Thursday 1 December 2011

Trouble For Nothing?

Okay, granted the initial setup and planning and sabotage is an exciting, amusing kind of thing to do. But is it worth the effort? Why not just stick with the easier social engineering and not worry about the remote possibility that the guy on the other end will be wise to you?

Well, first of all, that's foolish. Especially considering that many of the people and places you will want to hack most will be very security-aware. You must, in many circumstances, assume that they know what you're up to when you're bullshitting them. And if they know what you're doing, you shouldn't be doing it.

Another factor, one related to both this and a remark I made earlier: when you reverse engineer a situation, you create a friend on the inside. Once you start hacking big-time you'll never know if somebody's on your tail unless you have an inside connection. If you've proven yourself to some user by solving their computing problem, you can then call back a short time after breaking in and ask questions like, "Hi, remember me? I helped you with that problem... I was wondering if you heard about anyone else having that problem, or any other weird stuff going on with the system?" If they've heard about attempted break-ins or system failures, you will be the first to know. You might want to tell them to call you if they ever hear about "hackers" or whatever. This way if you are discovered and, let's say a memo is distributed telling everyone to change their passwords
because a hacker is on the loose, your contact will innocently call and let you know about it.

The continuing loyalty and assistance you will receive from the inside is well worth the beginning trouble you may have in setting up the sabotage.