• Choose a category
• All
• Classic-Fiction

By Root 1246 0

there, and that the company was really doing a customer survey. Given the practicalities of the real world and the time pressures that most people work under today, though, this kind of verification phone call is a lot to expect, except when an employee is suspicious that some kind of attack is being made.

THE ENGINEER TRAP

It is widely known that head-hunter firms use social engineering tactics to recruit corporate talent. Here’s an example of how it can happen.

In the late 1990s, a not very ethical employment agency signed a new client, a company looking for electrical engineers with experience in the telephone industry. The honcho on the project was a lady endowed with a throaty voice and sexy manner that she had learned to use to develop initial trust and rapport over the phone.

The lady decided to stage a raid on a cellular phone service provider, to see if she could locate some engineers who might be tempted to take a walk across the street to a competitor. She couldn’t exactly call the switchboard and say, “Let me talk to anybody with five years of engineering experience.” Instead, for reasons that will become clear in a moment, she began the talent assault by seeking a piece of information that appeared to have no sensitivity at all, information that company people give out to almost anybody who asks.

The First Call: The Receptionist

The attacker, using the name Didi Sands, placed a call to the corporate offices of the cellular phone service. In part, the conversation went like this:

Receptionist: Good afternoon. This is Marie, how may I help you?

Didi: Can you connect me to the Transportation Department?

R: I’m not sure if we have one, I’ll look in my directory. Who’s calling?

D: It’s Didi.

R: Are you in the building, or ... ?

D: No, I’m outside the building.

R: Didi who?

D: Didi Sands. I had the extension for Transportation, but I forgot what it was.

R: One moment.

To allay suspicions, at this point Didi asked a casual, just-making-conversation question designed to establish that she was on the “inside,” familiar with company locations.

D: What building are you in—Lakeview or Main Place?

R: Main Place. (pause) It’s 805 555 6469.

To provide herself with a backup in case the call to Transportation didn’t provide what she was looking for, Didi said she also wanted to talk to Real Estate. The receptionist gave her that number, as well. When Didi asked to be connected to the Transportation number, the receptionist tried, but the line was busy.

At that point Didi asked for a third phone number, for Accounts Receivable, located at a corporate facility in Austin, Texas. The receptionist asked her to wait a moment, and went off the line. Reporting to Security that she had a suspicious phone call and thought there was something fishy going on? Not at all, and Didi didn’t have the least bit of concern. She was being a bit of a nuisance, but to the receptionist it was all part of a typical workday. After about a minute, the receptionist came back on the line, looked up the Accounts Receivable number, tried it, and put Didi through.

The Second Call: Peggy

The next conversation went like this:

Peggy: Accounts Receivable, Peggy.

Didi: Hi, Peggy. This is Didi, in Thousand Oaks.

P: Hi, Didi.

D: How ya doing?

P: Fine.

Didi then used a familiar term in the corporate world that describes the charge code for assigning expenses against the budget of a specific organization or workgroup:

D: Excellent. I have a question for you. How do I find out the cost center for a particular department?

P: You’d have to get ahold of the budget analyst for the department.

D: Do you know who’d be the budget analyst for Thousand Oaks—headquarters? I’m trying to fill out a form and I don’t know the proper cost center.

P: I just know when y‘all need a cost center number, you call your budget analyst.

D: Do you have a cost center for your department there in Texas?

P: We have our own cost center but they don’t give us a complete list of