Social engineering

How to rob a bank: A social engineering walkthrough


Become An Insider

Sign up now and get free access to hundreds of Insider articles, guides, reviews, interviews, blogs, and other premium content from the best tech brands on the Internet: CIO, CSO, Computerworld, InfoWorld, IT World and Network World Learn more.

Professional social engineer Jim Stickley walks through the steps he typically takes to fool clients into thinking he's there for fire safety, while he's really proving they are an easy target for a data breach

If a company hires us for a social engineering engagement, typically they want us to get in and get to their back-up tapes, or into the data in their document room.

Let's say I am posing as a fire inspector. The first thing I will have besides my badge and uniform is a walkie-talkie, like all firemen. Outside, we'll have our car guy. The guy that sits in the car, and basically his job in the beginning is to send chatter through to our walkie-talkies. We will have a recording of all that chatter you'll hear on walkie-talkies. He sits in the car and plays it and sends it through to our walkie-talkies.

[Jim Stickley explains his social engineering methods in Social engineering: My career as a professional bank robber

While I'm talking with the person who has been assigned to us, my partner knows his job is to immediately wander away from us. So, my partner will immediately walk off. In most cases our escort will say "Can you come back here? I need to keep you guys together." We say "Sure, sorry." But really that means nothing to us. All it means is that we keep doing it until she gives up. My partner will wander off two or three times more times and get warned until she finally stops and gives up. She just thinks he's a fireman and thinks "Let's just let him do what he needs to do."

For even more depth, read CSO's Ultimate Guide to Social Engineering [13-page PDF - free CSO Insider registration required]

At that point, my partner's job is to start stealing everything he can steal and start putting it in his bag. And he also has to get under the desks of any employee he can find and start installing these little keyboard loggers. I stay with the person who is escorting me and my whole job now is keeping them entertained. I keep walking around rooms, giving them advice on keeping their facility fire safe, even though I really have no idea what I'm talking about. I make stuff up and probably give the worst advice ever. I'll pull out cords and say "This looks a little bit dangerous." I'll comment on space heaters. I'm completely winging it.

To continue reading, please begin the free registration process or sign in to your Insider account by entering your email address:
Insider: How a good CSO confronts inevitable bad news
View Comments
You Might Like
Join the discussion
Be the first to comment on this article. Our Commenting Policies