I am a glorified office administrator who understands server hardware why am I the only person in this company who gets what social engineering is?
Total stranger on the phone who we’ve never spoken to before: I have power of attorney over the CEO of this corporation and we are a customer of yours. Please change the administrator password on the server to XXXXX
My boss, putting on white grease paint and a red wig: Oh, of course! Let’s do it quickly so that you’ll want to keep working with us since you’re going to be making business decisions!
Me: I would sell you to satan for one corn chip and I’m allergic to corn but before you do this maybe you should call someone who is actually on our contact list for our customer and see if they’ve ever heard of this stranger.
My boss, looking through a selection of shoes that honk when you walk: Oh, but she said that it was very important that none of the employees know what was happening because they’re making staffing changes.
Me: As your lawyer I recommend that you just call a single one of our contacts and see if they’ve ever heard of her name.
My boss, shoving all of our technicians into a VW beetle: You’re not my lawyer.
Me: HOW THE FUCK WOULD YOU KNOW? I COULD BE! YOU SHOULD MAYBE CHECK ON THAT.
TIL everyone’s employee ID at my company is the last five of their SSN.
Boss: On the bright side, it’s only the last five
Me: YOU CAN COMMIT FRAUD WITH FOUR
Security firms that are hired to check the security of banks will often use the following tactic: They will walk up to the teller in a suit with their ID badge and a clipboard and go:
“Hello I am [name] from [security firm] we’ve been hired to verify the security of the facility I need to see your computers.”
“Erm…I’ll have to verify that with my managers.”
“Congratulations, you have just passed the security verification.” [Scribbles on clipboard] “But in all seriousness I do need to verify your security so I need to see your computers.”
“Oh okay.” AND LETS THEM IN.
“Social engineering” is a way too fancy word for what it is. I know a guy (not personally) who broke several people out of prison by essentially writing “Greetings, please release this person, signed, whoever the judge is” on a piece of paper and faxing it there. Because no one would have a fax machine in their own house I guess.
not to derail, but holy shit that praxis
I’ve had clerks just give out a whole ass SSN when I asked.
An inspection in 2014 found the password for the Louvre’s surveillance camera system was “louvre.”
My proudest moment in the shitfire that was my last job was when we got a full-on assault from scammers*, and my users were so well trained that it was completely bolloxed within an hour.
*it was a pen test that out infosec team paid a lot of money for, and was very unhappy that I blew it up. It was executed so obviously and badly that I was sending company-wide emails saying, “These calls from 000-000-0000 are not being recorded for quality or training purposes. You can tell these people to go fuck themselves. Have fun!”
Somewhere I still have a T-shirt that says “social engineering; because there is no patch for human stupidity”
I will never forget listening to a pen tester talking about how in one engagement his whole original plan was to talk the main IT security guy for a bank in to installing some software that's supposed to fix some problem with their mail server.
The guy was willing to do it but for whatever reason was failing at it so eventually pentester guy decides fuck it we ball and suggests he could come in person to the bank and provide an assist since security guy is having so much trouble.
Security guy agrees, pentester guy shows up a day or two later and security guy introduces him to the staff as the guy that's going to fix their mail problems and to let him do whatever he needs to.
And then, it gets better, apparently somebody in the office was having a birthday and everybody goes off to the break room for cake.
Leaving pen test guy alone with the bank vault door open.
So he did what any responsible pentester would do, he went into the vault, took a selfie with a stack of cash, and included the picture as a visual aid in his report.


















