The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [114]
How glad she had been to get the offer from Lambeck Manufacturing. Sure, it was humiliating to accept a secretarial position, but Mr. Cartright had said how eager they were to have her, and taking the secretarial job would put her on the spot when the next nonadministrative position opened up.
Two months later she heard that one of Cartright’s junior product managers was leaving. She could hardly sleep that night, imagining herself on the fifth floor, in an office with a door, attending meetings and making decisions.
The next morning she went first thing to see Mr. Cartright. He said they felt she needed to learn more about the industry before she was ready for a professional position. And then they went and hired an amateur from outside the company who knew less about the industry than she did.
It was about then that it began to dawn on her: The company had plenty of women, but they were almost all secretaries. They weren’t going to give her a management job. Ever.
Payback
It took her almost a week to figure out how she was going to pay them back. About a month earlier a guy from an industry trade magazine had tried to hit on her when he came in for the new product launch. A few weeks later he called her up at work and said if she would send him some advance information on the Cobra 273 product, he’d send her flowers, and if it was really hot information that he used in the magazine, he’d make a special trip in from Chicago just to take her out to dinner.
She had been in young Mr. Johannson’s office one day shortly after that when he logged onto the corporate network. Without thinking, she had watched his fingers (shoulder surfing, this is sometimes called). He had entered “marty63” as his password.
Her plan was beginning to come together. There was a memo she remembered typing not long after she came to the company. She found a copy in the files and typed up a new version, using language from the original one. Her version read:
TO: C. Pania, IT dept.
FROM: L. Cartright, Development
Martin Johansson will be working with a special projects team in my department.
I hereby authorize him to have access to the servers used by the engineering group. Mr. Johansson’s security profile is to be updated to grant him the same access rights as a product developer.
Louis Cartright
lingo
SHOULDER SURFING The act of watching a person type at his computer keyboard to detect and steal his password or other user information.
When most everybody was gone at lunch, she cut Mr. Cartright’s signature from the original memo, pasted it onto her new version, and daubed Wite-Out around the edges. She made a copy of the result, and then made a copy of the copy. You could barely see the edges around the signature.
She sent the fax from the machine near Mr. Cartright’s office.
Three days later, she stayed after hours and waited till everyone left. She walked into Johannson’s office, and tried logging onto the network with his username and the password, marty63. It worked.
In minutes she had located the product specification files for the Cobra 273, and downloaded them to a Zip disk.
The disk was safely in her purse as she walked in the cool nighttime breeze to the parking lot. It would be on its way to the reporter that night.
Analyzing the Con
A disgruntled employee, a search through the files, a quick cut-paste-and-Wite-Out operation, a little creative copying, and a fax. And, voilà!—she has access to confidential marketing and product specifications.
And a few days later, a trade magazine journalist has a big scoop with the specs and marketing plans of a hot new product that will be in the hands of magazine subscribers throughout the industry months in advance of the product’s release. Competitor companies will have several months head start on developing equivalent products and having their ad campaigns