Online Book Reader

Home Category

The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [101]

By Root 1242 0
tradeoff is so lousy. Instead he daydreams about doing a Rifkin—robbing a bank electronically.

The last time Bill was in Europe with the family, he opened a bank account in Monaco with 100 Francs. It still has only 100 francs in it, but he has a plan that could help it reach seven digits in a hurry. Maybe even eight if he’s lucky.

Bill’s girlfriend Annemarie worked in M&A for a large Boston bank. One day while waiting at her offices until she got out of a late meeting, he gave in to curiosity and plugged his laptop into an Ethernet port in the conference room he was using. Yes!-he was on their internal network, connected inside the bank’s network ... behind the corporate firewall. That gave him an idea.

He pooled his talent with a classmate who knew a young woman named Julia, a brilliant computer science Ph.D. candidate doing an internship at Marchand Microsystems. Julia looked like a great source for essential insider information. They told her they were writing a script for a movie and she actually believed them. She thought it was fun making up a story with them and giving them all the details about how you could actually bring off the caper they had described. She thought the idea was brilliant, actually, and kept badgering them about giving her a screen credit, too. They warned her about how often screenplay ideas get stolen and made her swear she’d never tell anyone.

Suitably coached by Julia, Bill did the risky part himself and never doubted he could bring it off.

I called in the afternoon and managed to find out that the night supervisor of the security force was a man named Isaiah Adams. At 9:30 that night I called the building and talked to the guard on the lobby security desk. My story was all based on urgency and I made myself sound a little panicky. “I’m having car trouble and I can’t get to the facility,” I said. “I have this emergency and I really need your help. I tried calling the guard supervisor, Isaiah, but he’s not at home. Can you just do me this one-time favor, I’d really appreciate it?”

The rooms in that big facility were each labeled with a mail-stop code so I gave him the mail-stop of the computer lab and asked him if he knew where that was. He said yes, and agreed to go there for me. He said it would take him a few minutes to get to the room, and I said I’d call him in the lab, giving the excuse that I was using the only phone line available to me and I was using it to dial into the network to try to fix the problem.

He was already there and waiting by the time I called, and I told him where to find the console I was interested in, looking for one with a paper banner reading “elmer”—the host that Julia had said was used to build the release versions of the operating system that the company marketed. When he said he had found it, I knew for sure that Julia had been feeding us good information and my heart skipped a beat. I had him hit the Enter key a couple of times, and he said it printed a pound sign. Which told me the computer was logged in as root, the superuser account with all system privileges. He was a hunt-and-peck typist and got all in a sweat when I tried to talk him through entering my next command, which was more than a bit tricky:

echo ‘ fix:x:0:0::/:/bin/sh’ » /etc/passwd

Finally he got it right, and we had now provided an account with a name fix. And then I had him type

echo ‘fix::10300:0:0’ » /etc/shadow

This established the encrypted password, which goes between the double colon. Putting nothing between those two colons meant the account would have a null password. So just those two commands was all it took to append the account fix to the password file, with a null password. Best of all, the account would have the same privileges as a superuser.

The next thing I had him do was to enter a recursive directory command that printed out a long list of file names. Then I had him feed the paper forward, tear it off, and take it with him back to his guard desk because “I may need you to read me something from it later on.”

The beauty of this was that he had no

Return Main Page Previous Page Next Page

®Online Book Reader