The famous hacker who mostly just asked

The story

Through the 1980s and early 1990s, Kevin Mitnick got into the systems of phone companies and technology firms. Some of it was technical, but much of it was done by phone. He would call an employee, pose as a colleague from another department or someone from IT, and ask for what he needed: a password, a phone number, a copy of some software. People helped him, because helping colleagues is what good employees do.

He spent more than two years as a fugitive before the FBI arrested him in 1995. After serving his sentence, he became a security consultant and author. His 2002 book, The Art of Deception, explained how social engineering works and how companies can resist it. He died in 2023.

How the technique works

Social engineering relies on a believable story and a reason to act now:

• A role: someone from IT, a new hire, a manager’s assistant, a vendor.
• Inside details: names, department jargon or current work, often found online, which make the story believable.
• A small, reasonable request: reset this, read me that, approve this one thing.

The lesson today

The groups behind some of the largest recent attacks used exactly these methods, calling help desks while posing as employees. The defense is a habit: check who you are talking to through a channel you already trust, every time, even when the caller is friendly and the request is small.