Social Engineer

Social Engineer - Chapter 4

Today, 9:10am

Brody’s voice came from the speakers in the HTL boardroom. “I’m on a call-out for . . . hold on a second . . .” The image showed Brody’s hands retrieve a clipboard from the passenger seat. It contained one piece of paper with a name written on it. “ . . . Mandy Jones in IT.”

The guard in the security gatehouse confirmed the details matched those on his computer screen. “Are you Charles West from Cisco?”

“Charlie, yes,” said Brody. “Only my mum calls me Charles.”

“Yeah, well my mum calls me selfish and ungrateful, but that’s another story.”

Brody laughed obligingly.

“Okay, Charlie West. You’re on the list. Please head for the visitor’s car park. I’ll let reception know you’re on your way.”

“How the hell did you get on that list?” demanded Jacobsen.

Brody paused the video.

“I phoned up your IT help desk and asked them what the process was to get someone registered as a visitor. They simply assumed I was an employee and told me about the guest registration web page on your intranet.” He paused briefly, sizing up the opposition. “You know, that’s the thing about help desk staff. They just want to help.”

Wilson made some notes. Hall asked, “You said earlier that you couldn’t break through our firewalls. So how did you gain access to the intranet? It’s only accessible by authorised employees from inside our network.”

“I didn’t need to. With that knowledge, I then phoned your reception, pretending to be Mandy in IT. I have the audio recording here by the way, but I’d rather not play it now. My high-pitched impression of Mandy is rather embarrassing!” Brody smiled innocently. “Anyway, as Mandy, I told her I’d already left for the day but had just remembered that I had a Cisco engineer arriving the following morning. And the receptionist — I think her name is Yvonne — kindly offered to fill in the guest registration for me.”

“So this is social engineering then?” asked Wilson. “Conning people into doing things for you?”

“In a way, yes. I manipulate people into performing actions or divulging confidential information, which gives me the access I need. It’s a method your Chinese competitors could easily employ. Or even those animal activists outside — if they put their mind to it. There are measures you can put in place to prevent this, which we’ll walk through later.”