Ghost in the Wires: My Adventures as the World's Most Wanted Hacker

by Kevin D. Mitnick

Not long after that visit, I found a way to divert calls to Directory Assistance from people in Rhode Island, so the calls would come to me instead. How do you have fun with people who are trying to get a phone number? A typical call in one of my routines went like this:

One day on the air I had heated words with the control operator of the repeater over what he labeled “weird calls” I was making. He had noticed I was regularly keying in a long series of digits when I was using the auto patch.

guy listening in contacted me afterward on the air, said his name was Lewis De Payne, and gave me his phone number. I called him that evening. Lewis said he was intrigued by what I was doing.

modify a two-meter radio so we could make our voices come out of the speaker where customers placed their orders at the drive-through of a fast-food restaurant. We’d head over to a McDonald’s, park nearby where we could watch the action without being noticed, and tune the handheld radio to the restaurant’s frequency.

We thought it would be funny if we drove people a little nuts by making it impossible to place their order. Taking over the speaker, each time a customer pulled up and placed an order, a friend of ours would repeat the order, but in a strong Hindi accent with hardly a word understandable.

The customer would say he couldn’t understand, and our friend would say something else just as impossible to understand, over and over—driving customers crazy, one after the other.

The best part was that everything we said at the drive-through also blared out over the speaker outside, but the employees couldn’t override it. Sometimes we’d watch the customers sitting outside at the tables, eating their bur...

One time, a manager came out to see who was messing with the speaker. He glanced around the parking lot, scratching his head. There w...

After about ten minutes, the burly guard comes out, looking around in every direction but knowing damned well we’re long gone. Of course, he’s wrong.

After I figured out how to obtain unpublished numbers, finding out information about people—friends, friends of friends, teachers, even strangers—held a fascination for me. The Department of Motor Vehicles is a great storehouse of information. Was there any way I could tap it?

“This is Officer Campbell, LAPD, Van Nuys station. Our computers are down, and some officers in the field need a couple of pieces of information. Can you help me?” The lady at the DMV said, “Why aren’t you calling on the law enforcement line?” Oh, okay—there was a separate phone number for cops to call. How could I find out the number? Well, obviously the cops at the police station would have it, but… was I really going to call the police station to get information that would help me break the law? Oh, yeah.

Placing a call to the nearest station house, I said I was from the Los Angeles County Sheriff’s Department, we needed to call the DMV, and the officer who had the number for the law enforcement desk was out. I needed the operator to give me the number. Which she did. Just like that.

The lady who answered said something I didn’t get. I said, “Is this the number for law enforcement?” She said, “No.” “I must have dialed wrong,” I said. “What’s the number for law enforcement?” She gave it to me! After all these years, they still haven’t learned.)

After phoning the DMV’s law enforcement line, I found there was a second level of protection. I needed a “Requester Code.” As in the past, I needed to come up with a cover story on the spur of the moment. Making my voice sound anxious, I told the clerk, “We’ve just had an urgent situation come up here, I’ll have to call you back.”

Calling the Van Nuys LAPD station, I claimed to be from the DMV and said I was compiling a new database. “Is your Requester Code 36472?” “No, it’s 62883.” (That’s a trick I’ve discovered very often works. If you ask for a piece of sensitive information, people naturally grow immediately suspicious. If you pretend you already have the information and give them something that’s wron...

With a few minutes’ worth of phone calls, I had set myself up for getting the driver’s license number and home address of anyone in the state of California, or running a license plate and getting the details such as the owner’s name and address, or running a person’s name and getting details about his or her car registration. At the time it was just a test ...

Of course phreakers like to score points by showing other phreakers what new things they’ve learned how to do. I loved pulling pranks on friends, phreakers or not. One day I hacked into the phone company switch serving the area where my buddy Steve Rhoades lived with his grandmother, changing the “line class code” from residential to pay phone.

When he or his grandmother tried to place a call, they would hear, “Please deposit ten cents.” Of course he knew who had done it, and called to complain. I promised to undo it, and I did, but changed the service to a prison pay phone.

Now when they tried to make a call, an operator would come on the line and say, “This will be a collect call. What is your name, please.” Steve called to say, “Very funny—chan...

Phone phreakers had discovered a way to make free phone calls, taking advantage of a flaw in some types of “diverters”—devices that were used to provide call forwarding (for example, to an answering service) in the days...

phreaker would call at an hour when he knew the business would be closed. When the answering service picked up, he would ask something like, “What hours are you open?” When the person who had answered disconnected the line, the phreaker would stay on; after a few moments, the dial tone would be heard. The phreaker could th...

The diverter could also be used to receive incoming calls for call-backs during a s...

In another approach with the diverter, the phreaker dialed the “automatic number identification,” or ANI number, used by phone company technicians, and in this way learned the phone number for the outgoing diverter line. Once the number was ...

I used this way of talking with my friend Steve late one night. He answered using the diverter line belonging to a company called Prestige Coffee Shop in the San Fernando Valley. We were talking about phone phreaking stuff when suddenly a voice interrupted our conversation.

“We are monitoring,” the stranger said. Steve and I both hung up immediately. We got back on a direct connection, laughing at the telephone company’s puny attempt to scare us, talking about what idiots the people who worked there were. The same voice interrupted again: “We are still monitoring!” Who were the idiots now?

Sometime later, my mom received a letter from General Telephone, followed by an in-person visit from Don Moody, the head of Security for the company, who warned her that if I didn’t stop what I was doing, GTE w...

Mom was shocked and upset by the idea of losing our phone service. And Moody wasn’t kidding. When I continued my phreaking, GTE did terminate our service....

The phone company associated each phone line with a specific address. Our terminated phone was assigned to Unit 13. My solution was pretty low-tech: I went down to the hardware store and sorted through the collection of letters and numbers that you tack up on your front door. When I g...

Then I called GTE and asked for the department that handled provisioning. I explained that a new unit, 12B, was being added to the condominium complex and asked them to adjust their records accordingly. They said it would take tw...

After the phone was installed, I took down the “12B” outside our door and replaced it with “13” again. It was several weeks before somebody at GTE caught on and shut the service down. Years later I would learn that this was when GTE started a file on me. I was seventeen years old.

In charge of maintaining the Los Angeles Unified School District’s PDP-11/70 minicomputer running the RSTS/E operating system, he—along with a number of his friends—possessed computer knowledge I highly prized.

Neal told me they’d agreed to allow me into their circle, but I had to prove myself first. They wanted access to a computer system called “the Ark,” which was the system at Digital Equipment used by the development group for RSTS/E.

The modem number brought up a logon banner on the Ark, but of course you had to enter a valid account number and password. How could I get those credentials?

had a plan I thought might work, but to get started I would need to know the name of a system administrator—not someone in the development group itself but one of the people who managed the internal computer systems at Digital. I called the switchboard for the facility in Merrimack, New Hampshire, where the Ark was located, and asked to be connected to the computer room. “Which one?” the switchboard lady asked. Oops. I hadn’t ever thought to research which lab the Ark was in. I said, “For RSTS/E development.” “Oh, you mean the raised-floor lab. I’ll connect you.”

“Is the PDP-11/70 for the Ark located in this lab?” I asked, giving the name of the most powerful DEC minicomputer of the time, which I figured the development group would have to be using. She assured me it was.

“You’ll have to contact Jerry Covert.” I asked for his extension; she didn’t hesitate to give it to me, and when I reached him, I said, “Hey, Jerry, this is Anton,” figuring that even if he didn’t know Chernoff personally, he was almost certain to know the name. “Hey, how’re you doing?” he answered jovially, obviously not familiar enough with Chernoff in person to know that I didn’t sound like him.

When I got together with Neal, I told him, “Getting into the Ark was a snap. I have every RSTS/E developer’s password.” He rolled his eyes with an expression that said, What’s this guy been smoking?

The guys started downloading the RSTS/E source code.

The old adage says there’s no honor among thieves. Instead of taking me into their confidence and sharing information, they downloaded the source code for RSTS/E and kept it to themselves.

learned later that these bastards actually called DEC and told them the Ark had been hacked, and gave my name as the hacker. Total betrayal. I had no suspicion these guys would dream of snitching on me, especially when they had reaped such rich rewards. It was the first t...

At seventeen, I was still in high school but dedicated to working on what might be calle...

used the Hirschman account to connect to Bloodstock Research so I could exploit a security flaw and gain access to a privileged account, then Micah and I played with the operating system to teach ourselves about it, basically for kicks.

The episode blew up in our faces. Micah logged in late one night without me, and Bloodstock spotted the break-in and alerted the FBI, telling them that the attack had been through the Hirschman account. The Feds paid Mr. Hirschman a visit. He denied knowing anything about the attack. When they pressured him, he fingered his son. Micah fingered me.

was in my bedroom on the second floor of our condo, online, hacking into the Pacific Telephone sw...

was flashing on the fact that I had a ton of that thermal paper under my bed, filled with data that would show I had been hacking for many hours a week into telephone company computers and switches, as well as a load of computers at private firms.

“I busted Stanley Rifkin,” he told me, understanding that I’d know whom he was talking about: the guy who had pulled off the biggest theft of its kind in history, stealing $10 million from Security Pacific National Bank by a wire-transfer ruse.

But this guy was a Fed, and there still weren’t any federal laws covering the kind of computer break-ins I was doing. He said, “You can get twenty-five years if you continue messing with the phone company.” I knew he was powerless, just trying to scare me.

It wasn’t long before I began experiencing some turbulence from the authorities. Micah had left shortly after for a trip to Paris. The Air France flight had been in the air for a couple of hours when an announcement came over the PA system: “Mr. Micah Hirschman, please turn on your stewardess call button.” When he did, a stewardess came to him and said, “The pilot wants to speak with you in the cockpit.” You can just imagine his surprise.

The whole situation made no sense. Micah gave his answer, and the agent grilled him for a few minutes. It turned out the Feds thought that Micah and I were pulling off some Stanley Rifkin–style big computer hack, maybe setting up a phony transfer of millions from a U.S. bank to some other bank in Europe. It was like a scene from a caper movie, and I loved the thrill of it.

What could be better than becoming a college student studying computers, working toward a degree while feeding my insatiable thirst for computer knowledge? In the summer of 1981, at the age of seventeen, I enrolled at Pierce College, a two-year school in nearby Woodland Hills.