Terrific Tuesday The Twenty-Third

[cd34]

Originally Posted by RawAlex

Social engineering is the most powerful weapon for scammers and jammers. Kevin Mitnick proved this over and over again, not by exploiting the computer systems as much as exploiting people and procedures.

when I worked for a few oil companies in their security division, we had a premise security system with slow-scan video over 9600 baud modems that we had developed. Many times I was sent out to fix the systems and often times I could walk up to a store, gain access to the manager's office, unlock the system with a key -- all without ever providing any credentials. And often times without even having a uniform or any other identifying materials with me.

I can remember one time I was doing service on a Checkers Restaurant in Baltimore that had the system, and they let my wife wait in the managers office while I made some adjustments. There was easily $15k in cash in a huge pile sitting on the managers office with the door that was open. Even though I was called by the district manager, the store manager had no idea I was coming, opened the door, let me in, let me mess with security equipment, etc without ever even asking for ID.

Needless to say, security procedures were updated within the week at a number of gas stations, fast-food restaurants and convenience stores.

I walked into the District of Columbia's Police HQ many times with nothing more than a clipboard in hand. This always astonished the police officers that thought I had to be announced to get in.

Years ago when Prince George's County Maryland opened a new high-tech maximum security prison, I was installing computers and overseeing cable runs with immense security precautions. No hole larger than an 1/8" larger than the conduit, must be secured with 9" disks of 1/4" steel throughbolted with anti-reverse heads, etc.

However, I was able to drive a truck in through the mantrap, get to the loading dock, exchanged keys with my boss, walked out through the front gate without having to sign out, drove back to the office, got my next ticket assignment at the E911 facility about 18 miles away. When he tried to leave with 3 other guys, the guard in the mantrap said -- No, this isn't right -- and held them in the mantrap, put the jail in lockdown, initiated a prisoner count and waited to get hold of me. I was assigned a pager the very next day.

If you look official, or even sound official, walk the walk, talk the talk, you would be amazed at how easy it is to get around security.

After 9/11 though, it has become much more difficult and people are more wary, but, a convincing smile, a clipboard, well kempt appearance and functional yet well maintained khakis with a shirt and an emblem, and I'd bet that I could get into manager's offices just the same.