Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker

were
watching at that moment, and they started laughing,
wondering, 
“How could he possibly know?”
)
Nonetheless, I continued my hacking into numerous internal systems at
Novell, where I planted tools to steal log-in credentials, and intercepted
network traffic so I could expand my access into yet more Novell systems.
A few days later I still felt a bit uneasy. I called the RCMAC (Recent
Change Memory Authorization Center) at Pacific Bell and spoke to the
clerk who processed orders for the San Jose switch. I asked her to query the
dial-up number in the switch and tell me exactly what the switch output
message said. When she did, I discovered it had a trap-and-trace on it. Son
of a bitch! How long had it been up? I called the Switching Control Center
for that area, posing as Pacific Bell Security, and was transferred to a guy
who could look up the trap-and-trace information.
“It went up on January twenty-second,” he said. Only three days earlier.
Whoa—too close for comfort! Luckily, I had not been calling much during
that time; Pacific Bell would have been able to trace my calls only as far as
the long-distance carrier, but could not track the calls all the way back to
me.
I breathed a sigh of relief and decided to leave Novell alone. Things
were getting way too hot there.

---

Years later, that voicemail I’d left for Shawn Nunley would come back to
bite me in the ass. Shawn for some reason saved my message, and when
somebody from Novell Security got in touch, he played it for him, and then
that guy in turn gave it to the San Jose High-Tech Crime Unit. The cops
weren’t able to tie the voice to any particular suspect. But months later, they
sent the tape to the FBI in Los Angeles to see if the Feds could make
anything out of it. The tape eventually found its way to the desk of Special
Agent Kathleen Carson. She inserted it into the player on her desk, hit Play,
and listened. She knew right away: 
That’s Kevin Mitnick, the hacker we’re
looking for!
Kathleen called Novell Security and said, “I have some good news and
some bad news. The good news is that we know the identity of your hacker
—it’s Kevin Mitnick. The bad news is, we have no idea how to find him.”
Long afterward, I met Shawn Nunley, and we became good friends. I’m
happy that today we can laugh about the whole episode.
With the Novell hack behind me, I decided to target one of the biggest cell
phone manufacturers, Nokia.
I called Nokia Mobile Phones in Salo, Finland, posing as an engineer
from Nokia USA in San Diego. Eventually I was transferred to a gentleman
named Tapio. He sounded like a very nice guy, and I felt kind of bad about
social-engineering him. But then I put those feelings aside and told him I
needed the current source code release for the Nokia 121 cell phone. He
extracted the latest version to a temporary directory in his user account,
which I then had him transfer (via FTP) to Colorado Supernet. At the end of
the call, he wasn’t suspicious in the least and even invited me to call him
back if I needed anything else.
That all went so smoothly that I thought I’d see if I could gain direct
access to Nokia’s network in Salo. A call to an IT guy there proved
awkward when his English turned out not to be all that good. Maybe a
Nokia facility in an English-speaking country would be more productive. I
tracked down a Nokia Mobile Phones office in the town of Camberley,
England, and reached a lady in IT named Sarah, who had a deliciously thick
British accent but used so much unfamiliar slang that I had to stay focused
and pay close attention.

---

I cited my standard excuse of “problems with the network connection
between Finland and the U.S., and a critical file to transfer.” The company
didn’t have direct dial-ups, she said, but she could give me the dial-up
number and password for “Dial Plus,” which would let me connect to the
VMS system in Camberley over an X25 packet switched network. She
provided the X25 subscriber address—234222300195—and told me I
would need an account on the VAX, which she would set up for me.
At this point I was on edge, in a state of high excitement, because I was
pretty sure I’d be able to get into my target, “Mobira,” one of the VMS
systems used by Nokia’s Cellular Engineering Group. I logged in to the
account and quickly exploited a vulnerability that gave me full system
privileges, then gave a “show users” command to list all the users currently
logged in, which in part looked like this: