The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [13]
A personal question is like a land mine—some people step right over it and never notice; for other people, it blows up and sends them scurrying for safety. So if I ask a personal question and she answers the question and the tone of her voice doesn’t change, that means she probably isn’t skepti cal about the nature of the request. I can safely ask the sought-after question without arousing her suspicions, and she’ll probably give me the answer I’m looking for.
One more thing a good PI knows: Never end the conversation after getting the key information. Another two or three questions, a little chat, and then it’s okay to say good-bye. Later, if the victim remembers anything about what you asked, it will probably be the last couple of questions. The rest will usually be forgotten.
So Chris gave me their Merchant ID number, and the phone number they call to make requests. I would have been happier if I had gotten to ask some questions about how much information you can get from CreditChex. But it was better not to push my luck.
It was like having a blank check on CreditChex. I could now call and get information whenever I wanted. I didn’t even have to pay for the service. As it turned out, the CreditChex rep was happy to share exactly the information I wanted: two places my client’s husband had recently applied to open an account. So where were the assets his soon-to-be ex-wife was looking for? Where else but at the banking institutions the guy at CreditChex listed?
Analyzing the Con
This entire ruse was based on one of the fundamental tactics of social engineering: gaining access to information that a company employee treats as innocuous, when it isn’t.
The first bank clerk confirmed the terminology to describe the identifying number used when calling CreditChex: the Merchant ID. The second provided the phone number for calling CreditChex, and the most vital piece of information, the bank’s Merchant ID number. All this information appeared to the clerk to be innocuous. After all, the bank clerk thought she was talking to someone from CreditChex—so what could be the harm in disclosing the number?
All of this laid the groundwork for the third call. Grace had everything he needed to phone CreditChex, pass himself off as a rep from one of their customer banks, National, and simply ask for the information he was after.
With as much skill at stealing information as a good swindler has at stealing your money, Grace had well-honed talents for reading people. He knew the common tactic of burying the key questions among innocent ones. He knew a personal question would test the second clerk’s willingness to cooperate, before innocently asking for the Merchant ID number.
The first clerk’s error in confirming the terminology for the CreditChex ID number would be almost impossible to protect against. The information is so widely known within the banking industry that it appears to be unimportant—the very model of the innocuous. But the second clerk, Chris, should not have been so willing to answer questions without positively verifying that the caller was really who he claimed to be. She should, at the very least, have taken his name and number and called back; that way, if any questions arose later, she may have kept a record of what phone number the person had used. In this case, making a call like that would have made it much more difficult for the attacker to masquerade as a representative from CreditChex.
mitnick message
A Merchant ID in this situation is analogous to a password. If bank personnel treated it like an ATM PIN, they might appreciate the sensitive nature of the information. Is there an internal code or number in your organization that people aren’t treating with enough care?
Better still would have been a call to CreditChex using a number the bank already had on record—not a number provided by the caller—to verify that the person really worked