In the heart of Tokyo, a figure known as “Shad0w” lurks in the darkness.
An expert in deception and technology, Shad0w exposes the hidden weaknesses in society’s security networks.
The Case of the Consulting Caper
Our story unfolds at a consulting firm in Tokyo, renowned for its stringent security and confidential dealings.
Shad0w sees this firm as a prime target.
She starts her covert operation a month early, gathering information from various cafes around the firm’s office, blending into the everyday hustle.
Shad0w meticulously notes employee habits, their interactions, and even scraps of conversation, piecing together the firm’s internal layout.
One morning, Shad0w, posing as a new employee of the firm, contacts the IT department. She fakes a tone of slight panic and confusion.
“Hi, this is Jenna—I just started last week, and I’m really embarrassed, but I’ve locked myself out of all my accounts. Can you help me reset my password?” she asks, her voice tinged with urgency and a hint of distress.
The person on the other end, Mark from IT, responds with a mix of professionalism and natural inclination to assist. “Of course, Jenna, don’t worry about it. Happens all the time. Let’s get you sorted out.”
“Thank you so much! I’m just starting to get the hang of things around here, and this really threw me off,” Shad0w continues, building rapport.
Building rapport is the strategic process of creating a connection and mutual understanding with a target, which allows the extraction of sensitive information or manipulation of the target’s actions. It is a crucial skill for social engineers to gain trust and influence their targets.
Mark guides her through the security process. “I’ll need to verify some details first. Can you tell me the name of your department head and the project you are currently assigned to?”
Shad0w, having found this information during her LinkedIn observations, replies confidently. “It’s Michael Thompson, and I’m assigned to the Horizon Project. I was actually trying to access our project documentation when I realized I was locked out.”
“Got it, that checks out,” Mark confirms, unaware that Shad0w is using each question to further her infiltration. “I’ll send a password reset link to your registered email. Can you access it right now?”
This question presents a potential stumbling block, but Shad0w is prepared. “Actually, that’s part of the problem. I think I made a mistake setting up my email account on my phone. Could you send it to my personal email just this once? I promise to sort it out immediately,” she suggests, hoping to intercept the reset link.
Mark hesitates, sensing a deviation from standard protocol. “I’m not really supposed to do that. But given it’s your first week, I’ll make an exception. Just make sure to get your email sorted, okay?”
“Absolutely, I really appreciate this, Mark. I’ll take care of it as soon as I’m back in,” Shad0w assures him, securing her access to the firm’s systems.
Through this exchange, Shad0w demonstrates the primary tactics of social engineering: pretexting by assuming a false identity, eliciting information through rapport building, and exploiting the human tendency to be helpful.
Social engineering techniques involve the psychological manipulation of individuals to obtain confidential information, access, or cooperation in activities that compromise security. These methods are employed by attackers to exploit human vulnerabilities rather than technical vulnerabilities in systems.
Each step of the process is critical, exposing vulnerabilities not in the digital defenses, but in human nature itself.
The Financial Fiasco
Continuing from the success at the consulting firm, Shad0w, now under the alias of “Kelly Smith,” set her sights on a new challenge: accessing customer accounts at a prominent bank.
Her strategy involved a two-pronged approach that began with a digital assault, specifically starting through the bank’s customer service chat.
Hack 2: Extracting Money from Customer Accounts
Attempt 1: Chat-Based Approach
Logging into the chat service, Shad0w, as Kelly, typed frantically, conveying urgency:
“I’m in a huge emergency! I lost access to my phone, email, and laptop after a night out and desperately need to access my bank account. I’m using a hotel phone because I’m stranded out of country and really need some help.”
Her #1 goal was clear: to persuade the customer service representative to change the registered email or phone number on her account, which would give her administrative control to do whatever she wanted.
The customer service agent replied, “I understand your situation, but for security reasons, we can only send a reset link to your original contact details. Can you access any of your devices?”
Faced with the bank’s strict adherence to protocol, Shad0w realized the limitations of the chat-based approach.
It was time for a more direct and personal tactic that would exploit human nature.
She closed out of the window, frustrated but moving on.
Attempt 2: Phone Call-Based Attack
Understanding the benefits of a voice call, Shad0w prepared to use the less traceable and more persuasive nature of phone communication. She used a caller ID spoofing app to mimic Kelly’s registered phone number, adding a layer of authenticity to her call.
Caller ID spoofing is a technique where attackers manipulate the caller ID information to make it appear as though the call is coming from a trusted or known number. This is often used in social engineering attacks to gain trust and deceive the target into divulging sensitive information or performing specific actions because we think our actual loved one is calling.
Dialing the bank’s customer support, Shad0w, as Kelly, began:
“Hi, this is Kelly Smith. I’m currently traveling and in a real jam. I can’t access any of my funds and I’m really, really stressed out. Could you please, please help me get access to my account?”
The agent, hearing the distress in Kelly’s voice, responded with empathy but maintained a professional demeanor. “I understand, Ms. Smith, and I’d like to help you. However, we need to follow our security procedures. Can we verify some additional information?”
Shad0w was prepared, having researched common security checks. “Of course, but I don’t have access to much right now,” she replied, crafting her responses to steer towards knowledge-based authentication, which could be easily researched.
They wouldn’t budge.
The agent suggested, “If you can’t receive a text message for two-factor authentication, we normally wouldn’t proceed. But given your situation, if you could provide some photo identification and perhaps another form of verification, we might be able to help.”
They said she could send in a driver’s license, social security card, and a utility bill to verify her identity and they might give her access.
Seizing the opportunity, Shad0w excitedly confirmed, and hung up.
Soon she and her side kick, equipped with Photoshop skills, created digitally altered documents—a driver’s license, social security card, and a utility bill.
The next morning at 9 a.m. right when the bank opened, she submitted the documents and held her breath.
And she waited.
Just her luck!
The documents weren’t scrutinized beyond matching names and addresses, a common oversight in such urgent situations.
“Thank you, Ms. Smith. Everything seems in order. I’ll grant access to your account. You should be able to have full access now” the agent finally conceded, swayed by the urgency and the seemingly valid documents.
By the next morning, Shad0w had successfully drained all the money in the accounts.
The Mergers
With her first objectives accomplished, Shad0w, now deeply embedded within the consulting firm’s digital infrastructure, set her sights on her next target: uncovering sensitive information about an impending merger and acquisition (M&A). This required a shift in tactics and an increase in the stakes.
Attack 1: Posing as a Journalist
Shad0w decided to take on the persona of a journalist. She stole a real journalist’s identity, but fabricated social media profiles and a detailed backstory. Using this persona, she reached out directly to employees within the target company, attempting to pry loose details about the M&A under the guise of gathering insights for an industry article.
She approached a potential insider, messaging him on LinkedIn. “Hi Nathan, I’m Alex Carter, a tech journalist looking to discuss the emerging trends affecting your sector. I’ve heard there might be some big moves coming up, perhaps even mergers. Could you share any insights?”
Nathan replied cautiously, “Hi Alex, thanks for reaching out. There isn’t much I can say. As you can understand, there are confidentiality clauses I need to adhere to.”
Shad0w, persisting, tried another angle. “Of course, I completely understand. Just looking for some general thoughts on how the market might be shifting. Any information would be helpful, even if it’s just the industry buzz.”
Despite several attempts, Nathan and others remained tight-lipped. It became clear that the journalist angle was not going to yield the desired results due to inherent distrust and the guarded nature of corporate employees.
Attack 2: Exploiting the Hiring Process
Not deterred by the setback, Shad0w shifted her approach. She crafted a resume and a LinkedIn profile portraying herself as a seasoned product manager. Applying to several positions, she got her foot in the door at the company undergoing the merger.
Shad0w’s approach to infiltrating the company undergoing the merger was meticulously planned and executed. Starting with a solid backstory and a fabricated resume, she successfully passed the initial intake interview, where her feigned enthusiasm and detailed industry knowledge won her the approval of the HR representative.
This success led to a more challenging round—a full day of six interviews with various team members and executives, each a potential gatekeeper to the confidential information she sought.
As she moved through her day of back-to-back interviews, Shad0w used a strategic approach during the “Do you have any questions for us?” segment of each session. This was her opportunity to subtly extract sensitive information under the guise of inquisitive enthusiasm for her potential new role.
In her first interview of the day, with a department head, she found an opening. “I’ve done extensive research for this role,” Shad0w began, leaning forward slightly to convey her interest. “I know you can neither confirm nor deny this information, but I found some news articles about a potential M&A. How do you expect this role to change over time, especially with market dynamics potentially shifting?”
The department head, pleased with her thorough preparation and intrigued by her question, responded with a knowing smile. “Well, I definitely can’t confirm or deny any specifics,” he started, his tone both cautious and conspiratorial. “But hypothetically, if there were any major strategic moves, like say, a merger, one might expect [REDACTED].”
Encouraged by this response, Shad0w continued to employ her carefully phrased questions in subsequent interviews. By the time she reached her sixth interview, her method had worked on three out of the six interviewees. Each provided her with fragments of information, cloaked in hypotheticals and denials, but collectively these pieces began to form a coherent picture of the upcoming merger.
Her ability to frame her questions within the context of role expectations allowed her to navigate through the interviews effectively, turning each conversation into an opportunity to glean protected information without ever raising suspicions.
The 60 Minutes Deception
In a daring final challenge, Shad0w sets her sights on a prominent television host, Ada, from the show “60 Minutes”. Ada, aware of potential security threats, has heightened her vigilance, making Shad0w’s task even more complex.
Planning the Heist
Shad0w’s first step involves gathering extensive information on Ada. Using open-source intelligence, she delves into Ada’s social media, interviews, and public engagements to identify potential vulnerabilities. Ada’s upcoming trip to Ukraine, mentioned in a recent interview, provides the perfect pretext for Shad0w’s approach.
Pretexting is a social engineering tactic where an attacker creates a fabricated scenario, or pretext, to deceive a target into divulging sensitive information or performing actions that they would not typically undertake. The pretext is carefully crafted to make the interaction appear legitimate and trustworthy.
Technology in Play
To execute her plan, Shad0w employs a sophisticated voice cloning tool. She chooses to mimic Ada’s assistant, Jess, whom Ada trusts implicitly. After hours of processing sample voice clips from Ada’s public speeches, the AI creates a convincing clone.
Setting the Stage
The plot thickens as Shad0w collaborates with insiders from the “60 Minutes” film crew under the guise of a special episode on cybersecurity. Her objective is to gain personal information live on air.
The film crew tricks Jess into stand in for Ada during a fake lighting setup. Unbeknownst to Jess, this is a ruse to position her right where Shad0w needs her for the final act.
The Call
With everything in place, Shad0w initiates the call. Her heart races as the phone rings, the line crackles, and Jess answers with a tentative, “Hello?”
Using the cloned voice of Ada, Shad0w quickly gets to the point, minimizing the chance for Jess to detect any discrepancies. “Jess, sorry, need my passport number because the Ukraine trip is on. Can you read that out to me?”
The execution is flawless. Jess, standing in for Ada and convinced by the urgent yet familiar request, doesn’t hesitate. “Of course, just a moment,” she replies, fetching and divulging the information on live television.
It worked!
Shad0w won the final round.
Revelation and Resolution
As the tales of these exploits reached their climax, the mysterious veil surrounding Shad0w was lifted, revealing a startling truth.
This spy wasn’t a fictional character from the pages of a suspense novel but a real-life social engineer, Rachel Tobac. Rachel, an ethical hacker and CEO of SocialProof Security, wields her expertise not for malevolence but to highlight critical vulnerabilities in human nature and technology. Her professional journey, marked by her accolades as a three-time runner-up at DEF CON’s Social Engineering Capture the Flag, underscores her commitment to enhancing security awareness by demonstrating just how easily it can be compromised.
Debrief: The Art of Defense Against Social Engineering
In analyzing the success of her recent operations, Shad0w highlights several key strategies to strengthen defenses against social engineering, applicable both to individuals and organizations.
But it’s surprisingly easy to protect yourself against her threat, here’s how:
Vigilance Against Familiarity
You should be cautious about requests received via communication platforms, especially those that seem unusual or urgent. If a friend or family member asks for sensitive information or money under strange circumstances, call them back directly on a known number to confirm the request. Also, establish a duress word to indicate covertly that you are in distress.
Duress words are pre-arranged code words embedded in normal conversation to indicate covertly that a person is in distress without alerting others. These words are agreed upon in advance and can be innocuously incorporated into speech, allowing someone to request help discreetly when under threat or duress.
Your company should require verification for out-of-the-ordinary requests, even from known sources. Any sensitive information requests, even from senior executives, should be confirmed through a direct phone call or verified in-person.
Limit Public Information
You should share less information on social media about personal details, travel plans, or family connections to reduce the risk of being targeted by social engineers. Regularly review your privacy settings to control who views your information. You should also wipe your personal data from data brokerage sites.
Your company should minimize the amount of operational and employee information available publicly. Avoid sharing details about internal processes or key personnel involved in sensitive projects on company websites or social media.
Implement Verification Protocols
You should enable two-factor authentication (2FA) on all accounts, from social media to banking. This adds an extra layer of security, making unauthorized access considerably more difficult. Avoid using text messages for 2FA, instead try an application like Authy.
Your company should enforce strict protocols for accessing sensitive information, such as implementing 2FA and requiring multiple forms of verification for password resets or access to critical data.
Educate and Train
You should stay informed about common social engineering tactics like phishing or pretexting and be skeptical of unsolicited communications. Learning to verify sources and understanding the importance of security practices are crucial defenses.
Your company should conduct regular training sessions to educate employees about social engineering tactics and how to respond to them. Phishing tests and other simulation exercises can be very effective in preparing employees to identify and handle security threats.
Identify Edge Cases
You can improve your personal security by considering “what-if” scenarios in your digital interactions. Question the legitimacy of unexpected requests for personal data or think twice before sharing information.
Your company should regularly review and update security policies to identify less obvious vulnerabilities that might be overlooked, such as conducting scenario-based testing to reveal potential weak spots and exceptions.
Implement Callbacks
You should hang up and initiate a new call back if you receive a request for sensitive information from a supposedly trusted phone number.
Phone spoofing remains a widespread problem due to the absence of unified telecom security standards. Achieving consensus on these standards across diverse regions and providers proves difficult, as stakeholders rarely agree on a unified approach. This discord makes it challenging to implement effective and consistent anti-spoofing measures that would adequately address and rectify this persistent vulnerability.
Your company should establish a standard procedure for verifying identity through callbacks whenever an unexpected or unusual request is received, especially for financial transactions or access to sensitive information.
Email Verification and One-Time Passwords
You should use email verification features where available, such as enabling notifications for new logins or changes to account settings, and using OTPs for verifying significant actions.
Your company can secure email communications by implementing tools that require additional verification for email changes or account resets, such as sending an OTP to a registered mobile number.
Service Codes, PINs, and Verbal Passcodes
You can set up verbal passcodes or PINs for personal security, ensuring that only those who know the passcode can make changes to your accounts.
Your company can enhance security by requiring service codes, PINs, or verbal passcodes not just for client interactions but also internally among staff to access certain departments or information systems.
Involve Someone Else
You should involve a trusted family member or friend in decisions related to unusual financial requests or sharing sensitive information as a safeguard against potential scams.
Your company should involve higher-level management in the verification of sensitive requests or unusual transactions to provide an additional layer of oversight and reduce the likelihood of successful social engineering attacks.
By integrating these measures, both you and your family can significantly fortify your defenses against social engineering tactics in an increasingly interconnected and digitally sophisticated world.
Stay Curious,
Addie LaMarr
