when I saw Kevin Kitnick Picture and The art of deception adv. I thought of this :

I remember delivering a training course on call center security for a team of 13 agents and supervisors, part of that Training course dealt with social engineering and Pretext calling,


In order to sharpen the teams skills and before we started Our training course we had this quiz, I will ask the same 2 questions (tasks) I asked the Team to do and come back with the answers in the following day:

1) I wrote a Phone Number on the Flip chart and asked the team to develop a scenario in order to get the passport Number That belongs to The Father or Mother that lives at the House of that specific Number! , The scenario should be conducted in Less than 5 Minutes and every one of the team was asked to develop 3 different scenario and those similar scenarios between the different agents will be rejected!
Remember all we want is the Passport Number! Nothing More.

2) We will take the whole team in a Bus to One of the major streets and there we will Point to a certain balcony (on the 3rd floor for example) and ask each and every Member to develop a different scenario so he/she can get into that apartment and in less than 15 Minutes, he or she Must appear on the balcony with a glass of water in His/her hand. (Of course we didn’t take any one in any Bus…this was to Help imagining the situation!) And again each was asked to develop 3 different scenarios and those weak or less persuasive scenarios were excluded!

P.S: The culture in the Middle East is different than USA (for example), if a US banker asked a customer a bout His Mother name, I think he will get an answer, in our region. Don’t count on that too much! , You better find other ways to get the answer

So my question is: Can you come Up with a scenario (Only One.forget the Three) to deal with the passport Number and The balcony thing?

I’ll be waiting for your answers, later On I will Post what some of the teams has come up with.

Enjoy it and Have some Social engineering fun!

Two thoughts:
1) Call and tell them they are a winner of an international flight. You need no credit card number, but do need a passport number to verify that they are eligible to fly at this time. Rules for this are very strict with airport security being what it is. (In the US, many of us don't have passports as we don't travel outside the US so this would be tough here. Unless you are in a major metropolitan area.)

2) Go door to door selling something, start to choke and ask for water, then fresh air because you feel sick. (They don't want a stranger throwing up in their home.)

1) Do a reverse phone # lookup on the # to get the name of the person who's phone it is. Call my friend at the passport control office and tell him I'll buy him a beer after work in exchange for the passport # of that person(s).

2) When you get into the building knock on the door. If no one answers (since they are likely at work) pick the lock or just "open" the door. Grab a glass of water and walk to the balcony. If the door is answered you need to assess the situation.

a) if they do not open the door you need to get them to. When they ask 'who is it' say it Bobby Smith from the Mayors office (chances are the door will be opened.)
b) If they do not open the door fully but have a 'chain' you need to immediately rush the door to keep the chain extended then shoot the chain apart.
c) Once inside calmly level your firearm at the inhabitant(s) and explain that they are to sit down quietly and that you will be gone in 2 minutes. If they stay calm they will not be injured and they will never see you again. If they are not calm they will be shot dead on the spot. Sit them in the nearest seat you can 'attach' them to. Quickly and calmly get your glass of water, wave hello out the balcony, 'detach' the inhabitant(s) if necessary and say goodbye.

See... there is no problem that bribery or force cannot solve.



(These views are just me kidding around... but they would likely work anyway. Who says social engineering need be subtle!)

1)I would either:
A. Be lazy and take the Gamble that the individual does not have a passport - I don't, or maybe just make one up and hope it doesn't get verified.
B. OK I know that wasn't what the point of the exercise was so if I really needed to get it I would Contact the individual explain who I was what I wanted and maybe offer an incentive to comply. I would also give them the bank's number to call and verify. Wait I still like the lazy way better.

2. There's also two ways I could approach this issue:

A. Using the batgrappling hook from my Bat utility belt I would climb up to the balcony and then remove the batglass from my utility belt and fill it from the batfaucet on the back of the belt.
B. On the other hand I could just knock on the door explain that I have some friends waiting below who dared me to find a way to drink a glass of water on the balcony. The occupant could probably see a van/bus/carload of people watching from the street and for a small fee would probably help out.

First I'd go on the internet and print out a logo for a major network studio onto paper that has a sticky back--easily found at CompUSA, etc... I would then call my friend who has professional TV camera equipment. We'd attach the logo to his camera. I'd then go up to the door while he pretended to film and tell the occupant that we were filming a new reality based game show called "Truth or Dare." I'd explain the dare and ask if I could go out on the balcony and drink a glass of water. If that did not work, I'd try their neighbors until someone let me in--then I'd jump to their balcony with a glass of water in my hand.

As far as the Passport number--I'm thinking about it. I'd only have 5 minutes, so that would rule out visiting their house after a reverse look-up. HMMM?!

Folks,

Thanks for those who replied and suggested some scenarios (even the James Bond style social engineering (SE) suggested by some

I guess it would be a better Idea if you took a deep dive into the world of SE through the art of deception seminar, maybe you will start developing your own scenarios and value the Power if a skilled Social engineer that Might bring your Whole network down or (Borrow) your customers Credit cards Numbers and advertise them for sale for the eastern Europe Organized crime .all he needs to achieve this is a simple Phone call maybe or an email or a chat session for 20 Minutes with One of your staff. You should absolutely never underestimate those People who are very innovative and stylish in every Move they take to take over your network or what ever goal they wanted to achieve.

I remember one of the girls among the team whom was 22 years old and the best in developing her own scenarios, that I asked her if she would Join me in the cyber crime seminar we had in Jordan last September 2002 at Radisson Sas, Amman, I wanted to show a demo to The participants (200 people from banks, law enforcement, Training & consulting and IT), the girl was a Little Bit shy of doing this Live in front of all these people, so we didn’t have the chance to do it!

What is this "Spy Games" ?

Get address from reverse phone directory.
Buy small pig for roasting(small). Go to residence, kick in door and pistol whip occupants until they calm down. Threaten to kill them and bury them with the pig. Obtain information. Take any obvious valuables for your trouble.

Scenario 2: Same deal. Kick in door, beat and threaten occupants, if any, go to balcony and perform desired task. Take any obvious valuables for your trouble.

Provide info to requestor, go to strip club and share take with boss. Watch girls. Wait for next job.