The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [116]
We read about cases of industrial espionage such as Borland accusing Symantec of stealing trade secrets, Cadence Design Systems filing a suit charging the theft of source code by a competitor. Many business people read these stories and think it could never happen at their company.
It’s happening every day.
VARIATION ON A SCHEME
The ruse described in the following tale has probably been pulled off many times, even though it sounds like something taken out of a Hollywood movie like The Insider, or from the pages of a John Grisham novel.
Class Action
Imagine that a massive class-action lawsuit is raging against a major pharmaceutical company, Pharmomedic. The suit claims that they knew one of their very popular drugs had a devastating side effect, but one that would not be evident until a patient had been on the medication for years. The suit alleges that they had results from a number of research studies that revealed this danger, but suppressed the evidence and never turned it over to the FDA as required.
William (“Billy”) Chaney, the attorney of record on the masthead of the New York law firm that filed the class-action suit, has depositions from two Pharmomedic doctors supporting the claim. But both are retired, neither has any files or documentation, and neither would make a strong, convincing witness. Billy knows he’s on shaky ground. Unless he can get a copy of one of those reports, or some internal memo or communication between company executives, his whole case will fall apart.
So he hires a firm he’s used before: Andreeson and Sons, private investigators. Billy doesn’t know how Pete and his people get the stuff“ they do, and he doesn’t want to know. All he knows is that Pete Andreeson is one good investigator.
To Andreeson, an assignment like this is what he calls a black bag job. The first rule is that the law firms and companies that hire him never learn how he gets his information so that they always have complete, plausible deniability. If anybody is going to have his feet shoved into boiling water, it’s going to be Pete, and for what he collects in fees on the big jobs, he figures it’s worth the risk. Besides, he gets such personal satisfaction from outsmarting smart people.
If the documents that Chaney wants him to find actually existed and haven’t been destroyed, they’ll be somewhere in the files of Pharmomedic. But finding them in the massive files of a large corporation would be a huge task. On the other hand, suppose they’ve turned copies over to their law firm, Jenkins and Petry? If the defense attorneys knew those documents existed and didn’t turn them over as part of the discovery process, then they have violated the legal profession’s canon of ethics, and violated the law, as well. In Pete’s book, that makes any attack fair game.
Pete’s Attack
Pete gets a couple of his people started on research and within days he knows what company Jenkins and Petry uses for storing their offsite backups. And he knows that the storage company maintains a list of the names of people whom the law firm has authorized to pick up tapes from storage. He also knows that each of these people has his or her own password. Pete sends two of his people out on a black bag job.
The men tackle the lock using a lock pick gun ordered on the Web at www.southord.com. Within several minutes they slip into the offices of the storage firm around 3 A.M. one night and boot up a PC. They smile when they see the Windows 98 logo because it means this will be a piece of cake. Windows 98 does not require any form of authentication. After a bit of searching, they locate a Microsoft Access database with the names of people authorized by each of the storage company customers to pick up tapes. They add a phony name to the authorization list for Jenkins and Petry, a name matching one on a phony driver’s license one of the men has already obtained. Could they have broken into the locked storage area and tried to locate the tapes their client wanted? Sure—but then all the company’s customers, including