Slashdot Mirror
Social Engineering in the Workplace
An anonymous reader writes "Could a total stranger walk out of your business with thousands of dollars in merchandise without your knowing? Even worse, could they manipulate you into helping them each step along the way?"
"thousands of dollars in merchandise"
Why merchandise?
Just take the cash and scram! O.o
Ken Lay did it to the tune of several billion dollars in California so I'd say it's very possible.
~S
I love it. Load it up, the very first line of the page is "SlashDot defense provided by Nexcess.Net"
There's forethought, with some free advertising thrown in.
|>
Here be Dragons
No way. I'm too lazy to help the people I should be helping. Why would I help a stranger?
At the last company I used to work for they once showed us a video about the importance of information privacy, and how social engineering works. In this particular example, the person would have been caught right away because he was wearing a suit. No one wears a suit on our floor, unless they're having a job interview, or meeting with the executives or something.
The reality is that most medium sized companies can be vulnerable to social engineering. In most cases the weak point in any security system is going to be on the human level. When you work with people you have to have some element of trust to make things more efficient.
You might need a security badge to get by a security desk, and a key card to get onto the floor. But people sometimes loose their badges and keycards and will be let by just this once.
If you can get into the cafateria without any security stuff you can just go to lunch there for a couple weeks, get to know people's name who work in the IS departments, and maybe even come across a dropped security badge. You can then fordge your own to get to the elevators, and then wait for someone else to open the door to get by needing a keycard. (Assuming the badge you came across didn't also have the person's keycard.)
Then getting information out might be easy. And at the company I used to work for you could probably steal hadware just by putting it on a cart. We had multiple buildings so it was common for people to be carting PCs from building to building. How many security guards would recognize the difference between a PC and a server?
Unless you have security guards that require written permission for every single hardware move your hardware is not going to be 100% safe. And unless you have a zero tollerance policy on holding the door open for someone, your information is not safe. How many companies are willing to do this?
I hate Liberals and Conservatives.
If you are a Liberal or a Conservative, then HAVE A NICE DAY!
Courage.
This is a great read! One has to wonder: Isn't it much easier to social-engineer ones way into a system than the "hacking" approach?
,something with the Australian customs office. And there is the now really famous French guy who used to simply walk in on high level government events and get his picture taken.
How hard can it be to get usernames/passwords this way? And since we are in linux-land here: I would bet that more than half of the sysads here would open up their systems to the first pretty girl that would walk along their cubicle. Obviously she cannot be too pretty as that would be VERY suspicious.
There are plenty of stories going around about people just walking into a server room, and taking a few servers home with them. We even had one of those on slashdot here a few months ago
But the world is probably safe: Somehow good social skills and good technical skills are mutually exclusive...
I work tech support at an isp, and after reading Kevin Mitnick's "The Art Of Dection", I've had a keen eye for situations were social engineering could be going down, the thing is if policy dictates that you respond a certain way, you do so reguardless. The funny thing is how much more helpful other internal departments are if you use some social engineering techniques. Sometimes the billing dept. will help a save desk agent more than techsupport; sometimes a field rep. gets less lip than tech.support to escalate an issue. Guess it goes to show any tool can be used for good or evil.
What's the deal with calling cheating and conning people "social engineering"? Giving it a catchy name doesn't make it any more fashionable or acceptable. I guess we have the l337 underground crowd to blame for this idiotic euphemism.
Can you social engineer your way to getting some stuff from a store and get away without getting arrested? I've noticed that with most social engineering test the people leave themselves VERY exposed in terms of being caught later. I saw this with a coworker. He did a hypothetical social engineering/hacking scenario. It was all well and good excpet that I gaurentee that had he does it in reality, he'd have been thrown in jail
since there were at least 10 people that could make an easy ID.
It's one thing to BS your way in and steal some stuff, it's quite another thing to get out and not get ID'd or videotaped. This is where most crimes go wrong. It's not that the crime itself doesn't work out ok, the criminals often get what they want, it is the aftermath that goes wrong. The crime gets reported, an investigated, and they find out who did it, and that's all she wrote.
..so we don't have stuff worth thousands of dollars sitting around. I'd wish that someone would steal some crappy old computers sitting around though. Please take away the Apple IIs...please..
Social Engineering "as we know it" is going to be impossible to combat or educate against.
No amount of technology or education can or more accurately 'will' stop SE from being effective.
The only hope is that most thieves are too dumb to use it.Those who are smart enough almost deserve to get away with it.
SE requires knowledge of methods, practices and the weaknesses inherent in such.
A smart business will simply acknowledge the existence of such and absorb minimal losses associated... and raise prices accordingly. Very similar to piracy of IP.
It will happen and you can do very little to stop it and what you can do will cost you more than the loss involved.
Soooooo.... minimize, minimize, minimize.... your losses as much as possible by identifying effective deterents and ignoring all else.
I'm sure companies do this already.... co this may or may not have been an effective exercise... was it realistic in terms of statistical attempts to steal merchandise? Probably not though it can identify weak areas in security that can be improved to catch less skilled SE perps...
A fool throws a stone into a well and a thousand sages can not remove it.
This time the phrase conveys additional information. Engineering is probably best described as the art of applying science to control failure. A typical con, ala Matchstick Men, The Grifters, etc is all about craftsmenship, using the people. Where social engineering is all about a well planned design for a well understood system, using the bureaucracy. One is personal, one is impersonal, one depends on personal charisma, one depends on blending in.
Actually, it's his second slashdotting, and his CMS, Drupal, has an anti-slashdotting mechanism built in--caching.
Actually, at my school the homeless people look more like professors. Go ASU!
No comment at this time
Well, I guess it comes down to how nice people are. If every person you passed asked for your identification, your papers, what you're doing here... hum... sounds like Germany back when...
But seriously, you can get to the point of having people anal and trusting no one. Everyone is suspicious of the other, and while I suppose that is a good way to reduce theft, it also makes the place not very nice to work and shop or be around.
**FREE** Track and view your phone's via CellID and/or WIFI and/or GPS
I'm not sure someone could walk out of my business with thousand dollars in merchandise, as I work at MacDonalds.
It's a place where no worker will listen to any social engineering attempt, you know. And anyway, thousand dollars of McDonalds food will probably kill anyone, in horrible pain.
____
nico
Nico-Live
I worked at a finacial institution, with doors that can only be opened with swipe cards, these were on each floor.
We were visited by a deaf woman (we assumed she was deaf from her speech, and her hearing aides, we learnt from the police that she was really deaf and was wanted in connection with other thefts) who was only just barely communicating that she was selling raffle tickets in something, no one knew sign language but let her in anyway assuming someone had let her in the building.
She used the time during lunch when most people werent at their desks to take wallets, go through draws or whatever, for some reason i was having lunch there, being the cheap bastard I am, I didnt buy a ticket, but my co-worker did.
For some reason I stood up to look at the woman operating from the otherside of the room, she looked a bit strange, she looked back so i sat back down. We found out later that she had her run of about 3 or 4 floors before someone challenged her being there.
It was also a running joke for us asking the co-worker who bought a ticket if she had won anything yet...
Be you Admins? nay, we are but lusers!
It happened on a Saturday.
White panel truck with appropriate lettering pulled up to corporate headquarters. Man wearing logo'd shirt gets out and approaches security guard, papers in hand. He is supposed to remove typewriters for cleaning, and is supposed to come back Sunday to return them. Papers are signed by an executive of that company.
[ uh-huh. right name, but *that* executive has never even seen the papers. Its just a signature. ]
Guard is cautious. Needs to call and check. Truck driver agrees to wait. Executive out of town. Guard says no-go. Truck driver says fine, just sign here that I showed up. Your company still must pay the $5000 fee for weekend overtime service as per the contract. ( Shows contract details to guard ). No biggie to me. ( Guard gets ansy. A lot of money, What's his boss gonna say about losing more money than his monthly pay just because he wouldn't let another man do his work? ). The guard refused to sign anything. The truck guy notes down his name from his badge, notes it on his form, looks at his watch again, dates and signs the form, and asks the guard to let 'em know he was there. Leaves the guard a business card, and mentions that the next available window to do the cleaning work on a weekend is about 3 months away. Another fee will be assessed for the next service. He tells the guard he has 50 people at his plant right now ready to clean typewriters, and when he gets back, he has no work for them, so he will pay them their four hours Union wage for showing up and send them home.
The guard is really sweating now. He doesn't know exactly what to do, but he doesn't wanna find out he screwed up the company something fierce by keeping someone from doing their job, so he relents. He even helps load the truck!
We never saw those typewriters again.
The truck? Bogus plates. Plain white panel truck with vinyl stick on lettering. Run of the mill truck. The guy even had shelves in it made in such a way so he could load up the completely full. Seeing how professional the truck was equipped for the job impressed the guard and reassured him that everything was indeed on the up-and-up.
The forms? Yes, lots of forms! Every typewriter was duly noted on its own form..serial numbers and all! Obviously our con-guy had gotten a hold of an inventory list, because every form indicated where the typewriter was. Why even a copy of each form was even left with the guard! The only traceable signature was that of the guard. There were other signatures on the forms, but no one ever found out who the actual signers were.
Come Monday, Management was very puzzled and disturbed over the missing typewriters.. a little over a couple hundred of them. There were investigations. There were lots of phone calls to the non-existent phone numbers, people, and attempted visits to the addresses referenced to in those oh-so-professionally done forms.
Yup, some clever guy invested in a couple hundred dollars worth of "movie props" and walked out with several hundred thousand dollars worth of nearly brand new IBM typewriters.
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
Social engineering isn't rocket science -- it boils down to exploiting the trust that exists between people. Smart-alec geeks and slashdotters seem to take pleasure in pointing out how stupid victims of social engineering are. Granted, many social engineering schemes are successful due to mere ignorance. But is it inherently stupid to trust people? Here's the problem: there are costs and benefits to an environment in which people don't trust each other.
.5% if it means being free of stifling bureacracy and draconian security. Given that, trusting each other is a choice we make because the risks it entails is, on the balance, worthwhile.
Yes, this Israel fellow demonstrated very well what happens when people trust each other too much, but what happens when you take it to the other extreme? You end up with stories about like Walmart where employees are locked in to prevent theft and can't call an ambulance when the forklift rolls on them. Some might think that it's worth compromising on a theft rate of, say
That's why, for example, hotels generally don't ask you to show ID when you claim you've lost your room key. If they did, they'd suffer more lost business than the cost of insuring against the occasional theft of a guest's belongings.
Everything is a compromise.
The issue of social engineering is taken so seriously here that there is a dedicated team whose job it is to attempt to compromise the network by any means possible. Their electronic attempts are generally significantly less successful than the attempts that include a human element. Because this is a large scale organization with multiple shifts of employees that rarely overlap, seeing strange faces is par for the course. The "red" team takes advantage of this during shift turnovers, and will attempt to follow people through passcode protected doors and use a USB flash device on an unlocked workstation once inside to compromise the network. We as employees are told to challenge anyone who passes a secured doorway without keying in, and lock any unlocked workstation we find (or report it to security).
Overall, I would say our electronic countermeasures are significantly more successful at defending the network than our human ones, so the security team takes social engineering very seriously.
Social engeneering is fun.
:)
;) )
It's even more fun when others don't notice that you are on to them and feeding them complete bull.
(from MSG)
'Isn't that that guy, from that other network? The script kiddy?'
'Yes.'
'the one that tried to hack you.'
'Yes.'
'And you are talking to him?'
'Yes.'
'WHY?'
'Shh,Watch.:)'
(In chan, after some yacking about and playing stupid, he was posing as a billing person from my ISP
'Oh, you need my new credit card info for that. let me msg it to you.'
'ok.'
(later, after he left)
'WTF! You gave him a CC number?'
'Yeah, of a old card.'
'I don't understand.'
'The card was reported stolen a year ago.'
'Yeah...okay..so, it won't work.'
'No, it wont, but guess what happens when you try to use a *stolen* credit card?'
'......'
'OHHHHH!'
Hee!:)
My new top secret key -> C>N|KB
If you pay someone $6 an hour, do you really expect them to be vigilant defenders of company property?
We recently had an internal discussion of how to reduce theft in the company - we are a retail group and often there's thousands of pounds worth of sports gear etc. parked temporarily in corridors. One of the astonishing revelations was that a large percentage of the theft had to be internal! Our own staff were stealing from us!
After a lot of hand-wringing and head scratching we concluded that the reason they are stealing is because they feel that at $6 an hour, the company is stealing from them. Senior execs were not prepared to negotiate a rise in the shop-floor staff wages, so we took the strategic decision to drop the whole issue.
Not really a difficult conclusion, just an unpalatable one.
"It's not your information. It's information about you" - John Ford, Vice President, Equifax
Exactly, and from the article, it sounds like Israel has not only done this before, but has a theme in mind for how he would approach the situation. Of course, every store would be a variation on the theme, but it would be rather similar nonetheless.
A $3500 take isn't much, especially considering that you aren't going to get full value on it when you pawn it off or sell it on e-bay. However, there are hundreds of stores just like that one in large cities, and perhaps thousands in a state. $3500 a day for a few hours work, isn't bad at all, considering some people barely make that much in a month. If you are patient enough, smart enough, and mix it around enough, you could probably get away with it for many many years pulling this job on a regular basis.
The question, unfortunately, is philosophy. If you are smart enough to regularly defraud hundreds of businessess, then you would either have a difficult time justifying your actions to yourself (your conscience), or you would have to acknowledge to yourself that you are an evil, evil person. And who wants to look at themselves in the mirror every day thinking that? That there is no redeeming factor to your life and existance.
Man, I gotta write a journal entry about some of my philosophical meusings sometime. Especially when it comes to perceptions about good and evil.
I haven't lost my mind!
It is backed up on disk...somewhere...
maybe I'm just in a bad mood but that guy seems to really enjoy being a smartass and getting people in shit. I hope one of the employees he dupes socially re-engineers his teeth next time.
When I was in college, two of my fraternity brothers made it a game to try and walk out of stores with ANYTHING. The bigger the better.
So one day they decided that they needed to snag a canoe from Sears. They walked in and waited until no one was looking and grabbed a canoe and headed for the door.
As they got near the door, a clerk stopped them and said "Excuse me, did you pay for that canoe?"
"No, we're just walking out the door with it!" they responded sarcastically. The clerk backed off and held the door open for them as they left.
Good story, kinda reminds me of a couple of my past experiences.
Just out of High School I'm a gofer at a major chain hardware store, it's holiday season (without a doubt, best time to social engineer) and because it's so busy, I'm stuck helping load customers vehicles with bulk merchandise at a usually closed side door.
A guy backs up a station wagon up and comes up to me (the youngest looking employee in the store) waving a "receipt" and saying he's here to get his pallet of Presto Logs. So being young and dum... errr... I mean, eager to help out, I went over to my very busy "dickish" "boss" and asked what to do, his curt reply was "Get him the logs, I'm busy.", and then he rapidly walked away toward the front of the store.
So I got a pallet jack and moved a whole pallet of Presto logs across the whole store to this side door, and proceed to load up his station wagon till it was sagging badly in the rear, but I got 'em all in.
The poor guy was in a BIG hurry because his wife was at another store and he had to go get her since her car had broken down, and he had a bad back so he couldn't help me load the boxes of "logs", but I loaded that whole pallet of "logs" into his station wagon in record time.
And not 30 seconds after he drove off than another guy drives up in a pickup truck wanting his pallet of Presto logs!
Well, I had just loaded up the last pallet of Presto logs...
Thats when I knew I'd been had...
Luckily, I'd asked my loser boss, and he had to take the heat, but that was a BIG lesson for me in Social Engineering.
Move ahead several years to 1977, I'm working for a private interconnect (TELCO) company in SillyCon Valley. We don't have company uniforms, or even name tags, really low budget, but we do have tool belts and butt sets (linemans test set), we had to buy those too.
So I'm one of the company's troubleshooters and we had many high tech clients, one of which is where I was making some changes to the state of the art TDM PBX our company sold and installed Waaaay better than anything MaBell had at the time. Merlins... what a joke.).
My boss (a "real" boss, yaaaa.) arrived unexpectedly to give me some good news (a raise!) and as we were leaving the building I joked that I could go anywhere I wanted with only my toolbelt and buttset.
My boss gave me the look and then smiled and said "no way".
Mistake...
We happened to be in a large room full of desks looking at a wall of glass, behind which was the computer room, you know, raised floors, BIG banks of BIG six foot tall computers with BIG reels of tape slowly spinning away, heavy duty air conditioning, guys in white lab coats! The whole deal. And the only door in/out was protected by an armed security guard.
Nobody had noticed us yet as they were all busy doing their jobs, and I looked at the computer room and said to my boss "Wait here and watch." He got an unsettled look on his face but didn't stop me as I calmly but purposefully walked straight toward the door with the guard.
I noticed that the guard was alert and saw me coming, so I was all ready to talk my way into the computer room, but as I got close enough to talk, he just opened the door for me! I said I needed to check out something and would be right out as I was calmly (yeah, right!) walking by him into the "secure" computer room.
The white lab coat guys totally ignored me even though there were NO phones in that room! I walked through the whole large room, looking at all the cool computers and stuff and attempting to look "official".
I finally got my fill of sightseeing and went back to my boss, who by now was angry at me, but I pointed out that no harm was done, and I had made my point to him. He forbade me to ever do it again, anywhere, but when we got back to the shop I was a big hit for my "ballsy" behavior and he was bragging about it and laughing like crazy.
Yeah... social engineering... it can work.
If the minimum wage plus a couple of bucks guard can prevent the blustering VP of Operations who forgot his security pass from entering the building WITHOUT repercussions AND the guard knows it; you have a chance of social engineering not working.
There's a probably apocryphal story of one of the von Siemens being stopped from getting into one their own buildings by some old German guard. The punch line is the old guy saying "Yes, I admit you LOOK a lot like von Siemens and you PROBABLY are von Siemens but without papers you are not getting into this building". von Siemens thought about it for a while, settled down and gave the old guy a big bonus. The story was passed around to everyone as how security should be done.