The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [77]
I have this friend Kenny who thinks he wants to be a helicopter pilot. He asked me, could I get him into the Skywatcher factory to see the production line where they make the choppers. He knows I’ve got into other places before. It’s an adrenaline rush to see if you can slip into places you’re not supposed to be.
But you don’t just walk into a factory or office building. Got to think it through, do a lot of planning, and do a full reconnaissance on the target. Check the company’s Web page for names and titles, reporting structure, and telephone numbers. Read press clippings and magazine articles. Meticulous research is my own brand of caution, so I could talk to anybody that challenged me, with as much knowledge as any employee.
So where to start? First I looked up on the Internet to see where the company had offices, and saw the corporate headquarters was in Phoenix. Perfect. I called and asked for Marketing; every company has a marketing department. A lady answered, and I said I was with Blue Pencil Graphics and we wanted to see if we could interest them in using our services and who would I talk to. She said that would be Tom Stilton. I asked for his phone number and she said they didn’t give out that information but she could put me through. The call rang into voice mail, and his message said, “This is Tom Stilton in Graphics, extension 3147, please leave a message.” Sure—they don’t give out extensions, but this guy leaves his right on his voice mail. So that was cool. Now I had a name and extension.
Another call, back to the same office. “Hi, I was looking for Tom Stilton. He’s not in. I’d like to ask his boss a quick question.” The boss was out, too, but by the time I was finished, I knew the boss’s name. And she had nicely left her extension number on her voice mail, too.
I could probably get us past the lobby guard with no sweat, but I’ve driven by that plant and I thought I remembered a fence around the parking lot. A fence means a guard who checks you when you try to drive in. And at night, they might be writing down license numbers, too, so I’d have to buy an old license plate at a flea market.
But first I’d have to get the phone number in the guard shack. I waited a little so if I got the same operator when I dialed back in, she wouldn’t recognize my voice. After a bit I called and said, “We’ve got a complaint that the phone at the Ridge Road guard shack has reported intermittent problems—are they still having trouble?” She said she didn’t know but would connect me.
The guy answered, “Ridge Road gate, this is Ryan.” I said, “Hi, Ryan, this is Ben. Were you having problems with your phones there?” He’s just a low-paid security guard but I guess he had some training because he right away said, “Ben who—what’s your last name?” I just kept right on as if I hadn’t even heard him. “Somebody reported a problem earlier.”
I could hear him holding the phone away and calling out, “Hey, Bruce, Roger, was there a problem with this phone?” He came back on and said, “No, no problems we know about.”
“How many phone lines do you have there?”
He had forgotten about my name. “Two,” he said.
“Which one are you on now?”
“3140.”
Gotcha! “And they’re both working okay?”
“Seems like.”
“Okay,” I said. “Listen, Ryan, if you have any phone problems, just call us in Telecom any time. We’re here to help.”
My buddy and I decided to visit the plant the very next night. Late that afternoon I called the guard booth, using the name of the Marketing guy. I said, “Hi, this is Tom Stilton in Graphics. We’re on a crash deadline and I have a couple of guys driving into town to help out. Probably won’t be here till one or two in the morning. Will you still be on then?”
He was happy to say that, no, he got off at midnight.
I said, “Well, just leave a note for the next guy, okay? When two guys show up and say they’ve come to see Tom Stilton, just wave ‘em on in—okay?