Social Engineering in the Workplace 316
An anonymous reader writes "Could a total stranger walk out of your business with thousands of dollars in merchandise without your knowing? Even worse, could they manipulate you into helping them each step along the way?"
If so, me too (Score:3, Funny)
Re:If so, me too (Score:2, Insightful)
Then again, just imagine if that story got around to the managers of all your favourite shops...would they tighten security so that nothing like that happened to them? On second thoughts...
As Isreal pointed out: No manager likes to do manual labor.
Shoplifting is Easy (Score:3, Interesting)
Walked through the door - Alarms went off - but just for the hell of it I kept walking like I didn't notice (Yes, I DID pay for everything). Just one of those things where you want to see what happens.
Both sets of automatic doors still opened for me, I think I heard one clerk yell out "Sir! Sir!", and that's it.
Calmly walked through the parking lot, nobody followed me.
Eve
Re:Shoplifting is Easy (Score:4, Interesting)
They also have no right to search your bags as you leave, ala Fry's. Just keep walking, they won't stop you.
Stupid (Score:5, Funny)
Why merchandise?
Just take the cash and scram! O.o
Re:Stupid (Score:5, Informative)
Also, while moving merchandise round is done everywhere in broadly the same way, the cash routines are normally more tightly fixed and less easy to predict. Also, the money has to be counted nice and carefully as the cashiers need to check they haven't screwed up during the day.
Yes it is (Score:5, Funny)
~S
Re:Yes it is (Score:2, Insightful)
;)
Re:Yes it is (Score:4, Insightful)
The fact that someone once did it proves that it CAN be done, and lends evidence that someone else can probably do it.
There's a whole lot of space between only one person being able to do something, and everybody being able to do it.
Pages /. defended. (Score:5, Interesting)
There's forethought, with some free advertising thrown in.
Second Slashdotting--Drupal (Score:4, Informative)
Re:Second Slashdotting--Drupal (Score:5, Interesting)
Re:Second Slashdotting--Drupal (Score:3, Interesting)
From the site. Smart in some ways, dumbass in others. Who the hell puts their database ON their webserver? Yeah, it may be a bit faster in some ways, but insecure and non-scalable in most others.
Re:Second Slashdotting--Drupal (Score:4, Insightful)
The funniest part of his HOWTO (Score:5, Interesting)
Help someone carry shit out of the office? (Score:5, Funny)
Human Limits of Security (Score:5, Insightful)
The reality is that most medium sized companies can be vulnerable to social engineering. In most cases the weak point in any security system is going to be on the human level. When you work with people you have to have some element of trust to make things more efficient.
You might need a security badge to get by a security desk, and a key card to get onto the floor. But people sometimes loose their badges and keycards and will be let by just this once.
If you can get into the cafateria without any security stuff you can just go to lunch there for a couple weeks, get to know people's name who work in the IS departments, and maybe even come across a dropped security badge. You can then fordge your own to get to the elevators, and then wait for someone else to open the door to get by needing a keycard. (Assuming the badge you came across didn't also have the person's keycard.)
Then getting information out might be easy. And at the company I used to work for you could probably steal hadware just by putting it on a cart. We had multiple buildings so it was common for people to be carting PCs from building to building. How many security guards would recognize the difference between a PC and a server?
Unless you have security guards that require written permission for every single hardware move your hardware is not going to be 100% safe. And unless you have a zero tollerance policy on holding the door open for someone, your information is not safe. How many companies are willing to do this?
Re:Human Limits of Security (Score:5, Interesting)
Re:Human Limits of Security (Score:5, Funny)
A lot of people are blind to anything that does not look out of place in their limited world. And a lot of others are sheep to any authority that comes along, anyone with confidence and some acting skills.
Re:Human Limits of Security (Score:5, Funny)
Re:Human Limits of Security (Score:4, Interesting)
When I was in the army as an intelligence analyst at an air force base, we had to go through a fancy turnstile every morning where an air force guard would take our badge, look at it, look at our face, look back at the badge, then give it back and let us through. One day my roommate and I were walking down the hall inside the secure building when a master sergeant stopped us, pointing out that our badges were switched. We'd long suspected that the guards at the gate just went through the motions of checking faces, but this proved they weren't looking AT ALL, because I am white and my roommate was black! We brought this to the attention of the major in charge of security. THe guards were a lot more diligent thereafter.
Re:Human Limits of Security (Score:5, Funny)
As a student, the worst stunt I pulled was when I noticed the SPs would come into the chowhall for lunch and just leave their M-16s at a table with their headgear & other junk. The USMC is very particular about always leaving a "complete safe weapon", so I strolled over, popped out the magazines, checked the chambers, and verified the selector was set to "Safe." The two "security specialists" didn't even notice!. The next day they came in and left the rifles again - so I made them safe again. To make the point more obvious, I removed the firing pins and left them sitting on top of the SP's jaunty black berets in the middle of their table. The look on their faces was priceless.
Our commander was forced to order us to "stop helping the SPs", though he did so with a smile on his face. They stopped leaving the rifles out, at least while I was there.
When I later returned to the same base to be an instructor they had a much smarter officer in charge of the guard force. Some of my students were telling me they had been drawing moustaches and/or sticking pictures on the front of their badges and getting in without being challenged, but before I could test this myself I was invited to assist the SP colonel in a little experiment: He asked me to check in (& out if possible) using a fake badge he had made up. It was a quality job, using the regular forms and professional lamination - but it said I was Vladimir Lenin (with his picture) and a member of the KGB!
Sadly, I got right through - one of the guards touched the badge to verify I had one, but none of them looked at it. The colonel was so disgusted those guards were immediately pulled and sent back to their original training base. I wanted to keep the badge, but the colonel said he might need it again, if his guys got sloppy again ...
I expected to get some flack from the other guards, but they all felt that "anybody that careless was no loss".
Re:Human Limits of Security (Score:5, Funny)
Re:Human Limits of Security (Score:5, Informative)
It's been said that with a hard hat and a clipboard you can get into nearly any building. This is just another example of that taken a step further.
Funny but true. (Score:2, Informative)
Re:Funny but true. (Score:5, Funny)
Re:Human Limits of Security (Score:5, Interesting)
That's just what they had in the military place I used to work. I notice that most larger offices and places with sensitive information are starting to use turnstyles and keycards, which amounts to the same thing. No badge = no entry. Forget your badge? You can get a 1-day pass at the security desk, but they will check your face against a photo on file, and require ID. Having reasonably good yet uncumbersome security is not that hard to implement for low-level security (i.e. against thieves). Problem is: many companies only pay passing attention to security (physical as well as electronic), and think one rent-a-cop at the door is sufficient. Also becoming more commonplace... These days, the most popular target for thieves is laptops. Easy to carry, valuable, and it's the one piece of equipment the guards will expect people to carry out.
large companies too (Score:2, Interesting)
One assignment was cleaning up a Christmas party at a big pharmaceutical company. While the guards were carding employees, they let me drive unasked onto the factory grounds in my unmarked van. I drove to the building, wandered around until I found my department, carted it into the freight elevator and loaded the van. This stuff was in boxes used for antidepressants. I walked through the wa
Re:Human Limits of Security (Score:3, Funny)
Is it wrong for me to want to teach my company why a zero-tolerance policy is a good idea by stealing laptops until it's implemented?
Re:Human Limits of Security (Score:2, Informative)
The federal government / armed forces aren't immune to this. I used to work at a building next to a Military Entrance Procesisng Center. (This was post 9-11). One of my buddies was a recruiting officer there. They have a strict policy that everyone gets 'stickered' if they don't have a government ID -- they basically plaster a barcode on you. (Inventory tag -- Recruit, Wet Behind Ears, 1)
One time when I was visiting, I had my employee badge on -- which was the same approximate size as the government/milit
Re:Human Limits of Security (Score:2)
And there is always the problem of tailgating. I've gone this myself. Our restaurant was in a separate building from the other offices. Access required swiping the keycard. But since there were so many people going in and out the door was more or less open all the time. In the end, security decided it was simpler to keep th
Re:Human Limits of Security (Score:4, Interesting)
I got into two power stations with no ID - in both cases because I was wearing overalls with a badge bearing the name of the former owner of the power plants (sold in one case, renamed in the other - but the same company in both cases). In both cases I was not working for the company owning the plant, but as a contractor. In one case I got the ID after going into the plant, in the other case I never got the ID since it was a one off visit.
Both times there was a security guy that I had never met before on the gate. I just walked in as if I belonged there, and it's just as well for everyone that I did have a legitimate reason to be there (and needed to go inside to get the ID to go inside).
The most dramatic theft I heard of at a workplace I was at was a diesel backup generator the size of a shipping container. It was located fifteen metres off the ground. The theives had to move a crane, get the generator, load it on a truck and drive out on the only road past the security gaurd on the gate and down the narrow neck of a peninsula.
Customs at Sydney Airport, Australia had a couple of guys turn up and remove most of the servers over the course of many hours one night. That one still hasn't been solved, despite the intelligence community and two police forces getting put on the job - since it was after 9/11.
Re:Human Limits of Security (Score:5, Funny)
This was a paper mill, of the type that took trees and made them into paper.
These mills typically have several large boilers to make heat and steam to do stuff, and there is a lot of paper scrap that gets created during cutting. The scrap is put in the boilers to burn it... getting rid of the scrap helping on saving of the other fuel (coal I think). So there's always guys moving the stuff around and everybody has a chance to see with this scrap looks like.
So the guards catch a guy with a wheelbarrow full of this type of paper scrap attempting to leave with it. No printing on it, just big sheets or partial rolls of paper. They poke through it and let the guy go. (I don't know if he used to work there or worked there or what, but in any case there was no badge involved. It was the 70's so maybe they didnt have them yet.)
The guy goes by the same few guards twice a week for weeks, each time getting his cargo inspected for contraband. No problems, sure you can have the paper scrap.
At the end of the year, 102 missing wheelbarrows.
Theft is not always what it seems to be at the time.
"social engineering" is the easy way. (Score:5, Interesting)
How hard can it be to get usernames/passwords this way? And since we are in linux-land here: I would bet that more than half of the sysads here would open up their systems to the first pretty girl that would walk along their cubicle. Obviously she cannot be too pretty as that would be VERY suspicious.
There are plenty of stories going around about people just walking into a server room, and taking a few servers [securitynewsportal.com] home with them. We even had one of those on slashdot here a few months ago
But the world is probably safe: Somehow good social skills and good technical skills are mutually exclusive...
Penetration Testing Using Social Engineering .. (Score:3, Funny)
Re:"social engineering" is the easy way. (Score:3, Informative)
I read about early hackers in "Approaching Zero" (by Brian clough & Paul Mungo) It's been common practice amongst hackers since the 80's or before. I hope that since then companies have learned to train their staff to check people are who they say they are. However, lots of money has been lost by people being tricked by email into going to fake bank websites and entering their personal details. It's more or less the same thing.
Re:"social engineering" is the easy way. (Score:3, Interesting)
Definitely -- on top, less of a risk and cheaper.
Somehow good social skills and good technical skills are mutually exclusive...
Disagreed - a colleage is a therapist as well as a SAS-programmer currently evaluating mainframe performance (of installed systems) for an insurance company.
CC.
Re:"social engineering" is the easy way. (Score:3, Insightful)
Re:"social engineering" is the easy way. (Score:3, Interesting)
social engineering is useful at work. (Score:5, Interesting)
Re:social engineering is useful at work. (Score:2, Informative)
That would be The Art of Deception [amazon.com] (not an affiliate link).
Stupid Catch Phrases (Score:5, Insightful)
It's more than lingo. (Score:5, Insightful)
Re:Stupid Catch Phrases (Score:2)
??? -> W.C. -> Toilet -> Washroom/Bathroom.
Dead-tree edition Hard copy. (Notice the direction of the arrows...)
Bystander deaths -> Collateral damage.
But in this case, I'd say it really is social engineering. You are conning not individuals, but a whole group of people.
The real question is (Score:5, Insightful)
since there were at least 10 people that could make an easy ID.
It's one thing to BS your way in and steal some stuff, it's quite another thing to get out and not get ID'd or videotaped. This is where most crimes go wrong. It's not that the crime itself doesn't work out ok, the criminals often get what they want, it is the aftermath that goes wrong. The crime gets reported, an investigated, and they find out who did it, and that's all she wrote.
Re:The real question is (Score:3, Insightful)
"Hi, Charles asked me to have five computers transfered. Let me fax you some paperwork. The van is parked out back, could you have it loaded?"
Re:The real question is (Score:2, Insightful)
Re:The real question is (Score:5, Interesting)
He presented a possible occurance, and explained it twice. Once to the stock boy, once to an assistant manager. Neither of them bothered to take a look at the "official papers" that he had folded up in his breast pocket, and he claimed that he had gotten those papers and authorization from accounting. Yet no one checked his story.
This is the goal of social engineering. To use the system so that you can get what you want without raising suspicions.
Lets just say, for arguments sake, that they did a full store inventory within the next 3 months, and found a discrepency. Where would you start investigating it? You wouldn't know when it happened. You wouldn't know how it happened. And because of how he pulled it off, no one would ever remember him. He blended in so well, and so convincingly, that by the time they finished their shift, they wouldn't have even been able to remember what he looked like. He was completely forgetable, and no one would have been the wiser. And if he was seen walking out of the store with a pallet full of computers by a video camera (assuming they kept tapes for that long), they would have seen him approached by an assistant manager who let him walk out of the store with the merchandice! And again, that is where the social engineering would have continued to work, anyone reviewing said tape would have seen him being checked out by the assistant manager, assumed the assistant manager was doing his job, and that there was a legitimate reason for him to take those computers out (even though the reviewer never heard the conversation). And 10 to 1 odds, the reviewer wouldn't even check with accounting to see if anyone was authorized to take 5 computers out of the store that day.
Re:The real question is (Score:3, Interesting)
Re:The real question is (Score:3, Interesting)
However, you are correct. If they could find out when (very important), they have other tools at their disposal to investigate with. CCTV being one. With it, they could track the guy as he walks in, canvases the place, goes in the back to the break room, finds a uniform, and his "official document", goes to the warehouse, runs his act, gets his merchandice, walks through the store with the merchandice, stopped by the assistant manager, and finally through the fron
Re:law requires months of video retention (Score:3, Insightful)
That my friend would indicate you don't have very much experience working with legislation.
This effect is known as "The law of un-intended consequenses". And is the main reason I do not approve of government programs to solve any problem with the exception of Policing the streets, and Defending the borders. I think the main problem with "un-intended consequenses", is that t
It beats holding up liquor stores (Score:2)
People rob liquor stores for $100 and some Boone's Farm. Those aren't sustainable crimes either, yet they happen all of the time in every city around the world.
He's not saying it's a perfect crime, he's just saying that on the scale of crimes, it's way above
Re:It beats holding up liquor stores (Score:5, Insightful)
A $3500 take isn't much, especially considering that you aren't going to get full value on it when you pawn it off or sell it on e-bay. However, there are hundreds of stores just like that one in large cities, and perhaps thousands in a state. $3500 a day for a few hours work, isn't bad at all, considering some people barely make that much in a month. If you are patient enough, smart enough, and mix it around enough, you could probably get away with it for many many years pulling this job on a regular basis.
The question, unfortunately, is philosophy. If you are smart enough to regularly defraud hundreds of businessess, then you would either have a difficult time justifying your actions to yourself (your conscience), or you would have to acknowledge to yourself that you are an evil, evil person. And who wants to look at themselves in the mirror every day thinking that? That there is no redeeming factor to your life and existance.
Man, I gotta write a journal entry about some of my philosophical meusings sometime. Especially when it comes to perceptions about good and evil.
Re:It beats holding up liquor stores (Score:3, Insightful)
Ha! I wish I pulled in $3500/month! If I did, I wouldn't have to get all my electronics by stealing them. (KIDDING about the last part!)
But the point isn't really whether someone could make a living doing this, but whether he could get himself an extra $3500 worth of gear just by deciding to do it.
Re:It beats holding up liquor stores (Score:2)
I work at a University... (Score:4, Funny)
Re:I work at a University... (Score:2, Funny)
They're Apples!
O.o
Never will be ready (Score:5, Insightful)
No amount of technology or education can or more accurately 'will' stop SE from being effective.
The only hope is that most thieves are too dumb to use it.Those who are smart enough almost deserve to get away with it.
SE requires knowledge of methods, practices and the weaknesses inherent in such.
A smart business will simply acknowledge the existence of such and absorb minimal losses associated... and raise prices accordingly. Very similar to piracy of IP.
It will happen and you can do very little to stop it and what you can do will cost you more than the loss involved.
Soooooo.... minimize, minimize, minimize.... your losses as much as possible by identifying effective deterents and ignoring all else.
I'm sure companies do this already.... co this may or may not have been an effective exercise... was it realistic in terms of statistical attempts to steal merchandise? Probably not though it can identify weak areas in security that can be improved to catch less skilled SE perps...
How is social engineering different from a con? (Score:2)
Re:How is social engineering different from a con? (Score:2)
It's got "engineering" in the name, which is essential these days.
Hell, you can spend all day cleaning shit off the floor and you're a "sanitation engineer."
use it for good (Score:3, Insightful)
the ability to talk your way out of anything, ESPECIALLY when you actually haven't done anything wrong, but are being used as a scapegoat or a target to help someone else look good, or say, for instance, in a situation where you may be eventually threatening you manager's job or c
"Social engineering" has more than one meaning (Score:2)
"Social Engineering in the Workplace" could easily be an article about the problems created by such policies as affirmative action, or the reactionary knee-jerk responses to charges of sexual harassment or discrimination that are so common nowadays.
I guess this is what happens when you're someone whose interests include
How nice people are (Score:5, Insightful)
But seriously, you can get to the point of having people anal and trusting no one. Everyone is suspicious of the other, and while I suppose that is a good way to reduce theft, it also makes the place not very nice to work and shop or be around.
depends on your job (Score:4, Funny)
It's a place where no worker will listen to any social engineering attempt, you know. And anyway, thousand dollars of McDonalds food will probably kill anyone, in horrible pain.
Re:depends on your job (Score:5, Interesting)
I'm not sure someone could walk out of my business with thousand dollars in merchandise, as I work at MacDonalds.
If your store has a night shift like ours did (no managers), I virtually guarantee that someone could turn up with a white van and steal a whole set of vats. Our guys would have drained it for you and helped you put it in the van.
In the McD's I worked at, we started inexplicably losing a few boxes of chicken nuggets a day. Management couldn't figure it out (surprise surprise), but it was obvious what was happening.
I realised straight away that it wasn't going through the kitchen (even our managers would check the transfer paperwork, every time). Then I worked out that, with the freezer door wide open, nobody could see the fire exit. I pointed this out to the shift manager - and the pompous bastard searched me then and there. For months afterward, he would regularly pull me into the office and rifle through my rucksack.
The lesson I learned from this was: If you discover a hole in the system, you either (1) keep your mouth shut, or (2) keep your mouth shut and exploit it. (Or, I suppose, (3) tell someone who will, um, appreciate the information.) Telling the bastards in management is too much trouble.
Besides, I wasn't going to risk my job, even that job, over a few measly nuggets. Putting a JCB through the wall and ripping out the deposit safe was more my style. :)
Footnote: that bastard shift manager went on long-term sick-leave. Our regional manager took our store manager to dinner, and who do you think was the waiter? He got fired from both jobs, as I understand it. Sweet.
Having a disability doesnt mean they're honest... (Score:5, Interesting)
We were visited by a deaf woman (we assumed she was deaf from her speech, and her hearing aides, we learnt from the police that she was really deaf and was wanted in connection with other thefts) who was only just barely communicating that she was selling raffle tickets in something, no one knew sign language but let her in anyway assuming someone had let her in the building.
She used the time during lunch when most people werent at their desks to take wallets, go through draws or whatever, for some reason i was having lunch there, being the cheap bastard I am, I didnt buy a ticket, but my co-worker did.
For some reason I stood up to look at the woman operating from the otherside of the room, she looked a bit strange, she looked back so i sat back down. We found out later that she had her run of about 3 or 4 floors before someone challenged her being there.
It was also a running joke for us asking the co-worker who bought a ticket if she had won anything yet...
Slightly OT (Score:2, Offtopic)
Offtopic...
But this occurred in the last 24 hours.
I live with some close friends in a 'share-house'. We all have common interests and we enjoy a fair deal of household harmony.
Recently, I did a big favour for a friend by letting him store some of his belongings at my house while he moved.
All of this was pr
Re:Slightly OT (Score:3, Funny)
Re:Slightly OT (Score:2)
Best Part of the story (Score:2, Funny)
oh yeah baby take it off
I saw this happen at one company... (Score:5, Interesting)
It happened on a Saturday.
White panel truck with appropriate lettering pulled up to corporate headquarters. Man wearing logo'd shirt gets out and approaches security guard, papers in hand. He is supposed to remove typewriters for cleaning, and is supposed to come back Sunday to return them. Papers are signed by an executive of that company.
[ uh-huh. right name, but *that* executive has never even seen the papers. Its just a signature. ]
Guard is cautious. Needs to call and check. Truck driver agrees to wait. Executive out of town. Guard says no-go. Truck driver says fine, just sign here that I showed up. Your company still must pay the $5000 fee for weekend overtime service as per the contract. ( Shows contract details to guard ). No biggie to me. ( Guard gets ansy. A lot of money, What's his boss gonna say about losing more money than his monthly pay just because he wouldn't let another man do his work? ). The guard refused to sign anything. The truck guy notes down his name from his badge, notes it on his form, looks at his watch again, dates and signs the form, and asks the guard to let 'em know he was there. Leaves the guard a business card, and mentions that the next available window to do the cleaning work on a weekend is about 3 months away. Another fee will be assessed for the next service. He tells the guard he has 50 people at his plant right now ready to clean typewriters, and when he gets back, he has no work for them, so he will pay them their four hours Union wage for showing up and send them home.
The guard is really sweating now. He doesn't know exactly what to do, but he doesn't wanna find out he screwed up the company something fierce by keeping someone from doing their job, so he relents. He even helps load the truck!
We never saw those typewriters again.
The truck? Bogus plates. Plain white panel truck with vinyl stick on lettering. Run of the mill truck. The guy even had shelves in it made in such a way so he could load up the completely full. Seeing how professional the truck was equipped for the job impressed the guard and reassured him that everything was indeed on the up-and-up.
The forms? Yes, lots of forms! Every typewriter was duly noted on its own form..serial numbers and all! Obviously our con-guy had gotten a hold of an inventory list, because every form indicated where the typewriter was. Why even a copy of each form was even left with the guard! The only traceable signature was that of the guard. There were other signatures on the forms, but no one ever found out who the actual signers were.
Come Monday, Management was very puzzled and disturbed over the missing typewriters.. a little over a couple hundred of them. There were investigations. There were lots of phone calls to the non-existent phone numbers, people, and attempted visits to the addresses referenced to in those oh-so-professionally done forms.
Yup, some clever guy invested in a couple hundred dollars worth of "movie props" and walked out with several hundred thousand dollars worth of nearly brand new IBM typewriters.
Re:I saw this happen at one company... (Score:2)
Great story, though!
Re:I saw this happen at one company... (Score:4, Funny)
Re:You didn't finish the story. (Score:3, Interesting)
No, the security guard did not get fired.
As far as I know, everyone considered he did the best he knew.
But, from what I could tell, ever since then, the guards were kept very well informed about anything that involved equipment moving, and this incident was never forgotten, and used to illustrate just how sneaky and well-prepared thieves can be.
Even twenty years later, me, as well as probably everybody who worked in or around that company, remembers the whol
The real problem -- do we value trust? (Score:5, Interesting)
Yes, this Israel fellow demonstrated very well what happens when people trust each other too much, but what happens when you take it to the other extreme? You end up with stories about like Walmart where employees are locked in to prevent theft and can't call an ambulance when the forklift rolls on them. Some might think that it's worth compromising on a theft rate of, say
That's why, for example, hotels generally don't ask you to show ID when you claim you've lost your room key. If they did, they'd suffer more lost business than the cost of insuring against the occasional theft of a guest's belongings.
Everything is a compromise.
Re:The real problem -- do we value trust? (Score:5, Interesting)
Well, that may be the case in the hotels you have visited, but having worked at a hotel for more than a few years I can tell you that we had a policy regarding key-loss. The guest had to ID themselves. Furthermore we had CC style keys (the ones you swipe the lock with to open it), and if lost (or taken as a souvenir) were useless... there was no room number on it, and once we coded a new key, the old one was made invalid by default (we could make a copy of it too).
The hotel received very kind "thank you" letters from both companies that hired the meeting rooms, as well as new reservations for future meetings. Both companies involved heartily recommend that hotel still to other people if they need to hire a meeting room.This seemed to work out pretty well, because in the 3 years I worked there there were only 2 thefts, both in meeting rooms that were left unlocked by their occupants. Both cases were easily solved anyway, because we had the perpetrators on video (no the hotel is not a 1984 big brother fortress) and measures against the thieves were taken accordingly. 1 case was solved the same day, the other within a week.
Damn, where do you stay? (Score:4, Interesting)
I used to travel a lot for work, and I've been to a lot of hotels, all over the country. All hotels nowadays use swipe cards or something along those lines, and if you lose your card, yes, you show ID to get back in. I've lost my card on a number of occasions (usually only to find it later hidden in the depths of my wallet) and they *always* prove that you are who you say you are. Some places are satisfied with a driver's license, but some require you to show the credit card you used to pay for the room, so they can compare the numbers in the computer to the numbers on the card.
Maybe if you stay in a place that allows non-credit card transactions, but I haven't seen a place that'll take cash for a hotel room for years and years...
training not necessary (Score:2)
Re:training not necessary (Score:4, Interesting)
Disclaimer: It's not something I'd EVER do, but it's the pattern I noticed because I do, in fact, buy a lot of shit from Best Buy (and conversely, have to exchange a lot of malfunctioning electronics)
Read Mitnick's book (Score:2)
Well probably not for my work place. (Score:2)
Government / Classified work. (Score:4, Interesting)
The issue of social engineering is taken so seriously here that there is a dedicated team whose job it is to attempt to compromise the network by any means possible. Their electronic attempts are generally significantly less successful than the attempts that include a human element. Because this is a large scale organization with multiple shifts of employees that rarely overlap, seeing strange faces is par for the course. The "red" team takes advantage of this during shift turnovers, and will attempt to follow people through passcode protected doors and use a USB flash device on an unlocked workstation once inside to compromise the network. We as employees are told to challenge anyone who passes a secured doorway without keying in, and lock any unlocked workstation we find (or report it to security).
Overall, I would say our electronic countermeasures are significantly more successful at defending the network than our human ones, so the security team takes social engineering very seriously.
Been there, done that. (Score:5, Funny)
It's even more fun when others don't notice that you are on to them and feeding them complete bull.
(from MSG)
'Isn't that that guy, from that other network? The script kiddy?'
'Yes.'
'the one that tried to hack you.'
'Yes.'
'And you are talking to him?'
'Yes.'
'WHY?'
'Shh,Watch.:)'
(In chan, after some yacking about and playing stupid, he was posing as a billing person from my ISP
'Oh, you need my new credit card info for that. let me msg it to you.'
'ok.'
(later, after he left)
'WTF! You gave him a CC number?'
'Yeah, of a old card.'
'I don't understand.'
'The card was reported stolen a year ago.'
'Yeah...okay..so, it won't work.'
'No, it wont, but guess what happens when you try to use a *stolen* credit card?'
'......'
'OHHHHH!'
Hee!:)
Low-paid employees are complicit (Score:5, Insightful)
We recently had an internal discussion of how to reduce theft in the company - we are a retail group and often there's thousands of pounds worth of sports gear etc. parked temporarily in corridors. One of the astonishing revelations was that a large percentage of the theft had to be internal! Our own staff were stealing from us!
After a lot of hand-wringing and head scratching we concluded that the reason they are stealing is because they feel that at $6 an hour, the company is stealing from them. Senior execs were not prepared to negotiate a rise in the shop-floor staff wages, so we took the strategic decision to drop the whole issue.
Not really a difficult conclusion, just an unpalatable one.
Re:Low-paid employees are complicit (Score:3, Informative)
Time to revisit this Fortune Magazine article [fortune.com] again.
Synopsis: Costco suffers much less stock shrinkage than Walmart because it pays its employees well and treats them nicely.
Didn't even *need* SE at my uni (Score:4, Funny)
At my uni you didn't even have to resort to social engineering to get the basics. All you had to do was show up at the finance office for your student loan.
They made everyone sign next to their name on a big printout that sat close to the counter. This was in surname order, but also contained forenames, date of birth, matriculation number, department, and a couple of other bits and bobs.
Which was great. Especially given that the network user IDs all took the form [first initial][last initial][matric no].[department code] and the default password was the date of birth.
As far as I'm aware, this wasn't used for anything beyond "I don't like Bob, log in as Bob, look at doggy-porn, print doggy-porn, log off, run" - which would still be pretty bad news if you were Bob. But it would have been so easy for anyone with even more malicious intent to take a few pages of the printout and use it to extract even more personal information.
Scary, really.
Ha i can tell where this was (Score:3, Interesting)
I remember that people returned a vcr in a xbox box, bricks in a tv box, run out the door with computers, and the list goes on. Most of the time when i was working we caught these people, or didn't because i couldn't find a manager fast enough to stop them ( you as an employee weren't allow to confront them). Also i remember an incident where 10 people distracted every employee on one side of the store and made off with $8000 of printer cartridges ( the cartridges were on anti-theft peghooks too). There were days i was expected to watch 4-5 departments by myself, basically 1/3 of the store, and there was many thefts.
I was actually fired for speaking up about it. Oh well not my problem now.
and this is bad--how? (Score:4, Insightful)
There may be procedures that you can follow that avoid this sort of social engineering and still let the business function--but devising them, implementing them, and training the employees for them has its own costs. A phone call would have done the trick in this case and may have been prudent, but getting each employee to remember to make the phone call is difficult. Employing a separate person keeping track of everything that leaves the store and asking the right kind of questions would be better and ensure that only one person was distrusting, but it has an obvious cost--another salary to pay.
Efficient businesses need a lot of trust and initiative on the part of employees. If you try to make this kind of social engineering too difficult, you may be preventing more thefts, but you also may be preventing your business from working. Given that this was demonstrated through a staged theft, it seems like the real thing is happening rarely enough for employees to be aware of it; this sort of thing is self-limiting--once the first real theft like that happens, people become less trusting automatically--with all the costs that that entails.
There are no easy answers--in some environments, you just have to bear the costs that come with increased security--but one also shouldn't automatically assume that it is automatically better to adopt business procedures that prevent loss or theft.
Inside edge (Score:4, Interesting)
Not that you don't have to be aware of employees or ex-employees who are trying to game the system, but being able to SE someplace you're familar with is an order of magnitude easier then trying to scam someplace else because you know all the right internal buzzwords and procedures.
Cheers,
=Blue(23)
The inescapable truth about people (Score:2, Insightful)
I needed to do something in someone's account and didn't know their password. I also didn't want to reset it in the server because then I'd have them calling me saying the computer didn't work or whatever. So I thought of asking the guy working across the cubicle from where I was, not really expecting a reply:
"Say, you wouldn't happen to know
Of course it works, everyday. (Score:2)
http://www.google.com/search?as_q=sco+lawsuit
guy sounds like a total asshole (Score:4, Funny)
"Did you pay for that?" (Score:5, Funny)
So one day they decided that they needed to snag a canoe from Sears. They walked in and waited until no one was looking and grabbed a canoe and headed for the door.
As they got near the door, a clerk stopped them and said "Excuse me, did you pay for that canoe?"
"No, we're just walking out the door with it!" they responded sarcastically. The clerk backed off and held the door open for them as they left.
It Works! (Score:5, Interesting)
Good story, kinda reminds me of a couple of my past experiences.
Just out of High School I'm a gofer at a major chain hardware store, it's holiday season (without a doubt, best time to social engineer) and because it's so busy, I'm stuck helping load customers vehicles with bulk merchandise at a usually closed side door.
A guy backs up a station wagon up and comes up to me (the youngest looking employee in the store) waving a "receipt" and saying he's here to get his pallet of Presto Logs. So being young and dum... errr... I mean, eager to help out, I went over to my very busy "dickish" "boss" and asked what to do, his curt reply was "Get him the logs, I'm busy.", and then he rapidly walked away toward the front of the store.
So I got a pallet jack and moved a whole pallet of Presto logs across the whole store to this side door, and proceed to load up his station wagon till it was sagging badly in the rear, but I got 'em all in.
The poor guy was in a BIG hurry because his wife was at another store and he had to go get her since her car had broken down, and he had a bad back so he couldn't help me load the boxes of "logs", but I loaded that whole pallet of "logs" into his station wagon in record time.
And not 30 seconds after he drove off than another guy drives up in a pickup truck wanting his pallet of Presto logs!
Well, I had just loaded up the last pallet of Presto logs...
Thats when I knew I'd been had...
Luckily, I'd asked my loser boss, and he had to take the heat, but that was a BIG lesson for me in Social Engineering.
Move ahead several years to 1977, I'm working for a private interconnect (TELCO) company in SillyCon Valley. We don't have company uniforms, or even name tags, really low budget, but we do have tool belts and butt sets (linemans test set), we had to buy those too.
So I'm one of the company's troubleshooters and we had many high tech clients, one of which is where I was making some changes to the state of the art TDM PBX our company sold and installed Waaaay better than anything MaBell had at the time. Merlins... what a joke.).
My boss (a "real" boss, yaaaa.) arrived unexpectedly to give me some good news (a raise!) and as we were leaving the building I joked that I could go anywhere I wanted with only my toolbelt and buttset.
My boss gave me the look and then smiled and said "no way".
Mistake...
We happened to be in a large room full of desks looking at a wall of glass, behind which was the computer room, you know, raised floors, BIG banks of BIG six foot tall computers with BIG reels of tape slowly spinning away, heavy duty air conditioning, guys in white lab coats! The whole deal. And the only door in/out was protected by an armed security guard.
Nobody had noticed us yet as they were all busy doing their jobs, and I looked at the computer room and said to my boss "Wait here and watch." He got an unsettled look on his face but didn't stop me as I calmly but purposefully walked straight toward the door with the guard.
I noticed that the guard was alert and saw me coming, so I was all ready to talk my way into the computer room, but as I got close enough to talk, he just opened the door for me! I said I needed to check out something and would be right out as I was calmly (yeah, right!) walking by him into the "secure" computer room.
The white lab coat guys totally ignored me even though there were NO phones in that room! I walked through the whole large room, looking at all the cool computers and stuff and attempting to look "official".
I finally got my fill of sightseeing and went back to my boss, who by now was angry at me, but I pointed out that no harm was done, and I had made my point to him. He forbade me to ever do it again, anywhere, but when we got back to the shop I was a big hit for my "ballsy" behavior and he was bragging about it and laughing like crazy.
Yeah... social engineering... it can work.
Trust AND Fear (Score:5, Informative)
If the minimum wage plus a couple of bucks guard can prevent the blustering VP of Operations who forgot his security pass from entering the building WITHOUT repercussions AND the guard knows it; you have a chance of social engineering not working.
There's a probably apocryphal story of one of the von Siemens being stopped from getting into one their own buildings by some old German guard. The punch line is the old guy saying "Yes, I admit you LOOK a lot like von Siemens and you PROBABLY are von Siemens but without papers you are not getting into this building". von Siemens thought about it for a while, settled down and gave the old guy a big bonus. The story was passed around to everyone as how security should be done.
Most people aren't observant (Score:4, Interesting)
Anyway why it's easy:
1) Most people are trusting and not paranoid.
2) Most people are too busy doing their main jobs.
3) Most people aren't observant.
4) Most people aren't very smart.
5) It's hard to be polite to people especially customers while at the same time be suspicious/wary of them. For most businesses it's better to err on the side of politeness. Let insurance etc take care of the other stuff. Remember if customers don't buy anything coz you pissed them off, the creditors come and take everything
6) High staff turnover is bad for security - makes things even harder - as a worker you can't stop every new face you see whilst trying to get you job done so that you don't lose your job. By the time you get around to training newbs about security they're already on their way out - you're lucky if you even managed to finish training them how to do their main jobs.
7) The people who aren't easily fooled aren't cheap and plentiful. Plus they probably got sacked or changed jobs coz they weren't easily fooled by management
The effect of a plain ID and a generic logo shirt (Score:3, Interesting)
Things that tend to happen:
1. I wear my ID with blank side showing. I get asked for help in any store, regardless of whatever uniform standards in place. If qualified, I generally will assist, but then people are surprised to find out that I don't work there.
2. I am in an automotive dealership (not exactly a very innocent place). I need to copy a few dozen pages from a service manual. I ask where I can do it, and I am advised to use the copier in the showroom. Now, this is a networked copier that also happens to be the printer for ALL customer paperwork (credit apps, driver licenses, insurance cards, you name it) that's associated with a vehicle sale transaction. Now, I basically monopolized the copier for over 40 minutes, and I was asked if there is something wrong with the machine and what would it cost to have it moved away from public sight by the dealership's GM. At this time, I was wearing my usual generic logo shirt and a blank ID. I explained I wasn't there to service the machine. I also advised him of this risk. The risk is simple - sniff the network and an access point.
I can't count how many times I walked into restricted areas by mistake and never got asked any questions. The logo gear I wear can be purchased from any corporate store on the web that allows its customers to promote the company by wearing its logo on a hat and shirt.
The public is conditioned to white piece of plastic and any logo as a universal access device.
The world is really lucky I am not malicious.
Re:Just in case the site goes down... (Score:2)
Re:I had this friend in highschool... (Score:3, Interesting)
Ooops!
The cops were there in 15 minutes, while I stalled the thief, pretending to look up the original sales sheet (there are sometimes advantages to using a paper-based system). The lady skipped on her bail, so I never
Re:I had this friend in highschool... (Score:3, Funny)