The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [81]
mitnick message
Your trash may be your enemy’s treasure. We don’t give much consideration to the materials we discard in our personal lives, so why should we believe people have a different attitude in the workplace? It all comes down to educating the workforce about the danger (unscrupulous people digging for valuable information) and the vulnerability (sensitive information not being shredded or properly erased).
THE HUMILIATED BOSS
Nobody thought anything about it when Harlan Fortis came to work on Monday morning as usual at the County Highway Department, and said he’d left home in a hurry and forgotten his badge. The security guard had seen Harlan coming in and going out every weekday for the two years she had been working there. She had him sign for a temporary employee’s badge, gave it to him, and he went on his way.
It wasn’t until two days later that all hell started breaking loose. The story spread through the entire department like wildfire. Half the people who heard it said it couldn’t be true. Of the rest, nobody seemed to know whether to laugh out loud or to feel sorry for the poor soul.
After all, George Adamson was a kind and compassionate person, the best head of department they’d ever had. He didn’t deserve to have this happen to him. Assuming that the story was true, of course.
The trouble had begun when George called Harlan into his office late one Friday and told him, as gently as he could, that come Monday Harlan would be reporting to a new job. With the Sanitation Department. To Harlan, this wasn’t like being fired. It was worse; it was humiliating. He wasn’t going to take it lying down.
That same evening he seated himself on his porch to watch the homeward-bound traffic. At last he spotted the neighborhood boy named David who everyone called “The War Games Kid” going by on his moped on the way home from high school. He stopped David, gave him a Code Red Mountain Dew he had bought especially for the purpose, and offered him a deal: the latest video game player and six games in exchange for some computer help and a promise of keeping his mouth shut.
After Harlan explained the project—without giving any of the compromising specifics—David agreed. He described what he wanted Harlan to do. He was to buy a modem, go into the office, find somebody’s computer where there was a spare phone jack nearby, and plug in the modem. Leave the modem under the desk where nobody would be likely to see it. Then came the risky part. Harlan had to sit down at the computer, install a remote-access software package, and get it running. Any moment the man who worked in the office might show up, or someone might walk by and see him in another person’s office. He was so uptight that he could hardly read the instructions that the kid had written down for him. But he got it done, and slipped out of the building without being noticed.
Planting the Bomb
David stopped over after dinner that night. The two sat down at Harlan’s computer and within in a few minutes the boy had dialed into the modem, gained access, and reached George Adamson’s machine. Not very difficult, since George never had time for precautionary things like changing passwords, and was forever asking this person or that to download or email a file for him. In time, everyone in the office knew his password.
A bit of hunting turned up the file called BudgetSlides2002.ppt, which the boy downloaded onto Harlan’s computer. Harlan then told the kid to go on home, and come back in a couple of hours.
When David returned, Harlan asked him to reconnect to the Highway Department computer system and put the same file back where they had found it, overwriting the earlier version. Harlan showed David the video game player, and promised that if things went well, he’d have it the next day.
Surprising George
You wouldn’t think that something sounding as dull as budget hearings would be of much interest to anyone, but the meeting chamber of the County Council was packed, filled with reporters, representatives