Undercover Hacking, For Money 246
Dollyknot writes: "Amusing story of a guy employed by IBM to check companies security out by trying to con his way onto their premises." This sounds like a fun job, to say the least, and supplies at least two good reasons to own a digital camera.
Sneaky... (Score:1)
Reminds me of... (Score:1)
Kinda like Sneakers.... =-) (Score:3, Informative)
OT: Favorite thing about Sneakers (Score:1)
Even the math behind the black box was reasonable. Which is to say that it's conceivable that one could find the right group theory construction to rapidly factor numbers of arbitrary size, but no one's figured out how (nor have they shown it can't work). The movie happily tells you that he's done it without saying anything meaningful about how its done.
Re:Kinda like Sneakers.... =-) (Score:5, Insightful)
~Philly
Re:Kinda like Sneakers.... =-) (Score:2, Interesting)
At HoHoCon in Houston about 10 years ago, Erik Bloodaxe (formerly of LoD/H) talked about a deal ComSec (the company he and a couple of other former LoD guys started) did that involved breaking into a corporate network and printing themselves a check for $0.00 (and mailing it to themselves!), then presenting it to the company with a comment along the lines of "This could have been for 50 grand..."
I don't recall if they got the job.
Second, about Hackers:
I own Hackers on DVD for one reason only: The Hackers drinking game. Whenever you encounter something that trips the head-shake, drink.
I've never made it all the way through the movie on anything stronger than beer. Usually I'm done within 30-45 minutes. LOTS of "aw geez" in that one.
-l
Re:Kinda like Sneakers.... =-) (Score:2)
Re:Kinda like Sneakers.... =-) (Score:2)
While it's true that a certain amount of license is allowed for the sake of entertainment, the problem comes in the form of movies like Hackers, where the inaccuracies are so glaring that even the non-technical audience is shaking their head.
It's fine to take some liberties, just don't insult me (and my non-technical friends) while doing so, ok?
-l
Re:Kinda like Sneakers.... =-) (Score:2)
It's not just the chip. It has aPCI bus. But then, you already knew that.
Risc architecture is going to change everything.
digital camera (Score:1)
I would like a digital camera for Christmas. It would really help me make those fake IDs.
The Weakest Link (Score:2)
How about hiring real security guards? (Score:2, Insightful)
Re:How about hiring real security guards? (Score:2, Informative)
A) fit in
B) seem to be legit
I have two customers that have fairly high security buildings. One, I went to the break room, and had yet to be informed the combo on the door, the gaurd just let me in when I told them that I got locked out.
At another customers location, I just told the guard that I was delivering some software. The guard gave me a day pass to the entire complex.... The receptionist (who was new, and I did not know) voilated their own security policy by not stopping me when I walked bye. Keep in mind, I did not blend in, Policy there is slacks, and a tie. I was wearing blue jeans and a polar fleece sweater, plus I'm more or less a long haired hippy.
Keep in mind that these are legit cases, but guard's jobs are very mundane, and locations such as server rooms should be protected by lock and key at the least.
One customer broke through the back wall of their server room... why I don't know, but they have a combo door lock on the door... the only one in their entire office. but, you can just walk around to the other side of the room and enter from the back, where there is no door.
*shrug*
I guess its a property of the large corperate world, stupid decisions = bad security.
Tight security (Score:4, Informative)
1: Require cardkeys to park a vehicle. This makes it more inconvenient for an attacker. Better yet, require an ID badge to bring a vehicle into all premises except for deliveries (restrict to a small area).
2: Think choke points and isolation levels. Always assume that at least one level of security will be broken and plan for it.
3: Keep the teams that have access to high security areas small and ensure that they know eachother. This helps there.
4: Electronically monitor server rooms. Cardkey and camera should be used for surveillance and there should not be a reason for maintenance workers to have access to the server rooms at all.
This means no garbage cans permanently stationed there. If janitors have access, then they become the weakest link...
I am actually surprised how many problems people have protecting their server rooms...
Re:Tight security (Score:1)
5: Make it company policy that *all* people that aren't paid full time be checked in. Have sometihng like a temp badge that signifies that they are. Require that they be escorted anywhere they go. At my company even contractors are escorted. They were slightly disturbed, but got used to it.
6: Make it policy that any employee should stop and question anyone without an employee or temp badge plainly visible. Usually one guy who does it abit helps.
This seems to help a bit by adding a little catchall in case people try to coerce their way places.
Re:Tight security (Score:2)
Re:How about hiring real security guards? (Score:1)
I'm paranoid enough already, and if someone starts tossing the mains breakers, I won't hesitate to stomp said persons ass....
Re:How about hiring real security guards? (Score:2)
The key to security in places like this (other than perimeter guard checking) is badges which clearly show one's access privileges. Of course, today it is a bit easier to fake a badge
So it can work - but only in places where security is high on peoples' minds.
That is one way... (Score:2)
Might as well just change all the screen savers to "We 0\/\/
Not that it has ever happened to me, mind you.
(ok, ok, the escorting a pretty girl part, but not the screensaver part. I did get griped at and rightfully so)
All that is needed... (Score:1)
Always Get Past Security (Score:4, Funny)
Not a bad idea... (Score:1)
The danger would be if you couldn't get ahold of a real pizza delivery outfit for some reason, and used a do-it-yourself outfit with a made-up company name. Many geeks know every joint in town, and would immediatly start asking questions if they didn't recognize the name.
:^)
Ryan Fenton
Re:Not a bad idea... (Score:2)
Easy. I worked at Papa Johns for quite a while and they always had old shirts and hats sitting around. You could sneak in and grab some or just get a job for a week and never take yours back. I still have mine, for instance. The hot bags and car tops would be a tougher deal, though you could steal some from a delivery car when the driver's not looking. They really hate that, lemme tell you.
Re:Not a bad idea... (Score:2)
Uniforms from everywhere can be found there. Just wash em to get that "cap'n crunch" smelling laundry detergent out of 'em (no reference to 2600 man, but to the cereal)
I've seen security uniforms there...
Re:Always Get Past Security (Score:2)
Nope, this trick won't work everywhere. At a bank where I used to work, standard procedures for such a case would be that the pizza guy left the pizza at the security guy, who then called the guy who ordered it to come down and pick it up.
Same drill if you had a visitor. You'd have to come down physically to meet him.
And all this was even before September 11th, but the place was so paranoid that they chose to build their underground parking lot below the garden rather than below the building, for fear of February 26th, 1993 type events... ;-)
The answer is obvious: (Score:1)
Re:The answer is obvious: (Score:1, Funny)
Some financial companies do this also (Score:1)
See also... (Score:5, Interesting)
as if i'm not paranoid enough!
Whatever happened to... (Score:1)
Re:Whatever happened to... (Score:2, Informative)
Layered Security (Score:2, Interesting)
He doesn't mention in the article whether any of them use layered security. As you cannot expect humans to be infalliable, shouldn't layers be built up around critical infrastructure, so if they get past reception or the first security door, they still don't have full roam of the business. Extra security should be provided around critcal points such as server rooms, closets etc, and a limited number of people provide access, and know reason of letting the serviceperson have access.
Even easier if... (Score:1)
Theyre used to seeing new faces often and may think nothing of another new face.
Just dont pretend to be the CEO or Chief Software Architect or anything
Frightening thought.... (Score:3, Funny)
Re:Frightening thought.... (Score:2)
Re:Frightening thought.... (Score:1)
"We need a marine biologist!!"
Re:Frightening thought.... (Score:2)
--Blair
Re:Frightening thought.... (Score:2)
Re:Frightening thought.... (Score:2)
<possible answer>
... Please postpone it for half an hour. Someone stole my laptop, and I'm on my way to the police to report it. By the way, can I use someone's account and a computer to have the presentation e-mailed to? It was on my laptop too...
<\possible answer>
In such a way you can use the situation to gain access to their network, maybe even get a 'temporary' laptop.
Better get paranoid!
Or you could spin this backwards... (Score:2, Funny)
Re:Or you could spin this backwards... (Score:2)
The "card" is a metaphor meaning that the top brass hired him to do it. As dumb as high-up people can be, nobody is *that* dumb.
Re:Or you could spin this backwards... (Score:2)
Some of his tactics aren't hard to employ at all. (Score:5, Interesting)
For the first few days, I had security let me in, but they got real frustrated with checking me in. So every morning, I would park my car, get out, and start towards the side door, which happened to be closest to the IT department. I would then try to find someone who was walking towards that door and high-tail it behind them.
If no one was going into the building at that time, I'd stop, pretend to take a phone call on my cell, or tie my shoes repeatedly, until someone walked past me, and then I'd just walk quickly behind them so they would hold the door for me.
Not once during those 3 weeks did I ever get questioned by anybody, which surprised me greatly, especially considering I was about 20 years younger than anyone else at the company, and I have facial piercings.
The moral of the story is that the overall trusting nature of humans is very easy to exploit, and this guy obviously shows off that point on a daily basis. Maybe we all should be a little more wary...
Re:Some of his tactics aren't hard to employ at al (Score:2)
Re:Some of his tactics aren't hard to employ at al (Score:1)
Re:Some of his tactics aren't hard to employ at al (Score:1)
At Georgia Tech?? That one won't fly
Re:Some of his tactics aren't hard to employ at al (Score:2)
Thankfully most dorms are becoming coed which only makes things easier.
Re:Some of his tactics aren't hard to employ at al (Score:3, Interesting)
Historical hacking at Stanford, KU (Score:3, Interesting)
My approach was to go late at night, find a janitor, and tell him I lost my key. It worked every time - no ID required. I would then have the computer to myself for hours. One time, about 3 AM, a researcher (I assume
During that same year, I also used the Stanford IBM 360/67 (an OS with a VMM while Bill Gates was in grade school) to do a bunch of personal programming. There, an ID from an out-of-town for the year gard student did th job.
Meanwhile, my friends at the University of Kansas (which had a rare GE-625), wanted source of the OS to improve their attacks on the OS. One of them found out the tape numbers by looking at printouts in a public place. He then ran jobs when times were busy to copy those tapes to his own... every once in a while so as to not draw suspicion. Then, he later printed out the whole thing, again in little bits. Thus when I later went there, we had source of the whole OS. We used that to find a number of holse, although GECOS-III was surprisingly well designed for security. In fact, the CIA used it for that reason, and it was chosen for the World Wide Military Command and Control System (WMMCS). As a result of our hacking, one of us later got a call, out of the blue, from a CIA recruiter who knew of the exploits and was looking to hire him for a white-hat hacking job. This was in 1970.
Social engineering works!
Similar to this....... (Score:3, Informative)
www.infiltration.org (Score:3, Interesting)
Re:It not-a-worka (Score:2)
I think there's a glitch in their DNS registration. Try here [209.157.133.147].
Re:It not-a-worka (Score:1)
Practice intrusions... (Score:2, Interesting)
It's pretty cool, but there's a lot more time writing up reports about the intrusion than there is actually doing intrusions.
Re:Practice intrusions... (Score:2)
I assume you mean their own company's sites. I don't imagine there's that much paperwork to do when conducting industrial espionage...
Less subtle? (Score:1)
I almost wouldn't doubt it could be done.
The ultimate dream job.. (Score:2)
..would be if a company were to pay to sabotage a competitor's web site.
I suppose that whole illegal thing gets in the way. Alternatively, it sure would be nice to be paid to test a company's security.
Re:The ultimate dream job.. (Score:3, Interesting)
I can imagine a scenario where two competitors that are on good terms with one another (or even two totally unrelated companies) might 'ritualize' assaults on one another's security. Set up rules, designate targets, award prizes to the team or individual that carries out the sneak, that sort of thing. It's fun and points out flaws in security. Much better than a lousy 'Employee of the Month' award.
Re:The ultimate dream job.. (Score:3, Funny)
I can just see that going too damned far...
The competing company's CIO settles into the limo for the early-morning ride to the airport to catch his flight to that trade show. Quickly becoming engrossed in some reports on his laptop, he doesn't notice anything amiss until the driver doesn't take the airport exit. As the CIO starts to protest, the door locks slam home and the partition goes up. Then the knockout gas starts coming out of the air vents...
~Philly
Re:The ultimate dream job.. (Score:2)
IBM doesn't send him in, the client requests it.
IBM probably sells the idea, but the guy isn't unauthorized, he's just not known by the security apparatus to be authorized.
Two companies that interact on terms that would allow them to set up this game would not be called competitors.
I mean, if you got in, and got out, and showed the other guy his "flag", should you also show him the draft 5-year plan you ran off on his mopier?
--Blair
FREE KEVIN! (Score:2)
Any good hacker knows the way into secure systems is through the weakest link: humans.
So, of course the US Gov't spent the past 10+ years evisserating the hum-int in favor of carnivore-type el-int. No wonder we didn't have a clue.
Re:FREE KEVIN! (Score:2)
I love knee-jerks and their reactions.
Double Standards (Score:3, Insightful)
In one sentance our values dictate respect for our fellow employees.
In another, we are to firmly question anyone that 'does not belong' or is unexpected
Recently our company hired a new diversity 'expert', and she was 'aghast' at the way fellow employees treated each other in the hallways
Now I ask all of you sentinent people... how should we react when confronted with someone we neither recognize nor know, and how do we fullfill both of the philosophies?
I used to work in a secure area, where if someone knocked I'd let them in but question and deliver them to the person they wanted... but now it's an open area- thus I don't exactly know the 250 people I now work with. Frankly the stress isn't worth it- any single one of them could be an auditor waiting to 'sneak up' and get you reported to upper management- it isn't fair.
My experiences in the Canadian Gov't (Score:5, Interesting)
Notwithstanding all of that though, it's kind of funny to see exactly how physical security is implemented these days. Back at my old job in the Canadian government (the department shall remain nameless), this stuff was nothing but a joke. Although you could certainly see that attempts were made at making things secure, like with the ID cards with the digital picture and magnetic swipe thing, it didn't really make much of a difference in the end. Firstly the only verification system that was used on these was to flash them at the rent-a-guards who sat all day long at the entrances. By this I mean that they would literally look at it for a split second - hardly enough time to even read the expiry date or even have a good look at the photo on the card. Case in point, after quitting, a friend of mine made a copy of his card on cardboard and was able to use that to get in without any trouble.
Another strange thing was the departmental library. It was actually located within the building that I worked in on the second floor. Thus anyone (who knew about it) could walk up to the guards in the main lobby asking for access to it. They would then have to lend a piece of ID and write down their name, number, etc... and they'd get a library pass. This would essentially give them acccess to the entire building, as there wasn't any verification that they were sticking to the library. I ended up using this method of entry a few times to visit friends while I was at school in another part of the country.
Anyway, I could rant on about it all night, but in the end it just came down to the fact that the people implementing the physical security were subcontracting to a bunch of dumbasses. Other things like network/information security were dealt with by intelligent and capable people for the mostpart, but I won't get into the whole weakest link discussion.
Re:My experiences in the Canadian Gov't (Score:1)
Security is pretty good. There is exactly one access point. (Alarms on the emergency exits, etc.). The guard is quite thorough. By now, he knows me, but he won't let me in. Someone who will vouch for me must physically come out and get me. Even then, I need a badge, and it only permits me access to the sections it's colour-coded to. I am told that people have been escorted out quickly when going into an area that doesn't match their badge. I'm also told that I get in relatively easily, since I'm a close relative.
Even though the guard knows the employees, he still has to check their badges on the way in, and he's not lax about it. When they had a substitute guard at one point, he *didn't* know me, and he was extremely suspicious, even after I was cleared.
Delivery people are simply not allowed in. They leave stuff in front of the guard kiosk, and someone comes down to fetch it. I'm sure there are ways to get through, but it's not bad.
I haven't been there since Sept. 11, so I don't know if they've tightened things at all. I do know that the next security level up requires people to use their access cards just to get to the guard kiosk (i.e. they lock the outside doors).
who needs a disguise? (Score:5, Funny)
Re:who needs a disguise? (Score:1)
Tiger Teams (Score:3, Interesting)
If the Jargon File [jargon.org] is anything to go by, this isn't exactly something IBM has only started doing recently.
The entry on Tiger Teams [tuxedo.org] provides the definition; the entry on patches [tuxedo.org] gives the example story:
Sounds fun (Score:1)
Funny that it's IBM (Score:3, Interesting)
Anyways, this building was almost totally insecure. They've got a bank of elevators with two entrances, north and south. In the day you can walk up to either, say that you're a consultant and forgot your page, sign a fake name and a random floor number and you're in. At night this isn't neccessary- they close one entrance and the sole guard is almost always napping. Reach over the desk to hit the door unlatch and there's a whole building full of computers awaiting you, with a loading dock you don't have to pass security to get to.
I'm sure they knew this when I worked there: I showed up one day to find my monitor moved from atop my PC and the case ajar. I opened it up, and found that someone had taken all my RAM.
if this interests you (Score:2)
Too Easy (Score:1)
Of course we all got the "security simply must be better" but no one really did much about it after a few days it was all as it was before.
Yup (Score:2)
Fat lot of good those did. While I was still working for that company, someone made off with a brand new combination TV/VCR, probably by waiting until the evening cleaning crew left the door unlocked. After that theft, my boss and I put in a passable security camera system consisting of some dinky yet highly visible cameras trained on the office doors, and one watching the door to our equipment storage and server room, from inside the room. We ran the camera inputs into a 4-way combiner, and then into a spare Mac with a video capture card and running webcam software that snapped a picture when movement was detected during non-business hours. Nothing further disappeared, though the system did catch some amusing photos of me staggering around the halls the morning after my 27th birthday party, when I crashed in my office.
I've been gone from that company for almost a year but I still talk to friends there. I heard that a month or so ago, employees of a different location of the same company (without security cameras) came in one morning to find about 10 Dell laptops were gone, ripped out of their docks by a guy who waited for the cleaning crew to start working and slipped into the offices. The company's solution to that one: All laptops must now be taken home at night.
~Philly
repo man (Score:1)
My experiences at IBM.. (Score:2)
Having worked at IBM SSD here in Tucson, I can tell you for a fact that Big Blue takes their security very, very seriously.
I worked out on the floor -- Your typical raised-floor temperature controlled room, except on a very large scale. [uatechpark.org] Without going into specifics, getting to work was always fun when it came to security. You have to go through a human checkpoint, then one card-access doorway, then another combination human/card-access doorway with a tailgate alarm.. At each point along the way you're monitored on cameras mounted in the ceiling Occasionally, if your badge doesn't work, a voice comes over the loudspeaker where you are and asks you to hold up your photo badge so they can confirm who you are before continuing.
My favorite story comes from one of my old floor bosses at IBM. He used to work for a defense contractor out east in New Jersey, right off the turnpike. He claims someone got busted sitting on a highway overpass with a camera and telescopic lens attachment, photographing the blackboards inside the plant. "Thats why all the exterior windows have reflective tint nowadays. Its a safety measure."
Fun stuff.. I miss IBM like you wouldn't believe. Friggin awesome company to work for.
Cheers,
Re:My experiences at IBM.. (Score:2)
Though it was back in the mid-80's, I can attest to IBM's security policies. Especially when I broke into a secured server room at IBM which had one of the two prototypes for the biggest, newest mainframe they were developing. (It's not quite THAT amazing, as I had the proper clearances for access to it, but the point is that others could have done what I did.)
Background: This was only a few years after an IBM competitor (Hitachi?) was found to have stolen plans for one of their still under development mainframes (IIRC it was the 3081). So, there was intense security throughout the site.
There were badge locks everywhere; to get into the parking lot, to get into the building, to get into the server room, and then another to get into the specially-constructed section of the server room where the prototype was located. I was working 3rd shift doing some testing on this new box. (Sweet! It could support hundreds of concurrent users, and I had it all to myself!) Anyway, at one point, I realized I needed some more blank mag tapes and stepped out to the main computer room to get them. Went back to the secured room and realized I had left my badge next to my terminal and I was locked out. What to do? (At that time of night, there was nobody around at all.) Yes, I could have called security at another building and waited about 30 minutes to an hour for them to let me in. But I had way too much to do and couldn't adfford the loss of time on the machine.
Then it hit me. There was raised floor here, and also in the secured area. Popped up one of the raised floor tiles on this side of the badge lock, crawled underneath, and pushed up a floor tile on the other side. Took about a minute to get in.
Told my boss about it the next day, and they soon had a construction crew extending the walls through the raised floor down to the concrete floor below it. And, up beyond the ceiling tiles, too. I was thanked for revealing the security hole, but was also strongly advised to follow proper procedures about calling for help from Security in the future.
So, I'd suggest taking a look at the physical security in YOUR area to see if someone could gain access by climbing over ceiling tiles or under raised floors.
Small Companies more secure? (Score:2)
Are small companies less resistant to social engineering, because of greater employee "intimacy"? If so, how can this be utilized at larger companies to increase security?
Classic Panels on Social Engineering Online (Score:1)
From the "Beyond Hope" Hacker Conference:
(streaming real audio)
Social Engineering [2600.com]
It was quite entertaining as well as educational.
Another Soc Eng panel from the "Hope 2000" Conference:
Social Engineering Panel [h2k.net]
Security (Score:2)
One cause is companies, despite security policies, routinely violate them themselves. You may say that a receptionist/guard/etc. is to challenge all vistors and ask for ID, but the first time they do that to a senior executive or VIP from out of town and get smacked down for it, they'll never question anyone again.
OTOH, I worked for an organization that took security seriously. You were to challenge anyone without a badge, and escort them to sercurity if tehy didn't have one. I challenged teh CEO once - he pulled out his badge, showed it to me, and clipped it to his collar, where it should have been. No "don't you know who I am?", no nasty note to my boss; just a simple "thanks" and doing what he expects everyone else to do. Of course, that also takes a leader, not a manager.
Legendary story (Score:2, Interesting)
It happens in Germany, at Siemens, the giant electrical engineering and electronics corporation. The über-boss, a member of the von Siemens familiy, an old man at the time, routinely used to test how easy was to enter his company facilities (most of the employees had seen photographs of him). Once, he tried to enter a factory where he meets this old-guard janitor, a typical case of prussian education. Von Siemens is denied entry, even when, having confirmed that the entrance was guarded well enough, he wanted to finally go into the factory. The old janitor kept on saying Yes, you are telling me you are von Siemens and you really look like him, but if you don't produce a valid ID, you are not entering this building
Von Siemens had to wait until the following day and the janitor was promoted.
ID Story... (Score:2, Interesting)
Monday, I show up at work and everyone is laughing at me. Turns out, I ID'd the new VP. Later that morning an email went around asking everyone to be more security conscious, and always ask someone you don't know for their ID.
It was sent out by the VP and corporate security.
People stopped laughing, and started asking for ID from those they didn't know.
Moral of the story: it doesn't hurt to ask someone to show their ID, and you never know who you'll be asking. (Plus, the brownie points are fabulous!)
You can't beat a digital camera... (Score:2, Insightful)
(Not that I'd ever do something like that, but as I do a bit of 'ethical hacking' as part of my job, I have developed a deviously cunning mind
I do this for a living too. (Score:5, Funny)
Maybe We Should Do This For the US (Score:2)
thinking up terrorist attacks to the united states, and
trying to "implement" them. Just more war games. So
we get a couple of agents trying what the Sep 11 hijackers
tried on July 13th, and we shore up weaknesses before they're
really exploited (we would, of course, have our gamers stop
short of say, actually killing or even threatening anyone. Wouldn't
do to have people saying "Oh, this isn't a REAL terrorist attack...
it's just the gamers. Sit back, everything's going to be OK.").
Actually, I know this is done to some extent. A couple of
weeks ago, for example, I heard a guy on the radio who
used to work out at Dugway Proving grounds in the Utah
west desert. His job for a while was to come up with
anthrax delivery scenarios.... from city wide to single
building to single person. I don't know if they actually
disseminated a "marker" substance to test their theories
and come up with security techniques, but I'd be happy
to some portion of my taxes spent on such a thing.
seems to cry out for biometrics . . . (Score:2)
OTOH, I'm sure someone will reply that biometrics has a weakest link as well. E.g., intruder could corrupt a root user and get their retina authorized into the system illegitimately, figure out some kind of black box to hold up to the scanner, crash it to its embedded version of shell prompt, and send it "unlock door" command, etc. But from my perspective, biometrics kicks the ass of any other solution, and I'd feel a lot safer if airports, highrises, and public utilities were using it for critical areas.
* * *
Re:seems to cry out for biometrics . . . (Score:2)
For example, an ATM requires you to have a specific object (your card) and special knowledge (your PIN). Either of these elements can be compromised without compromising the entire system.
Relying exclusivly on biometrics is as big a mistake as relying on any other single authentication mechnaism.
Re:seems to cry out for biometrics . . .were's my (Score:2)
* * *
Busting the CEO... legitly! (Score:2)
One of my co-workers challenged the company president (he was not on the list, and he was unescorted). She got atta-boyed!
Wish I'd been there to bust the pres...
Quite old stuff... (Score:2)
Tailgaters! (Score:2)
I once contracted at a large company that was so paranoid, contractors had to be re-badged every six months, the firewall only passed http and email, and there were even rules about leaving your workstation logged in and sending sensitive info via text page! Yet they had a serious tailgating problem. Headhunters would routinely sneak in to make the rounds. Nothing was done until valuable personal items started disappearing from people's desks at several locations, and security decided that the thief was a tailgater. They had the receptionists crack down, and launched an educational campaign. So it became much harder to sneak in -- for a while. Don't work there anymore, but once the thefts stopped, I doubt if people remained careful.
Damn reminds me of the good old days! (Score:3, Interesting)
Ahhh, back to the good old days.
Very appropriate comic... (Score:3, Funny)
Nodwick [gamespy.com] from a few days ago.
-l
False security... (Score:3, Insightful)
Heh... what a great job!
Back in '77 after the first "break-up" of Pacific Bell, I was a telecommunications tech at a small interconnect in Santa Clara, CA (i.e. Silicon Valley), one of three troubleshooters in the company, so I usually worked alone. We had no company uniforms or other identifying paraphernalia, but my tool belt was my "badge".
We sold state of the art (for the time. eh?) NEC microprocessor controlled, time division multiplex phone switches, and smaller office sized systems. Our switches kicked Pac Bell's ass, they ruled because the telcos in the USA we still in the dark ages.
Anyhow, my territorry was from San Francisco (and the rest of the Bay Area) to Montery, we had phone systems in many high tech companies, so I was steeped in the culture.
It didn't take me long to observe that I could go virtually anywhere in most of these companies, without question. Often even without a visitors security badge, company employees, and even security guards would open doors for me if my hands were full.
It seemed that my tool belt and butt set (Linemans test set) hanging off of it, was all I needed to have the run of the place. I started to play a "game", to see just how good their "security" was.
So here I am, this spikey haired punk rocker, in street clothes, but with my tool belt, butt set, and a professional attitude, walking up to a security guard and saying to him, "Hey, I need to look in that locked room over there to see if there is any phone equipment in there.".
They allways walked over and opened it for me without question, and then walked away reminding me to lock it when I was done. I did this just for grins at many of the companies I visited.
In those days, computers were still refrigerator sized, and filled large, lead lined, air conditioned rooms with raised floors, with lots of cabling under them, tended to, by clean-cut guys in long white lab coats (no kidding). And every company had a security guard at the door of these special rooms.
One day I screwed up my courage and decided to see if I could gain access to one, I had zero reasons to go in there, since there was never phone equipment in these rooms. I nervously walked up to the door, looked the security guard in the eye, and he glanced at my tool belt and test set, and opened the door for me without a word between us!
Next thing you know, I'm wandering around this large computer room, pretending to look like I know what I'm doing. None of the guys in there even pretended to notice me, I could have done what ever I wanterd, and nobody would have questioned what I was doing.
At work, I started to brag about how people were so easily manipulated by "normal" circumstances. None of my coworkers believed me, they were just like the people in these companies, they were non-observent.
One day, I needed some help, so I brought my boss along. We finished up our job and as we were walking out, I reminded him of my discovery, he said "bullshit!" . So I said "follow me", and walked toward the big computer room.
The security guard didn't bat an eye, and unlocked the door for us without a word. I was the only one with a tool belt, my boss was also in street clothes, we could have been anybody, but the magic tool belt, butt set combo got me through again.
My boss was blown away, and was also very nervous about being in this formerlly taboo computer room, so we exited. On the way out of the building, I couldn't resist, and stopped at random and asked the closest security guard to please open "that closet, over there", he of course, complied.
My boss was very impressed, but wasn't at all happy that I was doing this for "fun", and the next morning at work, I was admonished to never do "that" again.
I guess my point is, that people are easily fooled by normal seeming circumstances, and that security is often a Paper Tiger.
Did that at a Microsoft party (Score:2, Funny)
A while back Microsoft was in town running a conference. One of the gigs they had was a little party out at a local theme park. I copied my mate's ID card, and we waltzed up to the gate. We were let through without even being asked for ID, and we were free to enjoy the food and rides all night. :-)
Complete story [kimihia.org.nz].
Re:I want this job. (Score:1)
Re:I want this job. (Score:1)
Re:I want this job. (Score:2)
Re:I want this job. (Score:1)
the concept of implicit trust in pre-interpersonal interactions (even in the face of contradictory non-verbal cues.. eg. stuttering and shaking hands) amazes me so much that I am writing a thesis on the subject. unfortunately, there are very few people who do this sort of thing legitimately, so finding information on the topic is quite difficult. anyway, don't fool yourself into thinking that this type of work is easy.. talking people out of passwords or login methods on the phone, or sending a trojan "service pack" via email is child's play... looking someone in the eyes and overcoming your body's instinctive reaction to let them know that you don't even believe what you are saying is quite stressful. luckily, no one will ever imagine that you are just trying to get the same level of access that they have, so it doesn't matter how bad you screw up... seems easy, but it is incredibly stressful.. however, the "high" you get once you're in is incredible
Re:A good quote I once heard... (Score:2)
Re:I must be missing something (Score:2)
Probably $200 an hour.