Sunday 27 November 2011

Researching The Hack: Sorting Through Trash

It isn't really a dirty job, and nobody has got to do it, but serious investigators will. By "investigators" I refer to hackers who are research-ing a company or computer. It really isn't all that messy going through the garbage of most places. Often you'll find a separate bin for white paper. Some may be shredded, but mostly not. Try to plan your trips to the trash on days following a few days of sunny weather. You want your garbage to be in tip-top shape.

While I'm inside the dumpster I like to make stacks of the papers I find and load them into garbage bags. Then I bring it home to examine what I've collected. You'll find internal phone directories, names of public and private individuals, training manuals, outdated files, letters, information about projects being worked on, and
sometimes even mention of the computer system. Much of it is help-ful, and most is interesting too.

Even the regular trash is usually a pretty clean place to be (somewhat). Rummaging around in the garbage bins of various companies, office centers and other institutions, I have come across: micro-fiche, computer cards, entire boxes of business cards, books, a dead cat (really gross), broken elec-tronic junk, and lots and lots of, well, garbage. Of course most of it isn't helpful for the hack, but often there is knowledge to be gained. You can find out a lot about how an organization functions by its trash, and the way in which that trash is organized.

The first time I did this, I took a single green trash bag from the bin behind a bank. Bank bags, by the way, are stapled shut with a paper receipt that tells the name of the bank, and the time and date of disposal of the bag. The trash within is of two types. There are smaller bags containing refuse from each individual's office in the bank, and then there is the cytoplasm of crumpled forms and dis-carded paper tapes from behind the counter. The interesting parts are the bags from individual of-fices. In my first garbage heist, one banker was Japanese - he was throwing out a Japanese newspaper and a Japanese candy wrapper in addition to his bankrelated stuff. There was also the womanon the diet, the struggling-to-make-endsmeet single mother, and the assistant bank director. Now the bank director her garbage was very interesting. It contained a discarded lock from the vault, a box of orange "key hole signals (style V)," some vault-key envelopes, a slip of paper with the combination to a safe scrawled across it like a clue in a parlor mystery (12R- 32L-14R in case you care), and a memorandum to "Branch Managers" from the woman in charge of "Branch Automation," which apparently had accompanied a disk. From that let-ter I was able to get the name, address, and room number of the bank's Branch Automation Depart-ment and from there evolved a social engineer through the mails (see chapter on Social Engineer-ing) which resulted in myself getting a copy of the disk in question as well as some other very useful information.

If you were caught hacking a trash bin, you used to be able to say that you were "just looking for cans to recycle." Now offices pre" much recy-cle everything, so that won't do for an excuse. The old "school" or "community project" ploy is always a good bet: Say you are rummaging around in there doing research for a report on government or busi-ness waste.

Before you even step out of your house the first time, do a bit of phone work to find out what the garbage situation will be like. Call up the Solid Vyaste Department and ask when garbage collec-tion is for the street you have in mind to plunder. If pickup is Monday morning, that's good, since you'll be able to go at night over the weekend, when no one is around. You don't want to end up going the day after collection, so make that call be-fore you hop in your car.

As for recycled white paper, if there aren't any outside bins devoted specifically to it, you might want to go to the office during the day ( if it has a publicly-accessible area ) and take a casual look at the level of white paper in the recycling cans inside. Do this at different times of day for a few days, and you'll get their recycling
schedule. Again, you'll want to nab white office paper when the bins are'at their fullest.