I worked at a company that had hired Mitnick as a security consultant.

His report for a client that turned out to have been rife with SQL injection at the time was largely movie plot physical security stuff. Not wrong exactly, but not the center mass of the threat model they needed either.

He seemed to lack systems thinking, producing a report that focused on calling out specific employees as dumb or incompetent. Counterproductive at best. It seemed like his PR exceeded his utility by a great deal.

That trend continues beyond the grave, maybe.

In all fairness, a genuine attacker WILL be abrasive and abusive. They WILL single out employees that are gullible and exploit them. It's not pretty because a genuine attack is not pretty. Of course a simulated attack will be indecent and discourteous in nature, that is how attacks are.

Isn't he famous for social engineering/physical security type things? If you hire an expert in X, you are probably going to get X.

Dude I was called out by name in the report either right before you got there or the first one you were there. I was called out in the one where they got B's Audi keys in his office.

Whole thing was so dumb. A floor full of smart monitors that they could have put a keylogger on. A plethora of physical network access and I get called out for leaving my laptop on the lock screen and going downstairs for food.

And they got found out because I ran little snitch I paid for myself and it caught their hijacked chrome making all sorts of weird network calls. But I don't remember being given credit for that.

(Sips mojito)

He mostly used social engineering. Not technical exploits. So that's how he succeeded. Call it crazy, but it worked.

Kevin's security company is also a mess, and the training videos they produce are embarrassing at best.

I understand he probably just lent his name to the company (though he did show up in some of the videos), but still...

"He didn't breach us the way we wanted him to do it so it was dumb." Idk man, sounds like you locked your doors but left the windows open. That's the point of these things.

I mean, the landscape changed quite a bit since early days of what Mitnick did as a blackhat. He did his best to adapt and make money, which given his prison term, isn't really that surprising.

He social engineered your company into contracting him, and that adds to the legend, but people don't see how many other companies he failed to social engineer.

The hero worship of him makes me physically ill, always has.

He did cost people their jobs though, so I guess he's a good person.

> "He was a hacker-turned-security consultant who, later in life, helped shape the modern white-hat."

They left out convicted criminal.