Social Engineering

Has anyone ever heard of this? Or more over has anyone heard of Kevin Mitnick? For those who had their ear to the techie/hacker ground in the mid 90's, you may remember him. Kevin Mitnick was a computer hacker/cracker but more accurately, he was a master of the technique called "Social Engineering". He had charisma about him that allowed people he spoke to to trust him and even let him in on information that he wasn't supposed to be privy to. These conversations would generally take place over phone lines. He may call up a bank branch, and pretend to be someone from payroll, telling one of the tellers that if they didn't reveal their certain employee number, they wouldn't be able to recieve their paycheck. Then, once he gained this info, he may politely hang up and call another branch of the bank. This time switching hats, and becoming a fellow bank employee who's need's a customers files brought up, including debit card information, account numbers, balance etc..

As Mitnick said: You can have the best internet security software on the planet. The most expensive forensic team, and a host of gadgets to protect you from break ins, but all this will completely fail, as long as human error still exists. The human being, or the 'wetware' is the weak link in the chain of security. A human being is easily fooled, decieved, and can give away such valuable information.

This is just one example in thousands that could be done to gain sensitive information. Now one could easily just repute this and say its not 'social engineering', its just plain lying and stealing. I do agree with that, if you plan on keeping and using said information for nefarious purposes. I see nothing wrong with using this information to see how much information you can get out of someone.

To paraphrase Mitnick; People are very trusting, and generally want to be as helpful to you as possible. Especially if you call a help or service desk. They literally get back to bend over backwards for you. Now you don't want to aim to get the person their fired, or in any trouble, so don't ask them to reveal secrets that could cost them they're job. But just prodding around and asking for things that a normal person shouldn't know, I don't see anything wrong with that. Again, if you use this information for your own gain, then yes, you are thief. Mitnick unfortunately went to this extreme, and defrauded many companies of money, and was eventually caught, but the idea of Social Engineering, is one that I think is viable and is fun to practice.

If you go on Youtube, there is a video under Social Engineering, where these two idiots, drive into Mcdonalds, and "Socially Engineer" the manager into getting free food. Stuff like that isn't Social Engineering, its blatent lying to get free food that costs 3.99. This sort of thing should be done for sport, fun, and like hacking, just to find out how much you can find out..

Has anyone done their own Social Engineering? Stories to share?