The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [105]
lingo
SILENT INSTALL A method of installing a software application without the computer user or operator being aware that such action is taking place.
The first day they were supposed to be gone he placed a pretext urgent call just to make sure, and was told by a receptionist that “Mr. Vittaro is not in the office and neither is his secretary. Neither of them is expected any time today or tomorrow or the next day.”
His very first try at conning a junior employee into taking part in his scheme was successful, and she didn’t seem to blink an eye at being told to help him by downloading a “manuscript,” which was actually a popular, commercially available spyware program that the attacker had modified for a silent install. Using this method, the installation would not be detected by any antivirus software. For some strange reason, antivirus manufacturers do not market products that will detect commercially available spyware.
Immediately after the young woman had loaded the software onto Vittaro’s computer, Kurt went back up to the Geocities site and replaced the doc.exe file with a book manuscript he found on the Internet. Just in case anyone stumbled on the ruse and returned to the site to investigate what had taken place, all they’d find would be an innocuous, amateurish, unpublishable book manuscript.
Once the program had been installed and the computer rebooted, it was set to immediately become active. Ron Vittaro would return to town in a few days, start to work, and the spyware would begin forwarding all the keystrokes typed on his computer, including all outgoing emails and screen shots showing what was displayed on his screen at that moment. It would all be sent at regular intervals to a free email service provider in the Ukraine.
Within a few days after Vittaro’s return, Kurt was plowing through the log files piling up in his Ukrainian mailbox and before long had located confidential emails that indicated just how far Millard-Fenton Publishing was willing to go in making a deal with the author. Armed with that knowledge, it was easy for the author’s agent to negotiate much better terms than originally offered, without ever running the risk of losing the deal altogether. Which, of course, meant a bigger commission for the agent.
Analyzing the Con
In this ruse, the attacker made his success more likely by picking a new employee to act as his proxy, counting on her being more willing to cooperate and be a team player, and being less likely to have knowledge of the company, its people, and good security practices which could thwart the attempt.
Because Kurt was pretexting as a vice president in his conversation with Anna, a clerk in Finance, he knew that it would be very unlikely that she would question his authority. On the contrary, she might entertain the thought that helping a VP could gain her favor.
And the process he walked Anna through that had the effect of installing the spyware appeared innocuous on its face. Anna had no idea that her seemingly innocent actions had set an attacker up to gain valuable information that could be used against the interests of the company.
And why did he choose to forward the VP’s message to an email account in the Ukraine? For several reasons a far-off destination makes tracing or taking action against an attacker much less likely. These types of crimes are generally considered low priority in countries like this, where the police tend to hold the view that committing a crime over the Internet isn’t a noteworthy offense. For that reason, using email drops in countries that are unlikely to cooperate with U.S. law enforcement is an attractive strategy.
PREVENTING THE CON
A social engineer will always prefer to target an employee who is unlikely