The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [79]
Following the phone call, one of the security people should have stayed with the pair until they left the building. And then walked them to their car and written down the license-plate number. If he had been observant enough, he would have noted that the plate (the one that the attacker had purchased at a flea market) did not have a valid registration sticker—and that should have been reason enough to detain the pair for further investigation.
mitnick message
Manipulative people usually have very attractive personalities. They are typically fast on their feet and quite articulate. Social engineers are also skilled at distracting people’s thought processes so that they cooperate. To think that any one particular person is not vulnerable to this manipulation is to underestimate the skill and the killer instinct of the social engineer.
A good social engineer, on the other hand, never underestimates his adversary.
DUMPSTER DIVING
Dumpster diving is a term that describes pawing through a target’s garbage in search of valuable information. The amount of information you can learn about a target is astounding.
Most people don’t give much thought to what they’re discarding at home: phone bills, credit card statements, medical prescription bottles, bank statements, work-related materials, and so much more.
At work, employees must be made aware that people do look through trash to obtain information that may benefit them.
During my high school years, I used to go digging through the trash behind the local phone company buildings—often alone but occasionally with friends who shared an interest in learning more about the telephone company. Once you became a seasoned Dumpster diver, you learn a few tricks, such as how to make special efforts to avoid the bags from the restrooms, and the necessity of wearing gloves.
Dumpster diving isn’t enjoyable, but the payoff was extraordinary—internal company telephone directories, computer manuals, employee lists, discarded printouts showing how to program switching equipment, and more—all there for the taking.
I’d schedule visits for nights when new manuals were being issued, because the trash containers would have plenty of old ones, thoughtlessly thrown away. And I’d go at other odd times as well, looking for any memos, letters, reports, and so forth, that might offer some interesting gems of information.
On arriving I’d find some cardboard boxes, pull them out and set them aside. If anyone challenged me, which happened now and then, I’d say that a friend was moving and I was just looking for boxes to help him pack. The guard never noticed all the documents I had put in the boxes to take home. In some cases, he’d tell me to get lost, so I’d just move to another phone company central office.
lingo
DUMPSTER DIVING Going through a company’s garbage (often in an outside and vulnerable Dumpster) to find discarded information that either itself has value, or provides a tool to use in a social engineering attack, such as internal phone numbers or titles.
I don’t know what it’s like today, but back then it was easy to tell which bags might contain something of interest. The floor sweepings and cafeteria garbage were loose in the large bags, while the office wastebaskets were all lined with white disposable trash bags, which the cleaning crew would lift out one by one and wrap a tie around.
One time, while searching with some friends, we came up with some sheets of paper torn up by hand. And not just torn up: someone had gone to the trouble of ripping the sheets