YT YouTube2Text

YouTube2Text → Transcripts → The Kid Who Hacked America

The Kid Who Hacked America — Transcript

by fern · 5,801 words · 887 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:01This is Kevin Mitnik, one of the world's
0:03most famous hackers and one of the
0:06first. In many ways, his story shaped
0:08how we think of his kind. The media
0:10vilified him. The authorities hunted
0:12him, and they were all extremely scared
0:15of him. Mitnick's story is about the
0:17advent of modern IT, about a kid who
0:20always wanted to be a magician. Most of
0:22all, it's Catch Me If You Can, but with
0:24computers.
0:25>> In the 1990s, I was the most wanted
0:28hacker in the world. You get that
0:30adrenaline rush from the accomplishment
0:32of breaking into the system or finding a
0:35security hole.
0:51[music]
0:54This video is largely based on the book
0:56Ghost in the Wires by Kevin Mitnik. It
0:58tells the story from his point of view,
1:00meaning some details rely on his
1:02personal recollection and can't always
1:04be independently confirmed.
1:08[music]
1:10Young Kevin Mitnik loves watching magic
1:12tricks, but audiences fascinate him.
1:15Magic is about control. Magicians pull
1:18your attention where they want it, make
1:19you see what they want you to see. They
1:22take advantage of what you assume is
1:23true. At a magic show, people enjoy
1:26being fooled. Not so much in the real
1:28world, but it's equally easy, perhaps
1:31even easier than performing a magic
1:32trick. When the audience knows there's a
1:34literal ace up that sleeve, in everyday
1:37life, people tend to be helpful,
1:39trusting. They want to do the right
1:41thing. One can use that, manipulate
1:44them, control them, make them do things
1:46they shouldn't, or spill secrets they
1:48should have kept to themselves. This is
1:50called social engineering. And soon,
1:53young Kevin gets really, really good at
1:55it.
1:57You not only have to think about
1:58technology, you have to think about the
2:00people that use the technology because
2:01it's usually easier to hack a human than
2:05it is to hack technology.
2:08It's summer break in Los Angeles in
2:101975.
2:12Kevin is 12 years old. He spends the
2:14whole day riding the bus. Each ride is
2:1625 cents plus another 10 cents to
2:18transfer. It adds up. So Kevin comes up
2:21with a plan. He notices drivers carrying
2:24booklets of blank tickets. When they
2:26sell a ticket, they punch it with a
2:28special tool. Kevin needs both. So, he
2:31sits near the driver and spins a story
2:32about a school project. Something
2:34[music] about punching interesting
2:36shapes into cardboard. The driver ends
2:38up telling Kevin exactly where he bought
2:40the hole punch. Well, that was easy.
2:42Then he follows a driver to the bus
2:44depot. Many drivers throw their booklets
2:46away after their shift. Kevin checks the
2:49trash cans and finds tons of unused
2:51tickets. Now we can spend the whole day
2:53on the bus without paying a dime. But
2:55Kevin is just getting started.
2:59In high school, he meets Steven. With
3:01one call to the phone company, Steven
3:03manages to get the unlisted number of
3:05Kevin's mom.
3:06>> Yes. Hello.
3:08>> Kevin is blown away. He wants to know
3:10how this works. Soon he becomes part of
3:12a community of early phone hackers,
3:14so-called freakers. They manipulate
3:16telephone systems to make free calls and
3:18explore how the network works. Kevin's
3:21interested in the technical side, but
3:23the social part of freaking is what
3:24really intrigues him. He wants to
3:26understand how phone companies work.
3:28[music] So, he starts calling them,
3:29pretending to be a colleague. He asks
3:31about their departments, who has access
3:33to what, how employees handle requests.
3:35What he's really after is access to
3:37unlisted numbers, the ones omitted from
3:39the phone book for privacy. One day, he
3:42manages to get on the phone with someone
3:43from the department responsible for
3:45omissions, the non-pub bureau. Kevin
3:48pretends to be a certain Jake Roberts
3:50working for the telco company. The
3:52employee explains that unlisted numbers
3:54can only be shared with authorized staff
3:56and Jake Roberts isn't one of them.
3:58Kevin's asked to provide an internal
4:00phone number where they can call him
4:01back. Obviously, he doesn't have one.
4:04But hanging up now would attract
4:05suspicion, so Kevin keeps the story
4:08going. His department manager was
4:10supposed to add him to an authorization
4:11list. He'll need to double check. Kevin
4:13starts calling different departments
4:14asking to be connected to a manager.
4:17This time he's posing as Tom Hansen from
4:19the non-pub bureau. He says he's
4:21updating the list of authorized
4:22employees and asks if the manager wants
4:24to stay on it. He just needs to provide
4:26his name and phone number. Finally, he
4:28calls a company technician and asks him
4:30to forward the manager's calls to an
4:32external number. And voila, Kevin can
4:35now get the non-pub bureau to call him
4:37back and provide Bruce Springsteen's
4:38private number just for fun. Kevin is 17
4:42when the head of security of the phone
4:43company GTE pays his mom a visit. If her
4:46son doesn't stop freaking, they'll
4:48terminate the family's phone service. He
4:50doesn't, of course. Then one day,
4:53another visit. This time, it's the FBI.
4:57They warn Kevin to stop messing with the
4:59phone company. Kevin is terrified, but
5:01at the same time, it's a thrill. As soon
5:05as the agent leaves, Kevin is back to
5:06freaking. Hacker stories like Kevin's
5:09show that computers get a lot more
5:11interesting once you understand how they
5:12work. With boot.dev, dev. You learn
5:14coding by actually doing it, like
5:16writing a ton of code. It's basically a
5:19programming course disguised as an RPG.
5:21You complete quests, earn XP, unlock
5:24achievements, level up your skills, and
5:26battle your way through Python, Linux,
5:28and backend development. How's it going,
5:29Thomas? Oh, hey, Don. Now, Boot.dev's
5:33lessons take gamification and bring it
5:35to the next level. And it's all packaged
5:37in [music] this fantasy theme. So, as a
5:40nerd, what more could you really ask
5:42for? You're building real skills that
5:44can open the door to a career in tech.
5:46If you get stuck, a charming wizard bear
5:48can help you. If that's not enough,
5:49there's also an active Discord community
5:51full of actual humans who can support
5:53you. Create an account for free and try
5:54the interactive lessons yourself. With a
5:57code fern, you get 25% off your entire
6:00first year on the annual plan. Scan this
6:02QR code or click the link in the
6:04description. Boot.dev is really fun and
6:06we can't recommend it enough. A few
6:09months later, Kevin meets up with some
6:10freaker and hacker friends at a pizza
6:12place. They talk about Cosmos, a massive
6:15database used by Pacific Telephone and
6:17other major California carriers. It maps
6:19how the network is built and where the
6:21lines connect, making it easier to find
6:23weak spots and exploit the system. For
6:26freakers, this is the holy grail. The
6:28building housing Cosmos is just a few
6:30miles from the pizza place, so Kevin and
6:32two of his friends go check it out.
6:34Kevin takes the lead. He tells the guard
6:36he works there and wants to show his
6:38friends around. The guard buys it.
6:40They've analyzed Pacific telephone
6:42operations for so long and called the
6:44department so many times [music] they
6:45know which room the Cosmos employees
6:47work in. It's room 108. And they managed
6:50to find it. Inside they come across a
6:53folder with dialup numbers for every
6:55Southern California Wire Center along
6:57with manuals explaining how the entire
6:59system runs. It's a gold mine. They take
7:02the manuals with them.
7:04But their secret only lasts a few days.
7:07[music] One of Kevin's friends can't
7:08keep quiet. He tells an old flame about
7:10the manuals they stole and she rats them
7:12out to the phone company. Kevin gets
7:14arrested. He'll later describe how
7:16scared he is in that moment. At the
7:19time, he's still just 17. And as he's
7:21handcuffed, an officer supposedly yells
7:23at him, "We will teach you a lesson."
7:26Kevin is charged with burglary, grand
7:28theft, and conspiracy to commit computer
7:30fraud. Luckily, he's tried as a
7:32juvenile. The judge sends him to a
7:34juvenile correction center for a 90-day
7:36psychological evaluation, followed by a
7:39year of probation. All in all, he gets
7:41off pretty easy. This is his chance to
7:43stop, dial things back. But it isn't
7:46long before he's caught in the act
7:48again. This time, Kevin and his hacker
7:51friend Lenny are caught in the computer
7:52lab at the University of Southern
7:54California. They were trying to steal
7:56the login credentials of all the
7:57students. A pattern emerges. Probation,
8:00arrest, [music] probation. Kevin knows
8:03that something has to change.
8:10It's the mid80s. Kevin's in his early
8:1320s and trying to turn his hacker skills
8:14into an honest career. Of all places, he
8:17decides to apply for a job at a phone
8:19company. And not just any company. He
8:22lands a job as a programmer at GTE. At
8:25first, no one realizes who they've
8:27hired. Kevin thinks he's finally on
8:29track. a solid job, doing what he loves,
8:32a legitimate paycheck, but then he's
8:34asked to fill out a security form. After
8:36just 9 days, he's fired. They say his
8:39resume is inaccurate. His past is
8:41catching up with him, and it's easy to
8:43see why. It's the8s, and fear of hackers
8:45is on the rise. In 1983, the thriller
8:49War Games hits theaters. It's about a
8:51high school hacker who accidentally
8:52breaks into a military supercomput,
8:54nearly triggering World War II.
8:56>> Shall we play a game? How about global
9:00thermonuclear war?
9:05>> A wave of hacker hysteria follows.
9:08[music] Headlines ask, "How real is the
9:10horror of war games?" After watching the
9:13movie, President Reagan reportedly
9:15orders his advisers to look into whether
9:16any of it could actually become reality.
9:19At this point, computers are still a
9:21mystery to most Americans. People who
9:22can hack into them don't have a defined
9:24image. War Games changes that. It puts
9:27hackers in the spotlight, casting them
9:29as dangerous, unpredictable, and even
9:31catastrophic to society.
9:34Kevin doesn't see himself as any of
9:36those things. [music] Over the next few
9:38years, he drifts through boring jobs by
9:40day, but by night, he hacks. Together
9:42with Lenny, he's targeting a very
9:44specific company. [music] It's their
9:46biggest challenge yet. You've probably
9:49never heard of DEEC, but in the 80s,
9:52DEEC is the second largest computer
9:54manufacturer in the world. One of its
9:56biggest successes is its vax line.
9:59Relatively small and cheap enough that
10:00even smaller companies can afford them,
10:02these mini computers turn out to be real
10:04milestones. Kevin and Lenny take aim at
10:06their operating system. It's called the
10:08virtual memory system. They want to
10:10study its source code and find security
10:12flaws. And by looking at past fixes,
10:14they might be able to figure out how to
10:16sneak in their own back door, [music] a
10:18kind of secret entrance into other
10:19people's computers. But of course, they
10:21don't have access to the VMS source
10:23code. It's well guarded. They need to
10:25get into the VMS development [music]
10:27network. So Kevin falls back in what he
10:29does best, social engineering. [music]
10:31Lenny taps into the building's phone
10:33wiring from his work. He reroutes his
10:35connection through a fax line belonging
10:37to another company. This way, outgoing
10:39calls can't be traced [music] back to
10:41them. Meanwhile, Kevin is in a hotel
10:43near Lenny's office. He uses a pay phone
10:46to call Lenny. Then holding a different
10:48pay phone to his other ear, he calls
10:50DEEC. Posing as an employee, he
10:52convinces a DEEC operator to run a show
10:55users command. This command lists
10:57everyone currently active and logged
10:59into the system. At that moment, Lenny
11:01is in the process of logging in. One
11:03entry shows Lenny as login and the
11:05device name. Then Kevin tells her to
11:08type in this spawn command. It quietly
11:10creates a loggedin process on Lenny's
11:12modem connection using the operator's
11:14account. Now, Lenny is inside DEEC's BMS
11:17development system, a cluster of
11:19connected computers used to work on the
11:21operating system. [music] And Lenny has
11:23the full privileges of the operator they
11:25just tricked. But there's security
11:27software monitoring everything that's
11:29going on. So, they upload a tool that
11:31disables it without triggering an alarm.
11:34Instead of creating a new admin account,
11:36they hijack unused accounts and change
11:38their passwords. Now, Kevin and Lenny
11:40can dig through the system freely. They
11:42comb through the computers and mounted
11:44discs. Eventually, they find one called
11:46VMS source. [music] Bingo. Next, they
11:50look through the emails of a VMS
11:52developer. Maybe he mentions
11:54vulnerabilities. In one file, they find
11:56an analysis of a modified version of
11:58VMS's login program, Log Out. It was
12:01developed by members of the German
12:02hacker collective, Chaos Computer Club,
12:04and it's a back door. It changes the
12:07login system so it can secretly store
12:08passwords, hide certain users, and
12:11disable alarms when someone enters a
12:13special password. Kevin and Lenny build
12:15on the CCC's work. They improved the
12:17back door and keep adapting it to newer
12:19versions of VMS. Soon, they're able to
12:21install it on numerous VMS systems on
12:23DEC's global network. They essentially
12:26have access to any VMS system they want,
12:29but they're not after sensitive data.
12:31They want to copy the source code just
12:33for laughs. Finding it isn't hard.
12:36Transferring it is. The source code is
12:38massive, so they compress and encrypt
12:40it. If anyone comes across it, it'll
12:42look like garbage. Next, they want to
12:44smuggle the code out of DEC's network.
12:47They look for systems in the network
12:48that connect to Arpinet, a military and
12:50academic network that will later become
12:52the internet. They use it to move the
12:54code piece by piece. But soon, they
12:57encounter another challenge. Storing the
12:59code in one place creates a huge risk of
13:01being detected. So, they search for
13:03places where they can hide copies. One
13:05is a NASA lab. Using their back door,
13:08they get into the Jet Propulsion
13:09Laboratory systems. JPL eventually
13:12realizes someone is in their network.
13:14When they find the CCC's back door
13:15patch, they suspect the German hacker
13:17group of gaining access. The news breaks
13:20that a German hacker group has hacked
13:21NASA. Kevin and Lenny are undeterred.
13:24They continue with their plan until
13:26finally they've transferred the entire
13:28source code. Next, they put it on
13:30magnetic tape, essentially ancient hard
13:32drives, so they can go through the code
13:33without fear of being tracked. In the
13:36end, Lenny and Kevin have roughly 30
13:38tapes containing the full VMS source
13:39code.
13:41Kevin and Lenny could go on forever.
13:43They start challenging each other,
13:45making bets who's the better hacker.
13:47They both work at companies using VMS.
13:50Whoever manages to break into the
13:51other's company's VMS system wins. The
13:54prize is always $150. a dinner at a
13:57fancy Beverly Hills restaurant and Kevin
14:00often wins. So often that Lenny starts
14:02getting angry. At one point, he accuses
14:05Kevin of cheating and refuses to pay up.
14:07When Lenny doesn't pay his debt, Kevin
14:09comes up with an idea. He calls the
14:11company where Lenny works and
14:12impersonates an agent in the IRS's wage
14:15garnishment division. He claims to have
14:17a garnishment order and says that
14:18Lenny's payment should be withheld. When
14:20Lenny finds out about the prank, he
14:22doesn't find it funny at all. He's
14:24furious and he confesses to his boss
14:26about Kevin and the DEEC hack. The two
14:28of them call DEEC security. Eventually,
14:31the FBI is informed. A few days later,
14:34Lenny lures Kevin to a parking garage.
14:36When Kevin gets out of his car, FBI
14:38agents flood in and arrest him. As
14:40agents let him away, Kevin reportedly
14:43turned to Lenny and asked him, "Why did
14:44you do this to me?" Lenny answered,
14:47"Because you're a menace to society."
14:51Prosecutors hit Kevin with a long list
14:53of charges. The DEEC hack, stealing data
14:56from the NSA, breaking into police
14:58databases to erase their records of him,
15:00even spreading false information about a
15:01bank as revenge for not being hired. The
15:04DEC claims his fun little adventure has
15:06cost the company about $4 million.
15:09[music] Kevin says he had nothing to do
15:10with most of these hacks. He thinks
15:12they're rehashes of rumors about him,
15:14anything to make him look dangerous. But
15:16the prosecutors go even further. They
15:19tell the judge that Kevin is capable of
15:21accessing America's air defense systems
15:23with a phone call and initiating a
15:25nuclear holocaust.
15:27>> So, I started laughing in federal court
15:28because that's nothing. I never heard
15:30something so stupid in my life. [music]
15:32And the judge actually agreed with the
15:34government.
15:35>> It's the late '8s now, a few years after
15:38war games. Most people still don't
15:40really understand what hackers can and
15:42can't do. Computers in general are still
15:44met with suspicion since few people have
15:46one. Fear of nuclear war is in the air.
15:48>> Take [music] cover at once when you hear
15:50the attack sound.
15:54>> So, the authorities play it safe. Kevin
15:56is kept in solitary confinement while
15:58awaiting trial. He's denied access to a
16:00phone and he spends most of his time
16:02alone. Time magazine writes that a phone
16:04in Mitnik's hands is like giving a gun
16:06to a hitman. The LA Times labels him a
16:09dark side hacker. The article also
16:11quotes Lenny. He calls Mitnik an
16:13electronic terrorist [music] and claims
16:15he can ruin someone's life just using
16:17his fingers. One investigator suggests
16:20Mitnik's computer might be an umbilical
16:22cord to his soul. Eventually, Mitnik and
16:25the prosecutors reach a deal. He's
16:27sentenced to a year in prison followed
16:28by 6 months in a halfway house. There,
16:31he's supposed to address his addiction
16:32to hacking.
16:34By the early '90s, Kevin is free and
16:37he's serious about changing his life.
16:39Under the terms of his supervised
16:40release, he's forbidden from contacting
16:42other hackers. Finding a job proves
16:45almost impossible. Every time he gets an
16:47offer, his probation officer has to
16:49contact the employer. That outs him, and
16:51he stays unemployed. Without hacking,
16:53there's zero thrill in Kevin's life. He
16:55doesn't feel intellectually challenged.
16:58He'll later write in his book, "There
16:59was no sunshine in my life.
17:01>> I was so passionate with hacking. It
17:03came to be like somewhat of an obsession
17:04for me." So, when Kevin hears that a big
17:07super hacker named Eric Hines wants to
17:09talk to him, he calls him. Hines rattles
17:11off hacks he's pulled and well-known
17:12hackers he's worked with, Kevin is
17:14impressed and wants to hear more, but he
17:16has to be careful. He's on probation.
17:19Talking to Hines could get him into
17:20serious trouble. So, Kevin decides to
17:22bring in his friend Lewis. He becomes
17:24the front man doing most of the talking
17:26with Hines. On a phone call, Hines
17:28mentions a special internal testing
17:30system called SAS used by the telco
17:32giant Pacific Bell. [music] It can be
17:34used to monitor phone lines. In other
17:36words, to listen in. Kevin's never heard
17:39of it before, but he's instantly hooked.
17:41He wants access. Kevin does what he does
17:44best and manages to get in. Now, he and
17:46Louis can spy on almost any private
17:48conversation within Pacific Bell.
17:52Hines is a strange guy. His calls go
17:54through a middleman. Hines is hesitant
17:56about giving out his own phone number,
17:58and he doesn't appear to have a job.
18:00Yet, he's always talking about hanging
18:01out in expensive clubs. So Kevin and
18:03Lewis want to meet him in person. They
18:05set up a meeting at a burger joint. Once
18:07they arrive, they don't have to look
18:08long. You can't miss Eric Hines. He
18:11looks like a rock [music] star. Kevin
18:12and Lewis don't trust Eric, and they
18:14make that very obvious. They place
18:16handheld scanners right on the table.
18:18They even sweep Eric's body with an RF
18:20detector, checking for hidden
18:22microphones. It picks up nothing. At
18:24first, the conversation is cautious.
18:26Neither party wants to reveal too much,
18:28but eventually Kevin and Lewis tell
18:30Hines that they've already made it into
18:32the SAS system. To prove it, Lewis pulls
18:34out a floppy disc and inserts it into
18:36Eric's laptop. Hines is stunned. He
18:38warns them to stay away from SAS or
18:40they'll get caught. Kevin is suspicious
18:42of Hines, but it's clear he knows a lot
18:44about hacking, and he seems to have a
18:46master key giving him access to every
18:48phone company's central office. Despite
18:50his suspicions, Kevin decides to stay in
18:53touch with Hines. The contact is just
18:54too valuable. Maybe they could trade
18:56information at some point.
19:00At this point, Kevin has crossed several
19:01lines again. He's violated the terms of
19:04his supervised release. He's back in
19:06regular contact with hackers. He's
19:08hacked into another phone company's
19:10system. And his gut tells him something
19:12is off. Through a series of calls, he
19:14finds out his phone is tapped. Who's
19:17listening in and why? Maybe this has
19:20something to do with Hines. Kevin tracks
19:22down Hines's apartment and phone
19:24numbers. Then he checks in who actually
19:26owns them. Neither the apartment nor the
19:28phone numbers are registered to Eric
19:30Hines. They belong to a man named Joseph
19:32Warney. Kevin also gets a hold of
19:35another phone number linked to Hines
19:36under a different name. He calls the
19:38provider pretending to be Hines and says
19:39he's lost his phone bills. Could someone
19:41fax him copies? Customer service is of
19:44course happy to help. It seems that
19:46Hines has been calling the FBI.
19:50Who is Eric Hines? An informant? An FBI
19:53agent? It doesn't matter. Whoever it is,
19:55they're on to Kevin. And if they catch
19:57him, he's going back to prison.
20:00Kevin starts listening in on Hines's
20:02calls. One day, he talks to someone who
20:04sounds like an agent, and they mention a
20:06search warrant. Kevin immediately starts
20:08destroying evidence. He reprograms his
20:11phone and clones it to a new number. He
20:13takes his computer and boxes of discs to
20:15a friend's house. The FBI could show up
20:17at any moment, and they do. In late
20:20September 1992, the FBI searches
20:23apartment, but they don't arrest him. 3
20:25months, that's all that's left of his
20:27supervised release. Maybe he can still
20:29make it. Maybe they don't have enough
20:31evidence. After all, he wiped
20:33everything. Kevin makes a decision. He
20:36stays in LA for the 3 months he has
20:38left. If they come for him, so be it. If
20:40they don't, he's gone for good. He'll
20:42start a new life somewhere in the US.
20:44He's already thinking about which city
20:46he'll go to. Then his supervised release
20:48finally ends. Kevin Mitnik is a free
20:50man. For a moment, he's relieved.
20:54He learns that Hines is indeed a snitch,
20:56that he worked with the feds. He must
20:58have told the FBI a lot about him. And
21:00eventually, Kevin learns that there's
21:02another warrant for his arrest. His
21:04mother has been approached by agents
21:05searching for him. He has to run. But he
21:08can't escape what happens next. In just
21:10a year, his name will land on the front
21:12page of the New York Times. They'll call
21:14him a computer programmer run a muk. One
21:17of the nation's most wanted computer
21:18criminals. He'll become cyerspace's most
21:21wanted.
21:27This is Sutou Shimamura. He's a
21:29researcher at the University of
21:31California's San Diego Supercomputer
21:32Center. Chimamura doesn't look like
21:34[music] your typical scientist. With his
21:36long hair and shorts, he's a cross
21:37between computer nerd and surfer dude.
21:40His main focus is the physics of
21:41computing. But more and more, he's being
21:44pulled into cyber security. He's become
21:46a valuable expert for the FBI and NSA.
21:49It's the final days of 1994. Christmas
21:52is over and Shimamuru makes his way home
21:54from the airport. He's exhausted, but
21:57before going to bed, he realizes he
21:59hasn't checked his voicemails in a
22:00while. He isn't prepared for the message
22:02he receives.
22:03>> Damn you, my technique is the best. My
22:06boss is the best. Damn you, I know
22:09artist technique. I know send mail
22:11technique. And my style is much better.
22:14Don't you know who I am? Me and my
22:17friends will kill you. Hey boss, your
22:20kung fu is really good.
22:22>> That's right. My style is the best.
22:25>> At first, Shimamura thinks this must be
22:27a prank call. But two words stick out to
22:29him. Artist and send mail. They're basic
22:33tools used to move files around and send
22:35emails. But hackers also use both to
22:37exploit well-known vulnerabilities in
22:39Unix systems. Whoever left the message
22:41must know a lot about computer security.
22:44Maybe this has something to do with a
22:45very recent hack. Just a few days ago,
22:48someone broke into Shimomura's personal
22:50network. On his network, Shimamura kept
22:52a collection of security tools along
22:54with sensitive information about
22:56littleknown bugs and vulnerabilities.
22:58Some of these were found on widely used
22:59systems. For a hacker, this information
23:02could be extremely valuable. What the
23:04intruders probably didn't realize is
23:05that one of Shimomura's machines was
23:07automatically copying records. These
23:09files were sent to a secure place in the
23:11network. The moment the break-in
23:13started, an alert was triggered at the
23:14San Diego Supercomputer Center. Within
23:1624 hours, university staff kicked the
23:19attackers out. After being hacked,
23:21Shimamura and a student sought out the
23:22weak spots in his network and started
23:24fixing them. A few days after the first
23:26voice message, Shimamura gets another
23:28one.
23:31>> Your security technique will be
23:32defeated. Your technique is no good.
23:36>> These guys are clearly baiting him. But
23:38why? He's been looking into records of
23:40the recent attack, trying to reconstruct
23:42it. He realized just how much of his
23:44data was stolen. Tens of thousands of
23:46emails, personal files, and source code
23:49for programs he's written. His security
23:51systems were bypassed using a technique
23:52that until then has been mostly
23:54theoretical. IP spoofing. The attacker
23:57impersonated another computer's IP
23:59address. When data travels across the
24:01internet, it moves in small units called
24:03packets. Each carries an IP header with
24:06information on its source and
24:07destination. In an IP spoofing attack,
24:10the hacker modifies the source address
24:11in the header. This makes the packet
24:13look like it originated from a trusted
24:15source.
24:16Shimomura contacts the computer
24:18emergency response team orert about the
24:21attack. The group specializes in IT
24:23security. 2 weeks later, Cert issues an
24:26official warning about IP spoofing. The
24:28warning makes the front page of the New
24:30York Times. According to the article,
24:32many of the 20 million computers
24:33connected to the internet are at risk.
24:35attackers could peek into systems and
24:37steal files. A few days later, the
24:39newspaper publishes a profile of
24:41Shimamura. He's considered one of the
24:43country's most skilled computer security
24:45experts. According to the article, he
24:48considers solving the crime a matter of
24:50honor. The press has created a cyber
24:52superhero just as they created a cyber
24:54super villain, and eventually the two
24:57will go headto head.
25:00In February 1995, Shimamura gets another
25:03weird voice message. Too my learned
25:07disciple. Why you put my voice on the
25:09net? This is not good. Haven't I not
25:11taught you grasshopper? You must learn
25:13from the master. I know all the
25:15techniques and styles. I know tiger claw
25:17style. I know train. I know crane
25:19technique. I know crazy monkey
25:22technique. And I also know artist and
25:24send mail. And you put my voice on the
25:26net. I'm very disappointed. My son
25:30>> Shimamura wants to know who this strange
25:32caller is. So, he puts his own hacking
25:34skills to use and starts working closely
25:35with the FBI. One day, a user on an
25:39online hacker forum receives a
25:40notification. His account's storage is
25:42full. That's strange. He's barely used
25:45it. When he checks his directory, it's
25:47packed with mysterious compressed files
25:49and batches of emails. Someone must have
25:51taken over his account. [music] Most of
25:53the emails are addressed to the same
25:55person, Sutou Shimamura. A student of
25:58Shimamuras goes through the stolen files
26:00and discovers a file named 0108.Gz.
26:04It contains the credit card numbers of
26:05over 20,000 Netcom customers. At the
26:08time, Netcom was a booming internet
26:10provider in the US. Shimomura teams up
26:13with Netcom to track down the person
26:14[music] responsible. They discovered
26:16that the hacker used a Netcom account
26:18for some of the attacks. By cross-
26:20referencing login times from the online
26:22forum with Netcom's connection logs,
26:24they find a match. One user stands out
26:26as the likely culprit. The trail leads
26:28to Rally, North Carolina. Now they know
26:31the attacker's location, but they still
26:33don't know who he is. Then a Netcom
26:36technician has an idea. The company has
26:38a tool that shows what a user types in
26:40real time. A key logger. It was
26:43originally meant for troubleshooting,
26:44but Shimamura and the team can now use
26:46it to observe the hacker's moves. It
26:49looks like he's logging into a chat
26:50program. There, he starts chatting with
26:52another hacker. At first, they discuss
26:55security vulnerabilities, but then the
26:57topic shifts to Shimamura, who's
26:59watching them in real time. The hacker
27:01has no clue he's being monitored. He's
27:04fuming over a New York Times article,
27:05and the fact that his photo ended up on
27:07the front page for Shimamura. This is
27:10the final piece of the puzzle. The
27:12person who attacked his server must be
27:14Kevin Mitnik.
27:17February 15th, 1995. Kevin's been on the
27:20run for over 2 years. He's applied to a
27:23number of jobs using a fake identity,
27:25but nothing came of it. He's at his
27:27computer as always when he notices that
27:29back doors he's been using have recently
27:31been patched. Something's off. Like many
27:34other times in his life, it's the FBI.
27:36They ask if he's Kevin Mitnik. He says
27:38he's not. They enter and start searching
27:41his apartment. They go through his
27:42closet. In the inner pocket of an old
27:45ski jacket, they find a piece of paper.
27:47It's a payub made out to Kevin Mitnik.
27:52The next day, Mitnik is taken to court.
27:54The room is packed with journalists.
27:57Shimamura is present, too. Superhero and
28:00Super Villain face each other in real
28:01life for the first time. The hearing
28:03only lasts a few minutes. Then, Mitnik
28:05is let out of the courtroom. As he
28:07passes Shimamura, he nods and says, "I
28:10respect your skills." Shimamura nods
28:12back. Kevin Mitnik's arrest made
28:15headlines across the country for 3 days
28:17straight. Once again, he landed on the
28:19front page of the New York Times. A most
28:21wanted cyber thief is caught in his own
28:23web. The LA Times wrote, "To some Kevin
28:27Mitnik is an electronic terrorist. His
28:29trial takes place in North Carolina, but
28:31California wants to prosecute him, too.
28:34So, he makes a deal. He pleads guilty to
28:36a single charge. The other charges in
28:38North Carolina are dropped, and he's
28:40[music] transferred back to his home
28:41state. In September 1996, he's charged
28:44on 25 counts. He's accused of hacking
28:47companies like Motorola, Nokia, and
28:49Fujitsu during his two years on the run,
28:51stealing software worth millions. The
28:53total damage claims eventually reach
28:55almost $300 million. As the trial goes
28:58on, support for Mitnik grows. The hacker
29:01community rallies behind him. Some
29:03question his guilt. A free Kevin
29:05movement emerges. Supporters believe
29:07he's being treated unfairly and that his
29:09case is being exaggerated. Author
29:11Jonathan Litman questions whether it was
29:13really Mitnik who broke into Shimamura's
29:15systems. He also doubts that Mitnik left
29:17the voicemails. On the day of Mitnik's
29:20arrest, Shimamura received two more
29:22mysterious messages.
29:25>> Tommo, my friend, I just want to say, I
29:27want to reiterate it is big joke. It is
29:30big. Make fun of Kung Fu Movie. No, do
29:33not fly out to come and get me. I'm not
29:34worth it. Just make fun of Kung Fu
29:36Movie. That is it. Thank you.
29:38Hackers attack websites like Yahoo and
29:40the New York Times, leaving messages
29:42demanding Kevin Mitnik's release. Others
29:44criticize a book about the takedown of
29:45Mitnik. They think the author, Jonathan
29:47Markoff, may have embellished the story.
29:50A film studio secures the rights to a
29:51movie adaptation. In March 1999, Mitnik
29:55accepts another deal with prosecutors.
29:57He pleads guilty to seven of the 25
29:59charges. Combined with his earlier
30:01conviction in North Carolina, he's
30:03sentenced to 5 1/2 years. By this time,
30:05he's already spent four [music] years in
30:07pre-trial detention. What was once
30:09claimed to be nearly $300 million in
30:11damages is reduced to $4,125
30:14in restitution. The Mitnik case becomes
30:17a symbol for America's hacker paranoia.
30:19Even after he's served his sentence, the
30:21restrictions on him are severe. For 3
30:23years, he's banned from using any
30:25computers. No cell phones, not even a
30:27TV. The only electronic device he's
30:29allowed to use is a landline. He isn't
30:31allowed to take any [music] job that
30:33involves access to computers. And even
30:35back then, they were everywhere. Just
30:37before his release, Kevin Mitnik
30:39appeared on 60 Minutes. For the first
30:41time, he spoke directly to the American
30:43public.
30:43>> I saw myself as an electronic joy rider
30:46having a great time on the information
30:48superighway. I felt like I was like
30:50James Bond behind the computer. It was a
30:52big game to me. I was just having a
30:54blast.
30:54>> Did it ever occur to you that perhaps
30:57what you were doing was wrong?
30:58>> Oh, yeah. Yeah. It was an it was a
31:01invasion of privacy. [music] You know,
31:03going going and getting access to other
31:06people's information is obviously a
31:08gross invasion of privacy and it is
31:09wrong.
31:10>> And that didn't bother you?
31:11>> Um, at the time I was doing it. Um,
31:15no.
31:16>> A con artist trying to make big money is
31:18easy to label. You can put him in a box.
31:21But for people like Mitnik, there was no
31:23box. Maybe that's what fueled the myth
31:25of him as the dark side hacker and cyber
31:27thief.
31:29On January 21, 2000, Kevin Mitnik walks
31:33out of prison. Technically, he isn't
31:35allowed to use computers for 3 years
31:37after his release, [music] but his
31:38probation officer starts making
31:40exceptions. Mitnik reinvents himself as
31:42a cyber security expert. Companies
31:44[music] pay him to find their security
31:46flaws. He appears publicly as a
31:48specialist and writes several books. In
31:51his biography, he recalls that a single
31:53word changed hacking forever.
31:55Authorization. It magically [music]
31:57transformed him from the most wanted
31:59hacker into one of the most sought-after
32:01security experts around. On July 16,
32:042023, [music]
32:05Mitnik died of pancreatic cancer at the
32:07age of 59. Obituaries honor him as a
32:10pioneer and legendary hacker.
32:13Thanks again to boot.dev for sponsoring
32:15this video. Check out the link in the
32:17description and use code fern for 25%
32:19off.

About this transcript

This page contains the full transcript of The Kid Who Hacked America by fern, generated from the public captions YouTube serves with the video. The transcript has 5,801 words across 887 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.