The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [62]
By telling her she shouldn’t ever reveal her password, should not reveal it even to him, Peter did a thorough but subtle job of convincing her that he was concerned about the security of her company’s files. This boosted her confidence that he must be legitimate because he was protecting her and the company.
THE POLICE RAID
Picture this scene: The government has been trying to lay a trap for a man named Arturo Sanchez, who has been distributing movies free over the Internet. The Hollywood studios say he’s violating their copyrights, he says he’s just trying to nudge them to recognize an inevitable market so they’ll start doing something about making new movies available for download. He points out (correctly) that this could be a huge source of revenue for the studios that they seem to be completely ignoring.
Search Warrant, Please
Coming home late one night, he checks the windows of his apartment from across the street and notices the lights are off, even though he always leaves one on when he goes out.
He pounds and bangs on a neighbor’s door until he wakes the man up, and learns that there was indeed a police raid in the building. But they made the neighbors stay downstairs, and he still isn’t sure what apartment they went into. He only knows they left carrying some heavy things, only they were wrapped up and he couldn’t tell what they were. And they didn’t take anybody away in handcuffs.
Arturo checks his apartment. The bad news is that there’s a paper from the police requiring that he call immediately and set up an appointment for an interview within three days. The worse news is that his computers are missing.
Arturo vanishes into the night, going to stay with a friend. But the uncertainty gnaws at him. How much do the police know? Have they caught up with him at last, but left him a chance to flee? Or is this about something else entirely, something he can clear up without having to leave town?
Before you read on, stop and think for a moment: Can you imagine any way you could find out what the police know about you? Assuming you don’t have any political contacts or friends in the police department or the prosecutor’s office, do you imagine there’s any way that you, as an ordinary citizen, could get this information? Or that even someone with social engineering skills could?
Scamming the Police
Arturo satisfied his need to know like this: To start with, he got the phone number for a nearby copy store, called them, and asked for their fax number.
Then he called the district attorney’s office, and asked for Records. When he was connected with the records office, he introduced himself as an investigator with Lake County, and said he needed to speak with the clerk who files the active search warrants.
“I do,” the lady said. “Oh, great,” he answered. “Because we raided a suspect last night and I’m trying to locate the affidavit.”
“We file them by address,” she told him.
He gave his address, and she sounded almost excited. “Oh, yeah,” she bubbled, “I know about that one. ‘The Copyright Caper.’”
“That’s the one,” he said. “I’m looking for the affidavit and copy of the warrant.
“Oh, I have it right here.”
“Great,” he said. “Listen, I’m out in the field and I have a meeting with the Secret Service on this case in fifteen minutes. I’ve been so absent-minded lately, I left the file at home, and I’ll never make it there and back in time. Could I get copies from you?”
“Sure, no problem. I’ll make copies; you can come right over and pick them up.”
“Great,” he said. “That’s great. But listen, I’m on the other side of town. Is it possible you could fax them to me?”
That created a small problem, but not insurmountable. “We don’t have a fax up here in Records,” she