Yet Another Attack Vector

  • Eric M Russell (8/20/2014)


    Isn't it crazy how a lot of folks these days walk around in public with a complete history of their bank statements, address book, work correspondecnces, personal correspondeces, and even nude photos of themselves in their back pocket? It just seems nuts.

    You can all rest easy if you steal my phone. The only naked photo is of a snowman.

    Gaz

    -- Stop your grinnin' and drop your linen...they're everywhere!!!

  • A few days I mentioned how an auditor team showed up dressed as firemen to do an inspection at a bank branch. They totally buffaloed everyone in the branch as the loaded spyware and such.

    A cop stopping you on the side of the road in a full cop car is a little different.

    But if they were ever to show up at your facility also ask to see their id. They will be carrying that too. That gives you more reassurance. And if you've never seen them before, you can always call the department with the id in hand and they'll confirm it.



    ----------------
    Jim P.

    A little bit of this and a little byte of that can cause bloatware.

  • Jim P. (8/20/2014)


    A few days I mentioned how an auditor team showed up dressed as firemen to do an inspection at a bank branch. They totally buffaloed everyone in the branch as the loaded spyware and such.

    A cop stopping you on the side of the road in a full cop car is a little different.

    But if they were ever to show up at your facility also ask to see their id. They will be carrying that too. That gives you more reassurance. And if you've never seen them before, you can always call the department with the id in hand and they'll confirm it.

    I don't understand how posing as firemen could present a pretext for installing spyware on computers at the bank. Firemen don't need access to computers or the bank vault to do their job.

    "Do not seek to follow in the footsteps of the wise. Instead, seek what they sought." - Matsuo Basho

  • Eric M Russell (8/21/2014)


    Jim P. (8/20/2014)


    A few days I mentioned how an auditor team showed up dressed as firemen to do an inspection at a bank branch. They totally buffaloed everyone in the branch as the loaded spyware and such.

    A cop stopping you on the side of the road in a full cop car is a little different.

    But if they were ever to show up at your facility also ask to see their id. They will be carrying that too. That gives you more reassurance. And if you've never seen them before, you can always call the department with the id in hand and they'll confirm it.

    I don't understand how posing as firemen could present a pretext for installing spyware on computers at the bank. Firemen don't need access to computers or the bank vault to do their job.

    Some people see a uniform and comply with perceived authority without a second thought to either who they really are or what they are doing. It's a trick as old as the hills.

    Gaz

    -- Stop your grinnin' and drop your linen...they're everywhere!!!

  • I doubt many IT workers would stoop to this level of stupidity, but posing as a law enforcement officer on the phone is apparently sufficient to fool some fast-food restraunt managers into stripping and performing body cavity searches on employees and customers. One guy pulled it off on dozens of occasions before finally getting caught. This is an extreme example of social hacking.

    http://en.wikipedia.org/wiki/Strip_search_prank_call_scam

    "Do not seek to follow in the footsteps of the wise. Instead, seek what they sought." - Matsuo Basho

  • Gary Varga (8/21/2014)


    Eric M Russell (8/21/2014)


    Jim P. (8/20/2014)


    A few days I mentioned how an auditor team showed up dressed as firemen to do an inspection at a bank branch. They totally buffaloed everyone in the branch as the loaded spyware and such.

    A cop stopping you on the side of the road in a full cop car is a little different.

    But if they were ever to show up at your facility also ask to see their id. They will be carrying that too. That gives you more reassurance. And if you've never seen them before, you can always call the department with the id in hand and they'll confirm it.

    I don't understand how posing as firemen could present a pretext for installing spyware on computers at the bank. Firemen don't need access to computers or the bank vault to do their job.

    Some people see a uniform and comply with perceived authority without a second thought to either who they really are or what they are doing. It's a trick as old as the hills.

    If there are any managers reading this, they are no doubt shaking their heads and recalling how difficult is it to get a roomfull of IT cats to turn in their weekly timesheets or complete some HR training course. 😉

    Herding Cats

    https://www.youtube.com/watch?v=vfovupIL1ms&feature=player_embedded

    "Do not seek to follow in the footsteps of the wise. Instead, seek what they sought." - Matsuo Basho

Viewing 6 posts - 16 through 20 (of 20 total)

You must be logged in to reply to this topic. Login to reply