Confessions of a Social Engineer

Working at the dangerous intersection of technology and security, social engineers help organizations stay safe(r) by exposing their vulnerabilities. Often, this relies less on advanced coding skills than it does on old-fashioned behavioral psychology and the reflexes of a trickster. In this humorous account, an infosec con artist spills her secrets.


“How I Socially Engineer Myself Into High-Security Facilities”
By Sophie Daniel
Vice
October 20, 2017

Hello! My name is Sophie and I break into buildings. I get paid to think like a criminal.

Organizations hire me to evaluate their security, which I do by seeing if I can bypass it. During tests I get to do some lockpicking, climb over walls or hop barbed wire fences. I get to go dumpster diving and play with all sorts of cool gadgets that Q would be proud of.

But usually, I use what is called social engineering to convince the employees to let me in. Sometimes I use email or phone calls to pretend to be someone I am not. Most often I get to approach people in-person and give them the confidence to let me in.

My frequently asked questions include:
What break-in are you most proud of?
What have you done for a test that you were the most ashamed of?

What follows is the answer to both of these questions. Read more.


Carl Sagan’s Crash Course in Critical Thinking

This could hardly be more timely, so we’re revisiting Maria Popova’s Brainpickings review of “The Fine Art of Baloney Detection,” a chapter from Carl Sagan’s book The Demon-Haunted World: Science as a Candle in the Dark, in which the legendary scientist distills his years of professional skepticism into a primer for recognizing and calling BS in everyday life. H/t Dino.


“The Baloney Detection Kit: Carl Sagan”s Rules for Bullshit-Busting and Critical Thinking”
By Maria Popova
BrainPickings
January 3, 2014

Sagan reflects on the many types of deception to which we”re susceptible “” from psychics to religious zealotry to paid product endorsements by scientists, which he held in especially low regard, noting that they “betray contempt for the intelligence of their customers” and “introduce an insidious corruption of popular attitudes about scientific objectivity.” (Cue in PBS”s Joe Hanson on how to read science news.) But rather than preaching from the ivory tower of self-righteousness, Sagan approaches the subject from the most vulnerable of places “” having just lost both of his parents, he reflects on the all too human allure of promises of supernatural reunions in the afterlife, reminding us that falling for such fictions doesn”t make us stupid or bad people, but simply means that we need to equip ourselves with the right tools against them.

Through their training, scientists are equipped with what Sagan calls a “baloney detection kit” “” a set of cognitive tools and techniques that fortify the mind against penetration by falsehoods:

The kit is brought out as a matter of course whenever new ideas are offered for consideration. If the new idea survives examination by the tools in our kit, we grant it warm, although tentative, acceptance. If you”re so inclined, if you don”t want to buy baloney even when it”s reassuring to do so, there are precautions that can be taken; there”s a tried-and-true, consumer-tested method.

But the kit, Sagan argues, isn”t merely a tool of science “” rather, it contains invaluable tools of healthy skepticism that apply just as elegantly, and just as necessarily, to everyday life. By adopting the kit, we can all shield ourselves against clueless guile and deliberate manipulation. Sagan shares nine of these tools. Read more.


Voter Intimidation Shenanigans Exposed

Here’s an inside look at the bullying and election fraud Donald Trump’s buddy Roger Stone had in mind for “certain areas.” Also, check out this really good guide to ways to prevent you from voting and what you should do about it.


“Trump Loyalists Planned Voter Intimidation Using Fake ID Badges, Fake Exit Polling – Until HuffPost Asked Them About It”
by Christina Wilkie
Huffington Post
October 25, 2016

aotpvoteprotectorsVote Protectors, the anti-voter-fraud group hosted by Donald Trump ally and political dirty trickster Roger Stone, plans to send volunteers to monitor polling places in nine cities with high minority populations on Election Day, Stone said last week. Untrained poll-watchers have intimidated voters in previous elections. But Vote Protectors is going further than its predecessors.

Stone”s group created an official-looking ID badge for its volunteers to wear, and its volunteers planned to videotape voters and conduct fake “exit polls,” efforts that election experts say risks intimidating and confusing voters. Or at least that”s what the group was planning to do before The Huffington Post asked Stone about it on Tuesday. The controversial Trump ally, long known for his bare-knuckled political tactics, said that key proposals on his group”s websites were there without his knowledge, and assured HuffPost that he would operate within the confines of election law.

Stone had initially refused to explain just how Vote Protectors planned to accomplish its goals. So on Monday, The Huffington Post responded to the group”s request for additional volunteers to work as “Exit Pollers and Citizen Journalists.”

Once registered, HuffPost used the site”s “I.D. Badge Generator” to create this badge, which could pass for an official credential to people unfamiliar with polling signage and rules. Read more.

Inside the Amazon Million Dollar e-Book Scam

In a complex whirlwind of a story, ZDNet digs into a bizarre tech scam involving bots, bad e-books, Amazon Kindle, Tor, and one unscrupulous engineer.


“Revealed: How one Amazon Kindle scam made millions of dollars”
by Zach Whittaker
ZDNet
September 27, 2016

Emma Moore could have been the health and weight loss guru you spent your life looking for.

aotp_kindlecatfishYou might be forgiven for not knowing her work — after all, she has a common name, one that she shares with other similarly successful authors on Amazon. Until this week, she had dozens of health, dieting, cooking, and weight loss ebooks to her name. She published over a dozen ebooks on Amazon this year — five ebooks alone this month. And Moore would even work with other authors — like Nina Kelly, Andrew Walker, and Julia Jackson — who have all published about a dozen ebooks each this year as well.

Here’s the snag: to our knowledge, Moore doesn’t exist. None of them do.

Moore was just one of hundreds of pseudonyms employed in a sophisticated “catfishing” scheme run by Valeriy Shershnyov, whose Vancouver-based business hoodwinked Amazon customers into buying low-quality ebooks, which were boosted on the online marketplace by an unscrupulous system of bots, scripts, and virtual servers.

Catfishing isn’t new — it’s been well documented. Some scammers buy fake reviews, while others will try other ways to game the system.

Until now, nobody has been able to look inside at how one of these scams work — especially one that’s been so prolific, generating millions of dollars in royalties by cashing in on unwitting buyers who are tricked into thinking these ebooks have some substance.

Shershnyov was able to stay in Amazon’s shadows for two years by using his scam server conservatively so as to not raise any red flags.

What eventually gave him away weren’t customer complaints or even getting caught by the bookseller. It was good old-fashioned carelessness. He forgot to put a password on his server. Read more.

Uncle Sam’s Imaginary Pen Pal

Gizmodo’s Paleofuture blog examines the canon of opinion writer Guy Sims Fitch, a prolific non-existent writer for the United States Information Agency.


“Meet Guy Sims Fitch, a Fake Writer Invented by the United States Government”
by Matt Novak
September 27, 2016
Paleofuture

aotp_guysimsfitchGuy Sims Fitch had a lot to say about the world economy in the 1950s and 60s. He wrote articles in newspapers around the globe as an authoritative voice on economic issues during the Cold War. Fitch was a big believer in private American investment and advocated for it as a liberating force internationally. But no matter what you thought of Guy Sims Fitch”s ideas, he had one big problem. He didn”t exist.

Guy Sims Fitch was created by the United States Information Agency (USIA), America”s official news distribution service for the rest of the world. Today, people find the term “propaganda” to be incredibly loaded and even negative. But employees of the USIA used the term freely and proudly in the 1950s and 60s, believing that they were fighting a noble and just cause against the Soviet Union and the spread of Communism. And Guy Sims Fitch was just one tool in the diverse toolbox of the USIA propaganda machine.

“I don”t mind being called a propagandist, so long as that propaganda is based on the truth,” said Edward R. Murrow in 1962. Murrow took a job as head of the USIA after a long and celebrated career as a journalist, and did quite a few things during his tenure that would make modern journalists who romanticize “the good old days” blush.

But even when USIA peddled its own version of the truth, the propaganda agency wasn”t always using the most, let”s say, truthful of methods. Their use of Guy Sims Fitch””a fake person whose opinions would be printed in countries like Brazil, Germany, and Australia, among others””served the cause of America”s version of the truth against Communism during the Cold War, even if Fitch”s very existence was a lie.

Read more.