Chapter 15
Most people don't give much thought to what they're discarding at home: phone bills, credit card statements, medical prescription bottles, bank statements, work-related materials, and so much more.
At work, employees must be made aware that people do look through trash to obtain information that may benefit them.
During my high school years, I used to go digging through the trash behind the local phone company buildings--often alone but occasionally with friends who shared an interest in learning more about the telephone company. Once you became a seasoned Dumpster diver, you learn a few tricks, such as how to make special efforts to avoid the bags from the restrooms, and the necessity of wearing gloves.
Dumpster diving isn't enjoyable, but the payoff was extraordinary-- internal company telephone directories, computer manuals, employee lists, discarded printouts showing how to program switching equipment, and more--all there for the taking.
I'd schedule visits for nights when new manuals were being issued, because the trash containers would have plenty of old ones, thoughtlessly thrown away. And I'd go at other odd times as well, looking for any memos, letters, reports, and so forth, that might offer some interesting gems of information.
On arriving I'd find some cardboard boxes, pull them out and set them aside. If anyone challenged me, which happened now and then, I'd say that a friend was moving and I was just looking for boxes to help him pack. The guard never noticed all the doc.u.ments I had put in the boxes to take home. In some cases, he'd tell me to get lost, so I'd just move to another phone company central office.
LINGO.
DUMPSTER DRIVING Going through a company's garbage (often in an outside and vulnerable Dumpster) to find discarded information that either itself has value, or provides a tool to use in a social engineering attack, such as internal phone numbers or t.i.tles Going through a company's garbage (often in an outside and vulnerable Dumpster) to find discarded information that either itself has value, or provides a tool to use in a social engineering attack, such as internal phone numbers or t.i.tles I don't know what it's like today, but back then it was easy to tell which bags might contain something of interest. The floor sweepings and cafeteria garbage were loose in the large bags, while the office wastebaskets were all lined with white disposable trash bags, which the cleaning crew would lift out one by one and wrap a tie around.
One time, while searching with some friends, we came up with some sheets of paper torn up by hand. And not just torn up: someone had gone to the trouble of ripping the sheets into tiny pieces, all conveniently thrown out in a single five-gallon trash bag. We took the bag to a local donut shop, dumped the pieces out on a table, and started a.s.sembling them one by one.
We were all puzzle-doers, so this offered the stimulating challenge of a giant jigsaw puzzle... but turned out to have more than a childish reward. When done, we had pieced together the entire account name and pa.s.sword list for one of the company's critical computer systems.
Were our Dumpster-diving exploits worth the risk and the effort? You bet they were. Even more than you would think, because the risk is zero. It was true then and still true today: As long as you're not trespa.s.sing, poring through someone else's trash is 100 percent legal.
Of course, phone phreaks and hackers aren't the only ones with their heads in trash cans. Police departments around the country paw through trash regularly, and a parade of people from Mafia dons to petty embezzlers have been convicted based in part on evidence gathered from their rubbish. Intelligence agencies, including our own, have resorted to this method for years.
It may be a tactic too low down for James Bond--movie-goers would much rather watch him outfoxing the villain and bedding a beauty than standing up to his knees in garbage. Real-life spies are less squeamish when something of value may be bagged among the banana peels and coffee grounds, the newspapers and grocery lists. Especially if gathering the information doesn't put them in harm's way.
Cash for Trash Corporations play the Dumpster-diving game, too. Newspapers had a field day in June 2000, reporting that Oracle Corporation (whose CEO, Larry Ellison, is probably the nation's most outspoken foe of Microsoft) had hired an investigative firm that had been caught with their hands in the cookie jar. It seems the investigators wanted trash from a Microsoft-supported lobbying outfit, ACT, but they didn't want to risk getting caught. According to press reports, the investigative firm sent in a woman who offered the janitors $60 to let her have the ACT trash. They turned her down. She was back the next night, upping the offer to $500 for the cleaners and $200 for the supervisor.
The janitors turned her down and then turned her in.
Leading on-line journalist Declan McCullah, taking a leaf from literature, t.i.tled his Wired News story on the episode, "'Twas Oracle That Spied on MS." Time magazine, nailing Oracle's Ellison, t.i.tled their article simply "Peeping Larry."
a.n.a.lyzing the Con Based on my own experience and the experience of Oracle, you might wonder why anybody would bother taking the risk of stealing someone's trash.
The answer, I think, is that the risk is nil and the benefits can be substantial.
Okay, maybe trying to bribe the janitors increases the chance of consequences, but for anyone who's willing to get a little dirty, bribes aren't necessary.
For a social engineer, Dumpster diving has its benefits. He can get enough information to guide his a.s.sault against the target company, including memos, meeting agendas, letters and the like that reveal names, departments, t.i.tles, phone numbers, and project a.s.signments. Trash can yield company organizational charts, information about corporate structure, travel schedules, and so on. All those details might seem trivial to insiders, yet they may be highly valuable information to an attacker.
Mark Joseph Edwards, in his book Internet Security with Windows NT, talks about "entire reports discarded because of typos, pa.s.swords written on sc.r.a.ps of paper, 'While you were out' messages with phone numbers, whole file folders with doc.u.ments still in them, diskettes and tapes that weren't erased or destroyed- -all of which could help a would-be intruder."
The writer goes on to ask, "And who are those people on your cleaning crew?
You've decided that the cleaning crew won't [be permitted to] enter the computer room but don't forget the other trash cans. If federal agencies deem it necessary to do background checks on people who have access to their wastebaskets and shredders, you probably should as well."
MITNICK MESSAGE.
Your trash may be your enemy's treasure. We don't give much consideration to the materials we discard in our personal lives, so why should we believe people have a different att.i.tude in the workplace? It all comes down to educating the workforce about the danger (unscrupulous people digging for valuable information) and the vulnerability (sensitive information not being shredded or properly erased).
THE HUMILIATED BOSS.
n.o.body thought anything about it when Harlan Fortis came to work on Monday morning as usual at the County Highway Department, and said he'd left home in a hurry and forgotten his badge. The security guard had seen Harlan coming in and going out every weekday for the two years she had been working there. She had him sign for a temporary employee's badge, gave it to him, and he went on his way.
It wasn't until two days later that all h.e.l.l started breaking loose. The story spread through the entire department like wildfire. Half the people who heard it said it couldn't be true. Of the rest, n.o.body seemed to know whether to laugh out loud or to feel sorry for the poor soul.
After all, George Adamson was a kind and compa.s.sionate person, the best head of department they'd ever had. He didn't deserve to have this happen to him.
a.s.suming that the story was true, of course.
The trouble had begun when George called Harlan into his office late one Friday and told him, as gently as he could, that come Monday Harlan would be reporting to a new job. With the Sanitation Department. To Harlan, this wasn't like being fired. It was worse; it was humiliating. He wasn't going to take it lying down.
That same evening he seated himself on his porch to watch the homeward- bound traffic. At last he spotted the neighborhood boy named David who everyone called "The War Games Kid" going by on his moped on the way home from high school. He stopped David, gave him a Code Red Mountain Dew he had bought especially for the purpose, and offered him a deal: the latest video game player and six games in exchange for some computer help and a promise of keeping his mouth shut.
After Harlan explained the project - without giving any of the compromising specifics--David agreed. He described what he wanted Harlan to do. He was to buy a modem, go into the office, find somebody's computer where there was a spare phone jack nearby, and plug in the modem. Leave the modem under the desk where n.o.body would be likely to see it. Then came the risky part. Harlan had to sit down at the computer, install a remote-access software package, and get it running. Any moment the man who worked in the office might show up, or someone might walk by and see him in another person's office. He was so uptight that he could hardly read the instructions that the kid had written down for him.
But he got it done, and slipped out of the building without being noticed.
Planting the
A bit of hunting turned up the file called BudgetSlides2002.ppt, which the boy downloaded onto Harlan's computer. Harlan then told the kid to go on home, and come back in a couple of hours.
When David returned, Harlan asked him to reconnect to the Highway Department computer system and put the same file back where they had found it, overwriting the earlier version. Harlan showed David the video game player, and promised that if things went well, he'd have it the next day.
Surprising George You wouldn't think that something sounding as dull as budget hearings would be of much interest to anyone, but the meeting chamber of the County Council was packed, filled with reporters, representatives of special interest groups, members of the public, and even two television news crews.
George always felt much was at stake for him in these sessions. The County Council held the purse strings, and unless George could put on a convincing presentation, the Highways budget would be slashed. Then everyone would start complaining about potholes and stuck traffic lights and dangerous intersections, and blaming him, and life would be miser able for the whole coming year. But when he was introduced that evening, he stood up feeling confident. He had worked six weeks on this presentation and the PowerPoint visuals, which he had tried out on his wife, his top staff people, and some respected friends. Everyone agreed it was his best presentation ever.
The first three PowerPoint images played well. For a change, every Council member was paying attention. He was making his points effectively.
And then all at once everything started going wrong. The fourth image was supposed to be a beautiful photo at sunset of the new highway extension opened last year. Instead it was something else, something very embarra.s.sing. A photograph out of a magazine like Penthouse or Hustler. He could hear the audience gasp as he hurriedly hit the b.u.t.ton on his laptop to move to the next image.
This one was worse. Not a thing was left to the imagination.
He was still trying to click to another image when someone in the audience pulled out the power plug to the projector while the chairman banged loudly with his gavel and shouted above the din that the meeting was adjourned.
a.n.a.lyzing the Con Using a teenage hacker's expertise, a disgruntled employee managed to access the computer of the head of his department, download an important PowerPoint presentation, and replace some of the slides with images certain to cause grave embarra.s.sment. Then he put the presentation back on the man's computer.
With the modem plugged into a jack and connected to one of the office computers, the young hacker was able to dial in from the outside. The kid had set up the remote access software in advance so that, once connected to the computer, he would have full access to every file stored on the entire system.
Since the computer was connected to the organization's network and he already knew the boss's username and pa.s.sword, he could easily gain access to the boss's files.
Including the time to scan in the magazine images, the entire effort had taken only a few hours. The resulting damage to a good man's reputation was beyond imagining.
MITNICK MESSAGE.
The vast majority of employees who are transferred, fired, or let go in a downsizing are never a problem. Yet it only takes one to make a company realize too late what steps they could have taken to prevent disaster.
Experience and statistics have clearly shown that the greatest threat to the enterprise is from insiders. It's the insiders who have intimate knowledge of where the valuable information resides, and where to hit the company to cause the most harm.
THE PROMOTION SEEKER.
Late in the morning of a pleasant autumn day, Peter Milton walked into the lobby of the Denver regional offices of Honorable Auto Parts, a national parts wholesaler for the automobile aftermarket. He waited at the reception desk while the young lady signed in a visitor, gave driving directions to a caller, and dealt with the UPS man, all more or less at the same time.
"So how did you learn to do so many things at once?" Pete said when she had time to help him. She smiled, obviously pleased he had noticed. He was from Marketing in the Dallas office, he told her, and said that Mike Talbott from Atlanta field sales was going to be meeting him. "We have a client to visit together this afternoon," he explained. I'll just wait here in the lobby."
"Marketing." She said the word almost wistfully, and Pete smiled at her, waiting to hear what was coming. "If I could go to college, that's what I'd take," she said.
"I'd love to work in Marketing."
He smiled again. "Kaila," he said, reading her name off the sign on the counter, "We have a lady in the Dallas office who was a secretary. She got herself moved over to Marketing. That was three years ago, and now she's an a.s.sistant marketing manager, making twice what she was."
Kaila looked starry-eyed. He went on, "Can you use a computer?" "Sure," she said.
"How would you like me to put your name in for a secretary's job in Marketing.
She beamed. "For that I'd even move to Dallas."
"You're going to love Dallas," he said. "I can't promise an opening right away, but I'll see what I can do."
She thought that this nice man in the suit and tie and with the neatly trimmed, well-combed hair might make a big difference in her working life.
Pete sat down across the lobby, opened his laptop, and started getting some work done. After ten or fifteen minutes, he stepped back up to the counter. "Listen," he said, "it looks like Mike must've been held up. Is there a conference room where I could sit and check my emails while I'm waiting?"
Kaila called the man who coordinated the conference room scheduling and arranged for Pete to use one that wasn't booked. Following a pattern picked up from Silicon Valley companies (Apple was probably the first to do this) some of the conference rooms were named after cartoon characters, others after restaurant chains or movie stars or comic book heroes. He was told to look for the Minnie Mouse room. She had him sign in, and gave him directions to find Minnie Mouse.
He located the room, settled in, and connected his laptop to the Ethernet port.
Do you get the picture yet?
Right--the intruder had connected to the network behind the corporate firewall.
Anthony's Story I guess you could call Anthony Lake a lazy businessman. Or maybe "bent" comes closer.
Instead of working for other people, he had decided he wanted to go to work for himself; he wanted to open a store, where he could be at one place all day and not have to run all over the countryside. Only he wanted to have a business that he could be as sure as possible he could make money at.
What kind of store? That didn't take long to figure out. He knew about repairing cars, so an auto parts store.
And how do you build in a guarantee of success? The answer came to him in a flash: convince auto parts wholesaler Honorable Auto Parts to sell him all the merchandise he needed at their cost.
Naturally they wouldn't do this willingly. But Anthony knew how to con people, his friend Mickey knew about breaking into other people's computers, and together they worked out a clever plan.
That autumn day he convincingly pa.s.sed himself off as an employee named Peter Milton, and he had conned his way inside the Honorable Auto Parts offices and had already plugged his laptop into their network. So far, so good, but that was only the first step. What he still had to do wouldn't be easy, especially since Anthony had set himself a fifteen-minute time limit--any longer and he figured that the risk of discovery would be too high.
MITNICK MESSAGE.
Train your people not to judge a book solely by its cover--just because someone is well-dressed and well-groomed he shouldn't be any more believable.
In an earlier phone call pretexting as a support person from their computer supplier, he had put on a song-and-dance act. "Your company has purchased a two-year support plan and we're putting you in the database so we can know when a software program you're using has come out with a patch or a new updated version. So I need to have you tell me what applications you're using."
The response gave him a list of programs, and an accountant friend identified the one called MAS 90 as the target--the program that would hold their list of vendors and the discount and payment terms for each.
With that key knowledge, he next used a software program to identifiy," all the working hosts on the network, and it didn't take him long to locate the correct server used by the Accounting department. From the a.r.s.enal of hacker tools on his laptop, he launched one program and used it to identify all of the authorized users on the target server. With another, he then ran a list of commonly used pa.s.swords, such as "blank," and "pa.s.sword" itself. "Pa.s.sword" worked. No surprise there. People just lose all creativity when it comes to choosing pa.s.swords.
Only six minutes gone, and the game was half over. He was in.
Another three minutes to very carefully add his new company, address, phone number, and contact name to the list of customers. And then for the crucial entry, the one that would make all the difference, the entry that said all items were to be sold to him at 1 percent over Honorable Auto Parts' cost.
In slightly under ten minutes, he was done. He stopped long enough to tell Kaila thanks, he was through checking his emails. And he had reached Mike Talbot, change of plans, he was on the way to a meeting at a client's office. And he wouldn't forget about recommending her for that job in Marketing, either.
a.n.a.lyzing the Con The intruder who called himself Peter Milton used two psychological subversion techniques--one planned, the other improvised on the spur of the moment.
He dressed like a management worker earning good money. Suit and tie, hair carefully styled--these seem like small details, but they make an impression. I discovered this myself, inadvertently. In a short time as a programmer at GTE California--a major telephone company no longer in existence--I discovered that if I came in one day without a badge, neatly dressed but casual--say, sports s.h.i.+rt, chinos, and Dockers--I'd be stopped and questioned. Where's your badge, who are you, where do you work? Another day I'd arrive, still without a badge but in a suit and tie, looking very corporate. I'd use a variation of the age-old piggybacking technique, blending in with a crowd of people as they walk into a building or a secure entrance. I would latch onto some people as they approached the main entrance, and walk in chatting with the crowd as if I was one of them. I walked past, and even if the guards noticed I was badge-less, they wouldn't bother me because I looked like management and I was with people who were wearing badges.
From this experience, I recognized how predictable the behavior of security guards is. Like the rest of us, they were making judgments based on appearances- -a serious vulnerability that social engineers learn to take advantage of.
The attacker's second psychological weapon came into play when he noticed the unusual effort that the receptionist was making. Handling several things at once, she didn't get testy but managed to make everyone feel they had her full attention.
He took this as the mark of someone interested in getting ahead, in proving herself. And then when he claimed to work in the Marketing department, he watched to see her reaction, looking for clues to indicate if he was establis.h.i.+ng a rapport with her. He was. To the attacker, this added up to someone he could manipulate through a promise of trying to help her move into a better job. (Of course, if she had said she wanted to go into the Accounting department, he would have claimed he had contacts for getting her a job there, instead.) Intruders are also fond of another psychological weapon used in this story: building trust with a two-stage attack. He first used that chatty conversation about the job in Marketing, and he also used "name- dropping"--giving the name of another employee--a real person, incidentally, just as the name he himself used was the name of a real employee.
He could have followed up the opening conversation right away with a request to get into a conference room. But instead he sat down for a while and pretended to work, supposedly waiting for his a.s.sociate, another way of allaying any possible suspicions because an intruder wouldn't hang around. He didn't hang around for very long, though; social engineers know better than to stay at the scene of the crime any longer than necessary.
MITNICK MESSAGE.
Allowing a stranger into an area where he can plug a laptop into the corporate network increases the risk of a security incident. It's perfectly reasonable for an employee, especially one from offsite, to want to check his or her email from a conference room, but unless the visitor is established as a trusted employee or the network is segmented to prevent unauthorized connections, this may be the weak link that allows company files to be compromised.
Just for the record: By the laws on the books at the time of this writing, Anthony had not committed a crime when he entered the lobby. He had not committed a crime when he used the name of a real employee. He had not committed a crime when he talked his way into the conference room. He had not committed a crime when he plugged into the company's network and searched for the target computer.
Not until he actually broke in to the computer system did he break the law.
SNOOPING ON KEVIN.
Many years ago when I was working in a small business, I began to notice that each time I walked into the office that I shared with the three other computer people who made up the IT department, this one particular guy (Joe, I'll call him here) would quickly toggle the display on his computer to a different window. I immediately recognized this as suspicious. When it happened two more times the same day, I was sure something was going on that I should know about. What was this guy up to that he didn't want me to see?
Joe's computer acted as a terminal to access the company's minicomputers, so I installed a monitoring program on the VAX minicomputer hat allowed me to spy on what he was doing. The program acted as if a TV camera was looking over his shoulder, showing me exactly what he was seeing on his computer.
My desk was next to Joe's; I turned my monitor as best I could to partly mask his view, but he could have looked over at any moment and realized I was spying on him. Not a problem; he was too enthralled in what he was doing to notice.
What I saw made my jaw drop. I watched, fascinated, as the b.a.s.t.a.r.d called up my payroll data. He was looking up my salary!
I had only been there a few months at the time and I guessed Joe couldn't stand the idea that I might have been making more than he was.
A few minutes later I saw that he was downloading hacker tools used by less experienced hackers who don't know enough about programming to devise the tools for themselves. So Joe was clueless, and had no idea that one of American's most experienced hackers was sitting right next to him. I thought it was hilarious.
He already had the information about my pay; so it was too late to stop him.
Besides, any employee with computer access at the IRS or the Social Security Administration can look your salary up. I sure didn't want to tip my hand by letting him know I'd found out what he was up to. My main goal at the time was maintaining a low profile, and a good social engineer doesn't advertise his abilities and knowledge. You always want people to underestimate you, not see you as a threat.
So I let it go, and laughed to myself that Joe thought he knew some secret about me, when it was the other way around: I had the upper hand by knowing what he had been up to.