The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [120]
Most people wouldn’t have the guts to do what I do. Try to cheat people over the telephone or over the Internet and nobody ever gets to see you. But any good con man, the old-fashioned, face-to-face kind (and there are plenty of them still around, more than you would think) can look you in the eye, tell you a whopper, and get you to believe it. I’ve known a prosecutor or two who think that’s criminal. I think it’s a talent.
But you can’t go walking in blind, you have to size things up first. A street con, you can take a man’s temperature with a little friendly conversation and couple of carefully worded suggestions. Get the right responses and Bingo!—you’ve bagged a pigeon.
A company job is more like what we call a big con. You’ve got setup to do. Find out what their buttons are, find out what they want. What they need. Plan an attack. Be patient, do your homework. Figure out the role you’re going to play and learn your lines. And don’t walk in the door until you’re ready.
I spent better than three weeks getting up to speed for this one. The client gave me a two-day session in what I should say “my” company did and how to describe why it was going to be such a good joint marketing alliance.
Then I got lucky. I called the company and said I was from a venture capital firm and we were interested in setting up a meeting and I was juggling schedules to find a time when all of our partners would be available sometime in the next couple of months, and was there any time slot I should avoid, any period when Larry wasn’t going to be in town? And she said, Yes, he hadn’t had any time off in the two years since they started the company but his wife was dragging him away on a golf vacation the first week in August.
That was only two weeks away. I could wait.
Meanwhile an industry magazine gave me the name of the firm’s PR company. I said I liked the amount of space they were getting for their robotics company client and I wanted to talk to whoever was handling that account about handling my company. It turned out to be an energetic young lady who liked the idea she might be able to bring in a new account. Over a pricey lunch with one more drink than she really wanted, she did her best to convince me they were oh, so good at understanding a client’s problems and finding the right PR solutions. I played hard to convince. I needed some details. With a little prodding, by the time the plates were being cleared she had told me more about the new product and the company’s problems than I could have hoped for.
The thing went like clockwork. The story about being so embarrassed that the meeting was next week but I might as well meet the team as long as I’m here, the receptionist swallowed whole. She even felt sorry for me into the bargain. The lunch set me back all of $150. With tip. And I had what I needed. Phone numbers, job titles, and one very key guy who believed I was who I said I was.
Brian had me fooled, I admit. He seemed like the kind of guy who’d just email me anything I asked for. But he sounded like he was holding back a little when I brought up the subject. It pays to expect the unexpected. That email account in Larry’s name, I had it in my back pocket just in case. The Yahoo security people are probably still sitting there waiting for somebody to use the account again so they can trace him. They’ll have a long wait. The fat lady has sung. I’m off on another project.
Analyzing the Con
Anyone who works a face-to-face con has to cloak himself in a look that will make him acceptable to the mark. He’ll put himself together one way to appear at the race track, another to appear at a local watering hole, still another for an upscale bar at a fancy hotel.
It’s the same way with industrial espionage. An attack may call for