Phoenix needs to get the name of everybody in the organization or as many as he can. Why and how? He needs the names so that he can either contact a specific individual or impersonate a specific individual. It wouldn’t go over very well if he tried to convince someone inside the company that he is John Doe but no John Doe works there. Now here is the meat of social engineering. There are a lot of ways to get information from a company. Phoenix should take the direct approach first: ask. A lot of times the receptionist is more than willing to tell someone who is in charge of the Human Resources department or who is in the IT department. Phoenix has found that if you act lost, dazed, or confused, people will help. It’s human nature to want to help people. What works really well is if an attacker can get access to a phone system and adjust the outbound caller ID. If, during his reconnaissance, he found internal phone numbers, he could change the outbound caller ID from another number to that internal phone number. Phoenix will get a lot more answers if the person he is calling sees caller ID come up with an internal number. If that doesn’t work, Phoenix can try the infamous dumpster diving. When dumpster diving, he will need to grab every conceivable piece of paper he can carry. He needs to take it back to a safe location and start sifting through it. This process might take days, but it can reveal a lot. Phoenix has been amazed by what he has found inside a dumpster. He has found jewels of information such as corporate phone directories, organizational charts, budgets, and vacation schedules. Nancy Drew calls this “sleuthing.” Now Phoenix has names and possibly some phone numbers.

Phoenix will need to do some searching on the Internet. By going to the company’s Web site and trying the Contact Us page, Phoenix should find a corporate phone number. He can then run a simple Nslookup command such as the following:

The previous Nslookup response displays several pieces of information. Does the medical center host its own mail? Where are its Web pages hosted? After Phoenix ran Nslookup, he could run the telnet command to see what was back there. This is referred to as footprinting.

The response tells Phoenix that the Regional Care Center hosts its mail on a Microsoft Exchange Server.

Phone numbers are needed to stage a social engineering attack via the phone. Let’s say during his recon with the Web site Phoenix found Regional Care Center has several medical branches and one administrative office stretching out over several cities. Now he can make a couple of phone calls. The following might be one sample phone conversation:

Phoenix hangs up. He picked up two names. He learned that they search by Social Security number and, more importantly, he learned where the records are stored. The next day, he drives down to the Records Department. When entering he makes a mental note of every aspect of the office. What type and brand of locks are on the doors? Is there an alarm system and who is the manufacturer? Is there video surveillance? If so, what type of cameras? Are they digital cameras or IP cameras? Each variation has its own set of flaws.

When Phoenix gets inside, he asks for Ted because that is the person he spoke with the day before:

Now, Phoenix watches to see what type of computer and operating system Bill uses to look up the record. He will also try to see what program he is using to access the records, as well as the username and password he types:

When Phoenix walks towards the restroom, he notices a door labeled Records.

Phoenix has just done a physical reconnaissance of the entry to the records office. What did he find? He has obtained the operating system of the PC, the name of the software the office uses and more importantly a username and password combination to get into the SOAPware software. He also noticed no cameras and no alarm system. He noticed only one door in the front and that the building appears to have good parking lot lighting. He walks around to the rear of the building and notices a loading dock and one door with poor lighting.

Phoenix is now starting the building blocks of deception.

This one is probably easy enough to find out—Phoenix just needs to call up and ask. It is public information. For that matter, it is probably on their Web site or printed on the door.

Phoenix will need to know types of medical procedures the target performs to be successful in his social engineering attack. If asked what medical exam he had done, and he tells them that he had a prostate exam, and the office is that of a podiatrist, he probably won’t get any answers. Again, this should be easy enough information to retrieve. It is probably on the company’s Web site, or he could again just call and ask them.

This information is a little tougher to get because IT personnel names generally are not publicized, or the company might use an outside IT firm. Why does Phoenix want the names of the IT personnel? If Phoenix sends an employee an e-mail from the IT director, he can almost guarantee that the employee will open it. He spoofs the IT director’s e-mail address, attaches a file to it, and maybe hides a root kit such as Hacker Defender, FU, or Vanquish in the alternate data stream. How does he get a name? As stated before, you might be surprised if you ask. In his previous phone conversation and site visit he managed to get three names: Mary, Ted, and Bill.

His phone conversation might go something like this.

Now Phoenix has the name of an internal IT person.

Because he is going to try to gain physical access, one method would be to impersonate an outside vendor. It’s easy to strap on a telephone test set (butt set) and walk right into a business. Companies are so accustomed to seeing the phone guy that these service personnel are rarely stopped. Phoenix researches the CLECs (competitive local exchange carriers) and ILEC (incumbent local exchange carrier) in the area.

When he was on site trying to get the medical records, Phoenix took note of the operating system and software the company used. In the world of EMR, there is a myriad of vendors. One item most of them have in common is the use of HL7 (health level 7) formatting to transfer clinical and administrative data.

Is the company running Windows, UNIX, Linux, or some other operating system?

Phoenix will need to check out the Web site again. It might tell who built the Web site. Maybe he needs to do a little bit of dumpster diving or Web site reconnaissance on the marketing company to see what little pieces of information he can pick up. Press releases are always good information. Companies do press releases for recent hires, recent promotions, and all types of valuable, yet seemingly innocuous information.

Phoenix reviews not just the Web site of the medical firm he is planning to attack, but the marketing company’s too. He might be able to obtain information from software vendors for the software his target is using.

These can be very helpful. If he sends an e-mail to someone inside the company from IT personnel, the recipient will open it. How can he spoof an e-mail address? It’s very simple:

The preceding is a simple example of how easy it would be for Phoenix to spoof an e-mail address. Here is a Visual Basic script that sends a file as an attachment:

If Phoenix sends the preceding e-mail to someone inside the organization from inside the organization, the receiver will open it because it appears to be coming from Mark in the IT department.

Vacation schedule information might be tough to get, but it is important. Phoenix would not want to impersonate Mark from the IT department if Mark is on vacation. He might get lucky and find a vacation schedule in the dumpster. But this is not likely. So, what does he do? Perhaps the company has an intranet. Some companies use Microsoft SharePoint Server or a similar product for company calendars and contact lists. He could try to compromise the company’s intranet. There are some tips in other chapters that might help Phoenix. Another avenue would be to gain physical access. Often company calendars are posted in community areas such as kitchens, break rooms, or smoking areas.

An almost infallible method of gaining information is to have e-mails forwarded to your outside SMTP (Simple Mail Transfer Protocol) account. Vacation schedules as well as all types of company internal information are sent via e-mail.

Fortunately Phoenix previously spoke to Mark, so he knows Mark is not on vacation.

This information is generally the most direct to obtain.

Entry points are physical access to offices. Phoenix needs to gain access to the Records office in particular. How many entry points are there? Which ones have less light? Which ones have more or less security? What else is at the Records office? Is it just a room in a fully operational 24×7 medical facility or is it a separate building that is locked after 5:00 p.m.? If the Records office is open and staffed 24×7, entry will entail overcoming some different obstacles.

Is there any in place? Does the company have guards? Does it have video surveillance? Perimeter and motion detection? Does the company use proximity cards? Does it have biometrics? Depending on the level of expertise, the physical access controls the company has implemented will influence Phoenix’s attack vector.

Organizational charts can provide a wealth of information. Phoenix will try to get his hands on a chart containing names and positions because that will give him the first big step in impersonation. Even if the organizational chart just shows positions, it is still helpful. A social engineer who has a good working knowledge of the company staff and departments will probably be more successful when making an approach than one without that information. Most staff members will assume that someone who knows a great deal about the company must surely be part of the staff. The chart might also tell Phoenix whether the company has an internal IT staff.

Where is the records room located? Phoenix found the Records office, but where is the records room? First floor? Second floor? Is it behind and through the bathroom? If he has to gain illegal entry to this office, he doesn’t want is to spend a lot of time searching for the records room.

If he calls the office and is greeted by an automated attendant; he will go through all the prompts and collect as many names, departments, and extension numbers as possible. With information like this he can begin to build his impersonation attack on the phone.

The following is a list of the information Phoenix has gathered through social engineering, piggybacking, and reconnaissance:

Physical Security and Access Control:

•   No alarm system, just locks on the doors for the perimeter.

•   Standard 480 series deadbolt lock on perimeter door. See Figure 6.1.

Figure 6.1 Standard 480 deadbolt

•   No guards.

Now that he has volumes of information, Phoenix can start to formulate an attack plan:

To gain physical access, Phoenix must get past two locks. This can be done in two ways: He can break the doors down or pick the locks. Both methods are effective, but in different ways. If Phoenix doesn’t need to cover his tracks, the smash-and-grab technique is fine. If he wants to cover his tracks, he must pick the locks. Depending on how much practice he has at picking locks, it might take him 5 minutes or it might take 45 minutes. This is one of many skills Phoenix has to hone to perfection before attempting to pick a lock in the real world.

There are three styles of lock picking:

Phoenix will use a bump key because he knows it doesn’t leave scaring on the tumblers like a pick gun and it is very effective.

A bump key is sometimes referred to as a “999 key” because all cuts are at the maximum depth of 9. Bump keys are effective and simple to make.

Notice in Figure 6.2 that all the keys have all the same cuts. All cuts are at the maximum depth of 9. You can cut bump keys for both regular pin tumbler locks as well as for dimple locks, whether or not they are “pin-in-pin.”

Figure 6.2 Key cuts

Phoenix can create his own bump keys with a file and some patience. He takes an old used key and files all the valleys down to the deepest cut already on the key.

The principle behind a bump key is to insert the key as far in as it will go, and then pull it back just one click. Phoenix will hear a click when the last pin settles in. Then he will turn the key as if he were opening the lock to put pressure on the pins. With a hammer handle, or something solid but not too heavy, he strikes the butt of the key continuously while keeping pressure on the key. If performed with the right turn pressure and strike force, the lock will open. If the lock does not turn, Phoenix has either applied too much pressure or he struck the key too softly or too harshly. The art of bumping locks is very effective in the hands of an accomplished practitioner.

If Phoenix is unsuccessful in bumping locks, he can move on to a pick gun. A pick gun, as shown in Figure 6.3, consists of one or more vibrating, pick-shaped pieces of metal. A pick gun performs an “automated” rake. When using a pick gun, Phoenix will also need several picks and a tension wrench. He inserts the tension wrench and a pick, and then pulls the trigger. This method can be fairly successful.

Figure 6.3 Standard pick gun

If the pick gun does not work, Phoenix might have to get a set of picks and pick the lock.

Most deadbolts use cylinder locks. A deadbolt is more secure than a spring-driven latch because it’s much harder to push the bolt in from the side of the door. Figure 6.4 shows an example of cylinder locks.

Figure 6.4 Cylinder locks

There are two main elements to lock picking: picks and tension wrenches. Picks are long and thin, similar to a dentist tool. A tension wrench is similar to a screwdriver. In fact, a screwdriver is a good tension wrench.

One common method of picking is raking. Raking is much less exact than picking and is used by lock picking novices. When you rake a lock, you insert a pick with a wider tip all the way to the back of the plug. Then you pull or rake out quickly as it bounces all of the pins up on its way out, while applying pressure with the tension wrench—similar to the tension you apply when you bump a lock. This causes the pins to catch on the shear line. The shear line is where the inner cylinder ends and the outer cylinder begins. If Phoenix has to pick the lock, he will not rake the lock because doing so scars the pins and can leave traces of his entry. Figure 6.5 shows the interior of a lock.

Figure 6.5 Inside a lock

After he gains access to the building, Phoenix needs to gain access to the records room. The records room is locked using a biometric lock.

Defeating biometrics could take two nights. If forced to create a false print, Phoenix might not have the necessary tools, such as computer and printer, with him. Figure 6.6 shows a typical fingerprint lock.

Figure 6.6 The lock is an LA9-3 fingerprint lock by ADEL.

There are three methods of defeating a fingerprint scanner:

The first method is the easiest to try. Some fingerprint scanners will reactivate the previous print just by breathing on them. That’s correct. Phoenix gets close to the scanner and breathes slow deep breaths on it. When he breathes on it, the sensors detect the heat and humidity in his breath, and see the print left from the previous person. This method is quick and takes no skill at all. If that fails, Phoenix will have to move onto method number two.

The second method can be very successful because many scanners on the market today scan in only two dimensions, not three dimensions. That means a picture of a print is almost as good as the real finger. To defeat a fingerprint scanner using method number two, Phoenix will need some supplies.

A $35 latent fingerprint kit is the easiest way to use this method. Another option is a home-based kit as seen on certain Internet blogs:

Phoenix also needs the following:

He will need to obtain a cup, a glass, or some other nonporous item that a person authorized to enter the records room has left lying around. Phoenix will look in the kitchen, dumpster, or around the person’s desk. In a worst case scenario, he can try to lift the latent print off the door lock itself.

After obtaining an object, Phoenix will need to lift a latent print from it. If he has the fingerprint kit, doing so will be very quick. If he does not have the kit, he will need to do the following.

Squirt some Super Glue into the small bottle cap and place it over the latent print. When the vapors from the glue fumigate the print, it will turn a light shade of grayish white.

After either dusting the item or using the Super Glue trick, Phoenix will need to take a photograph of the latent print from very close up. Then he will download that picture into his computer. He will clean up the picture using photo-editing software and print it on the acetate sheet. With the straw, he rolls out wood glue over the print—this will act as the new print. After the glue dries, Phoenix cuts out the print, making sure the print he cuts is the same size as the original latent print he lifted off the glass. After cutting out the new print, he uses the skin-friendly glue to glue the new print onto his finger.

Unfortunately some fingerprint readers won’t fall for the overlaid fingerprint. If that is the case, Phoenix will have to use method three, which is much more time-consuming, and he probably will have to spread out his entry over two visits.

Following are the steps to take if he attempts method three, creating a dummy finger.

After Phoenix has lifted the latent print, photographed it, and printed it as described previously, he will need to get some polymer clay. Phoenix will transfer the printed image onto the clay. Using a small drill, he will cut or chisel out the ridges and valleys in the molding material. Fingerprint scanners need only a small amount of minutia. Ridge endings and bifurcations are known as minutiae. After Phoenix creates the three-dimensional fingertip, he can use it to enter the records room.