Part 11 (1/2)
”Any other wages?”
”No”
”Thanks,” he said ”You've been very kind”
Then he tried to arrange to call her whenever he needed infor the favorite trick of social engineers of always trying to establish a connection so that he can keep going back to the sa to find a new mark each ti to Kentucky for her sister's wedding' Any other time, she'd do whatever she could
When she put the phone down, May Linn felt good that she had been able to offer a little help to a fellow unappreciated public servant
Keith Carter's Story To judge fro cri on knowledge of how to get the juicy facts on people They do this by using thoroughly illegalarrested The truth, of course, is that iti lives as sworn law enforceal and what isn't, and most are not tempted to cross the line
There are, however, exceptions Souys in the criuys are known in the trade as infor to break the rules
They know they can get any assignood deal easier if they take some shortcuts That these shortcuts happen to be potential felonies that ht land them behind bars for a few years doesn't seem to deter the more unscrupulous ones
Meanwhile the upscale PIs--the ones ork out of a fancy office suite in a high-rent part of town--don't do this kind of work themselves They simply hire souy we'll call Keith Carter was the kind of private eye unencumbered by ethics
It was a typical case of ”Where's he hiding thethe money?” Sometimes it was a rich lady anted to knohere her husband had hidden her uy without was a riddle Keith Carter wondered about now and then but had never found a good answer for)
In this case the husband, whose na the h-tech company with ten thousand dollars he borrowed from his wife's fa to her divorce lawyer, he had done an i his assets, and the laanted a co point would be the Social Security Ad their files on Johnson, which would be packed with highly useful information for a situation like this Aret and get the banks, brokerage fir
His first phone call was to a local district office, using the same 800 number that any member of the public uses, the number listed in the local phone book When a clerk came on the line, Keith asked to be connected to someone in Claims
Another wait, and then a voice Now Keith shi+fted gears; ”Hi,” he began ”This is Gregory Ada to reach a claims adjuster that handles an account nuoes to a fax machine”
”That's Mod 2,” the ave it to Keith
Next he called Mod 2 When May Linn answered, he switched hats and went through the routine about being from the Office of the Inspector General, and the probleave hireed to do whatever she could when he needed help in the future
analyzing the Con What made this approach effective was the play on the e his computer and ”my boss is not happy with me” People don't show their eht over so attacks The emotional ploy of ”I'm in trouble, won't you help me?” was all it took to win the day
Social Insecurity Incredibly, the Social Security Adram Operations Manual on the Web, crammed with information that's useful for their people, but also incredibly valuable to social engineers It contains abbreviations, lingo, and instructions for how to request what you want, as described in this story
Want to learn more inside information about the Social Security Adle or enter the following address into your browser: policyssagov/poency has already read this story and removed the manual by the tiive detailed inforive to the law enforcement community In practical terineer who can convince an SSA clerk that he is froanization The attacker could not have been successful in obtaining this information froeneral public The kind of attack Keith used only works when the person on the receiving end of the call is someone whose phone number is unavailable to the public, and who therefore has the expectation that anyone calling must be somebody on the inside--another example of speakeasy security' The ele the phone nuy they used--nu to be froovernency with broad powers This gives the attacker an aura of authority
One interesting sidelight: Social engineers seem to kno to make requests so that hardly anyone ever thinks, ”Why are you calling ically; it would have one to some other person in some completely different department Perhaps it sirind to help the caller that the victim discounts how unusual the call seems
Finally, the attacker in this incident, not satisfied with getting the information just for the case at hand, wanted to establish a contact he could call on regularly He ht otherwise have been able to use a common ploy for the sympathy attack-- ”I spilled coffee on h, because a keyboard can be replaced in a day
Hence he used the story about so his co out for weeks: ”Yep, I thought he'd have his own couy pulled soot it instead So this joker is still showing up in my cubicle” And so on
Poor me, I need help Works like a charm
ONE SIMPLE CALL
One of an attacker'stypical of requests that co that doesn't put the victi a request sound logical e one day, but the next, it may be a piece of cake
Mary H's Phone Call Date/Time: Monday, November 23, 7:49 AM Monday, Nove, New York Toand bean counting, generally viewed as being about as enjoyable as having a root canal Fortunately, not everyone sees the work that way Mary Harris, for exa, part of the reason she was one of thee, New York Toand bean counting, generally viewed as being about as enjoyable as having a root canal Fortunately, not everyone sees the work that way Mary Harris, for exa, part of the reason she was one of theemployees at her firet a head start on what she expected to be a long day, and was surprised to find her phone ringing She picked it up and gave her name
”Hi, this is Peter Sheppard I'm with Arbuclde Support, the coed a couple of co probleht I could troubleshoot before everybody co any proble to the network?”
She told him she didn't know yet She turned her co, he explained what he wanted to do
”I'd like to run a couple of tests with you, he said ”I'm able to see on my screen the keystrokes you type, and I want toacross the network correctly So every time you type a stroke, I want you to tell me what it is, and I'll see if the saht day of not being able to get any work done, she was more than happy to have this man help her After a fewto type init now--MARYD”
”Great so far,” he said ”I'o ahead and type your password but don't tell me what it is You should never tell anybody your password, not even tech support I'll just see asterisks here--your password is protected so I can't see it': None of this was true, but it made sense to Mary And then he said, ”Let me know once your co, he had her open two of her applications, and she reported that they launched ”just fine”
Mary was relieved to see that everything seelad I could make sure you'll be able to use your computer okay And listen,” he went on, ”we just installed an update that allow people to change their passwords Would you be willing to take a couple of ht?
She was grateful for the help he had given her and readily agreed Peter talked her through the steps of launching the application that allows a user to change passwords, a standard ele system ”Go ahead and enter your password,” he told her ”But remember not to say it out loud”
When she had done that, Peter said, ”Just for this quick test, when it asks for your new password, enter 'test123' Then type it again in the Verification box, and click Enter”
He walked her through the process of disconnecting from the server He had her wait a couple ofon with her new password It worked like a char back to her original password or choosing a new one--oncethe password out loud
”Well, Mary,” Peter told her ”We didn't find any trouble, and that's great Listen, if any problems do come up, just call us over here at Arbuckle I'm usually on special projects but anybody here who answers can help you” She thanked hiotten around about Peter--a nuone to school with him had heard he turned into some kind of a computer ho could often find out useful inforet When Alice Conrad came to him to ask a favor, he said no at first
Why should he help? When he ran into her once and tried to ask for a date, she had turned him down cold
But his refusal to help didn't see he could do anyway That was like a challenge, because of course he was sure he could And that was how he caree
Alice had been offered a contract for so coood Before she went back to ask for a better deal, she wanted to knohat terms other consultants had on their contracts