• Choose a category
• All
• Classic-Fiction

Here’s just one more example of how easy it can be for a social engineer to get what he wants by following the simple principle of “just ask for it.”

GAS ATTACK

Not only company assets are at risk in a social engineering scenario. Sometimes it’s a company’s customers who are the victims.

Working as a customer-service clerk brings its share of frustrations, its share of laughs, and its share of innocent mistakes—some of which can have unhappy consequences for a company’s customers.

Janie Acton’s Story

Janie Acton had been manning a cubicle as a customer service rep for Hometown Electric Power, in Washington, D.C., for just over three years. She was considered to be one of the better clerks, smart and conscientious.

It was Thanksgiving week when this one particular call came in. The caller said, “This is Eduardo in the Billing Department. I’ve got a lady on hold, she’s a secretary in the executive offices that works for one of the vice presidents, and she’s asking for some information and I can’t use my computer. I got an email from this girl in Human Resources that said ‘ILOVEYOU,’ and when I opened the attachment, I couldn’t use my machine any more. A virus. I got caught by a stupid virus. Anyways, could you look up some customer information for me?”

“Sure,” Janie answered. “It crashed your computer? That’s terrible.”

“Yeah.”

“How can I help?” Janie asked.

Here the attacker called on information from his advance research to make himself sound authentic. He had learned that the information he wanted was stored in something called the Customer Billing Information System, and he had found out how employees referred to the system. He asked, “Can you bring up an account on CBIS?”

“Yes, what’s the account number?”

“I don’t have the number; I need you to bring it up by name.”

“Okay, what’s the name?”

“It’s Heather Marning.” He spelled the name, and Janie typed it in.

“Okay, I have it up.”

“Great. Is the account current?”

“Uh huh, it’s current.”

“What’s the account number?” he asked.

“Do you have a pencil?”

“Ready to write.”

“Account number BAZ6573NR27Q.”

He read the number back and then said, “And what’s the service address?”

She gave him the address.

“And what’s the phone?”

Janie obligingly read off that information, too.

The caller thanked her, said good-bye, and hung up. Janie went on to the next call, never thinking further about it.

Art Sealy’s Research Project

Art Sealy had given up working as a freelance editor for small publishing houses when he found he could make more money doing research for writers and businesses. He soon figured out that the fee he could charge went up in proportion to how close the assignment took him to the sometimes hazy line between the legal and the illegal. Without ever realizing it, certainly without ever giving it a name, Art became a social engineer, using techniques familiar to every information broker. He turned out to have a native talent for the business, figuring out for himself techniques that most social engineers had to learn from others. After a while, he crossed the line without the least twinge of guilt.

A man contacted me who was writing a book about the Cabinet in the Nixon years, and was looking for a researcher who could get the inside scoop on William E. Simon, who had been Nixon’s Treasury secretary. Mr. Simon had died, but the author had the name of a woman who had been on his staff. He was pretty sure she still lived in D.C., but hadn’t been able to get an address. She didn’t have a telephone in her name, or at least none that was listed. So that’s when he called me. I told him, sure, no problem.

This is the kind of job you can usually bring off in a phone call or two, if you know what you’re doing. Every local utility company can generally be counted on to give the information away. Of course, you have to BS a little. But what’s a little white lie now and then—right?

I like to use a different approach each time, just to keep things