The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [68]
chapter 9
The Reverse Sting
TheSting, mentioned elsewhere in this book (and in my opinion probably the best movie that’s ever been made about a con operation), lays out its tricky plot in fascinating detail. The sting operation in the movie is an exact depiction of how top grifters run “the wire,” one of the three types of major swindles referred to as “big cons.” If you want to know how a team of professionals pulls off a scam raking in a great deal of money in a single evening, there’s no better textbook.
But traditional cons, whatever their particular gimmick, run according to a pattern. Sometimes a ruse is worked in the opposite direction, which is called a reverse sting. This is an intriguing twist in which the attacker sets up the situation so that the victim calls on the attacker for help, or a coworker has made a request, which the attacker is responding to.
How does this work? You’re about to find out.
THE ART OF FRIENDLY PERSUASION
When the average person conjures up the picture of a computer hacker, what usually comes to mind is the uncomplimentary image of a lonely, introverted nerd whose best friend is his computer and who has difficulty carrying on a conversation, except by instant messaging. The social engineer, who often has hacker skills, also has people skills at the opposite end of the spectrum—well—developed abilities to use and manipulate people that allow him to talk his way into getting information in ways you would never have believed possible.
lingo
REVERSE STING A con in which the person being attacked asks the attacker for help.
Angela’s Caller
Place: Valley branch, Industrial Federal Bank.
Time: 11:27 A.M.
Angela Wisnowski answered a phone call from a man who said he was just about to receive a sizeable inheritance and he wanted information on the different types of savings accounts, certificates of deposit, and whatever other investments she might be able to suggest that would be safe, but earn decent interest. She explained there were quite a number of choices and asked if he’d like to come in and sit down with her to discuss them. He was leaving on a trip as soon as the money arrived, he said, and had a lot of arrangements to make. So she began suggesting some of the possibilities and giving him details of the interest rates, what happens if you sell a CD early, and so on, while trying to pin down his investment goals.
She seemed to be making progress when he said, “Oh, sorry, I’ve got to take this other call. What time can I finish this conversation with you so I can make some decisions? When do you leave for lunch?” She told him 12:30 and he said he’d try to call back before then or the following day.
Louis’s Caller
Major banks use internal security codes that change every day. When somebody from one branch needs information from another branch, he proves he’s entitled to the information by demonstrating he knows the day’s code. For an added degree of security and flexibility, some major banks issue multiple codes each day. At a West Coast outfit I’ll call Industrial Federal Bank, each employee finds a list of five codes for the day, identified as A through E, on his or her computer each morning.
Place: Same.
Time : 12:48 P.M., same day.
Louis Halpburn didn’t think anything of it when a call came in that afternoon, a call like others he handled regularly several times a week.
“Hello,” the caller said. “This is Neil Webster. I’m calling from branch 3182 in Boston. Angela Wisnowski, please.”
“She’s at lunch. Can I help?”
“Well, she left a message asking us to fax some information on one of our customers.”
The caller sounded like he had been having a bad day.
“The person who normally handles those requests is out sick,” he said. “I’ve got a stack of these to do, it’s almost 4 o‘clock here and I’m supposed to be out of this place to go to a doctor’s appointment in half an hour.”
The manipulation—giving all the reasons