Social Engineer

Social Engineer - Chapter 6

Today, 9:14am

Brody resumed playing the video. It cut to him entering the main reception. A young woman sat behind the reception desk, wearing an unflattering female version of the uniform worn by the guard at the gatehouse. Her bright lipstick and long, manicured nails aided her in maintaining some degree of femininity. She greeted him brightly and verified the details displayed on her computer, just as the previous guard had done.

The receptionist phoned through. The camera panned around as Brody scanned the foyer. Floor-to-ceiling barriers blocked further access into the building. They had proximity sensors that opened when an identification pass was waved within range and authorised by the access management system.

“Hi Mandy —”

The video turned sharply. Brody remembered that he had been shocked, thinking that Mandy had somehow answered the receptionist’s call.

“ — just letting you know that the engineer from Cisco you were expecting has arrived in reception.” She terminated the call. It had only been a voicemail.

Brody’s voice said, “I’m not surprised Mandy didn’t answer. We’ve just been texting each other and she’s in a meeting that’s overrunning. She said she might even be another half-hour or so.”

“Well, you’re welcome to wait,” she replied, indicating the round sofas by the window.

“Sure, thanks.” The camera turned and stopped at a mirror reflecting Brody head to toe. As well as the cap, he wore an engineer’s grey fleece with the Cisco logo prominently embroidered upon it and carried an aluminium case. He patted his stomach, turning back to the receptionist.

“I don’t suppose you know if there’s somewhere I can get something to eat? It’s been a long drive and I missed breakfast.”

“Well, the nearest place would be in the village, but that’s a good fifteen minutes drive . . .” She looked at the logo on his fleece and, visibly making up her mind, said, “Actually, we have a staff restaurant onsite. I’m not really supposed to let you through unescorted, but —”

“That would be great. Thanks . . .” Brody read the red security id pinned to her jacket. It had the word ‘SECURITY’ across the top, her picture and name below. “. . . Yvonne. You’re doing me a real favour.”

“Okay,” she nodded. “Before I let you through I need to give you a visitor pass.”

Following Yvonne’s instructions, Brody removed his cap. The image turned around to show Brody posing for the webcam connected to her computer. Placing the cap back on his head, the camera then showed her insert a white plastic pass with the HTL logo and the word ‘VISITOR’ into a machine. A few moments later, it spat out the card with his picture and false name neatly printed on it. She placed it inside a plastic holder with a clip and handed it to him. He attached it to his fleece, careful not to cover the Cisco logo.

“Bob, that’s against security policy,” whined Jacobsen to Moorcroft. “She should never let someone through unescorted, even to the canteen. I’ll have her fired.”

Brody paused the footage.

Moorcroft replied coldly, “It gets worse. And, if I were you, Paul, I wouldn’t jump too quickly to firing other people.”

Jacobsen narrowed his eyes.

“Look at it from Yvonne’s point of view,” Brody jumped in. “I’m on the list of visitors for someone in the IT department. I look like a Cisco engineer. And the canteen is not in a secure area of the building. She made a judgement call. Training can fix that.”

Hall, who had been fiddling with his Blackberry, interrupted. “Hold on a second, you asked for Mandy. She works in my department and I know for a fact that she was on holiday last week. She wasn’t even in the building.”

“Exactly,” said Brody. “Go on . . .”

“ . . . So you chose her because you knew she wasn’t there. But how could you know that? Not my help desk again!”

“No, they would be unlikely to give me personal information like that. It was much simpler. I used LinkedIn to identify people who work in the IT department. Most people use that site very openly when it comes to posting information about their careers and linking to each other. And, guess what? IT professionals are among the most active users on there.

“Then with a list of names and photos, I went to Facebook. That’s where it tends to get more personal. Mandy’s Timeline clearly stated she’s on holiday. From the pictures she’s just posted, I’d say she’s in the Maldives.”

“Good grief,” said Wilson.

 “The thing is,” the pentester continued, “Yvonne on reception has no way of checking, despite the fact you have the most sophisticated access control systems available. That’s something else that you can change. Shall we continue?”

Met, as expected, with silence, Brody pressed a key on his laptop. All heads turned towards the screen once more.

Yvonne showed the onscreen Brody how to use the visitor pass to get through the security gates. She followed him through and helpfully pointed him down the only corridor, explaining that the staff restaurant was at the end. Thanking her again, he turned away and walked past a secure door on his right.

Brody arrived at the restaurant double doors, his hand pushing one slightly ajar. He turned his head, the image panning around quickly. Yvonne was still staring at him. Brody waved thanks to her with his other hand. She smiled and turned away, walking back through the barriers.

“Phew, that was close,” Brody’s voice whispered a note of relief from the speakers, but in real time, he shifted uncomfortably in his seat. He’d forgotten he’d spoken aloud and had missed it when he’d edited the video for this morning’s meeting. He wished he’d cut it out.

“If Yvonne hadn’t turned around then, I’d have had to enter the restaurant and I’d have lost a good ten minutes going through the motions of buying coffee and drinking it,” Brody felt the need to explain.

The onscreen Brody returned to the security doors he’d passed a minute before. The screen jogged momentarily and the audience heard some fumbling noises, and then his hand held up an HTL pass in the name of ‘Colin Renshaw’ to the camera. It was yellow, with the word ‘EMPLOYEE’ printed across the top. The picture on this pass showed the grey-haired, clean-shaven and lined face of a much older man, quite different to Brody’s youthful appearance. Brody swiped the pass at the proximity sensor and the doors swung open.

Jacobsen leaned forward. Brody paused the playback.

“Oh, for fuck’s sake!” said Jacobsen, his teeth bared. “I know for a fact it’s impossible to fake those security passes. They have military-grade secure RFID technology embedded in them.”

“It’s not a fake,” said Brody.