Online Book Reader

Home Category

The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [54]

By Root 1184 0
or pass?

In much the same way, a social engineer can talk his way into places that you would not have thought possible—as the following story about the movie industry makes clear.

The Phone Call

“Ron Hillyard’s office, this is Dorothy.”

“Dorothy, hi. My name is Kyle Bellamy. I’ve just come on board to work in Animation Development on Brian Glassman’s staff. You folks sure do things different over here.”

“I guess. I never worked on any other movie lot so I don’t really know. What can I do for you?”

“To tell you the truth, I’m feeling sort of stupid. I’ve got a writer coming over this afternoon for a pitch session and I don’t know who I’m supposed to talk to about getting him onto the lot. The people over here in Brian’s office are really nice but I hate to keep bothering them, how do I do this, how do I do that. It’s like I just started junior high and can’t find my way to the bathroom. You know what I mean?”

Dorothy laughed.

“You want to talk to Security. Dial 7, and then 61 38. If you get Lauren, tell her Dorothy said she should take good care of you.”

“Thanks, Dorothy. And if I can’t find the men’s room, I may call you back!”

They chuckled together over the idea, and hung up.

David Harold’s Story

I love the movies and when I moved to Los Angeles, I thought I’d get to meet all kinds of people in the movie business and they’d take me along to parties and have me over to lunch at the studios. Well, I was there for a year, I was turning twenty-six years old, and the closest I got was going on the Universal Studios tour with all the nice people from Phoenix and Cleveland. So finally it got to the point where I figured, if they won’t invite me in, I’ll invite myself. Which is what I did.

I bought a copy of the Los Angeles Times and read the entertainment column for a couple of days, and wrote down the names of some producers at different studios. I decided I’d try hitting on one of the big studios first.

So I called the switchboard and asked for the office of this producer I had read about in the paper. The secretary that answered sounded like the motherly type, so I figured I had gotten lucky; if it was some young girl who was just there hoping she’d be discovered, she probably wouldn’t have given me the time of day.

But this Dorothy, she sounded like somebody that would take in a stray kitten, somebody who’d feel sorry for the new kid that was feeling a little overwhelmed on the new job. And I sure got just the right touch with her. It’s not every day you try to trick somebody and they give you even more than you asked for. Out of pity, she not only gave me the name of one of the people in Security, but said I should tell the lady that Dorothy wanted her to help me.

Of course I had planned to use Dorothy’s name anyway. This made it even better. Lauren opened right up and never even bothered to look up the name I gave to see if it was really in the employee database.

When I drove up to the gate that afternoon, they not only had my name on the visitor’s list, they even had a parking space for me. I had a late lunch at the commissary, and wandered the lot until the end of the day. I even sneaked into a couple of sound stages and watched them shooting movies. Didn’t leave till 7 o‘clock. It was one of my most exciting days ever.

Analyzing the Con

Everybody was a new employee once. We all have memories of what that first day was like, especially when we were young and inexperienced. So when a new employee asks for help, he can expect that many people—especially entry-level people—will remember their own new-kid-on-the-block feelings and go out of their way to lend a hand. The social engineer knows this, and he understands that he can use it to play on the sympathies of his victims.

We make it too easy for outsiders to con their way into our company plants and offices. Even with guards at entrances and sign-in procedures for anyone who isn’t an employee, any one of several variations on the ruse used in this story will allow an intruder to obtain a visitor’s badge and walk

Return Main Page Previous Page Next Page

®Online Book Reader