-=+[SOCIAL ENGINEERING]+=- ========================== WRITTEN BY BOXPHREAK ON 11/7/00 =============================== WWW.PHREAK2600.COM ================== Social Engineering , a concept of manipulation , quick thinking and knowing what to say to make yourself *seem* as if it's ok to tell you , to make it *seem* as if your source can trust you and provide you with the information your looking for confidently, with minimal doubts that you already possessed it or were supposed to have access to it ... or perhaps transfer you to that outside line by dialing it's extension for you. But how can you make yourself seem to be an employee from accounting who's phone is broken or who forgot the outside line extension ? This is the ultimate goal , the challenge of social engineering, to exploit the worker , get the information you want and need. First you have your goal ...to get whatever information you desire...regardless of what it is , the same general routine exists: + Get all the info you can on your target, work hours, family members name's, anything you feel would be relevant to the social engineering scheme you wish to pull off,... in this example well use our victim Tyrel Houseman *Tyrel is a normal guy , but hell he got some people fired from there networking job so now there's a hit out for him, on every aspect of his life that can be impersonated that is.... Scene One: Background info on Tyrel Social engineering is critical here as we are going to call Ty as his home residence. We should be able to find his number in the phonebook , but hell who wants to flip through goddam pages of numbers when there's 555- 1212.com . While were at it why not look up local pizza places too , as well as Ty's work number. So we now know a few phone numbers right ? what's the big deal , well now we can have some fun .... but what to do ? why not call his work place , McDonalds pretending to be him and scheduling crazy hours for him , or just plain making up family emergencies... wouldn't it be fun to make ty think his mom got hurt in a horrible accident ....? maybe it's cruel but after all he got me fired from work so here's how the conversation went .. we outlined the probably questions that would be asked , location , time , and the traffic conditions , all of these elements are considered to make the story sound more believable ....now here social engineering is used to extract an emotion from our victim ty , the emotion of compassion , for him mother. Call # 1: From 555-1212.com we have Ty's address too , what fun ...now we can go to his house to prepare for what we have in store for him .... find his green teleco TNI box , cut all the goddam wires coming out of it , kill his fucking phone...in case he tries to call home after hearing the unfortunate news that mommy got into an auto wreck. Dialing of phone to call Mc Donalds (XXX) XXX-XXXX Underpaid slave woman: Hello McDonald's Boxphreak: Hello my name is Woody Freeze , and im a police office with the name of your law enforcement's agency here, Im going to need to speak to a manager in regarding one of the employees there .( Why did we ask for the manager , to make it more believable , because when the manager calls ty from his register it's going to allready make him nervous as to just what the manager called him for , what could have possibly happened? * boxphreak does not endorse pretending to be officers of the law and may not be held accountable for anything stupid you might do to get you self arrested after reading this article) Underpaid slave woman: Just one moment, ill put Mr.Boss on right away Mr.Boss: Hello , how can I help you officer Freeze ? Boxphreak : Hello Mr.Boss , Im calling in regards to one of your employees Tyrel Houseman , it seems I have some rather unfortunate news that I'd need you to tell him as his mother was involved in an accident , could I please speak with him? Ty: ( nervous from his boss describing his mom's accident) yesssss.....? hello? Boxphreak: hello Tyrel it seems I have some rather unfortunate news that I'd need tell you , news that no one should ever have to hear ... your mother was on her way home from ( critical info here , find out if he drives or .gets dropped off by mommy) insert a common place here I.E. a Grocery Store and a horrific event seems to have taken place, your mother was struck head on by a weary motorist not paying attention , from what we can make out here at the scene the light apparently struck the driver at fault in the eyes and blocked his vision , your mother didn't even have time to react to the situation , she is now stable though and in critical condition at Hospital near you. these can be difficult events to go through son, and I wish you the best of luck...Goodbye Ty: (Crying and nervous) no.....oh god no.....(weeps,sobbs) ...Goodbye Now what just happened? Tyrel just was convinced that his mom was in an auto wreck , but how this was done is the aspect of social engineering... The critical components of the situation are as follows : 1. sound professional , practice on telemarketers , operators, whoever ...the more you practice the better you'll get if are determined (...its sort of like sex ...) 2. Now I know it was a cruel thing to do, make ty worry and all but hell he shouldn't have gotten me fired from my job , shit happens right? 3.The tone of your voice is critical to sounding professional , sound compassionate , sound sorry , remember your an actor ...play your role , the better you play your role the more ty's gonna think his mama's hurtin in the hospital If we just called up and were like " um ty ...your mom got hurt in a car accident and is dead" no one would believe us , but since we go through the boss, have a professional association and have a good script we become the truth or at least sound like it... Its a stage, your an actor ...seriously..no shit right ....you have to be that outside technician looking for the DATU number or info from CN/A..the more you get into your role ..the more info your likely to get... Though it may seem hard at first, practice makes perfect as they say, so don't get discouraged if you get turned down, hopefully you've learned a few things on what and what not to say, of the coincidence level your supposed to possess...a forgetful bell worker on his first day as an maintenance man is going to sound more worried about getting directions to the maintenance yard as is "Bill" looking to check his voice mail box because he forgot his access code. An access code which he didn't change so it was the default ... see where im going with this ...you need the default code , scan for some unused VMB's and there you go , a nice new home for all of your drug dealing messages....or I suppose you could just hack Ty's 1987 Sony answering machine and check your messages from that , but hell ...an 800 VMB is just nicer. - Boxphreak ------------------------------------------------------------------------------------------------- Shoutouts to ..: Pentium Cowboy, ChaoticPhreak, Cycad, Prefix, Crispexi and everyone else in #hackphreak on EFnet and irc.ussrback.com ------------------------------------------------------------------------------------------------- (c) COPYRIGHT 2000 Phreak2600.com All rights reserved