The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [90]
Piece a’ cake, he thought.
Calling Ma Bell ...
Johnny began by calling the phone company business office under the pretext of being from the General Services Administration, the agency responsible for purchasing goods and services for the federal government. He said he was working on an acquisition order for additional services and needed to know the billing information for any direct connect services currently in use, including the working telephone numbers and monthly cost at the San Diego detention center. The lady was happy to help.
Just to make sure, he tried dialing into one of those lines and was answered by the typical audichron recording, “This line has been disconnected or is no longer in service”—which he knew meant nothing of the kind but instead meant that the line was programmed to block incoming calls, just as he expected.
He knew from his extensive knowledge of phone company operations and procedures that he’d need to reach a department called the Recent Change Memory Authorization Center or RCMAC (I will always wonder who makes up these names!). He began by calling the phone company Business Office, said he was in Repair and needed to know the number for the RCMAC that handled the service area for the area code and prefix he gave, which was served out of the same central office for all the telephone lines in the detention center. It was a routine request, the kind provided for technicians out in the field in need of some assistance, and the clerk had no hesitation in giving him the number.
He called RCMAC, gave a phony name and again said he was in Repair. He had the lady who answered access one of the telephone numbers he had conned out of the business office a few calls earlier; when she had it up, Johnny asked, “Is the number set to deny termination?”
“Yes,” she said.
“Well, that explains why the customer isn’t able to receive calls!” Johnny said. “Listen, can you do me a favor. I need you to change the line class code or remove the deny terminate feature, okay?” There was a pause as she checked another computer system to verify that a service order had been placed to authorize the change. She said, “That number is supposed to be restricted for outgoing calls only. There’s no service order for a change.”
“Right, it’s a mistake. We were supposed to process the order yesterday but the regular account rep that handles this customer went home sick and forgot to have someone else take care of the order for her. So now of course the customer is up in arms about it.”
After a momentary pause while the lady pondered this request, which would be out of the ordinary and against standard operating procedures, she said, “Okay.” He could hear her typing, entering the change. And a few seconds later, it was done.
The ice had been broken, a kind of collusion established between them. Reading the woman’s attitude and willingness to help, Johnny didn’t hesitate to go for it all. He said, “Do you have a few minutes more to help me?”
“Yeah,” she answered. “What do you need?”
“I’ve got a several other lines that belong to the same customer, and all have the same problem. I’ll read off the numbers, so you can make sure that they’re not set for deny terminate—okay?” She said that was fine.
A few minutes later, all ten phone lines had been “fixed” to accept incoming calls.
Finding Gondorff
Next, find out what housing unit Gondorff was on. This is information that the people who run detention centers and prisons definitely don’t want outsiders to know. Once again Johnny had to rely on his social engineering skills.
He placed a call to a federal prison in another city—he called Miami, but any one would have worked—and claimed he was calling from the detention center in New York. He asked to talk to somebody who worked with the Bureau’s Sentry computer, the computer system that contains information on every prisoner being held in a Bureau of Prisons facility anywhere in the country.
When that person came on the phone, Johnny put on his