The Day I was a Social Engineer
In February of 2001, Kevin Mitnick – a famous hacker (in the "bad" sense of the word) – published a book called The Art of Deception. As an aspiring computer whiz at the time, I was enamored at the idea of tales of the early days of breaking and entering, geek style. Compare it to how a modern day sociopath might view the publication of O.J.'s book. Only less creepy.
Now, you might recall – especially if you're my mom, and one of you is – that our laws prevent you from profiting from your crimes. Mitnick was convicted of various computer crimes, so instead of poorly disguising his confessions behind bad grammar (Seriously… they're publishing a book called, "If I Did It: Here's How It Happened" ?! I'm sure dead English teachers across the globe are rolling over in their graves.) he had to be creative. Not that this was difficult for him, considering the subject matter. So Kevin's book used fictional characters to tell fictional stories with non fictional lessons, under the guise that it would help managers and secretaries alike prevent unauthorized access to private networks. This is the only book I've ever pre-ordered. This was my Wii.
I lost interest pretty quickly. I wanted to read exciting accounts about tricking security guards to give him the modem's telephone number – but the book turned out to be pretty dry and, unfortunately, did a fairly good job at it's claimed intention of education and prevention. Not too exciting at all. Last I recall, I gave the book to my dad. I hope he enjoyed it more than I did.
But I did learn a thing or two. The big thing was that Social Engineering, convincing people to give you information they probably shouldn't, isn't that hard. You just have to play to their sympathy and add a little bit of charm. Obviously I learned well, because a couple of weeks ago I smooth talked my way through activating an eBay purchased Treo on my Verizon account. Yes I know this is perfectly legal, but in my defense the phone I received ended up looking kind of shadily obtained.
I don't know why, but I didn't want to admit that I had bought the phone from someone on eBay. I told the woman working customer service that it was my dad's. I told her that he had purchased it a while ago (they don't even sell this model any more) and that he just got a new job and his new job gave him the latest model, so he gave me this older one. This is where it starts to get a little tricky.
These days, a phone's ESN is printed on a sticker and placed somewhere underneath the battery. With this older model of the Treo that didn't have a detachable battery, the ESN sticker was simply stuck to the back of the phone. Unfortunately it was completely missing. Not even a trace of glue. As soon as she said that, I had images of guns with the serial number scraped off running through my head. "Fudge Monkeys" I thought. "What am I going to tell them if it turns out the phone was stolen? Why has she been gone so long? Could she be calling the cops?" I paced the hallway between the customer service desk and the sales floor, where she claimed she was going to ask one of the techie guys how to get the ESN from the phone's internal programming, urinating a little bit in my pants. I decided I would tell the truth. That I had bought it on eBay and I would turn in the seller if they wanted me to.
Somewhere between 15 minutes and 3 days later, she returned and told me that with some assistance she was able to find the ESN. Now we just had to confirm the old account details and it would be mine-all-mine. Crap. She found the fatal flaw of my cover story!
I'm not sure if it was my dashing good looks or if some people really are stupid enough to not know or remember where their dad works. I prefer to think it was my looks. Either way, I played dumb. She immediately came back with, "Was it `Sun` something?" AHA! She's going to give it away… I just have to press her for it a little bit.
"I don't know. That sounds really familiar. Maybe."
"Sun Microsystems?"
"Yeah, that's it!"
Five minutes later I was signing some paperwork that approved the service change for our contract and granted Verizon an additional two year claim to our eternal souls – or something equally confusing – and she waived the standard $20 fee for what she claims was my trouble but we both know was my gorgeous smile.
So thanks, Kevin.
Now, you might recall – especially if you're my mom, and one of you is – that our laws prevent you from profiting from your crimes. Mitnick was convicted of various computer crimes, so instead of poorly disguising his confessions behind bad grammar (Seriously… they're publishing a book called, "If I Did It: Here's How It Happened" ?! I'm sure dead English teachers across the globe are rolling over in their graves.) he had to be creative. Not that this was difficult for him, considering the subject matter. So Kevin's book used fictional characters to tell fictional stories with non fictional lessons, under the guise that it would help managers and secretaries alike prevent unauthorized access to private networks. This is the only book I've ever pre-ordered. This was my Wii.
I lost interest pretty quickly. I wanted to read exciting accounts about tricking security guards to give him the modem's telephone number – but the book turned out to be pretty dry and, unfortunately, did a fairly good job at it's claimed intention of education and prevention. Not too exciting at all. Last I recall, I gave the book to my dad. I hope he enjoyed it more than I did.
But I did learn a thing or two. The big thing was that Social Engineering, convincing people to give you information they probably shouldn't, isn't that hard. You just have to play to their sympathy and add a little bit of charm. Obviously I learned well, because a couple of weeks ago I smooth talked my way through activating an eBay purchased Treo on my Verizon account. Yes I know this is perfectly legal, but in my defense the phone I received ended up looking kind of shadily obtained.
I don't know why, but I didn't want to admit that I had bought the phone from someone on eBay. I told the woman working customer service that it was my dad's. I told her that he had purchased it a while ago (they don't even sell this model any more) and that he just got a new job and his new job gave him the latest model, so he gave me this older one. This is where it starts to get a little tricky.
These days, a phone's ESN is printed on a sticker and placed somewhere underneath the battery. With this older model of the Treo that didn't have a detachable battery, the ESN sticker was simply stuck to the back of the phone. Unfortunately it was completely missing. Not even a trace of glue. As soon as she said that, I had images of guns with the serial number scraped off running through my head. "Fudge Monkeys" I thought. "What am I going to tell them if it turns out the phone was stolen? Why has she been gone so long? Could she be calling the cops?" I paced the hallway between the customer service desk and the sales floor, where she claimed she was going to ask one of the techie guys how to get the ESN from the phone's internal programming, urinating a little bit in my pants. I decided I would tell the truth. That I had bought it on eBay and I would turn in the seller if they wanted me to.
Somewhere between 15 minutes and 3 days later, she returned and told me that with some assistance she was able to find the ESN. Now we just had to confirm the old account details and it would be mine-all-mine. Crap. She found the fatal flaw of my cover story!
I'm not sure if it was my dashing good looks or if some people really are stupid enough to not know or remember where their dad works. I prefer to think it was my looks. Either way, I played dumb. She immediately came back with, "Was it `Sun` something?" AHA! She's going to give it away… I just have to press her for it a little bit.
"I don't know. That sounds really familiar. Maybe."
"Sun Microsystems?"
"Yeah, that's it!"
Five minutes later I was signing some paperwork that approved the service change for our contract and granted Verizon an additional two year claim to our eternal souls – or something equally confusing – and she waived the standard $20 fee for what she claims was my trouble but we both know was my gorgeous smile.
So thanks, Kevin.
Recent Comments