Cloud Security Office Hours Banner

Mitnick / Novell 1994 — 1994

Step-by-step kill chain mapped to MITRE ATT&CK Cloud, sourced from official post-mortems and primary technical analyses.

1993–1995 (fugitive period) Critical On-Premises / Dial-Up

Kevin Mitnick / Novell – OSINT → Pretexting → Phone Social Engineering → Dial-Up Access → NetWare Source Code Theft

While a fugitive living under a false identity in Denver, Kevin Mitnick — the FBI's most wanted hacker — targeted Novell's technical support staff using a technique he called pretexting. By impersonating a Novell employee using authentic corporate lingo, internal knowledge, and manufactured urgency, he convinced support staff to provide credentials and system access. He then used dial-up connections to extract proprietary NetWare source code. Shawn Nunley, a Novell support analyst at the time, was directly targeted by Mitnick and later became the FBI's star witness — before becoming one of Mitnick's closest friends. This entry is notable as a foundational case study in social engineering before the term existed in mainstream security.

NetWare source code stolen
2.5 years as fugitive targeting multiple companies
25 counts in federal indictment
Threat actor: Kevin Mitnick ("Condor"), FBI's Most Wanted
📄 Wired — Mitnick Meets His Pigeon (Shawn Nunley) ↗ 📄 Federal indictment details ↗ 📄 Malicious Life — Mitnick Part 2 ↗
ℹ️ Shawn Nunley (CSOH founder) was Mitnick's target at Novell. For more on their remarkable story, read the Kevin Mitnick — In Memoriam tribute on this site.
🔍 Reconnaissance — Open Source Intelligence
01
Mitnick researches Novell's internal org structure, employee names, and technical lingo
T1591 – Gather Victim Org Information T1589 – Gather Victim Identity Info

Before making a single call, Mitnick invested significant time learning everything publicly available about his target. He gathered employee names from directory listings, understood Novell's internal team structures, and immersed himself in NetWare technical documentation so he could speak fluently about the product — a prerequisite for any convincing pretext. As he wrote in The Art of Deception: "When you know the lingo and terminology, it establishes credibility — you're legit, a coworker slogging in the trenches just like your targets."

Sources used: Phone directories, technical manuals, product documentation, prior calls to gather names
Goal: Build enough authentic detail to withstand scrutiny from a real Novell employee
Mitnick's method: "Pretext calls" — low-stakes calls to gather information for higher-stakes calls later
OSINTPretexting PrepT1591Phone Phreaking
📞 Initial Contact — The Pretext Call
02
Mitnick calls Novell technical support impersonating an internal employee
T1566.004 – Phishing: Voice T1656 – Impersonation

Mitnick called Novell's technical support line — the same line customers and employees used — and presented himself as a legitimate Novell employee or developer with a plausible reason for needing help. He used real employee names, correct internal terminology, and manufactured urgency to make the call feel routine. Shawn Nunley, a support analyst, took the call.

Impersonation type: Internal Novell employee / developer
Technique used: Pretexting — a fully constructed scenario with backstory, urgency, and technical credibility
Location: Mitnick was calling from Denver, living as "Eric Weiss" under a fabricated identity
VishingImpersonationPretextingT1566.004T1656
🎭 Trust Building — The Human Exploit
03
Mitnick establishes rapport and credibility through technical knowledge and urgency
T1656 – Impersonation

Mitnick's genius was not technical — it was psychological. He assessed his target's willingness to cooperate in the first few seconds, adapting his approach in real time. He used Novell-specific technical language that only an insider would know, referenced real internal projects or colleagues, and framed his request as urgent but routine — something that needed to be resolved quickly to avoid a bigger problem. This is the core of social engineering: making the target feel that compliance is the safe, helpful, professional response.

Psychological levers used: Authority (internal employee), urgency (time pressure), likeability (charm), reciprocity (asking a reasonable favour)
Mitnick on reading targets: "I'm always on the watch for signs that give me a read on how cooperative a person is"
Why support staff were vulnerable: Helping people quickly was their job — suspicion felt like being unhelpful
Social EngineeringPretextingAuthority BiasUrgencyHuman Exploit
🔑 Credential Access — Information Elicitation
04
Mitnick elicits credentials, dial-up numbers, or system access details from support staff
T1589.001 – Credentials T1598 – Phishing for Information

Once trust was established, Mitnick steered the conversation toward his actual goal — obtaining credentials, a dial-up number, or system access that would let him connect to Novell's internal network remotely. The request was framed as something mundane: a password reset, a need for a dial-in number to work remotely, or a request to verify account details. The target had no reason to suspect anything unusual.

Documented outcome: Mitnick obtained access credentials or dial-up access to Novell internal systems
Federal indictment: Mitnick and DePayne "stole and copied proprietary computer software from Novell" including NetWare source code
Credential ElicitationDial-Up AccessT1589.001T1598
💻 System Access — Dial-Up Intrusion
05
Mitnick dials into Novell's network using obtained credentials — from a cloned cell phone
T1078 – Valid Accounts T1036 – Masquerading

Using the credentials or dial-up access obtained from the call, Mitnick connected to Novell's internal systems remotely from his Denver apartment — at night, while working a day job at a law firm under a false identity. To hide his location from both the FBI and the phone company, he used cloned cellular phones, cycling through cloned numbers to avoid detection through call records.

Connection method: Dial-up modem (pre-internet era remote access)
Credentials used: Obtained via social engineering call to support staff
Location obfuscation: Cloned cellular phones — using stolen ESN/MIN pairs to masquerade as other subscribers
When: Nights, while working as "Eric Weiss" at a Denver law firm during the day
Dial-UpCloned Cell PhoneValid CredentialsT1078False Identity
📤 Exfiltration — NetWare Source Code
06
Proprietary Novell NetWare source code copied and exfiltrated
T1048 – Exfiltration Over Alternative Protocol T1213 – Data from Information Repositories

With authenticated access to Novell's internal systems, Mitnick copied proprietary NetWare source code — some of the most valuable intellectual property the company owned. The federal indictment confirmed that Mitnick and co-conspirator Lewis DePayne stole and copied this software. Mitnick's motivation, as he repeatedly stated, was not financial — it was intellectual curiosity and the challenge of accessing systems that were supposed to be inaccessible.

Data stolen: Proprietary Novell NetWare source code (confirmed in 25-count federal indictment)
Co-conspirator: Lewis DePayne (charged alongside Mitnick)
Motivation: Intellectual curiosity — Mitnick: "simple crimes of trespass... I wanted to know how these systems worked"
No financial use: No evidence source code was ever sold or used commercially
Source Code TheftNetWareT1048Intellectual PropertyNo Financial Motive
🚨 Discovery and Aftermath
07
FBI investigation — Shawn Nunley becomes star witness, then Mitnick's closest friend

The FBI built their case against Mitnick in part through witness testimony from support staff he had targeted. Shawn Nunley, who had taken Mitnick's call at Novell, became the government's star witness. But the story didn't end there — Shawn grew disillusioned with the government's handling of the case, contacted Mitnick's defence team, and ultimately became one of Mitnick's dearest friends. It's one of the most extraordinary victim-to-friend trajectories in the history of computer crime.

Arrest: February 15, 1995 — Raleigh, North Carolina apartment
Found with: Cloned cellular phones, 100+ cloned phone codes, multiple pieces of false identification
Sentence: 46 months + 22 months for supervised release violation (5 years total, including 8 months solitary)
Shawn Nunley: FBI star witness → disillusioned with prosecution → contacted defence → lifelong friend of Mitnick
FBI Arrest 1995Star WitnessFalse Identity UnravelledCloned Phones

🛡 How to Defend Against This Chain

Implement a call-back verification procedure for any credential or access request by phone. Never provide passwords, dial-up numbers, or system access to an inbound caller — regardless of how convincing they sound. Hang up and call back on a number you independently verify from your internal directory.
Train support staff to recognise the three pressure levers: authority, urgency, and likeability. Mitnick used all three in every call. When someone is very charming, very knowledgeable, and very urgent all at once — that combination itself is a red flag. Slow down, verify, never let urgency override procedure.
Restrict what information support staff can provide and to whom. Credentials, dial-up numbers, and system access details should never be distributed by phone without a formal verification workflow. The support desk should have a written procedure and authority to refuse without penalty.
Monitor dial-up and remote access connections for unusual times or locations. Mitnick connected at night from Denver. Anomalous remote access — unusual hours, unknown caller ID, high volume of data transferred — should trigger a review.
Security awareness training is not optional — it is the primary control against social engineering. Technical controls stopped none of Mitnick's Novell attack. The only defence was a human one. Regular training that uses realistic scenarios — not just policy documents — is the difference between a staff member who pauses and verifies and one who helps an attacker.
This attack still works today. Vishing (voice phishing) remains one of the top two attack vectors in 2024. The tools have changed — attackers now use AI voice cloning, LinkedIn for OSINT, and SMS as a follow-up — but the psychology is identical to what Mitnick did in 1994. The defence is also identical: verify independently, never let urgency override process.