of the ease with which an attack like this could go down. It isn’t a purely mechanical hack being demonstrated either. There’s no fancy code or stack whatnots on display. It’s about phishing. Many devs can write malicious code that does “bad” stuff when executed with full permissions, and there’s many ways to get to that point. You can dev all sorts of protections or work arounds, but sometimes you just need the right person to click the right thing. Boom. Access. Plus it’s mitnick. His whole shtick has been social hacking (and cool business cards) for good reason. Educating ends users about phishing is worthwhile.
This isn't a presentation for developers, doofus, it's for organisations that don't understand how phishing works or the threat it represents to their business. Mitnick is simply demonstrating the ease with which a remote attacker could target an employee and convince them to install a malicious application that allows an attacker to infiltrate an organisation and steal sensitive information.
