- Social Engineers Are High-Tech Con Artists
- It's All About Control
- A Social Engineer's Biggest Asset Is Knowledge
- Defense Against the Dark Arts
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
A Social Engineer's Biggest Asset Is Knowledge
The devil is in the details, but what's really freaky is when he calls you up and asks questions about them.
"Whether the object be to crush an army, to storm a city, or to assassinate an individual, it is always necessary to begin by finding out the names of the attendants, the aides-de-camp, and door-keepers and sentries of the general in command. Our spies must be commissioned to ascertain these."—Sun Tzu, The Art of War
Most of the time, social engineers don't just call a company and ask for usernames and passwords. Consider this: A phone rings in a large office park and the office administrator picks up. The following conversation ensues:
Office Administrator: "Hello, Acme Company."
Social Engineer: "Hi, my name is Steve and I'm calling about your copier. I see here that your support contract is up and I wanted to know if you would like to renew?"
Office Administrator: "Well, I'm not the person who handles our support contracts, but I can forward you to the person that does that."
Social Engineer: "Great! By the way, which copier do you have in that location? I need to update my files here to reflect that model number."
Office Administrator: "We have the Xerox DocuTech 135."
Social Engineer: "Oh, I see. I had that one marked down as in the Boston office. Thank you for checking." [Finds other offices on their web site.]
Office Administrator: "Okay, I'll forward you now. Have a nice day."
See anything wrong with this conversation? What information was gathered? Would this office administrator find it weird that two days later a man with a toolbox and Xerox shirt comes to the door and asks to see the DocuTech 135 for its pre-support renewal checkup? (And yes, I do own a Xerox shirt.)
You might be wondering what the hacker would do next, after gaining access to the building. That's a topic for another article, but believe me when I say that it's devastating to have a hacker inside your facility. This example was intended simply to show that, no matter how innocuous the data seems, it may be deadly in the wrong hands.
Now imagine this activity on a larger scale. A social engineer works on your company for weeks. He calls and talks to different people, trying to find out as much as he can about your company, each time getting just a little piece of data that seems meaningless. After stringing together all that information, he has a much better chance of convincing someone to give him sensitive information.