The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [110]
When I demonstrated this little trick on the Art Bell Show, I spoofed my caller ID to display the name and number of the Los Angeles headquarters of the FBI. Art was quite shocked about the whole affair and admonished me for doing something illegal. But I pointed out to him that it’s perfectly legal, as long as it’s not an attempt to commit fraud. After the program I received several hundred emails asking me to explain how I had done it. Now you know.
This is the perfect tool to build credibility for the social engineer. If, for example, during the research stage of the social engineering attack cycle, it was discovered that the target had caller ID, the attacker could spoof his or her own number as being from a trusted company or employee. A bill collector can make his or her calls appear to come from your place of business.
But stop and think about the implications. A computer intruder can call you at home claiming to be from the IT department at your company. The person on the line urgently needs your password to restore your files from a server crash. Or the caller ID displays the name and number of your bank or stock brokerage house, the pretty sounding girl just needs to verify your account numbers and your mother’s maiden name. For good measure, she also needs to verify your ATM PIN because of some system problem. A stock market boiler-room operation can make their calls seem to come from Merrill Lynch or Citibank. Someone out to steal your identity could call, apparently from Visa, and convince you to tell him your Visa card number. A guy with a grudge could call and claim to be from the IRS or the FBI.
If you have access to a telephone system connected to a PRI, plus a bit of programming knowledge that you can probably acquire from the system vendor’s Web site, you can use this tactic for playing cool tricks on your friends. Know anybody with overblown political aspirations? You could program the referral number as 202 456-1414, and his caller ID will display the name “WHITE HOUSE.”
He’ll think he’s getting a call from the president!
The moral of the story is simple: Caller ID cannot be trusted, except when being used to identify internal calls. Both at work and at home, everyone needs to become aware of the caller ID trick and recognize that the name or phone number shown in a caller ID display cannot ever be trusted for verification of identity.
mitnick message
The next time you receive a call and your caller ID shows it’s from your dear old mom, you never know—it might be from a sweet little old social engineer.
THE INVISIBLE EMPLOYEE
Shirley Cutlass has found a new and exciting way to make fast money. No more putting in long hours at the salt mine. She has joined the hundreds of other scam artists involved in the crime of the decade. She is an identity thief.
Today she has set her sights on getting confidential information from the customer service department of a credit card company. After doing the usual kind of homework, she calls the target company and tells the switchboard operator who answers that she’d like to be connected to the Telecom Department. Reaching Telecom, she asks for the voice mail administrator.
Using information gathered from her research, she explains that her name is Norma Todd from the Cleveland office. Using a ruse that should by now be familiar to you, she says she’ll be traveling to corporate headquarters for a week, and she’ll need a voice mailbox there so she won’t have to make long distance calls to check her voice mail messages. No need for a physical telephone connection, she says, just a voice mailbox. He says he’ll take care of it, he’ll call her back when it’s set up to give her the information she’ll need.
In a seductive voice, she says “I’m on my way into a meeting, can I call you back in an