[00:00.000 --> 00:01.300]  Alright, sorry for the delay.
[00:01.580 --> 00:02.260]  Wow, that's loud.
[00:05.240 --> 00:16.220]  Kevin Mitnick has been part of the 2600 community for many years and his story resulted in a documentary that Emmanuel put together and put a lot of work into called Freedom Downtime.
[00:23.130 --> 00:25.850]  If you haven't seen that, I highly suggest you pick it up.
[00:25.970 --> 00:28.990]  I don't know if it's for sale out there, but if not, it should be.
[00:29.510 --> 00:31.730]  But let's get straight away to Kevin Mitnick.
[00:40.190 --> 00:40.590]  Hello.
[00:41.290 --> 00:42.270]  How's everybody doing?
[00:43.430 --> 00:43.830]  Alright.
[00:48.610 --> 00:49.010]  Hello.
[00:49.830 --> 00:50.210]  Test this.
[00:50.370 --> 00:50.790]  Okay, perfect.
[00:50.950 --> 00:51.750]  I can walk around now.
[00:52.050 --> 00:53.150]  It's great to be back.
[00:53.330 --> 01:01.670]  I'm sorry, I was supposed to speak here two years ago, but I was in Bogota, Colombia, and either from the food or the water, I ended up getting really sick.
[01:02.150 --> 01:03.790]  Ended up in the hospital in Colombia.
[01:04.110 --> 01:09.090]  They couldn't figure out what virus I had or what I ate that put me in there for about eight days.
[01:09.430 --> 01:11.130]  I remember I'm sitting there in the hospital.
[01:11.790 --> 01:13.930]  All of a sudden, like three days later, the phone rings.
[01:14.470 --> 01:15.070]  I pick it up.
[01:15.490 --> 01:16.530]  I figure it's my family, right?
[01:17.110 --> 01:18.550]  It's some guy from CNN.
[01:18.730 --> 01:20.230]  He goes, Kevin, what's going on?
[01:21.070 --> 01:24.350]  And first of all, how did you know I was in the hospital?
[01:24.650 --> 01:25.950]  B, how did you get my number?
[01:26.290 --> 01:28.490]  And he says, oh, no, no, we found out you're in the hospital.
[01:28.590 --> 01:29.530]  We want to know what's going on.
[01:29.670 --> 01:30.750]  So I just told him I'm sick.
[01:30.790 --> 01:31.330]  I have a flu.
[01:32.090 --> 01:34.070]  But then he started getting into more interesting questions.
[01:34.170 --> 01:37.190]  He goes, so why exactly are you in Bogota, Colombia?
[01:38.970 --> 01:40.150]  I told him I couldn't tell him.
[01:41.210 --> 01:45.010]  But yeah, so I'm sorry I didn't get to make it last hope.
[01:45.190 --> 01:50.550]  But I'm here today, and I'm just going to go through some stories that you might find entertaining.
[01:51.150 --> 01:53.830]  I'm going to show you guys how you could easily unmask caller ID.
[01:54.390 --> 01:58.890]  So when anybody calls you, like on your cell phone, there's a real quick and easy way you could do it.
[01:59.030 --> 02:02.170]  So basically, you don't have privacy.
[02:02.370 --> 02:03.230]  You know, get over it.
[02:05.170 --> 02:05.530]  Right?
[02:06.210 --> 02:07.470]  Have any of you already do that?
[02:07.610 --> 02:09.690]  Do you already unmask your caller ID when people call you?
[02:10.730 --> 02:16.450]  Because the old way of doing that is you forward the incoming call to an 800 number and then forward it, you know, through one of these services back.
[02:16.670 --> 02:17.890]  But there's a much easier way.
[02:19.190 --> 02:23.810]  And last week, I'm proud to announce I got to sign my book deal with Little Brown.
[02:23.930 --> 02:25.410]  It's a publisher in New York.
[02:25.530 --> 02:27.190]  And I'm going to be able to write my life story.
[02:27.190 --> 02:28.870]  I had to wait a long time.
[02:36.090 --> 02:37.730]  Finally, I get to tell my side.
[02:37.950 --> 02:47.310]  I had to wait seven years because part of my plea agreement with the federal government was that I couldn't profit off my story for seven years and that expired in 2007.
[02:47.810 --> 02:51.270]  And then it took a while for my co-author and I to write up a proposal.
[02:51.490 --> 02:54.350]  Then I went around to these publishing houses and I finally got the deal.
[02:54.770 --> 03:03.270]  So I hope maybe in the next conference, I hope this is not really the last hope, but if it is, but the next HackerCon, I'll be able to present that book all to you.
[03:04.730 --> 03:05.770]  So, some stories.
[03:07.110 --> 03:10.230]  I don't know, how many of you were here when I spoke four years ago?
[03:11.950 --> 03:12.750]  Okay, wow.
[03:13.090 --> 03:15.610]  Okay, about 30% to 50%.
[03:15.610 --> 03:18.110]  So I might go over some of the same stories.
[03:18.530 --> 03:23.070]  Just sit back and relax and hopefully the people that weren't here will be entertained.
[03:24.010 --> 03:29.170]  When I first got into computers, it really started when I was a young kid.
[03:29.290 --> 03:31.730]  When I was 11 years old, I was fascinated with magic.
[03:32.330 --> 03:36.150]  And I used to hang out at the magic store on the weekends to learn.
[03:36.510 --> 03:39.070]  You know, my mom used to go to work and I had to go to school.
[03:39.310 --> 03:47.370]  And on the weekends, I'd go to the magic store and kind of sit there and try to watch the salespeople perform illusions and then I'd try to learn the secrets.
[03:47.370 --> 03:53.510]  And then from magic, I fell into this hobby called amateur radio.
[03:54.030 --> 03:57.590]  And I think you just heard that they're offering amateur radio tests.
[03:58.070 --> 04:11.430]  And when I started in amateur radio, this is where I got very interested in telephony because ham radio, they had things called auto patch back in the days where you can make phone calls but you couldn't do it for personal use.
[04:14.030 --> 04:20.110]  So once I got into amateur radio, I met another student in high school in Los Angeles, California.
[04:20.350 --> 04:21.950]  And this kid was into phone phreaking.
[04:22.910 --> 04:31.510]  And he wanted to borrow one of my ham radios and in exchange, he said he will teach me a little bit about this unknown world of me of telephones.
[04:32.030 --> 04:35.830]  And this kid could do amazing things at the time that I thought was amazing.
[04:36.070 --> 04:42.130]  He can call a telephone number, a local number, put in a five digit code and call anywhere in the world.
[04:42.910 --> 04:46.330]  Little did I know, he was using Sprint and MCI at the time.
[04:47.390 --> 04:55.850]  If he had somebody's telephone number, he can call a secret number at the phone company called the CNA Bureau and he can get the name and telephone number.
[04:55.850 --> 05:01.210]  If he just had my parents' names, he was able to get their non-published number.
[05:01.770 --> 05:04.050]  So this was all very interesting to me.
[05:04.130 --> 05:07.010]  So I became involved in this area of phone phreaking.
[05:07.410 --> 05:14.630]  And then because I'm a prankster, I took this area of phone phreaking and I applied it to pulling pranks on friends.
[05:16.130 --> 05:23.550]  So one of the first things I did was I accessed a telephone company switch in Pasadena, California.
[05:24.830 --> 05:28.110]  And I was friends with another guy that was also into the phone phreaking.
[05:28.610 --> 05:32.170]  And I changed the class of service on his home telephone to that of a pay phone.
[05:33.790 --> 05:37.750]  So whenever he or his parents would try to make a call, I'd say, please deposit a quarter.
[05:40.670 --> 05:41.530]  That was fun.
[05:42.330 --> 05:46.390]  But what was even more interesting is intercepting directory assistance.
[05:46.750 --> 05:49.170]  There was a special way of calling a toll-free number.
[05:49.170 --> 05:57.690]  And then with the A, B, and C, D tones, you could actually set up intercepts on directory assistance around the United States.
[05:58.210 --> 06:02.510]  And they really fixed this flaw after we had fun with them for about a weekend.
[06:03.410 --> 06:08.350]  Especially Providence, Rhode Island, people would call in and we get to play directory assistance operator.
[06:08.350 --> 06:12.230]  And you could imagine, 17 and 18 years old, the fun you could have, right?
[06:13.730 --> 06:15.370]  Some people would call and I'd say, what city?
[06:15.670 --> 06:16.930]  They'd say, Providence, Rhode Island.
[06:17.710 --> 06:19.210]  I'd say, name, please.
[06:19.410 --> 06:20.010]  They'd give me the name.
[06:20.570 --> 06:22.370]  And I'd say, hold on, I'm looking that up for you, sir.
[06:22.670 --> 06:24.230]  And I'd say, oh, by the way, we're doing a survey.
[06:24.330 --> 06:27.130]  Do you mind spending about 15 to 20 seconds to complete our survey today?
[06:27.510 --> 06:28.170]  He'd go, sure.
[06:28.870 --> 06:29.790]  And I'd say, okay.
[06:30.010 --> 06:32.030]  One of our first questions, are you at home or in the office?
[06:32.450 --> 06:32.970]  I'm at home.
[06:33.490 --> 06:36.710]  Do you have our current yellow pages and white pages at home?
[06:37.150 --> 06:37.870]  Yes, I do.
[06:38.490 --> 06:39.690]  Then why are you calling me?
[06:46.330 --> 06:48.370]  Another call, someone, you know, what city?
[06:48.530 --> 06:49.430]  Providence, Rhode Island?
[06:50.390 --> 06:51.690]  May I have the name, ma'am?
[06:51.970 --> 06:53.010]  Sure, it's John Smith.
[06:53.970 --> 06:55.070]  Okay, one moment, please.
[06:55.850 --> 06:58.210]  That number is 555-215-37.
[07:01.130 --> 07:01.570]  What?
[07:03.070 --> 07:05.090]  555-215-37.
[07:05.430 --> 07:07.890]  And they'd go, how do I dial a half?
[07:09.950 --> 07:15.350]  And I said, you know, between the one and zeros, you're dialing the phone, you just kind of give it a little bit of a nudge.
[07:15.670 --> 07:20.130]  Or you can go down to our phone center stores.
[07:20.250 --> 07:21.250]  They existed at the time.
[07:21.410 --> 07:22.910]  And you can buy one of our new phones.
[07:23.030 --> 07:23.830]  It has halves on it.
[07:27.630 --> 07:29.810]  Unfortunately, that fun only lasted for the weekend.
[07:31.490 --> 07:39.990]  Because we did a little bit more immature pranks, but I'm not going to go into that over here in this conference, because I'm being recorded.
[07:40.310 --> 07:44.310]  And by the way, anything I talk about today, just my disclaimer, everything happened over five years ago.
[07:44.590 --> 07:46.490]  So it's passed the Federal Statue of Limitations.
[07:48.050 --> 07:48.590]  All right.
[07:48.830 --> 07:49.670]  So, just so we know.
[07:49.950 --> 07:50.590]  Okay, perfect.
[07:51.330 --> 07:54.850]  But when I was an amateur radio, I also was a prankster.
[07:55.250 --> 08:02.810]  And my target was my favorite, not my favorite, but the most well-known fast food restaurant in the industry, McDonald's.
[08:03.210 --> 08:07.950]  Have any of you played with McDonald's with radio in the audience?
[08:09.670 --> 08:11.590]  And you know what fun you could have, right?
[08:11.810 --> 08:21.710]  So when a customer drives up to the drive-in window and places an order, I, with my friends, parked across the street, could take over the system.
[08:22.030 --> 08:26.030]  So now the customer's not speaking to the guy inside with the headset.
[08:26.330 --> 08:27.390]  He's speaking to me.
[08:28.290 --> 08:29.710]  So you can imagine, right?
[08:30.170 --> 08:31.230]  Customer drives up.
[08:31.550 --> 08:32.890]  Yes, may I take your order, please?
[08:33.610 --> 08:34.410]  Yada, yada, yada.
[08:34.930 --> 08:38.170]  And say, well, congratulations, you're our 50th customer today.
[08:38.550 --> 08:40.010]  Drive forward, your order's for free.
[08:44.460 --> 08:47.220]  And then I had a friend that did a really good Indian accent, right?
[08:47.580 --> 08:53.580]  So what happened is the customer would place the order, and it kept getting repeated back incorrectly.
[08:54.600 --> 08:55.000]  Right?
[08:55.280 --> 08:58.260]  For, you know, for about 10 or 15 times, the person loses patience.
[08:59.080 --> 09:01.640]  And then, of course, there was menu changes at McDonald's.
[09:01.740 --> 09:04.420]  Where no longer were there hamburgers, french fries, and sodas.
[09:04.580 --> 09:07.520]  It was all burritos, tacos, and hot dogs.
[09:10.550 --> 09:14.050]  So after messing with this one McDonald's, this was in Hollywood, California.
[09:15.450 --> 09:20.430]  This, they put a sign on the drive-up window that it's closed.
[09:20.890 --> 09:23.710]  Because they kept getting messed with.
[09:23.990 --> 09:31.390]  So the manager of this McDonald's comes out, right after we were playing with him for a while.
[09:31.650 --> 09:33.730]  He comes out, and he's looking in the parking lot.
[09:34.110 --> 09:35.590]  And he's looking for the culprit.
[09:35.910 --> 09:37.630]  Who's messing with, you know, their system.
[09:38.530 --> 09:41.030]  And he's looking around, and he has no idea.
[09:41.470 --> 09:44.270]  Again, we're sitting across the street of a big boulevard.
[09:44.270 --> 09:45.850]  It's, like, right over here on Broadway.
[09:46.350 --> 09:47.190]  And we're watching.
[09:47.330 --> 09:48.070]  We're laughing in the car.
[09:48.490 --> 09:50.470]  And so this guy starts looking around.
[09:50.690 --> 09:51.570]  He sees nothing.
[09:52.290 --> 09:55.150]  He goes up to the drive-up speaker.
[09:55.510 --> 09:59.830]  And he's examining it, and he's looking at it like, you know, like it's possessed.
[09:59.830 --> 10:01.150]  And he's, like, looking around.
[10:01.930 --> 10:06.790]  And then, he doesn't see anything, so he puts his face right next to the speaker.
[10:08.750 --> 10:09.770]  I couldn't resist.
[10:10.030 --> 10:11.110]  What the f*ck are you looking at?
[10:11.190 --> 10:11.990]  And this guy...
[10:12.530 --> 10:12.970]  Boo.
[10:18.010 --> 10:20.750]  I never saw a guy run so fast except win.
[10:24.510 --> 10:25.350]  It was great.
[10:25.510 --> 10:28.050]  I mean, we had a great time with McDonald's.
[10:28.530 --> 10:32.190]  So, yeah, those were kind of interesting pranks.
[10:35.700 --> 10:42.720]  Back in 1988, I don't know if you know kind of my history, that was the first time I was, like, federally busted for computer hacking.
[10:43.040 --> 10:47.280]  A friend of mine and I were hacking into a company called Digital Equipment Corporation.
[10:47.960 --> 10:50.000]  And what happened is, we had a falling out.
[10:50.180 --> 10:52.740]  And he informed the FBI what I was doing.
[10:52.900 --> 10:54.280]  And he set up a sting operation.
[10:54.600 --> 10:55.580]  I was arrested.
[10:56.140 --> 11:06.060]  At the time, the federal prosecutors had told the judge that I had the capability of starting a nuclear war by whistling into a phone.
[11:08.440 --> 11:16.420]  At the time I was in court, when I went to court for my detention hearing, as they call it, I was, like, expecting to get out.
[11:16.660 --> 11:19.420]  Because I just spent three days in Terminal Island Federal Prison.
[11:19.800 --> 11:21.380]  And it wasn't a fun experience.
[11:21.940 --> 11:26.980]  And I go to court and I'm ready, you know, I'm looking at, you know, when am I going to get out of here?
[11:27.300 --> 11:36.020]  And then when the federal prosecutor said that I could just whistle into a phone and start a nuclear war, I actually grinned because I thought he would lose all credibility with the court.
[11:36.520 --> 11:40.200]  But what happened is the judge says, you're absolutely right, Mr. Prosecutor.
[11:40.360 --> 11:44.760]  In fact, we need to make sure that he can't even get to a telephone in the prison.
[11:44.960 --> 11:46.980]  So I ended up in the hole in solitary confinement.
[11:47.960 --> 11:49.300]  But eventually I was released.
[11:49.840 --> 11:51.760]  And at that time I was keeping my nose clean.
[11:51.900 --> 11:53.760]  I found new hobbies and new interests.
[11:54.440 --> 12:08.300]  And my brother called me one day, my half-brother, and he told me that this guy Eric Hines wants to speak with me, that he used to be a hacker and he has a lot of interesting things he would like to talk to me about.
[12:09.640 --> 12:12.160]  And I kind of really wasn't that interested.
[12:13.440 --> 12:16.620]  And my brother called me again saying this guy really wants to talk to you.
[12:17.960 --> 12:19.420]  So I called the telephone number.
[12:19.740 --> 12:30.920]  It turned out to be this guy that wasn't Eric, but what he would do is he would actually page Eric to his number and he would conference it in like this ultra, you know, doo-doo-doo-doo-doo-doo-doo-doo.
[12:31.680 --> 12:33.340]  So I finally get this guy on the phone.
[12:34.520 --> 12:37.180]  And he seemed very knowledgeable about phone phreaking.
[12:37.340 --> 12:39.600]  He knew a lot about the internal systems at the phone company.
[12:39.980 --> 12:41.760]  He knew about equipment in the central offices.
[12:42.040 --> 12:44.860]  And it intrigued me because I had a passion for technology.
[12:45.620 --> 12:47.900]  So we set up a meeting to meet at a Hamburger Hamlet.
[12:48.200 --> 12:55.980]  And I brought a friend of mine along, a guy named Lewis De Payne, who incidentally was my hacking partner for a number of years.
[12:56.480 --> 12:59.820]  And we meet this guy, Eric, at a Hamburger Hamlet.
[13:00.840 --> 13:04.760]  And he starts telling us that he was part of the Kevin Poulsen case.
[13:04.920 --> 13:06.200]  Everybody familiar with Kevin Poulsen?
[13:06.880 --> 13:07.400]  Okay.
[13:07.940 --> 13:13.220]  And he starts telling me about all their escapades into phone company offices.
[13:13.900 --> 13:15.260]  I'm sitting there and I'm listening.
[13:15.720 --> 13:17.460]  And I said, so what happened to you?
[13:18.100 --> 13:19.080]  Because Poulsen was busted.
[13:19.640 --> 13:21.680]  He says, well, I was in Texas.
[13:22.080 --> 13:25.020]  And I was busted for doing some sort of credit card fraud.
[13:25.800 --> 13:30.000]  But they wanted some information about how I was doing the fraud, the FBI.
[13:30.300 --> 13:35.220]  So I cooperated with them and told them how I was able to commit these frauds.
[13:35.280 --> 13:36.180]  This is him telling me.
[13:36.740 --> 13:38.220]  And I got out early.
[13:38.280 --> 13:38.800]  I got a deal.
[13:39.240 --> 13:41.180]  I said, so they didn't ask you about Poulsen?
[13:41.580 --> 13:42.340]  He goes, no.
[13:42.460 --> 13:43.620]  They only wanted to know about me.
[13:44.240 --> 13:45.340]  Doesn't sound like the FBI.
[13:45.600 --> 13:45.660]  I know.
[13:45.940 --> 13:46.740]  Usually they want to know about everything.
[13:47.900 --> 13:52.780]  So eventually, during the conversation, he says, we're talking about different systems at the phone company.
[13:52.920 --> 13:55.080]  You know, COSMOS, SCCS.
[13:55.620 --> 13:57.980]  I'm not going to go into all the MIZAR.
[13:58.400 --> 14:01.160]  Remember all these, familiar with all these names of internal systems of mobile?
[14:02.140 --> 14:04.080]  And then he mentions a system called SAS.
[14:04.440 --> 14:06.260]  He goes, you know about SAS, don't you?
[14:07.100 --> 14:07.480]  And I go, no, no.
[14:15.120 --> 14:16.160]  I go, tell me more about it.
[14:16.700 --> 14:19.020]  And then he clammed up and didn't say another word.
[14:19.220 --> 14:20.100]  And the meeting ended.
[14:20.920 --> 14:21.920]  And I was intrigued.
[14:22.200 --> 14:25.040]  I wanted to find out, I didn't know about this system called SAS.
[14:25.280 --> 14:26.300]  What exactly is it?
[14:26.680 --> 14:38.480]  And how he told me he discovered it is he and Kevin Poulsen were actually in one of the phone company central offices, found the equipment, and were able to hook up a tape recorder and actually record the protocol going back and forth.
[14:39.500 --> 14:41.260]  So what I did is I called the phone company.
[14:41.740 --> 14:50.100]  And using my social engineering skills, I wanted to find out the company that developed this tool.
[14:51.420 --> 14:56.820]  And so, after about, you know, two or three phone calls, I found out the name of the company that manufactured SAS.
[14:58.000 --> 14:59.660]  I do some research on this company.
[15:00.320 --> 15:02.580]  And I find out that they went out of business.
[15:02.800 --> 15:03.980]  They no longer are in business.
[15:04.180 --> 15:17.300]  So I did a little bit more research and I found out the founders of the company, tracked one of them at home, pretended to be a person working for Pacific Bell IT, and that I wanted to make improvements on the system, but I had no information.
[15:18.300 --> 15:23.860]  And the guy says, well, since we went out of business, do you want me to send you the design plans and the different protocols and everything?
[15:24.500 --> 15:26.940]  I could either FedEx it to you or I could fax it to you.
[15:27.020 --> 15:27.540]  What do you want?
[15:27.900 --> 15:29.240]  I said, sure, fax it to me.
[15:29.760 --> 15:34.100]  So then I had all the protocols and all the information of how to access SAS.
[15:34.240 --> 15:45.320]  And how SAS worked is they had remote RTPs, remote test points in every central office, and they would use computer terminals in a test department at Pacific Bell, and it would talk to a concentrator.
[15:45.520 --> 15:58.220]  That concentrator would dial-up to the RTP in each central office and it would use a proprietary protocol and it would give the test technician the ability to make calls from that number, to listen to the calls, to do a number of different test functions.
[15:59.500 --> 16:03.440]  So now I had the capability, like Eric had, of using SAS.
[16:04.660 --> 16:05.820]  So let's fast-forward.
[16:06.020 --> 16:10.360]  This is kind of a lengthy story, but it's kind of interesting.
[16:11.880 --> 16:20.080]  So I started to get suspicious about Eric because every time we'd get together or talk on the phone, he'd start, like, asking me questions.
[16:20.480 --> 16:21.960]  Who do you associate with?
[16:22.080 --> 16:22.860]  Who do you talk to?
[16:23.100 --> 16:24.860]  What are other hackers doing?
[16:25.060 --> 16:27.160]  And to me that was a big red flag and yellow flag.
[16:27.740 --> 16:30.980]  So I started wanting to look into, well, who is this guy?
[16:31.540 --> 16:37.220]  And at the time, the Public Utilities Commission did not tariff Caller ID in California.
[16:37.820 --> 16:40.880]  But since I had switch access, I did.
[16:41.140 --> 16:44.640]  So I basically implemented Caller ID in Los Angeles.
[16:45.020 --> 16:54.340]  I set up Caller ID on a friend's telephone, and then at 3:30 in the morning, I called Eric's pager number to call this telephone number.
[16:54.700 --> 16:59.960]  He did, and we were able to ID the number, and then from there get the address information from the phone company.
[17:00.500 --> 17:03.820]  It turned out this went to the Oakwood apartments in Los Angeles, California.
[17:04.420 --> 17:07.280]  Then I decided, well, I've got to find a little bit more about Eric.
[17:07.420 --> 17:08.200]  I just know his name.
[17:08.860 --> 17:12.380]  I called the Oakwood... I find out from the phone company the unit number he's living in.
[17:12.760 --> 17:15.680]  I call up the rental office, pretending to be Oakwood corporate.
[17:15.920 --> 17:20.840]  I was able to get the whole rental application for the apartment where that phone terminated it.
[17:22.060 --> 17:27.460]  And to my surprise, there was no work information on this application.
[17:27.740 --> 17:30.300]  It only listed a mobile cell phone number.
[17:31.480 --> 17:38.060]  So I did some research, and I found out that this mobile telephone number is listed in the name of Mike Martinez.
[17:38.660 --> 17:47.260]  And then to find out more information about this number, I need to either be the customer and use social engineering, or I needed to get into the cellular phone company's network.
[17:48.020 --> 17:53.700]  At the time, I found a vulnerability in AirTouch Cellular, so I was able to get inside access to their internal network.
[17:54.120 --> 18:00.940]  What they gave me the ability to do is look at any calls that were originated from that cell phone or terminated.
[18:01.880 --> 18:11.480]  And one number that kept popping up over and over and over again was 310-477-6565, which is the headquarters of the Los Angeles FBI.
[18:13.320 --> 18:21.460]  So there I knew that there was a big problem for me because this guy was either an undercover agent or he was an informant.
[18:22.960 --> 18:30.220]  So why I'm telling you the story, too, is because I had to go through a lot of trouble to implement caller ID to get his telephone number.
[18:30.340 --> 18:35.380]  Now I'm going to show you how you could unmask private numbers, because if it happened today, he would have simply blocked his number.
[18:38.500 --> 18:45.240]  After I got the cell phone number, I pulled all the cell bills because I had access to all their internal systems.
[18:45.460 --> 18:54.900]  And then I started doing traffic analysis and found that this cell phone number was calling other phone numbers within government, other FBI cell phone numbers.
[18:55.020 --> 19:01.560]  And at the end of the analysis, I had every telephone number that belonged to the white-collar crime squad in Los Angeles.
[19:03.560 --> 19:06.560]  So what I started doing was having their numbers.
[19:06.960 --> 19:09.740]  I was able to do originating and terminating number searches.
[19:09.980 --> 19:13.440]  And then what I started doing was searching on Eric's number.
[19:13.600 --> 19:16.780]  Well, who's calling him within AirTouch Cellular?
[19:17.120 --> 19:19.100]  And who's calling Pacific Bell Security?
[19:19.620 --> 19:24.220]  And then I was able to find the case agent's cell phone number because he was calling Eric.
[19:24.380 --> 19:25.600]  He was calling Pacific Bell Security.
[19:25.920 --> 19:27.360]  He was calling different numbers at the bureau.
[19:29.740 --> 19:33.040]  So then, what I did is there was this device called the DDI.
[19:33.400 --> 19:34.680]  Is anybody familiar with it?
[19:34.980 --> 19:36.620]  A guy named Marquis Salomon Milwaukee.
[19:37.240 --> 19:44.720]  And what the DDI device allowed you to do was monitor the forward and reverse control channel of a cell site and actually be able to see calls.
[19:45.100 --> 19:46.720]  Anybody remember the DDI device?
[19:47.340 --> 19:48.720]  Okay, maybe two or three hands.
[19:49.300 --> 20:00.740]  So at the time, I was working as a private investigator in Los Angeles and I set up in my office a scanner that monitored the forward control channel of the cell site in Calabasas, California.
[20:01.940 --> 20:10.620]  So anytime any of those agents, if they registered their phone, drove into the area or through the area, it would alert... it would...
[20:10.620 --> 20:14.500]  the PC would capture the data and it would alert me with a page.
[20:15.840 --> 20:29.620]  So on September 28, 1992, I walk into the office 8 in the morning and I hear this weird beeping sound as I open the office door of the PI agency.
[20:29.780 --> 20:30.500]  Nobody else was there.
[20:31.280 --> 20:33.200]  And I'm like, listen, where's this beeping coming from?
[20:33.660 --> 20:35.600]  And I... it's coming from my office.
[20:35.760 --> 20:35.960]  Wait!
[20:36.440 --> 20:37.820]  It's coming from my PC.
[20:38.380 --> 20:45.780]  And I go to the PC and see that it caught one of the case agent's telephone number actually in my central office.
[20:46.340 --> 20:48.400]  I mean, in the cell site, right?
[20:48.600 --> 20:53.140]  So I knew that the agent was within two miles of where I was because that was the cell site's coverage.
[20:54.580 --> 20:56.040]  So what do I do?
[20:56.560 --> 20:58.320]  Well, I knew two things were happening.
[20:58.780 --> 21:00.200]  One, I was under surveillance.
[21:00.760 --> 21:06.440]  Or two, they were going to my address in Calabasas to get a description of the premises for a search warrant.
[21:07.060 --> 21:08.740]  I assumed the latter a search warrant.
[21:09.100 --> 21:10.100]  So what did I do?
[21:10.260 --> 21:14.340]  I went to Winchell's Donuts and bought a big 24-pack of donuts.
[21:15.940 --> 21:18.900]  And I wrote on a sign on my refrigerator, you know, for FBI.
[21:19.360 --> 21:20.720]  And I cleaned out my apartment.
[21:32.050 --> 21:34.390]  But I wasn't sure if it was really the bureau, okay?
[21:34.930 --> 21:35.830]  No, I knew it was the bureau.
[21:35.890 --> 21:37.710]  I wasn't sure if they were really going to search me at the time.
[21:38.310 --> 21:39.790]  So I was really unprepared.
[21:40.030 --> 21:41.190]  I waited the next day.
[21:41.510 --> 21:42.570]  Nobody knocked on the door.
[21:42.770 --> 21:43.590]  There was nothing happening.
[21:43.830 --> 21:45.590]  So the next day I got kind of lax.
[21:45.770 --> 21:47.450]  But I still kept the donuts in the refrigerator.
[21:48.650 --> 21:50.410]  And I went to bed.
[21:51.790 --> 21:55.970]  Around 5 in the morning, I hear somebody putting a key in my door.
[21:56.530 --> 21:57.250]  Actually a key.
[21:57.350 --> 21:58.270]  I could hear the key go in.
[21:58.390 --> 21:59.250]  And it kind of woke me up.
[21:59.370 --> 22:01.850]  And somebody's like messing with the door.
[22:02.590 --> 22:04.170]  Immediately, I didn't think government.
[22:04.330 --> 22:06.330]  I was thinking, oh, somebody's trying to break into my apartment.
[22:07.050 --> 22:08.610]  So immediately I jump out of bed.
[22:09.310 --> 22:11.390]  And at that time, I slept nude.
[22:13.950 --> 22:15.110]  Too much information.
[22:16.830 --> 22:18.250]  And I go, who is it?
[22:19.330 --> 22:20.690]  FBI, open up, open up.
[22:20.770 --> 22:21.890]  And I was like dazzled, right?
[22:21.970 --> 22:23.010]  It was like 5:30 in the morning.
[22:23.150 --> 22:24.110]  And I opened up the door.
[22:24.310 --> 22:26.690]  And I'm facing a female FBI agent right there.
[22:27.590 --> 22:28.390]  And the nude.
[22:31.090 --> 22:32.190]  A little bit embarrassing.
[22:33.630 --> 22:35.810]  But oh well.
[22:36.010 --> 22:46.210]  So in any case, once that happened, I knew that the government was definitely looking into my activities.
[22:46.490 --> 22:53.030]  So what I decided to do was use SAS, which I never really used before, and monitor the informant.
[22:53.590 --> 23:03.130]  So now that I had Eric's telephone numbers that were in his apartment because I got them through the phone company, I then used SAS to monitor those numbers for one day.
[23:03.990 --> 23:08.690]  And about after one hour, there's this call that comes in.
[23:09.050 --> 23:12.650]  And when the call comes in, you hear like it's, what they call it is a SAS shoe.
[23:12.790 --> 23:13.590]  You call the frame.
[23:13.830 --> 23:19.470]  You put up a SAS shoe and then you use that, use SAS to actually lay and wait for the call.
[23:19.770 --> 23:24.310]  The other way was using what they call a no-test trunk, which you can only use when the call is in progress.
[23:25.010 --> 23:26.450]  So the call came in.
[23:26.450 --> 23:27.410]  And I'm listening.
[23:27.650 --> 23:30.650]  I'm actually at the offices in this PI agency in Calabasas.
[23:31.030 --> 23:34.230]  And I hear Eric answer the phone.
[23:34.630 --> 23:36.370]  And it's a guy named Ken.
[23:36.950 --> 23:41.390]  And all of a sudden, they're discussing Mitnick and discussing a search warrant and evidence.
[23:41.610 --> 23:45.010]  And I'm listening to this call with all the full attention.
[23:45.250 --> 23:52.850]  And what I found out later, this was the case agent and the informant working together to try to collect evidence against me at the time.
[23:54.110 --> 24:01.810]  So at that time, that's when I knew that I was in serious trouble.
[24:02.370 --> 24:06.770]  And I needed to get out of town, so to speak.
[24:07.330 --> 24:11.210]  Unfortunately, my supervised release wasn't up for another month.
[24:11.450 --> 24:14.390]  Meaning if I left, I'd be actually a fugitive for my probation.
[24:15.270 --> 24:23.510]  So what I did is myself and Lewis De Payne, we conspired with an attorney, actually, to come up with a disinformation campaign.
[24:24.150 --> 24:29.430]  Meaning Eric had no idea we knew he was an informant and working as a government agent.
[24:29.990 --> 24:35.430]  But in knowing this, and knowing that he doesn't know that we know, we could feed him information that would go to the bureau.
[24:35.750 --> 24:45.150]  And the whole purpose of that disinformation campaign was to get them to delay issuing an arrest warrant or arresting until my probation ended because it ends by time.
[24:46.110 --> 24:54.970]  And what happened is we actually thought it had worked because nobody came after me until two or three days after my supervised release expired.
[24:56.670 --> 25:03.770]  So why I'm telling you the story is to give you a little bit of history of my background of what actually happened with him.
[25:04.330 --> 25:07.050]  And now I'm going to give you just a...
[25:07.050 --> 25:18.010]  I'm just going to divert to a quick demo because I know we're running out of time of how this tool would have been very useful to me back in those days if I was still an unethical hacker of unmasking Caller ID.
[25:18.170 --> 25:22.370]  So I'm going to show you on a little video first and explain it, then I could demo it.
[25:22.950 --> 25:24.530]  So, one moment.
[25:25.250 --> 25:29.970]  There's this provider, SIP trunking provider called FlowRoute.
[25:30.170 --> 25:31.390]  I believe they're out of California.
[25:32.610 --> 25:37.450]  And I think because of a feature of their system... one second...
[25:37.450 --> 25:40.430]  It allows you to easily unmask caller ID.
[25:40.530 --> 25:41.970]  So I'll walk you through this video really quick.
[25:44.070 --> 25:47.090]  It's kind of slow, and I should have speeded it up, but I'm sorry.
[25:47.450 --> 25:49.870]  So I'm going to log into this FlowRoute account I created.
[25:51.410 --> 25:53.670]  And what the first thing I'm going to do is just purchase a DID.
[25:54.230 --> 25:55.730]  And then I'll walk you through how this works.
[26:01.230 --> 26:03.430]  So at least you've got something useful other than stories.
[26:03.630 --> 26:07.990]  Something that you can actually use for your inbound calls.
[26:08.150 --> 26:09.230]  So I'm going to purchase a DID.
[26:10.090 --> 26:11.790]  I'm going to purchase an Idaho number.
[26:12.610 --> 26:13.710]  It's like $1.39.
[26:14.510 --> 26:16.710]  I just went through every step so you'd see what's going on.
[26:31.370 --> 26:31.930]  All right.
[26:32.170 --> 26:33.930]  So we're going to get... it's going slow.
[26:34.050 --> 26:34.910]  I can't speed it up.
[26:35.910 --> 26:37.150]  I could stop it, of course.
[26:37.310 --> 26:40.370]  So I'm going to just go in and get the SIP configuration for asterisk.
[26:41.930 --> 26:43.190]  So I can do the registration.
[26:46.210 --> 26:47.150]  Which is all common.
[26:47.290 --> 26:49.210]  This is all no-brainer stuff.
[26:49.470 --> 26:51.370]  But I wanted to put it in for people that don't know.
[26:51.370 --> 26:52.610]  And I can make the video available.
[26:53.990 --> 26:59.330]  So this is so when a call comes into the DID, it knows where to send the call.
[26:59.690 --> 27:01.630]  So here's my asterisk VPS box.
[27:02.450 --> 27:05.330]  So I'm going to modify SIPC.conf.
[27:05.670 --> 27:09.990]  I did this by video rather than doing it live because things always mess up.
[27:12.150 --> 27:13.470]  So this is all common.
[27:14.150 --> 27:16.310]  Really easy stuff in just setting up a DID.
[27:17.030 --> 27:19.550]  Then I'll get into why this works.
[27:19.550 --> 27:23.750]  And why this actually works is this particular sub-trunking provider is like enterprise class.
[27:24.050 --> 27:26.970]  So what happens is they're getting the ISUP information.
[27:27.250 --> 27:30.750]  And you're able to map the SIP headers to the ISUP information.
[27:31.070 --> 27:36.090]  So you're getting the caller ID information and you're getting the privacy bit.
[27:36.370 --> 27:39.830]  So a normal call, when a call comes in, here's a SIP header.
[27:40.070 --> 27:40.910]  You see the from number.
[27:41.170 --> 27:42.350]  This is my cellular phone number.
[27:42.350 --> 27:43.110]  Oops.
[27:43.970 --> 27:44.730]  Let me back it up.
[27:46.070 --> 27:46.810]  One moment.
[27:50.140 --> 27:50.620]  Okay.
[27:51.460 --> 27:55.060]  You're getting the from number, okay, which is the number that I'm calling from.
[27:55.480 --> 27:59.880]  And the PSERT identity is basically a SIP header that contains the same information.
[28:00.100 --> 28:01.580]  Here the call is not blocked.
[28:01.700 --> 28:02.880]  This is a normal call coming in.
[28:03.940 --> 28:05.020]  So one second.
[28:05.400 --> 28:06.580]  We'll go to a block call.
[28:10.730 --> 28:11.650]  One moment.
[28:14.450 --> 28:20.190]  So if you look up here, you'll see here it's from anonymous because it's a block call.
[28:20.190 --> 28:24.610]  But since this particular provider is still getting the PSERT identity.
[28:24.870 --> 28:26.870]  It's still able to map to the ISUP information.
[28:27.510 --> 28:31.610]  You're actually getting the caller ID in the PSERT identity header.
[28:31.970 --> 28:33.730]  And then you're getting the privacy ID.
[28:34.070 --> 28:36.210]  And this means that the privacy bit is set.
[28:36.790 --> 28:39.130]  So all we want to do is we're getting that information.
[28:39.410 --> 28:45.450]  What I do in this little eight line asterisk script is basically look and see if anybody's calling me.
[28:45.550 --> 28:46.770]  Is there a privacy ID set?
[28:47.270 --> 28:50.490]  If it is, it will prepend 900 to it.
[28:50.730 --> 28:53.430]  It will set that as the caller ID and then call me so I'll see the number.
[28:57.570 --> 28:59.070]  So there's the privacy ID.
[28:59.990 --> 29:02.210]  There's the PSERT identity.
[29:03.690 --> 29:05.690]  So we're going to check if the caller ID is private.
[29:06.350 --> 29:08.730]  If it isn't, we're just going to forward the call.
[29:08.850 --> 29:10.590]  If not, we're going to prepend the 900 to it.
[29:13.560 --> 29:15.500]  So I have to modify extensions.conf.
[29:18.120 --> 29:19.380]  Is everybody following this?
[29:19.540 --> 29:22.820]  It's pretty straightforward and easy, actually, if you've played with asterisk before.
[29:24.320 --> 29:27.960]  So because there's an asterisk bug, well, you'll see it in a moment.
[29:29.260 --> 29:30.640]  There's like a deadlock audio bug.
[29:30.780 --> 29:34.660]  There's like one in line in there that will hopefully go away when they come out with a new release.
[29:43.160 --> 29:44.620]  Sorry, this is a little bit slow.
[29:46.320 --> 29:49.360]  This is because of the asterisk bug in the first line.
[29:52.420 --> 29:53.640]  That takes care of that.
[29:54.980 --> 29:57.100]  And what I'm doing is I'm just setting two variables.
[29:57.800 --> 30:05.580]  I'm setting the PSERT ID to the PSERT ID from the identity from the SIP header.
[30:06.680 --> 30:09.280]  And the same thing I'm going to do is set up for the caller ID as well.
[30:10.920 --> 30:12.060]  I mean the privacy bit.
[30:12.200 --> 30:12.500]  I'm sorry.
[30:13.460 --> 30:14.400]  You'll see it in a second.
[30:19.100 --> 30:23.040]  So you just have to copy these eight lines and sign up front of the account and you can unmask your caller ID.
[30:26.700 --> 30:28.620]  Then I'll get into a couple more stories at the end.
[30:28.700 --> 30:29.920]  I just wanted to show you this real quick.
[30:40.450 --> 30:44.810]  So what I'm going to do is if you see at line four, I'm going to go to...
[30:46.510 --> 30:50.930]  If the privacy bit is set, I'm just going to jump further down.
[30:51.230 --> 30:53.710]  Otherwise, I'm going to just set the caller ID normally.
[30:55.450 --> 30:56.710]  I'll jump down to line eight.
[30:56.950 --> 30:57.710]  You'll see it in a second.
[31:02.880 --> 31:04.480]  I hope this is interesting to you folks.
[31:04.620 --> 31:06.000]  I like when people call me.
[31:06.080 --> 31:06.700]  I can see their number.
[31:07.680 --> 31:08.980]  You know, that's just me.
[31:11.340 --> 31:13.200]  Because my business card is out there, right?
[31:13.340 --> 31:15.460]  So everybody calls me at all times of day and night.
[31:15.620 --> 31:16.820]  So I like to see who's calling me.
[31:17.660 --> 31:26.900]  So basically all this is doing at lines five and five is just basically setting the caller ID and then dialing out to me through the flow route.
[31:33.680 --> 31:46.220]  This is where I jump to if the privacy bit is set, then I'm still going to grab... I'm going to prepen 900 to the caller ID on the P asserted identity.
[31:46.760 --> 31:49.240]  Then I'm going to set that and then call myself.
[31:49.520 --> 31:54.920]  So what happens is when somebody calls me and the number is blocked, it will prepen 900 to it.
[32:00.040 --> 32:01.480]  Has anybody done this before?
[32:01.660 --> 32:02.830]  Or is this old stuff for you?
[32:04.810 --> 32:05.220]  Yes?
[32:05.220 --> 32:05.620]  Okay.
[32:06.050 --> 32:06.830]  For some that don't.
[32:11.860 --> 32:18.300]  Because I rarely find providers that actually have the P asserted identity and the privacy bit that they'll provide you that information.
[32:18.460 --> 32:19.200]  I haven't found any.
[32:19.400 --> 32:22.140]  So this is why it's kind of unique to me and I just found it the other day.
[32:26.300 --> 32:27.460]  And that's basically it.
[32:27.460 --> 32:27.460]  Okay.
[32:28.020 --> 32:30.720]  So does anyone want to give this a shot?
[32:30.860 --> 32:36.360]  You'll call me unblocked to my DID and then you'll call me blocked.
[32:36.500 --> 32:37.920]  Do you want to see the difference or do you believe it?
[32:39.440 --> 32:40.300]  Oh, you want to see it?
[32:40.360 --> 32:40.840]  Let's see it.
[32:40.920 --> 32:41.180]  All right.
[32:41.740 --> 32:42.240]  All right.
[32:42.760 --> 32:43.540]  So go to the camera.
[32:47.680 --> 32:48.820]  Somebody's sending me all these texts.
[32:49.160 --> 32:49.700]  All right.
[32:49.860 --> 32:50.760]  Let's hold on a second.
[32:52.220 --> 32:52.580]  See.
[32:53.880 --> 32:54.420]  All right.
[32:54.940 --> 32:56.260]  Don't send me text messages.
[32:56.680 --> 32:57.040]  Okay.
[32:57.900 --> 32:59.220]  So anybody have a cell phone?
[32:59.340 --> 33:00.860]  They want to call me blocked?
[33:01.320 --> 33:01.780]  All right.
[33:01.900 --> 33:02.360]  Here's the number.
[33:03.880 --> 33:04.640]  Who's doing that?
[33:04.980 --> 33:05.120]  Okay.
[33:06.960 --> 33:09.020]  That wasn't blocked because you don't see the 900.
[33:09.200 --> 33:12.700]  So you want to call 208-906-8200.
[33:13.100 --> 33:17.920]  That's the DID that's going through this Asterisk logic.
[33:18.220 --> 33:18.860]  Say it again.
[33:21.160 --> 33:22.780]  208-906-8200.
[33:23.220 --> 33:25.220]  I could also do it from this phone, but if you want to try it.
[33:27.280 --> 33:27.940]  There you go.
[33:28.200 --> 33:28.920]  Somebody called it.
[33:29.540 --> 33:30.340]  You see it?
[33:30.860 --> 33:32.120]  It's prepending the 900.
[33:34.000 --> 33:40.060]  And what that means is when I get a call, if I see that 900 and the number, I know that they intentionally try to block the call to me.
[33:40.420 --> 33:42.700]  So this is kind of cool if you want to unblock caller ID.
[33:43.040 --> 33:44.380]  I wish I had this years ago.
[33:47.290 --> 33:48.370]  I'll show you...
[33:49.710 --> 33:51.170]  I'm kind of jumping around here.
[33:51.450 --> 33:53.790]  But I wondered, do you all want to see a quick video?
[33:53.790 --> 33:58.430]  I was working with a television company out here to do a pen-testing reality show.
[33:58.430 --> 34:00.410]  And have you ever heard of Tiger Team?
[34:00.630 --> 34:01.470]  Have you heard of Tiger Team?
[34:01.670 --> 34:01.950]  Yes!
[34:02.410 --> 34:03.370]  It was on for two days?
[34:03.970 --> 34:04.790]  I mean, two episodes?
[34:05.090 --> 34:06.070]  I thought it was a great show.
[34:06.150 --> 34:07.330]  I'm really sad they cancelled it.
[34:07.530 --> 34:10.210]  I actually know Luke and I know Pyro.
[34:11.010 --> 34:15.070]  And I thought it was a good idea, but for some reason they cancelled it at TruTV.
[34:16.270 --> 34:22.590]  So another company has actually been shopping around the idea of me heading up one of these reality pen-testing shows.
[34:22.910 --> 34:24.330]  And they just created a trailer.
[34:24.490 --> 34:32.090]  And I thought when they sent it to me, they sent it to me about five or six months ago, I thought, ew, I wonder what they thought of, you know, is it going to be crappy?
[34:32.370 --> 34:39.490]  And I played it and it was actually pretty good because they blended a lot of different scenes in from Italian Job, from Alias, and so on and so forth.
[34:39.610 --> 34:41.290]  So do you all want to see the quick trailer?
[34:41.730 --> 34:42.250]  All right.
[34:43.750 --> 34:44.250]  All right.
[34:47.630 --> 34:50.470]  Hopefully we... and if we can get sound here, because we're going to need sound.
[34:52.490 --> 34:53.130]  A couple...
[34:56.450 --> 34:57.770]  So we have the sound set, I hope.
[34:58.610 --> 34:59.510]  And we're going to try it.
[35:51.610 --> 35:53.410]  Let's tell you our telephone manufacturers.
[35:54.830 --> 36:01.830]  He was able to elude us by virtue of knowing the telephone and the computer systems well enough.
[36:06.200 --> 36:09.440]  He was arrested and subsequently sentenced to federal prison time.
[36:09.440 --> 36:09.900]  That's a bad picture, isn't it?
[36:30.390 --> 36:31.170]  All right.
[36:32.050 --> 36:32.890]  I wasn't willing to...
[36:32.890 --> 36:34.770]  I was laughing too...
[37:22.350 --> 37:25.310]  It's supposed to be after Punk'd they did hack.
[37:25.310 --> 37:27.430]  So, we did this little trailer.
[37:27.610 --> 37:29.350]  I thought it was kind of cute, so I thought I'd share it with you.
[37:36.620 --> 37:43.640]  I don't think it's going to go anywhere because I can't imagine Apple or Nintendo saying we can pen-test you and have it on reality TV.
[37:43.700 --> 37:44.520]  I just don't see it.
[37:44.600 --> 37:45.620]  I don't see the benefit.
[37:45.820 --> 37:47.380]  They don't care about their product placement.
[37:49.020 --> 37:55.960]  And I wonder if my high school teacher, if he saw this... I don't think I've told you the story of this.
[37:56.720 --> 38:03.020]  When I was in the phone phreaky in high school, and I had another student, and he said, hey, you might want to go to computer class.
[38:03.180 --> 38:03.840]  It's kind of interesting.
[38:04.300 --> 38:07.660]  And at the time, I was like, oh, no, I'm just interested in telephones and radios.
[38:07.780 --> 38:08.880]  I can care less about computers.
[38:10.980 --> 38:19.500]  And at the time, to get into computer class, you had like a prerequisite of trigonometry and calculus and all this sort of thing.
[38:20.940 --> 38:26.280]  And the telcos were going for electromechanical switching, you know, crossbar over into ESS.
[38:27.060 --> 38:31.340]  So I kind of half wanted to get involved in computers, but I didn't have the prerequisites.
[38:32.240 --> 38:35.320]  So the student introduced me to this computer instructor.
[38:35.680 --> 38:37.000]  He said, I'm sorry, Kevin.
[38:37.220 --> 38:40.780]  You know, you have to wait to take these additional math courses.
[38:40.980 --> 38:41.980]  We can't let you in.
[38:41.980 --> 38:45.660]  So my friend says, hey, show the teacher what you can do with the telephone.
[38:47.020 --> 38:53.980]  So I was able to do all these, like, neat things that you can imagine what you can do with the telephone system.
[38:54.760 --> 38:56.700]  Actually access computers over voice.
[38:57.380 --> 39:01.440]  And he says, sure, I'm going to waive the prerequisites and let you in the class.
[39:02.280 --> 39:09.980]  So the first assignment was to find the first 100 Fibonacci numbers in, like, Darth Mouth Basic.
[39:09.980 --> 39:11.660]  And to me, that was boring.
[39:11.860 --> 39:15.020]  Who cares about finding the first 100 Fibonacci numbers?
[39:15.340 --> 39:17.640]  I was more interested in finding the teacher's password.
[39:20.000 --> 39:23.640]  And at the time, can you imagine, you had an Olivetti 110-Baud terminal.
[39:24.040 --> 39:29.200]  And you dial-up to the DEC system, which was running RSTS/E, if you remember that.
[39:29.840 --> 39:35.900]  And you used the acoustic coupler and you were doing, you know, a lightning-fast speed of 110-Baud.
[39:37.620 --> 39:42.340]  So the teacher, when he was typing in his password, he would, like, really shield it.
[39:42.760 --> 39:44.840]  And I go, oh, what is he trying to hide?
[39:45.000 --> 39:46.140]  I want to get his password.
[39:46.880 --> 39:52.300]  So rather than writing that program that would find the first 100 Fibonacci numbers, I simply wrote a simple login simulator.
[39:52.720 --> 39:56.840]  So what it would do is it would simulate the RSTS/E system that he was dialing up to.
[39:57.620 --> 40:04.920]  It would take his username, and the username was actually a number, 1 comma 5 or whatever, and ask you for the password, and it would actually log him in.
[40:05.400 --> 40:09.920]  But he wouldn't know that he was actually, you know, talking to my code and not talking to the operating system.
[40:10.400 --> 40:14.400]  So then what we would do is we would go up to him and say, hey, Mr. Chris, your new password is blah, blah, blah.
[40:14.760 --> 40:16.220]  And he'd get really pissed.
[40:16.400 --> 40:17.500]  And he'd go change it.
[40:18.920 --> 40:20.720]  And he couldn't figure out how we were doing it.
[40:20.720 --> 40:23.220]  He actually made me... this is not bullshit.
[40:23.680 --> 40:28.500]  He actually made me, when he would log into the computer, I'd actually have to leave the classroom.
[40:31.600 --> 40:33.820]  This guy thought I was David Copperfield, right?
[40:34.160 --> 40:35.620]  That I can get his password.
[40:35.700 --> 40:36.820]  I actually had to leave the room.
[40:37.480 --> 40:39.520]  He didn't know he was talking to my login simulator.
[40:40.060 --> 40:42.020]  So I got bored of that, right, getting his password.
[40:42.160 --> 40:49.120]  So I figured I want to dial-up to USC because they had the newest games, you know, Star Trek, Zork, Adventure, right?
[40:49.180 --> 40:51.020]  And my buddies, you know, we wanted to dial-up.
[40:51.020 --> 40:53.080]  They had a restricted Centrix.
[40:53.660 --> 40:55.160]  So you couldn't dial nine to get an outside line.
[40:55.960 --> 41:00.620]  Well, with my phone ability and knowing how it worked, I simply used social engineering.
[41:00.800 --> 41:05.560]  I called a department called RC Mac in Pacific Bell and just added outside calling.
[41:06.040 --> 41:11.200]  And then what we would do is we would call into USC and play games when we were supposed to be doing assignments.
[41:12.820 --> 41:19.040]  Unfortunately, in all of Betty printing terminal, the teacher was able to come back into class and look at the paper.
[41:19.700 --> 41:20.920]  How is he getting into USC?
[41:21.140 --> 41:23.460]  And he's looking at it and he rips off the paper.
[41:23.660 --> 41:32.220]  At a point, he was getting so angry with us, he would actually sign a part of the printout, you know, the spooling printout.
[41:32.360 --> 41:35.260]  And then we couldn't take it with us.
[41:35.320 --> 41:38.460]  He'd actually look to make sure that the top was with his signature.
[41:39.340 --> 41:41.140]  So this got kind of tiring for him.
[41:41.320 --> 41:43.600]  So one day he shows up to class.
[41:44.500 --> 41:46.600]  He brings all the students into the classroom.
[41:46.940 --> 41:53.940]  He says, students, I found the one device that's going to stop Kevin from dialing up to USC.
[41:56.200 --> 41:57.600]  And I'm kind of looking cool.
[41:57.800 --> 41:58.880]  Where do you get that device?
[41:59.160 --> 42:01.580]  And he holds up a telephone lock.
[42:01.580 --> 42:02.580]  It was a dial phone.
[42:03.900 --> 42:10.360]  And he proudly places the dial lock into the telephone, number one position.
[42:10.660 --> 42:14.740]  And he proudly takes the key and he puts it in his pocket and he has a big smile on his face.
[42:15.760 --> 42:21.360]  And of course, I said, Mr. Christ, what's the telephone number of the administrative office?
[42:21.840 --> 42:23.900]  And he gives it to me and then, you know, the pulsing trick.
[42:23.900 --> 42:25.600]  I just pulsed out the number.
[42:26.040 --> 42:28.280]  This guy, his face turned red.
[42:28.720 --> 42:33.540]  He actually took the phone, this phone, it was like this type of phone with a dial, and threw it across the room.
[42:36.800 --> 42:41.320]  So I guess I didn't get along too well with my computer instructors in those days.
[42:42.440 --> 42:46.060]  So let me tell you about the, you know, I kind of told you about my funny hack in the McDonald's.
[42:46.840 --> 42:48.440]  And then I know we're running out of time.
[42:48.600 --> 42:51.400]  So I just want to tell you what was the most scariest kind of hack for me.
[42:51.400 --> 42:54.000]  And this is when I was a fugitive in Seattle.
[42:57.080 --> 43:01.520]  I was leaving my apartment one day and I had a phone.
[43:01.660 --> 43:03.460]  I had the Novatel PTR825.
[43:03.880 --> 43:05.780]  I was able to get the source code to the cell phone.
[43:06.080 --> 43:13.880]  So what I did was I was able to modify the phone so when it would sit in idle mode, it would listen to the reverse control channel.
[43:14.460 --> 43:24.240]  And what would happen is if the signal met certain strength requirements, it would capture the min and the ESN of anybody that was in listening distance of the cell phone and put it into a table.
[43:24.920 --> 43:31.140]  Rather than me having to go get an ESN and an MIN, my phone device would actually listen to it and store it.
[43:31.800 --> 43:32.240]  Okay?
[43:33.600 --> 43:40.020]  So what I did is I went outside my apartment and I turned on my cell phone and I was having a conversation with somebody.
[43:40.100 --> 43:40.580]  I forgot who.
[43:41.080 --> 43:44.300]  And all of a sudden I hear, do-do-do-do-do-do-do-do-do-do-do-do-do-do.
[43:44.680 --> 43:45.900]  And there's a school here.
[43:46.120 --> 43:47.380]  There's like a school where I'm walking.
[43:47.720 --> 43:49.420]  And it was like a military helicopter.
[43:51.240 --> 43:52.880]  And, you know, I'm just thinking, nah.
[43:53.440 --> 43:54.600]  You know, it has nothing to do with me.
[43:54.780 --> 43:59.440]  And all of a sudden I thought it was going to land in the school and it's like hovering over my head.
[44:00.000 --> 44:01.460]  Do-do-do-do-do-do-do-do-do-do-do.
[44:01.540 --> 44:02.940]  And I go, no!
[44:03.200 --> 44:06.360]  You know, and I turn off the cell phone and I run.
[44:06.600 --> 44:11.180]  And where I was in Seattle in the U District, there's lots of covers and trees and yada-yada-ya.
[44:11.360 --> 44:13.440]  And I wasn't sure, was it with me?
[44:13.520 --> 44:14.340]  Was I being paranoid?
[44:15.860 --> 44:24.880]  So I got like about three blocks into the U District, ducked into a store, and then I turned on my cell phone again to make a call.
[44:25.280 --> 44:28.900]  And all of a sudden, do-do-do-do-do-do-do-do-do-do-do-do-do-do.
[44:28.960 --> 44:30.680]  And the helicopter was coming closer.
[44:31.320 --> 44:32.340]  I go, shit!
[44:32.920 --> 44:34.060]  Now what's going on here?
[44:34.440 --> 44:38.240]  So I waited a little bit and it was like right outside the store that I just ran into.
[44:38.340 --> 44:39.400]  I shut the cell phone off.
[44:40.660 --> 44:45.540]  Then I, because of the situation of you could actually exit both sides of the store.
[44:45.880 --> 44:53.460]  I decided to go out the store and go about, I'd say about four or five or six blocks away at the end of the U District in Seattle.
[44:53.720 --> 44:56.980]  I turned on the cell phone again and, damn it, the helicopter's coming.
[44:57.160 --> 44:58.760]  Do-do-do-do-do-do-do-do-do-do-do-do.
[44:58.800 --> 45:07.460]  So I never found out what happened of who that was, or was it the cellular phone company, or was it the government, or was it a private investigation firm?
[45:07.620 --> 45:10.480]  I never found that out in my discovery who that was.
[45:11.800 --> 45:17.820]  But I remember I called my dad, because it kind of startled me having a helicopter chasing.
[45:18.720 --> 45:27.800]  So I remember I had a secret code with my dad that if I paged him with a certain code, he'd go to a supermarket to a pay phone and he'd wait for my phone call for like 15 minutes.
[45:28.740 --> 45:30.800]  With my mom, it was a more intricate system.
[45:31.140 --> 45:39.180]  Because of all the, because I know if a government or a law enforcement agency knows you're going to a pay phone, it's really easy to get the history terminating and originating numbers.
[45:39.300 --> 45:40.640]  I know it because I did it on them.
[45:42.600 --> 45:47.740]  So what I figured is with my family, I'd contact them is have them go into a casino.
[45:48.140 --> 45:53.900]  So they'd have a pager and I'd page with a certain code means Stardust, Mirage, whatever, right?
[45:54.160 --> 46:01.580]  And then they'd go in and listen for the call to be paged like Mary Sue, and they'd go to the white courtesy phone and pick up the call, and that would be me.
[46:02.080 --> 46:04.700]  And it would be really difficult for the government to trace these calls.
[46:05.520 --> 46:06.840]  With my dad, it wasn't so...
[46:06.840 --> 46:10.000]  Since I didn't talk to him so much, it was where I'd call him at a pay phone.
[46:10.100 --> 46:13.240]  So I remember calling him up and saying, Dad, Dad, you wouldn't believe what happened.
[46:13.600 --> 46:14.100]  He goes, what?
[46:14.320 --> 46:15.000]  What's going on?
[46:15.060 --> 46:16.560]  And I go, a helicopter just chased me.
[46:16.860 --> 46:21.060]  He goes, son, you really need help if you think helicopters are chasing you.
[46:24.290 --> 46:26.410]  And I go, no, Dad, it was really chasing me.
[46:26.570 --> 46:30.010]  And he goes, you really need to see a psychologist.
[46:30.010 --> 46:31.850]  No helicopter is chasing you, Kevin.
[46:32.010 --> 46:33.150]  You're being paranoid.
[46:33.350 --> 46:40.850]  So anyway, long story short, I was being chased, but I never found out by who or what had happened.
[46:42.230 --> 46:43.370]  So what am I doing today?
[46:47.250 --> 46:48.690]  It's... I'm really fortunate.
[46:48.910 --> 46:52.070]  You know, I never thought I'd be where I am today.
[46:52.570 --> 46:55.430]  And a lot of it has to do with a lot of you that were my supporters.
[46:56.610 --> 47:04.550]  I still give thanks to everybody that was part of the Free Kevin movement, you know, especially Manuel and everybody part of the 2600 group.
[47:04.790 --> 47:15.130]  I really knew that there was no influence on the courts because you can't influence the government, but at least I got the message out there about, you know, about some certain civil rights violations in my case.
[47:15.430 --> 47:24.710]  I never said that I didn't deserve to be punished, but they went a little bit overboard by holding me in solitary confinement because I could launch nuclear missiles by whistling launch codes.
[47:26.470 --> 47:34.650]  So today what I do is I go around the world and I do a lot of public speaking engagements, not what I'm talking about now, but mostly like on social engineering and wireless security.
[47:34.970 --> 47:37.070]  I do a lot of penetration testing.
[47:37.230 --> 47:39.530]  So companies, you know, hire me to hack in.
[47:39.830 --> 47:43.910]  Kind of what I was doing all my life, but I do it with authorization and I get paid for it.
[47:44.070 --> 47:45.730]  And I don't have to go to jail for it.
[47:46.410 --> 47:49.890]  So it's kind of a win-win-win situation all the way around.
[47:49.890 --> 48:01.550]  But I want to sincerely thank all of you for being there for me when I was at the bottom of the bucket during that time in my life, when I was sitting in federal prison not knowing if I'd ever get out.
[48:01.870 --> 48:08.490]  The government was saying they wanted to hold me for 400 years for making like 21 clone cell phone calls.
[48:09.050 --> 48:11.330]  And I never had a light at the end of the tunnel.
[48:11.910 --> 48:14.630]  And at the time the government wanted me to become an informant.
[48:14.770 --> 48:25.610]  They actually wanted me to tell on what other people were doing and I refused because I had the integrity not to become a snitch on somebody else just to get myself out of trouble.
[48:25.930 --> 48:26.970]  You know.
[48:36.490 --> 48:45.170]  Because unfortunately that's what happens in 95% of the time is people cooperate against each other and everybody goes down.
[48:45.850 --> 48:49.110]  And I just, you know, again, I didn't think that was part of my personal integrity.
[48:49.110 --> 48:54.570]  So I figured, hey, if I did something wrong, I'm going to take the licks for it and I'm not going to try to bring somebody else down with me.
[48:55.210 --> 49:05.730]  So, when I was going through this whole process, I had hundreds of people writing me letters, taking my phone calls, building websites, starting the Free Kevin movement.
[49:06.790 --> 49:13.670]  I mean, and today I'm still thankful for all of you that have participated and supported me all those years.
[49:14.170 --> 49:21.110]  I don't know who all of you are because, you know, when I was in prison, I didn't get much access to email.
[49:21.530 --> 49:21.850]  Why?
[49:22.230 --> 49:29.870]  Because when people would send me even printouts of email, they would actually prohibit me from looking at, from getting a copy of the email, saying it's in secret code.
[49:30.370 --> 49:32.010]  I go, what do you mean secret code?
[49:32.310 --> 49:35.390]  And they would look at the mime headers and go, that is a code.
[49:37.450 --> 49:39.350]  That's the intelligence of the Bureau of Prisons.
[49:41.310 --> 49:43.870]  But, again, I want to thank everybody for being there for me.
[49:44.150 --> 49:49.390]  I'm kind of sad that this is the last hope, because I kind of look forward to it.
[49:49.550 --> 49:56.850]  I couldn't make it last year, but I thought this would be a tradition that would continue, where people that share similar interests would get together.
[49:57.190 --> 50:03.430]  And again, I want to thank everybody for being part of 2600 and hope, and I'm glad I could be part of it now.
[50:03.810 --> 50:04.550]  So, thank you.
[50:22.230 --> 50:24.470]  So, I have a gift for most people here.
[50:24.770 --> 50:25.650]  And I don't know...
[50:25.650 --> 50:27.690]  They said they had, like, probably two minutes left?
[50:27.830 --> 50:28.170]  One minute?
[50:28.850 --> 50:29.190]  Two minutes.
[50:29.550 --> 50:41.490]  And I don't know how I'm going to get this to you, because I have to give courtesy to the next speaker, but I normally have these on my website, you know, and because I don't like going and doing the mail, I, you know, charge five bucks.
[50:41.490 --> 50:45.030]  But I'm not charging anything, because I'm here at this conference.
[50:46.070 --> 50:47.270]  All of you are my fan.
[50:47.550 --> 50:48.510]  I mean, I'm your fan.
[50:48.970 --> 50:56.570]  Meaning, I, I, I, I, I'm dedicated to your support through the years of my problems and stuff like that.
[50:56.650 --> 50:59.050]  So, I wanted to give this gift of my lockpick business card.
[50:59.230 --> 51:02.010]  But I don't know how to give it out without interrupting the other speakers.
[51:02.290 --> 51:05.510]  So, you can come up to me, and it's absolutely free of charge.
[51:05.510 --> 51:07.350]  I'd be happy to give you one of these cards.
[51:07.510 --> 51:11.630]  I only brought, I ordered like 600 of them, because they're kind of expensive.
[51:11.790 --> 51:12.630]  They're like three bucks a piece.
[51:13.830 --> 51:21.010]  So, any of you that want one of these lockpick business cards, you're welcome to come up, and I'll give it to you.
[51:21.410 --> 51:22.250]  Until I run out.
[51:24.470 --> 51:25.590]  Whoa, slow down.
[51:28.990 --> 51:30.790]  All right, we're going to do this on the mezzanine.
[51:30.790 --> 51:36.810]  You know, otherwise we're going to have like a Who concert situation here.
[51:36.970 --> 51:42.370]  There's going to be people smashed, and Robert Townsend will be looking at young boys.
[51:42.510 --> 51:43.250]  It'll be a bad scene.
[51:43.350 --> 51:44.390]  Downstairs, because I have another speaker.