Comments on: AOL Busts Staten Island Hacker http://www.belch.com/blog/2007/04/27/aol-busts-staten-island-hacker/ I can't believe that came from your mouth! Mon, 01 Dec 2008 20:49:41 +0000 http://wordpress.org/?v=2.6.5 By: Pat http://www.belch.com/blog/2007/04/27/aol-busts-staten-island-hacker/#comment-73034 Pat Mon, 28 Jan 2008 15:39:14 +0000 http://www.belch.com/blog/2007/04/27/aol-busts-staten-island-hacker/#comment-73034 Drew, I only know what the article is telling me. From what I read, I infer that Mike used trojans and targeted emails to phish the accounts of AOL employees both at corporate headquarters and at the call center. This was not done over the phone. And Drew, phishing I dont think is "most real form of hacking there is" like you say. But I do think that when all else fails, phishing still works and it works quite well, as your friend Mike demonstrated. And yes, it is a huge gap in network security. Lots of manhours and technology are being focused at the problem trying to fix it with stronger authentication, etc. But with dumb employees still in the loop, its a huge uphill battle. So what is the latest on your friend Mike? I tried a Google search but didn't manage to find much. Was he released? Charges dropped? and thanks for sharing your thoughts! Drew,
I only know what the article is telling me. From what I read, I infer that Mike used trojans and targeted emails to phish the accounts of AOL employees both at corporate headquarters and at the call center. This was not done over the phone.

And Drew, phishing I dont think is “most real form of hacking there is” like you say. But I do think that when all else fails, phishing still works and it works quite well, as your friend Mike demonstrated. And yes, it is a huge gap in network security. Lots of manhours and technology are being focused at the problem trying to fix it with stronger authentication, etc. But with dumb employees still in the loop, its a huge uphill battle.

So what is the latest on your friend Mike? I tried a Google search but didn’t manage to find much. Was he released? Charges dropped? and thanks for sharing your thoughts!

]]> By: drew http://www.belch.com/blog/2007/04/27/aol-busts-staten-island-hacker/#comment-72987 drew Mon, 28 Jan 2008 06:52:19 +0000 http://www.belch.com/blog/2007/04/27/aol-busts-staten-island-hacker/#comment-72987 A corporation as large as AOL should not allow its customers' credit card and payment information to be so easily discovered by a simple phone call where somebody says they are somebody else. I know Mike personally, and I also work tech support in a call center for a large cable internet provider, and the company I work for is very prepared for such calls and prepared against social engineering. Obviously, the charges against mike was a little more than just "phishing accounts," in your terms sounds like he just got a couple member usernames. Mike is charged, according to the article, with gaining access to about 50 employee accounts. Please explain the difference, Pat, between a weakness in a network, and the ability for somebody to social engineer their way to customer financial information. In my opinion, social engineering is the most real form of hacking there is, and the lack of attention that companies put to that aspect of hacking IS quite a large gap in network security. A corporation as large as AOL should not allow its customers’ credit card and payment information to be so easily discovered by a simple phone call where somebody says they are somebody else.

I know Mike personally, and I also work tech support in a call center for a large cable internet provider, and the company I work for is very prepared for such calls and prepared against social engineering.

Obviously, the charges against mike was a little more than just “phishing accounts,” in your terms sounds like he just got a couple member usernames. Mike is charged, according to the article, with gaining access to about 50 employee accounts.

Please explain the difference, Pat, between a weakness in a network, and the ability for somebody to social engineer their way to customer financial information. In my opinion, social engineering is the most real form of hacking there is, and the lack of attention that companies put to that aspect of hacking IS quite a large gap in network security.

]]> By: Pat http://www.belch.com/blog/2007/04/27/aol-busts-staten-island-hacker/#comment-72926 Pat Sun, 27 Jan 2008 14:59:21 +0000 http://www.belch.com/blog/2007/04/27/aol-busts-staten-island-hacker/#comment-72926 Phishing accounts is not the same as penetrating a network using weaknesses, Drew. His stupidity is evident because of his flagrant flaunting of his criminal activity. Phishing accounts is not the same as penetrating a network using weaknesses, Drew. His stupidity is evident because of his flagrant flaunting of his criminal activity.

]]> By: drew http://www.belch.com/blog/2007/04/27/aol-busts-staten-island-hacker/#comment-72902 drew Sun, 27 Jan 2008 08:59:49 +0000 http://www.belch.com/blog/2007/04/27/aol-busts-staten-island-hacker/#comment-72902 Quick comment... If Mike Nieves is a stupid kid, and if AOL is among the best protected networks in the world, then how did some "stupid kid" hack into the "best protected network" so easily? Just Wondering.... Also, no jailtime Quick comment…

If Mike Nieves is a stupid kid, and if AOL is among the best protected networks in the world, then how did some “stupid kid” hack into the “best protected network” so easily?

Just Wondering….

Also, no jailtime

]]>