FlyerTalk Forums - View Single Post - Phishing/Social Engineering of Hotel Guests
Old Mar 6, 2007 | 5:20 pm
  #5  
Kagehitokiri
FlyerTalk Evangelist
 
Join Date: Jun 2006
Location: IAD/DCA
Posts: 31,871
this is more phishing, dialing a ton of people in the hopes that a few will fall for it.

a real social engineer would have called the hotel and gotten an employee to give him the credit card number.

kevin mitnick's books were both enlightening and disturbing at how effective social engineers can be.

think ocean's 11, if they didnt have unlimited funding for all the gadgetry.

http://en.wikipedia.org/wiki/The_Art_of_Deception
it's got a ton of scenarios (mostly fictional examples) of social engineers eliciting information from not only customer service reps(like front desk/reservations agents at a hotel), but even employees who do not take calls from customers.

from Art of Intrusion (which includes a compilation of true stories) >
Curious about how much they could get away with, several team members gained access to a company building by tailgating [following an employee through a door secured by a keycard or other measure], lugging with them an enormous antenna, an in-your-face contraction that took a real effort to carry. Some employee would surely notice this freaky device, wonder about it, and blow the whistle. So, without badges, the team roamed first one of Biotech's [alias for company who hired team for penetration testing] secured building and then the other, for 3 hours. No one said a single thing to them. No one even asked a simple question like "What the hell is that thing?" The strongest response came from a security guard who passed them in a hallway, gave them a strange look, and moved on his way without even a glance back over his shoulder. The Callisma team concluded that, as in most organizations, anyone could walk in off the street, bring in their own equipment, wander throughout the buildings, and never be stopped or asked to explain themselves and show authorization.

Last edited by Kagehitokiri; Mar 7, 2007 at 8:31 am
Kagehitokiri is offline