Friday, March 28, 2014

VIP Social Engineering

Yesterday there was this big commercial vendor security event in Belgium with a VIP area. I was offered VIP entrance tickets but at the time offered I wasn't even sure I wanted to go and now I had regular tickets.

The thing was thus that a number of people I knew were VIP and I wanted access to the area were I was not supposed to come.

The first time I stopped at the lady checking the badges with my phone next to my ear, totally ignoring her and having a conversation with somebody who was actually inside. It was funny because I was describing the area loudly like "I see this banner, and to the left that poster and ... ok now I see you" and just walked right in like I belonged there without getting challenged.

The second time I wanted a different approach and got challenged. I showed my badge, she said I couldn't enter I asked why not so she had the feeling she was doing her job. Then I said, I really needed to talk to my colleague and pointed at a guy who was going to sit down. He was actually my colleague but I could have pointed at anybody just far away enough to make sure she couldn't leave her desk. Since she was alone, she had no way of going to check my story. She said ok, but I couldn't have any drinks or snacks ... sure, I said I needed a chat with that guy, no drinks, no snack.

One of the guys going in with me, piggy backed on my excuse and did not even have to speak a word, he just smiled.

Yes, we did this for fun and giggles but social engineering is daily used by bad people.

Sunday, March 9, 2014

SMS Scam

Hello,

I want to tell you about a scam I received last Friday on my phone. I got during the evening a text message which was a nice piece of Social Engineering. The text message said "Appelle moi urgent 0010664112011".

The text was in French, a language spoken in my social circle, so I could have been tempted to call back. It is a classic in Belgium that people without any calling credit can send you a message that looks similar to this. This is for a lot of youngsters the way they communicate with their parents over the phone since they are most of the time out of credit.

The form that it is written in is interesting too. "Appelle moi" means "call me" so that is an instruction and if you would still hesitate it says that it is urgent and thus trying to take away any resistance. It uses the feeling of guilt that we have if we don't help somebody in need.

When I researched the number online it was immediately obvious that I was not the only one and there are number of variations. The best illustration of this is anruf-info.de. They collected some data which is interesting. If you look at the 7th, the evening I got the message there are quite a lot of Belgians reporting it, when a time stamp is given it was in the evening, just like mine. This could be an indication of some form of automatization. As we can see the day after on the 8th the scam just goes on.

Unfortunately I don't have any knowledge about how to trace the origin of this number but it would be very interesting.