2KKUU7ita

Chapter 5: Social Engineering
A case study in social engineering with Ira Winkler
In this case study, Ira Winkler, a professional
social engineer, graciously shared an interesting
study in social engineering.
The Situation
Mr. Winkler’s client wanted a general gauge
of the organization’s security awareness level.
Ira and his accomplice went for the pot of gold
and tested the organization’s susceptibility to
social engineering. To start, they scoped out
the main entrance of the client’s building and
found that the reception area and security desk
were in the middle of a large lobby and were
staffed by a receptionist. The next day, the two
men walked into the building during the morning
rush while pretending to talk on cellphones.
They stayed at least 15 feet from the attendant
and simply ignored her as they walked by.
After they were inside the facility, they found
a conference room to set up shop in. They sat
down to plan the rest of the day and decided
a facility badge would be a great start. Mr.
Winkler called the main information number
and asked for the office that makes the badges.
He was forwarded to the reception/security
desk. Ira then pretended to be the CIO and told
the person on the other end of the line that he
wanted badges for a couple of subcontractors.
The person responded, “Send the subcontractors
down to the main lobby.”
When Mr. Winkler and his accomplice arrived,
a uniformed guard asked what they were working
on, and they mentioned computers. The
guard then asked them if they needed access
to the computer room! Of course, they said,
“That would help.” Within minutes, they both
had badges with access to all office areas and
the computer operations center. They went to
the basement and used their badges to open
the main computer room door. They walked
right in and were able to access a Windows
server, load the user administration tool, add a
new user to the domain, and make the user a
member of the administrators’ group. Then they
quickly left.
The two men had access to the entire corporate
network with administrative rights within two
hours. They also used the badges to perform
after-hours walkthroughs of the building. While
doing so, they found the key to the CEO’s office
and planted a mock bug there.
The Outcome
Nobody outside the team knew what the two
men had done until they were told after the fact.
After the employees were informed, the guard
supervisor called Mr. Winkler and wanted to
know who issued the badges. Mr. Winkler
informed him that the fact that the security
office didn’t know who issued the badges was
a problem in and of itself, and that he does not
disclose that information.
How This Could Have Been Prevented
According to Mr. Winkler, the security desk
should be located closer to the entrance, and
the company should have a formal process for
issuing badges. Access to special areas like the
computer room should require approval from a
known entity, as well. After access is granted,
a confirmation should be sent to the approver.
Also, the server screen should be locked, and
the Windows account should not be logged on
unattended. Any addition of an administratorlevel
account should be audited, and appropriate
parties should be alerted.
Ira Winkler, CISSP, CISM, is founder and president
of the Internet Security Advisors Group.
You can find more of his case studies in his
book Spies Among Us: How to Stop the Spies,
Terrorists, Hackers, and Criminals You Don’t
Even Know You Encounter Every Day (Wiley).
67