The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [72]
Short of lifting the person’s wallet or peering over her shoulder at an opportune moment, finding out the driver’s license number ought to be next to impossible. But for anyone with even modest social engineering skills, it’s hardly a challenge.
One particular social engineer—Eric Mantini, I’ll call him, needed to get driver’s license and vehicle registration numbers on a regular basis. Eric figured it was unnecessarily increasing his risk to call the Department of Motor Vehicles (DMV) and go through the same ruse time after time whenever he needed that information. He wondered whether there wasn’t some way to simplify the process.
Probably no one had ever thought of it before, but he figured out a way to get the information in a blink, whenever he wanted it. He did it by taking advantage of a service provided by his state’s Department of Motor Vehicles. Many state DMVs (or whatever the department may be called in your state) make otherwise-privileged information about citizens available to insurance firms, private investigators, and certain other groups that the state legislature has deemed entitled to share it for the good of commerce and the society at large.
The DMV, of course, has appropriate limitations on which types of data will be given out. The insurance industry can get certain types of information from the files, but not others. A different set of limitations applies to Pls, and so on.
For law enforcement officers, a different rule generally applies: The DMV will supply any information in the records to any sworn peace officer who properly identifies himself. In the state Eric then lived in, the required identification was a Requestor Code issued by the DMV, along with the officer’s driver’s license number. The DMV employee would always verify by matching the officer’s name against his driver’s license number and one other piece of information—usually date of birth—before giving out any information.
What social engineer Eric wanted to do was nothing less than cloak himself in the identity of a law enforcement officer.
How did he manage that? By running a reverse sting on the cops!
Eric’s Sting
First he called telephone information and asked for the phone number of DMV headquarters in the state capitol. He was given the number 503- 555-5000; that, of course, is the number for calls from the general public. He then called a nearby sheriff’s station and asked for Teletype—the office where communications are sent to and received from other law enforcement agencies, the national crime database, local warrants, and so forth. When he reached Teletype, he said he was looking for the phone number for law enforcement to use when calling the DMV state headquarters.
“Who are you?” the police officer in Teletype asked.
“This is Al. I was calling 503-555-5753,” he said. This was partly an assumption, and partly a number he pulled out of thin air; certainly the special DMV office set up to take law enforcement calls would be in the same area code as the number given out for the public to call, and it was almost as certain that the next three digits, the prefix, would be the same, as well. All he really needed to find out was the last four.
A sheriff’s Teletype room doesn’t get calls from the public. And the caller already had most of the number. Obviously he was legitimate.
“It’s 503-555-6127,” the officer said.
So Eric now had the special phone number for law enforcement officers to call the DMV. But just the one number wasn’t enough to satisfy him; the office would have a good many more than the single phone line, and Eric needed to know how many lines there were, and the phone number of each.
The Switch
To carry out his plan, he needed to gain access to the telephone switch that handled the law enforcement phone lines into DMV. He called the state Telecommunications Department and claimed he was