Beware of Internal Threats

Kevin Mitnik told of several cases where he created a hack inside the (virtual and otherwise) walls.

Case 1. Nice lady, waiting for the junior VP to get out of the meeting. While waiting, is trying to work her laptop in the waiting room to create a good impression for said VP. A little nice chat and a little sympathy from the receptionist and a chance to sit in that unused conference room. Leaves a few minutes later with the info taken right off the intranet terminals right there at the conference table.

Case 2. (Actually used by the Hells Angels in Montreal to find the address of a reporter) Find out a low paid person with access and pay an ungodly amount for the information. If that doesn't work, blackmail and physical threats are good back up plans.

Case 3. My laptop got switched at the StarBucks. How did THAT happen! And gee...it got all sorted out later that evening when the nice man got in touch with me, and so no harm done. Right? Its not like I would report this security breach...if I do I am in deep trouble.

Case 4. We put our best guy into the competitions building as a temp. Lots of people on the move in these troubled economic times.

Case 5. I'm the new IT guy...got any problems with your computer? Yeah? (you should, I infected it with that little data stick I had when I vacuumed your floor. It helped that you had the password of the day written on a post it note stuck to the top of the screen!) Well, yeah...I am helping out the regular guy who is swamped with that Y2K benefits package virus. Yeah..don't open that email. You did! Oh well, listen, just go to this site and download the cleaner. Save me from driving across town just to do it myself.

Case 6. Yeah. There we go. Every single key stroke. Those wireless keyboards are priceless! They don't even know I am right here in the next office! Oh look, the Senator is downloading a porn site. hmmm. Wonder how I can leverage THIS little bit of info!

If you have not read Kevin Mitnik's book, The Art of Deception, you deserve to have your data fall into the wrong hands. Note that none of these methods I mention above use data mining or any of the usual IT hacks. They are social engineering methods which get in behind the walls your IT guys are working so hard to create!