Slashdot Mirror
How To Rob a Bank: One Social Engineer's Story
itwbennett writes "Today's criminals aren't stealing money — that's so yesterday, according to professional social engineer Jim Stickley. In an interview with CSO's Joan Goodchild, Stickley explains how he's broken into financial institutions large and small, and stolen their sensitive data. In a companion story, Stickley walks through the steps he takes to fool clients into thinking he's there for fire safety, while he's really proving they are an easy target for a data breach."
The real big criminals own the banks.
Give me Classic Slashdot or give me death!
by the banks, I'm ok with the role reversal.
Absolute power corrupts absolutely. indymedia
So when did con men become "social engineers"? It sounds almost like a respectable profession.
Yes...they are stealing money. They just aren't doing it directly. EVERYONE who steals does it for the money. The guy who steals bread to feed his family would be just as likely to steal money to buy the bread if an opportunity presented itself. These guys are stealing information....that they will then sell to make money.
Unless you are stealing decorations from Pier 1 in an attempt to make your home look like a twisted and freakish version of a "Better Homes and Gardens" cover, you are stealing money...just not directly.
You can talk your way into almost anywhere by claiming you're from IT. A couple years ago I did these server upgrades for bank of the west. No ID cards or anything, just walk in and do what you want.
As a former security auditor myself, I'd attack the voice response units. Quite frequently those boxes (often standalone towers covered with a quarter inch of dust) were neglected in the corner, with no IDS, no one checking logs and frequently no automatic lockouts. Routed through Skype and/or Google Voice...
Stickley reads like Kurk Vonnegut Jr. That provided an amusing image.
No kidding!!! What do you say at this point?
I think acting as a fake fireman is a felony and I don't think the real firemen like professional security consultants doing tests acting / saying that they are a fireman.
Bullshit. You mean to say that this guy both steals stuff from bank employees desks AND installs keyboard loggers, and no one at the bank suspects anything like "hey, these guys stole all this stuff from us, maybe they weren't firemen, maybe security has been breached, let's check to see if computers/equipment has been tampered with!"
From TFA:
At that point, my partner's job is to start stealing everything he can steal and start putting it in his bag.
On our way out, we don't want them to know we're done. We want to be able to come back another time.
Too much mission impossible on TV. This is just an attention whore trying to cash in by pretending to be a crook. Typical of a "security consultant", really.
Seven puppies were harmed during the making of this post.
Interestingly, I was watching an old movie from the 60s a few days ago where the crook convinces the bank staff that he's from their insurance company and come to the bank to check their security, then robs it.
Similar ideas seem to have been around for a long time.
Here we are in between.
Surely recent years has shown the most successful bank robbers run banks.
Democracy Now! - uncensored, anti-establishment news
So putting key loggers onto some computer is going to make you money how?
Physical security and access is not the job of the standard employee. The only job the employee has is to ensure that their credentials are only used for thier access, either physical or digital, and that they are kept secure.
I once was working for a company that had higher a new CIO. The area where the IT people sit was secured with keycards, and was just outside of the server room, which had its own keycard. There was never any problem with letting visitors and other employees in and out to discuss IT projects, etc. In other words, while it had keycard access, it wasn't considered a security zone. The CIO came to visit the IT area and I let him in without knowing who he was. He was then buzzed into the Sever room by one of the operators who did know who he was. Of course, he made a big stink about the whole thing. The funny thing of course, is that nothing changed. He was just trying to make a big splash.
The point is, I am not a security guard. I am not about to put my physical safety in jeopardy for the sake of corporate secrets. I do not have the necessary skills to vett or interrogate every new visitor wandering our halls, nor do I have the authority or tools to throw them out. You can chew out your employees for allowing physical access to this "fireman" but the problem is management not spending the money to have proper security at the door, not the lack of vigilance by the employees.
I will keep my passwords secret, I will choose complex passwords, I will not allow people to tailgate on my keycard access, and I will inform IT security if any of my corporate devices goes missing. I will do all of this, but I will not be your security guard, there are people who do this who are much better at than I could ever be...
This story is working on too many assumptions that probably aren't true.
An analogy would be a story about robbing Fort Knox but putting on a fake military uniform and saying you're an important general, and you want to look at the gold just to make sure it is all there.
Seriously, THATS how bad this story is. IDs not checked? USB ports not disabled? What?
...wallet inspector.
Most of the companies called banks nowdays have about as much to do with banking as going down to Vegas and putting all your money into a slot machine.
Banking is relatively low-risk; creating "financial instruments" and selling them is potentially high risk, unregulated, and untested.
So don't call it banking.
There's no -1 for "I don't get it."
I remember an article from a few years ago where I man would wear a white shirt with a tie, and black pants and just walked into this one office every week for months and just took computers and walked out. Nobody questioned him at all because he looked like anyone else working there so they had no suspicions. The only reason they found out about him was the security footage of him coming and going at random times.
But the group that sets the rules TELLS THE BANKS what they will do.
CRA, The Community Reinvestment Act demanded that banks make loans to low income areas regardless of meeting loan requirements or...the banks would be subject to having their approval to be a bank revoked by the Treasury Dept. or whoever oversaw the CRA.
The banks made the loans but said "We can't keep these marginal loans" so all the biggies agreed that FMae and FMac would take them...but then they said they couldn't hold them, so rules were made to allow them to sell into "mortgage pool securities".
The whole damned thing was pushed by the U.S. Congress.
Comment removed based on user account deletion
Here is a link to the printable version.
But the group that sets the rules TELLS THE BANKS what they will do.
Not really, although that's what they teach you in schools. In reality, congress asks the financial industry lobbyists what laws they want and has the lobbyists write the legislation. The congressman sponsoring the legislation writes very little of it (if any) and probably doesn't even read it all. That's why laws like exceptions to capital requirements for large banks (Bearn Sterns or bigger) are passed - look it up. That's the rule now, not the exception.
CRA, The Community Reinvestment Act demanded that banks make loans to low income areas regardless of meeting loan requirements
This has next to nothing to do with the financial crisis, as many financial insiders (like the old Lehman Brother's CEO and others) have discussed. Those loans were extremely profitable to the banks and in any case, it has nothing to do with the housing bubble in Spain, Ireland, China, etc... There are many rebuttals to this position online.
back 8 years or so ago, a guy who was installing security cameras in a bank called. I never met him before or knew who he was, he just knew of me through a friend. He wanted me to come setup the network on the cameras to work with the banks network. So I show up and spend the next couple hours in the back room of the bank with the servers, totally un monitored and un supervised, and after hours setting up the cameras. No one at the bank asked for my id or even my name, and one person asked if I would look at their laptop quick...
http://www.youtube.com/watch?v=C7fsxnzZF9w
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Then don't create a system where employees are forced to question someone who might be the company CEO or a senior VP.
This is the core issue - security systems are set up where "playing it safe" for the employees means looking the other way.
The solution? Get rid of card reader-only secured doors. You need vertical turnstiles which ONLY allow one person through, and signs which clearly say that if you let someone through, YOU will be fired for that.
This has next to nothing to do with the financial crisis, as many financial insiders (like the old Lehman Brother's CEO and others) have discussed.
How do they know? Because they're insiders? There's so much misinformation and genuine complexity that it's almost impossible to say. However, look at this little tidbit in an article about Capital One's plans to buy ING Direct: http://dealbook.nytimes.com/2011/08/23/in-feds-move-on-capital-one-deal-a-test-of-dodd-frank/
Clarity, if not an answer, may have come inadvertently from National Community. The coalition argues that Capital One’s application to acquire ING Direct is suspect because Capital One refuses to lower its credit standards to extend Federal Housing Administration-insured loans to people with credit scores of 580. This is the lowest credit score allowed by the F.H.A. National Community contends that this is discriminatory against members of minority groups because they tend to have lower credit scores and have been hit harder by the financial crisis.
Capital One has responded by agreeing to lower its credit score requirements by 2012. For National Community, this is not enough, because Capital One’s F.H.A. loan volume is relatively flat in growth. Capital One is now a bit player with less than 1 percent of the F.H.A. loan market. National Community wants the combined entity to make more of these loans, since they help people who could not otherwise afford a mortgage.
Who is National Community? (http://www.ncrc.org/)
In recent years, NCRC has led efforts to reform the financial system, respond to the foreclosure crisis, and expand the Community Reinvestment Act. We are experts on banking, business development, community reinvestment, community development, civil rights, housing, and workforce issues.
I love the idea of "inadvertent clarity" here -- it's funny but absolutely true. This organization is working with the government to make banks, today, right now, take on more risk and make more loans to poor people, and fight legitimate business deals that reduce risk. They don't go out of their way to advertise the role they play in adding risk to the financial system, of course, but the fact that it was slipped into this rather dry article is awesome. You really don't see that happen in the NY Times too much.
You're claiming "Those loans were extremely profitable to the banks" -- I'm curious if the excerpt I posted makes you change your mind on that.
And you also claim "and in any case, it has nothing to do with the housing bubble in Spain, Ireland, China, etc" but surely you see how the largest market in the world (the US) has an affect on international banks (e.g. ING Direct is owned by a Dutch conglomerate).