The Art of Deception: Controlling the Human Element of Security

Chapter 5. "Let Me Help You"

we're all grateful when we're plagued by a problem and somebody with the knowledge, skill, and willingness comes along offering to lend us a hand. The social engineer understands that, and knows how to take advantage of it.

He also knows how to cause a problem for you . . . then make you grateful when he resolves the problem . . . and finally play on your gratitude to extract some information or a small favor from you that will leave your company (or maybe you, individually) very much worse off for the encounter. And you may never even know you've lost something of value.

Here are some typical ways that social engineers step forward to "help."

THE NETWORK OUTAGE

Day/Time: Monday, February 12, 3:25 p.m.

Place: Offices of Starboard Shipbuilding

The First Call: Tom DeLay

"Tom DeLay, Bookkeeping."

"Hey, Tom, this is Eddie Martin from the Help Desk. We're trying to troubleshoot a computer networking problem. Do you know if anyone in your group has been having trouble staying on line?"

"Uh, not that I know of."

"And you're not having any problems yourself."

"No, everything seems fine."

"Okay, that's good. Listen, we're calling people who might be affected 'cause it's important you let us know right away if you lose your network connection."

"That doesn't sound good. You think it might happen?"

"We hope not, but you'll call if it does, right?"

"You better believe it."

"Listen, sounds like having your network connection go down would be a problem for you . . ."

"You bet it would." ...