Published by Adrian
on Tuesday, April 11, 2006 at 1:43 PM.
Here is another example from Mitnik's Book of what you can do with only good telemarketing skills and a phone
We like to think that government agencies with files on us keep the information safely locked away from people without an authentic need to know. The reality is that even the federal government isn't as immune to penetration as we would like to imagine.
May Linn’s Phone Call
Place: A regional office of the Social Security Administration
Time: 10:18 A.M., Thursday morning
“- Mod Three. This is May Linn Wang.” The voice on the other end of the phone sounded apologetic, almost timid.
“- Ms. Wang, this is Arthur Arondale, in the Office of the Inspector General. Can I call you ‘May’?”
“- It's ‘May Linn’,” she said.
“- Well, it's like this, May Linn. We've got a new guy in here who there's no computer for yet, and right now he's got a priority project and he's using mine. We're the government of the United States, for cryin' out loud, and they say they don't have enough money in the budget to buy a computer for this guy to use. And now my boss thinks I'm falling behind and doesn't want
to hear any excuses, you know?”
“- I know what you mean, all right.”
“- Can you help me with a quick inquiry on MCS?” he asked, using the name of the computer system for looking up taxpayer information.
“- Sure, what'cha need?” “The first thing I need you to do is an alphadent on Joseph Johnson, DOB 7/4/69.” (Alphadent means to have the computer search for an account alphabetically by taxpayer name, further identified by date of birth.) After a brief pause, she asked:
“- What do you need to know?”
“- What's his account number?” he said, using the insider's shorthand for the social security number. She read it off.
“- Okay, I need you to do a numident on that account number,” the caller said. That was a request for her to read off the basic taxpayer data, and May Linn responded by giving the taxpayer's place of birth, mother's maiden name, and father's name. The caller listened patiently while she also gave him the month and year the card was issued, and the district office it was issued by. He next asked for a DEQY. (Pronounced “DECK-wee,” it's short for “detailed earnings query.”)
The DEQY request brought the response, “For what year?” The caller replied, “Year 2001.”
May Linn said, “The amount was $190,286, the payer was Johnson MicroTech.”
“- Any other wages?”
“- Thanks,” he said. “You've been very kind.”
Then he tried to arrange to call her whenever he needed information and couldn't get to his computer, again using the favorite trick of social engineers of always trying to establish a connection so that he can keep going back to the same person, avoiding the nuisance of having to find a new mark each time.
“- Not next week,” she told him, because she was going to Kentucky for her sister's wedding.” Any other time, she'd do whatever she could. When she put the phone down, May Linn felt good that she had been able to offer a little help to a fellow unappreciated public servant.