To improve your chances of getting in with social engineering, here are some tips. Notice how the person you speak to reacts to your questions. If you speak to a receptionist or other worker on the bottom of the pay ladder, he or she may not want to chit chat or fool around with computers if he or she's being monitored, or if
calls are being screened by the boss.
Go to some public place where they have terminals hooked up, and look at the wall where the terminal is connected to the phone box. Write down the four digits that appear on the box (these are the last four digits of the phone line that the terminal is hooked to). Guess the first three digits of the number by looking at a directory for the "public place" in question. Call a couple times at different times of day to make sure the line is always busy. Keep some of these "leased line" phone numbers handy when you social engineer to give to people who want to call you back. This is especially true of sysops who suspect you're a hacker and want to see if you're brave enough to give them personal identification information about yourself. This is better than just making up a phone number out of thin air, because if they do call up, the busy signal will at least create some reassurance in their mind that you weren't a complete fake.
Just giving them a number will usually relax them enough so they feel you are one to be trusted.
Confront people in a lighthearted way when they give you a password. Say, "Are you sure that's really the one you use?" Secretaries may have two passwords. One is their own, which grants them access to a low-level group account. The other is their boss's password, a higher level one that they know about because, frankly, sec-retaries know everything about an organization.
Challenging someone in a non-accusatory way about the password you are given may also cause them to fess up if they had indeed given you an invalid password to get you off their backs. Second guessing them shows that you al-ready knew the correct password, and that you caught them in a lie.
If they are bewildered when you ask for a higher password, just say, "Didn't they upgrade your access yet? They just bought this whole new system that's supposed to work fifty times faster and everyone's saying how wonderful it is...... Then quickly change the subject.
Have a background tape playing with office sounds or whatever is appropriate for the num-ber you call. Before using this tape, try to take a tour of the company and listen to the real sounds made during the work day. Also, play the tape for a friend over the telephone, and similarly have a friend play the tape while you listen over the phone - trying to adjust the tape to a realistic sound level. Remember that if you're the "first one in the office" as with our naive user example, you don't want the tape to include background chatter or typing!
When you're talking to people, even if it's just over the telephone, keep a smile on your face and act in a jovial, friendly manner. Pretend you're that person's best friend. If the person picks up the phone with a, "Hello, General Widgit Corporation, Lulu speaking," you re-spond with, "Hi Lulu! This is..." and go on with your spiel.
Now Lulu doesn't know if you two have met before, and as you continue with your friendly attitude, she will begin to treat you more like a friend. Try looking through some books on voice marketing, telephone selling, etc., to get more ideas.
The way in which your phone call is re-ceived can also affect your credibility. Often a company telephone will make a different sort of ring, depending on whether the caller is on an inside or outside line. Since you are pretending to be an inside caller, you will want your tele-phone ring to reflect that. To fix that, call a wrong
office or department in the company, and have them transfer you to the number you're after. For instance:
PERSON ON OTHER END: "Advertising. May I help you?"
YOU:"I'm sorry, I guess I dialed wrong. Would you mind transferring me to extension 4358?
Now you'll get that in-house ring, and with it, an air of authority (and maybe even a special inside caller light will flash on the telephone, too).
Another way to get that desirable inside caller ring/light is to dial, not the listed number, but one next to it. Any organization with more than one phone line almost certainly owns a block of phone numbers. So if the listed number to call is 123- 4567, try calling 123-4568, or some-thing a few digits higher or lower. Your call
will usually go through, and it will take on the clout of having been placed by someone who is ap-parently a company insider - anyone else would have dialed the listed number.
Another thing to consider is if you're trying to reach a higher-up in the corporation, you may only end up contacting secretaries, receptionists and/or other underlings. A good trick is to call an office of higher or similar prestige as your goal office, and let the secretary transfer you over. For example, suppose I want to try social engineering Mr. Palooka - a middle manager who runs the shoe division. But I can't get through to speak with him personally. What I do is, I call up Mrs. Colt, who is either a same-level, or higher-level manager, and I ask her secretary to connect me with Colt person-ally. Colt's secretary asks what I wish to speak to Colt in reference to, and I say, "Shoes!" But Mrs. Colt handles only the rubber band accounts, not shoes. So Colt's secretary says, "Well, you'll have to speak to Mr. Palooka about that one; would you like me to connect you?" She will then trans-fer your call to Mr. Palooka's secretary. Pa-looka's secretary comes on the line, and you say to her, "Hello. This is so-and-so. Mrs. Colt's of-fice suggested I speak with Mr. Palooka about shoes." Here you have a recommendation from another company member! You're now much more likely to get in to bullshit Mr. Palooka. Happy engineering!
