The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [63]
He said, “Let me call the Clerk’s office and set it up.”
The lady in the Clerk’s office said she’d be glad to take care of it but wanted to know “Who’s going to pay for it?” She needed an accounting code.
“I’ll get the code and call you back,” he told her.
He then called the DA’s office, again identified himself as a police officer and simply asked the receptionist, “What’s the accounting code for the DA’s office?” Without hesitation, she told him.
Calling back to the Clerk’s office to provide the accounting number gave him the excuse for manipulating the lady a little further: He talked her into walking upstairs to get the copies of the papers to be faxed.
Covering His Tracks
Arturo still had another couple of steps to take. There was always a possibility that someone would smell something fishy, and he might arrive at the copy store to find a couple of detectives, casually dressed and trying to look busy until somebody showed up asking for that particular fax. He waited a while, and then called the Clerk’s office back to verify that the lady had sent the fax. Fine so far.
note
How does a social engineer know the details of so many operations—police departments, prosecutor’s offices, phone company practices, the organization of specific companies that are in fields useful in his attacks, such as telecommunications and computers? Because it’s his business to find out. This knowledge is a social engineer’s stock in trade because information can aid him in his efforts to deceive.
He called another copy store in the same chain across town and used the ruse about how he was “pleased with your handling of a job and want to write the manager a letter of congratulations, what’s her name?” With that essential piece of information, he called the first copy store again and said he wanted to talk to the manager. When the man picked up the phone, Arturo said, “Hi, this is Edward at store 628 in Hartfield. My manager, Anna, told me to call you. We’ve got a customer who’s all upset—somebody gave him the fax number of the wrong store. He’s here waiting for an important fax, only the number he was given is for your store.” The manager promised to have one of his people locate the fax and send it on to the Hartfield store immediately.
Arturo was already waiting at the second store when the fax arrived there. Once he had it in hand, he called back to the Clerk’s office to tell the lady thanks, and “It’s not necessary to bring those copies back upstairs, you can just throw them away now.” Then he called the manager at the first store and told him, too, to throw away their copy of the fax. This way there wouldn’t be any record of what had taken place, just in case somebody later came around asking questions. Social engineers know you can never be too careful.
Arranged this way, Arturo didn’t even have to pay charges at the first copy store for receiving the fax and for sending it out again to the second store. And if it turned out that the police did show up at the first store, Arturo would already have his fax and be long gone by the time they Could arrange to get people to the second location.
The end of the story: The affidavit and warrant showed that the police had well-documented evidence of Arturo’s movie-copying activities. That was what he needed to know. By midnight, he had crossed the state line. Arturo was on the way to a new life, somewhere else with a new identity, ready to get started again on his campaign.
Analyzing the Con
The people who work in any district attorney’s office, anywhere, are in constant contact with law enforcement officers—answering questions, making arrangements, taking messages. Anybody gutsy enough to call and claim to be a police officer, sheriff’s deputy, or whatever will likely be taken at his word. Unless it’s obvious that he doesn’t know the terminology, or if he’s nervous and stumbles over his words, or in some other way doesn’t sound authentic, he may not even be asked a single question