[ news_security_news ]
Security Pros, Beware Of No-Tech Hacks
David Utter
Staff Writer
2007-08-06
 Security News RSS Feed
Focus too much on Metasploit and application exploits, and you may be too engrossed to pay attention to the guy wearing a jumpsuit and carrying a toolbox.
It's possible to become effectively invisible in modern society. Not in an electronic sense, but in a way that people actively ignore others.
Internet News had an account of Johnny Long's talk at Black Hat about no-tech hacking one's way into places. It's the Jedi mind trick made real, only with a duplicate of a legitimate ID card instead of The Force making it work.
His experience with a copy of an AT&T name badge allowed him to get into all kinds of places. To the non-tech people in the workforce, the least desirable thing that could happen to them would be to have to talk to the techies.
They make the assumption that a phone guy wouldn't be there unless he had to be, so they let him go on his merry way. Plenty of people make judgment calls about others, and that seems to be Long's point. It's easy to take advantage of that.
I've seen that in real life too. A clipboard gives the illusion of being busy, since virtually no one totes a clipboard around all of the time. People look at the clipboard rather than the person.
Put on a worksuit and grab a toolbox, and the world practically sits up and begs for one to come on inside. In a typical white-collar office, no one wants to do dirty work that involves tools. It's obvious someone called the repair guy, right?
Many years ago in my younger geek days, I watched a guy dressed this way, complete with toolbox, casually stroll to the front of a long line awaiting the opening of a certain Midwestern gaming convention. He pounded on the door until he got the attention of a security guard, and angrily pointed at the toolbox and into the convention hall.
He made it inside. Later on, he turned out to be a friend of a friend, and I asked him what he was there to fix. He laughed at that; he just wanted to claim one of the few available lockers inside the convention hall before the hordes came pelting through the front doors.
This was around the time the Soviets were in Afghanistan and Bin Laden received funding from the CIA. Twenty years later, people still make the same basic mistakes that Long demonstrated and discussed with the Black Hat crowd.
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Security News RSS Feed
|
|
RSS
Archive
Contact Us
Advertise
